{"id":"fdd878711112473f","repo":"docker/cli","slug":"tag-can-t-be-used-with-all-tags-a","errorCode":null,"errorMessage":"tag can't be used with --all-tags/-a","messagePattern":"tag can't be used with --all-tags/-a","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/image/pull.go","lineNumber":75,"sourceCode":"\t// TODO(thaJeztah): DEPRECATED: remove in v29.1 or v30\n\tflags.Bool(\"disable-content-trust\", true, \"Skip image verification (deprecated)\")\n\t_ = flags.MarkDeprecated(\"disable-content-trust\", \"support for docker content trust was removed\")\n\n\tflags.StringVar(&opts.platform, \"platform\", os.Getenv(\"DOCKER_DEFAULT_PLATFORM\"), \"Set platform if server is multi-platform capable\")\n\t_ = flags.SetAnnotation(\"platform\", \"version\", []string{\"1.32\"})\n\t_ = cmd.RegisterFlagCompletionFunc(\"platform\", completion.Platforms())\n\n\treturn cmd\n}\n\n// runPull performs a pull against the engine based on the specified options\nfunc runPull(ctx context.Context, dockerCLI command.Cli, opts pullOptions) error {\n\tdistributionRef, err := reference.ParseNormalizedNamed(opts.remote)\n\tswitch {\n\tcase err != nil:\n\t\treturn err\n\tcase opts.all && !reference.IsNameOnly(distributionRef):\n\t\treturn errors.New(\"tag can't be used with --all-tags/-a\")\n\tcase !opts.all && reference.IsNameOnly(distributionRef):\n\t\tdistributionRef = reference.TagNameOnly(distributionRef)\n\t\tif tagged, ok := distributionRef.(reference.Tagged); ok && !opts.quiet {\n\t\t\t_, _ = fmt.Fprintln(dockerCLI.Out(), \"Using default tag:\", tagged.Tag())\n\t\t}\n\t}\n\n\tvar ociPlatforms []ocispec.Platform\n\tif opts.platform != \"\" {\n\t\t// TODO(thaJeztah): add a platform option-type / flag-type.\n\t\tp, err := platforms.Parse(opts.platform)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tociPlatforms = append(ociPlatforms, p)\n\t}\n\n\tencodedAuth, err := command.RetrieveAuthTokenFromImage(dockerCLI.ConfigFile(), distributionRef.String())","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/image/pull.go#L57-L93","documentation":"docker pull --all-tags/-a pulls every tag of a repository, so the image reference must be a bare repository name. In runPull (cli/command/image/pull.go:74-75), after ParseNormalizedNamed, if opts.all is set and reference.IsNameOnly() is false — the reference carries a :tag or @digest — the two instructions conflict and the CLI rejects the command rather than guess which one you meant.","triggerScenarios":"`docker pull -a ubuntu:22.04` or `docker pull --all-tags myrepo/app@sha256:...` — any --all-tags pull whose reference includes a tag or digest. Note the implicit ':latest' is only appended when -a is NOT set, so only an explicitly written tag/digest triggers this.","commonSituations":"Adding -a to an existing pull command that already has a tag; scripts that template IMAGE:TAG and conditionally append --all-tags; confusion thinking -a plus a tag means 'this tag and newer'.","solutions":["Drop the tag/digest when using --all-tags: docker pull -a ubuntu","Or drop --all-tags and pull the single tag: docker pull ubuntu:22.04","In scripts, make the tag and the --all-tags flag mutually exclusive when building the command line"],"exampleFix":"# before\ndocker pull --all-tags ubuntu:22.04\n# after\ndocker pull --all-tags ubuntu","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker-cli","image-pull","all-tags","image-reference","flag-conflict"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}