docker/cli · error

cannot rotate because autolock is not turned on

Error message

cannot rotate because autolock is not turned on

What it means

Thrown by runUnlockKey (cli/command/swarm/unlock_key.go:55) when `--rotate` is requested but the swarm's EncryptionConfig.AutoLockManagers is false. Rotating the unlock key only makes sense when autolock is on (the key encrypts Raft logs at rest); without autolock there is no key material role to rotate.

Solutions

1. Enable autolock first: `docker swarm update --autolock`.
2. Capture the resulting key immediately (`docker swarm unlock-key`) and store it safely.
3. Then rotate: `docker swarm unlock-key --rotate`.

Example fix

// before
docker swarm unlock-key --rotate   # autolock off -> error

// after
docker swarm update --autolock
docker swarm unlock-key            # capture & store the key
docker swarm unlock-key --rotate   # now valid

res, err := apiClient.SwarmInspect(ctx, client.SwarmInspectOptions{})
if err != nil { return err }
if !res.Swarm.Spec.EncryptionConfig.AutoLockManagers {
	return errors.New("autolock is off; enable before rotating the unlock key")
}

When it happens

Trigger: Running `docker swarm unlock-key --rotate` on a swarm where autolock was never enabled (`docker swarm update --autolock` was not run).

Common situations: Operator wants to rotate keys but never turned on autolock; assuming autolock is the default (it is off by default).

Related errors

• no unlock key is set
• could not fetch unlock key
• could not fetch unlock key
• could not fetch unlock key
• node ID not found in /info

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/65f8f58b7978c196. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/swarm/unlock_key.go:55

	flags := cmd.Flags()
	flags.BoolVar(&opts.rotate, flagRotate, false, "Rotate unlock key")
	flags.BoolVarP(&opts.quiet, flagQuiet, "q", false, "Only display token")

	return cmd
}

func runUnlockKey(ctx context.Context, dockerCLI command.Cli, opts unlockKeyOptions) error {
	apiClient := dockerCLI.Client()

	if opts.rotate {
		res, err := apiClient.SwarmInspect(ctx, client.SwarmInspectOptions{})
		if err != nil {
			return err
		}

		if !res.Swarm.Spec.EncryptionConfig.AutoLockManagers {
			return errors.New("cannot rotate because autolock is not turned on")
		}

		_, err = apiClient.SwarmUpdate(ctx, client.SwarmUpdateOptions{
			Version: res.Swarm.Version,
			Spec:    res.Swarm.Spec,

			RotateManagerUnlockKey: true,
		})
		if err != nil {
			return err
		}

		if !opts.quiet {
			_, _ = fmt.Fprintln(dockerCLI.Out(), "Successfully rotated manager unlock key.")
		}
	}

	resp, err := apiClient.SwarmGetUnlockKey(ctx)

View on GitHub (pinned to 4f84911bfe)