docker/cli · error

cannot get label %s for service %s

Error message

cannot get label %s for service %s

What it means

Emitted by `docker stack ls`. getStacks (list_utils.go:12-35) lists services filtered by the stack namespace label (com.docker.stack.namespace) and groups them by that label's value; if a returned service somehow lacks the label, the CLI cannot attribute it to a stack and fails with 'cannot get label com.docker.stack.namespace for service <id>'. In practice this indicates inconsistent label state, since the filter itself selects on that label.

Source

Thrown at cli/command/stack/list_utils.go:26

	"github.com/moby/moby/client"
)

// getStacks lists the swarm stacks with the number of services they contain.
func getStacks(ctx context.Context, apiClient client.ServiceAPIClient) ([]stackSummary, error) {
	res, err := apiClient.ServiceList(ctx, client.ServiceListOptions{
		Filters: getAllStacksFilter(),
	})
	if err != nil {
		return nil, err
	}

	idx := make(map[string]int, len(res.Items))
	out := make([]stackSummary, 0, len(res.Items))

	for _, svc := range res.Items {
		name, ok := svc.Spec.Labels[convert.LabelNamespace]
		if !ok {
			return nil, errors.New("cannot get label " + convert.LabelNamespace + " for service " + svc.ID)
		}
		if i, ok := idx[name]; ok {
			out[i].Services++
			continue
		}
		idx[name] = len(out)
		out = append(out, stackSummary{Name: name, Services: 1})
	}
	return out, nil
}

View on GitHub (pinned to e9452d6e78)

Solutions

1. Identify the offending service from the error's service ID: `docker service inspect <id> --format '{{json .Spec.Labels}}'`
2. Restore the label: `docker service update --label-add com.docker.stack.namespace=<stackname> <id>`, or remove the orphaned service if it shouldn't belong to a stack
3. Redeploy the stack with `docker stack deploy` so labels are re-applied consistently

Example fix

# before (label was stripped)
docker service update --label-rm com.docker.stack.namespace web
docker stack ls   # cannot get label com.docker.stack.namespace for service ...

# after
docker service update --label-add com.docker.stack.namespace=mystack web
docker stack ls

When it happens

Trigger: `docker stack ls` where ServiceList (filtered on label com.docker.stack.namespace) returns a service whose Spec.Labels map is missing that key — e.g. a service whose labels were stripped by a later `docker service update --label-rm`, or an API/engine inconsistency.

Common situations: Someone removed the stack namespace label from a stack service via `docker service update --label-rm com.docker.stack.namespace`; third-party tools creating services with the label set only partially; rare engine/version mismatches where label filtering and returned specs disagree.

Related errors

• specify a Compose file (with --compose-file)
• node ID not found in /info
• replicas can only be used with replicated or replicated-job
• replicas-max-per-node can only be used with replicated or re
• max-concurrent can only be used with replicated-job mode

AI-assisted analysis of docker/cli@e9452d6e78 (2026-08-01). Data as JSON: /data/errors/b57b8864d56ece59.json. Report an issue: GitHub.