docker/cli · warning

could not fetch unlock key

Error message

could not fetch unlock key: %w

What it means

After a successful 'docker swarm init --autolock', the CLI calls SwarmGetUnlockKey to print the unlock command; any error from that call is wrapped here. The swarm was initialized but the unlock key could not be retrieved for display.

Solutions

1. Recover the key later with 'docker swarm unlock-key' once the manager is stable.
2. Confirm the daemon/API version supports autolock and unlock keys (API >= 1.24, manager node).
3. Check 'docker info' for swarm status and re-run unlock-key if needed.

Example fix

# before: init with autolock failed to print the key
docker swarm init --autolock

# after: fetch the key explicitly afterwards
docker swarm init --autolock
docker swarm unlock-key

func isUnlockKeyFetchErr(err error) bool {
	return err != nil && strings.Contains(err.Error(), "could not fetch unlock key:")
}

resp, err := apiClient.SwarmGetUnlockKey(ctx)
if err != nil {
    // swarm initialized; recover key later
    log.Warnf("could not fetch unlock key after init: %v; run 'docker swarm unlock-key'", err)
}

When it happens

Trigger: 'docker swarm init --autolock' where the subsequent SwarmGetUnlockKey RPC fails (transient daemon error, connection reset, manager not yet ready to serve the key).

Common situations: Autolock enabled on a freshly-initialized single-manager swarm that hasn't fully converged; daemon restart between init and key fetch; API version mismatch where unlock key endpoint is unavailable.

Related errors

• cannot rotate because autolock is not turned on
• no unlock key is set
• could not fetch unlock key
• could not fetch unlock key
• invalid IP address

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/83516f7ed1a4807e. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/swarm/init.go:129

	if err != nil {
		if strings.Contains(err.Error(), "could not choose an IP address to advertise") || strings.Contains(err.Error(), "could not find the system's IP address") {
			return fmt.Errorf("%w - specify one with --advertise-addr", err)
		}
		return err
	}

	_, _ = fmt.Fprintf(dockerCLI.Out(), "Swarm initialized: current node (%s) is now a manager.\n\n", res.NodeID)

	if err := printJoinCommand(ctx, dockerCLI, res.NodeID, true, false); err != nil {
		return err
	}

	_, _ = fmt.Fprintln(dockerCLI.Out(), "To add a manager to this swarm, run 'docker swarm join-token manager' and follow the instructions.")

	if opts.swarmOptions.autolock {
		resp, err := apiClient.SwarmGetUnlockKey(ctx)
		if err != nil {
			return fmt.Errorf("could not fetch unlock key: %w", err)
		}
		printUnlockCommand(dockerCLI.Out(), resp.Key)
	}

	return nil
}

View on GitHub (pinned to 4f84911bfe)