{"id":"77d40f87cc9c6670","repo":"docker/cli","slug":"default-context-cannot-be-edited","errorCode":null,"errorMessage":"default context cannot be edited","messagePattern":"default context cannot be edited","errorType":"validation","errorClass":"invalidParameter","httpStatus":null,"severity":"error","filePath":"cli/command/defaultcontextstore.go","lineNumber":149,"sourceCode":"\treturn s.Store.Remove(name)\n}\n\n// GetMetadata implements store.Store's GetMetadata\nfunc (s *ContextStoreWithDefault) GetMetadata(name string) (store.Metadata, error) {\n\tif name == DefaultContextName {\n\t\tdefaultContext, err := s.Resolver()\n\t\tif err != nil {\n\t\t\treturn store.Metadata{}, err\n\t\t}\n\t\treturn defaultContext.Meta, nil\n\t}\n\treturn s.Store.GetMetadata(name)\n}\n\n// ResetTLSMaterial is not implemented for default context and fails\nfunc (s *ContextStoreWithDefault) ResetTLSMaterial(name string, data *store.ContextTLSData) error {\n\tif name == DefaultContextName {\n\t\treturn invalidParameter(errors.New(\"default context cannot be edited\"))\n\t}\n\treturn s.Store.ResetTLSMaterial(name, data)\n}\n\n// ResetEndpointTLSMaterial is not implemented for default context and fails\nfunc (s *ContextStoreWithDefault) ResetEndpointTLSMaterial(contextName string, endpointName string, data *store.EndpointTLSData) error {\n\tif contextName == DefaultContextName {\n\t\treturn invalidParameter(errors.New(\"default context cannot be edited\"))\n\t}\n\treturn s.Store.ResetEndpointTLSMaterial(contextName, endpointName, data)\n}\n\n// ListTLSFiles implements store.Store's ListTLSFiles\nfunc (s *ContextStoreWithDefault) ListTLSFiles(name string) (map[string]store.EndpointFiles, error) {\n\tif name == DefaultContextName {\n\t\tdefaultContext, err := s.Resolver()\n\t\tif err != nil {\n\t\t\treturn nil, err","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/defaultcontextstore.go#L131-L167","documentation":"ContextStoreWithDefault.ResetTLSMaterial refuses to replace the TLS material of the context named 'default'. The default context's TLS data is derived at runtime from CLI flags and environment (DOCKER_CERT_PATH, DOCKER_TLS_VERIFY, --tlscacert etc.) rather than stored in the context store, so there is no stored TLS bundle to reset; mutating it through the store API is disallowed and returned as an invalid-parameter error.","triggerScenarios":"Calling ResetTLSMaterial(\"default\", ...) on a ContextStoreWithDefault — reached via `docker context update default` code paths or `docker context import default <file>` that attempt to replace the default context's TLS data.","commonSituations":"Trying to attach TLS certificates to the default context via `docker context update default --docker \"...\"`; importing a context export over the name 'default'; automation that iterates all contexts and rewrites their TLS material without skipping 'default'.","solutions":["Configure TLS for the default context via environment/flags instead: set DOCKER_CERT_PATH, DOCKER_TLS_VERIFY, DOCKER_HOST (or pass --tlscacert/--tlscert/--tlskey to docker).","Create a named context carrying the desired TLS config and switch to it: `docker context create mytls --docker \"host=tcp://host:2376,ca=ca.pem,cert=cert.pem,key=key.pem\" && docker context use mytls`.","In scripts that update all contexts, skip the 'default' name."],"exampleFix":"# before\ndocker context update default --docker \"host=tcp://remote:2376,ca=ca.pem\"\n# after\ndocker context create remote --docker \"host=tcp://remote:2376,ca=ca.pem\"\ndocker context use remote","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker-cli","context-store","tls","invalid-parameter"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}