What causes "closing tar for config copy failed: %w" in docker/cli?

Retry the create after freeing memory/reducing load.

closing tar for config copy failed

Error message

closing tar for config copy failed: %w

What it means

Returned by copyDockerConfigIntoContainer (create.go:424) when tar.Writer.Close() fails while finalizing the in-memory tar archive of the docker config. Close flushes the trailing zero blocks of the tar format.

Solutions

Retry the create after freeing memory/reducing load.
Upgrade the Docker CLI to eliminate a known tar-finalization bug.
Examine the wrapped error for the underlying cause.

Defensive patterns

Strategy: retry

Validate before calling

// No caller-side pre-check exists; the failure is internal to tar.Close().
// Best prevention is ensuring a healthy environment: enough memory, current client.
return nil

Try / catch

// Retry once on this internal error; escalate if it persists.
if err != nil && strings.Contains(err.Error(), "closing tar for config copy") {
    /* log, free memory, single retry */
}

Prevention

Upgrade the CLI to a patched version.
Reduce concurrent memory pressure during create.
Report persistent occurrences with the wrapped underlying error.

When it happens

Trigger: tarWriter.Close() returns an error after writing the config header/body into the in-memory buffer. As with the write step, because the target is a bytes.Buffer, this is an unusual internal failure rather than a typical user error.

Common situations: Rare internal failure during tar finalization; usually correlated with the prior io.Copy failing or with a bug in the tar writer under memory pressure.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/a9ce3549c9478280. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/container/create.go:424

		return fmt.Errorf("saving creds: %w", err)
	}

	// We don't need to get super fancy with the tar creation.
	var tarBuf bytes.Buffer
	tarWriter := tar.NewWriter(&tarBuf)
	_ = tarWriter.WriteHeader(&tar.Header{
		Name: configPath,
		Size: int64(configBuf.Len()),
		Mode: 0o600,
	})

	if _, err := io.Copy(tarWriter, &configBuf); err != nil {
		_ = tarWriter.Close()
		return fmt.Errorf("writing config to tar file for config copy: %w", err)
	}

	if err := tarWriter.Close(); err != nil {
		return fmt.Errorf("closing tar for config copy failed: %w", err)
	}

	_, err := apiClient.CopyToContainer(ctx, containerID, client.CopyToContainerOptions{
		DestinationPath: "/",
		Content:         &tarBuf,
	})
	if err != nil {
		return fmt.Errorf("copying config.json into container failed: %w", err)
	}

	return nil
}

View on GitHub (pinned to 4f84911bfe)