{"id":"680e0c0f040c0ebb","repo":"docker/cli","slug":"no-unlock-key-is-set","errorCode":null,"errorMessage":"no unlock key is set","messagePattern":"no unlock key is set","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/swarm/unlock_key.go","lineNumber":79,"sourceCode":"\n\t\t\tRotateManagerUnlockKey: true,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tif !opts.quiet {\n\t\t\t_, _ = fmt.Fprintln(dockerCLI.Out(), \"Successfully rotated manager unlock key.\")\n\t\t}\n\t}\n\n\tresp, err := apiClient.SwarmGetUnlockKey(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not fetch unlock key: %w\", err)\n\t}\n\n\tif resp.Key == \"\" {\n\t\treturn errors.New(\"no unlock key is set\")\n\t}\n\n\tif opts.quiet {\n\t\t_, _ = fmt.Fprintln(dockerCLI.Out(), resp.Key)\n\t\treturn nil\n\t}\n\n\tprintUnlockCommand(dockerCLI.Out(), resp.Key)\n\treturn nil\n}\n\nfunc printUnlockCommand(out io.Writer, unlockKey string) {\n\tif len(unlockKey) > 0 {\n\t\t_, _ = fmt.Fprintf(out, \"To unlock a swarm manager after it restarts, \"+\n\t\t\t\"run the `docker swarm unlock`\\ncommand and provide the following key:\\n\\n    %s\\n\\n\"+\n\t\t\t\"Remember to store this key in a password manager, since without it you\\n\"+\n\t\t\t\"will not be able to restart the manager.\\n\", unlockKey)\n\t}","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/swarm/unlock_key.go#L61-L97","documentation":"Raised by `docker swarm unlock-key` when the Swarm API's SwarmGetUnlockKey call succeeds but returns an empty key. The CLI treats an empty key as \"autolock is not enabled on this swarm,\" because a non-empty unlock key only exists when manager autolock is turned on.","triggerScenarios":"Running `docker swarm unlock-key` (with or without --quiet) against a swarm where autolock is disabled; apiClient.SwarmGetUnlockKey returns resp.Key == \"\" in cli/command/swarm/unlock_key.go:79.","commonSituations":"Users run `docker swarm unlock-key` on a fresh swarm assuming a key exists by default; scripts that fetch the unlock key before autolock was ever enabled; running against the wrong context/host that points at a non-autolocked swarm.","solutions":["Enable autolock first: `docker swarm update --autolock=true`, which prints and sets an unlock key.","Alternatively run `docker swarm unlock-key --rotate` after enabling autolock to generate a fresh key.","Verify you are targeting the intended swarm manager (`docker context ls`, `docker info | grep -i autolock`)."],"exampleFix":"# before\ndocker swarm unlock-key\n# Error: no unlock key is set\n\n# after\ndocker swarm update --autolock=true\ndocker swarm unlock-key -q","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker-cli","swarm","autolock","configuration"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}