docker/cli · error

cannot rotate because autolock is not turned on

Error message

cannot rotate because autolock is not turned on

What it means

Returned by `docker swarm unlock-key --rotate` when SwarmInspect shows Spec.EncryptionConfig.AutoLockManagers is false. There is no unlock key to rotate unless manager autolock (encryption of Raft logs at rest) is enabled, so the CLI rejects the rotation before calling SwarmUpdate.

Source

Thrown at cli/command/swarm/unlock_key.go:55

	flags := cmd.Flags()
	flags.BoolVar(&opts.rotate, flagRotate, false, "Rotate unlock key")
	flags.BoolVarP(&opts.quiet, flagQuiet, "q", false, "Only display token")

	return cmd
}

func runUnlockKey(ctx context.Context, dockerCLI command.Cli, opts unlockKeyOptions) error {
	apiClient := dockerCLI.Client()

	if opts.rotate {
		res, err := apiClient.SwarmInspect(ctx, client.SwarmInspectOptions{})
		if err != nil {
			return err
		}

		if !res.Swarm.Spec.EncryptionConfig.AutoLockManagers {
			return errors.New("cannot rotate because autolock is not turned on")
		}

		_, err = apiClient.SwarmUpdate(ctx, client.SwarmUpdateOptions{
			Version: res.Swarm.Version,
			Spec:    res.Swarm.Spec,

			RotateManagerUnlockKey: true,
		})
		if err != nil {
			return err
		}

		if !opts.quiet {
			_, _ = fmt.Fprintln(dockerCLI.Out(), "Successfully rotated manager unlock key.")
		}
	}

	resp, err := apiClient.SwarmGetUnlockKey(ctx)

View on GitHub (pinned to e9452d6e78)

Solutions

1. Enable autolock first: `docker swarm update --autolock=true` (this generates and prints an unlock key).
2. Verify the setting with `docker swarm inspect --format '{{.Spec.EncryptionConfig.AutoLockManagers}}'` or check `docker info`.
3. If rotation scripts run fleet-wide, gate them on the autolock setting.
4. To just view the current key on an autolocked swarm, run `docker swarm unlock-key` without `--rotate`.

Example fix

# before
docker swarm unlock-key --rotate   # fails: autolock off
# after
docker swarm update --autolock=true
docker swarm unlock-key --rotate

When it happens

Trigger: Running `docker swarm unlock-key --rotate` against a swarm whose spec has AutoLockManagers=false — autolock was never enabled, or was disabled with `docker swarm update --autolock=false` at some point before the rotation attempt.

Common situations: Key-rotation cron jobs or compliance scripts running against clusters where autolock was turned off; assuming autolock is on by default after `docker swarm init` (it is not unless `--autolock` was passed); operating on the wrong cluster context.

Related errors

• error: this node is not part of a swarm
• error: swarm is not locked
• node ID not found in /info
• cannot supply extra formatting options to the pretty templat
• role was already set to the requested value

AI-assisted analysis of docker/cli@e9452d6e78 (2026-08-01). Data as JSON: /data/errors/65f8f58b7978c196.json. Report an issue: GitHub.