docker/cli · error · invalidParameterErr

default context cannot be edited

Error message

default context cannot be edited

What it means

ContextStoreWithDefault.ResetTLSMaterial() rejects the "default" name. The default context's TLS material is held in memory (resolved from DOCKER_* TLS env vars and config), so bulk-resetting TLS material for it is not supported and returns invalidParameter.

Solutions

1. Manage the default context's TLS via DOCKER_TLS_VERIFY / DOCKER_CERT_PATH env vars instead
2. Target a real stored context name for TLS reset
3. Exclude "default" from any TLS-rotation loop

Example fix

// before
store.ResetTLSMaterial("default", &tls)
// after
store.ResetTLSMaterial("myctx", &tls)

if name == command.DefaultContextName {
    return fmt.Errorf("cannot reset TLS material on the default context; set DOCKER_CERT_PATH/DOCKER_TLS_VERIFY instead")
}
return store.ResetTLSMaterial(name, data)

func isReservedContextName(name string) bool { return name == command.DefaultContextName }

When it happens

Trigger: Programmatically calling ResetTLSMaterial("default", data); `docker context update default` flows that try to reset TLS material.

Common situations: Tooling that rotates TLS certs for every context including default; automation unaware default is synthetic.

Related errors

• default context cannot be created nor updated
• default context cannot be removed
• conflicting options: cannot specify both --host and…
• cowardly refusing to export to a terminal, specify a file…
• no context specified

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/77d40f87cc9c6670. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/defaultcontextstore.go:149

	return s.Store.Remove(name)
}

// GetMetadata implements store.Store's GetMetadata
func (s *ContextStoreWithDefault) GetMetadata(name string) (store.Metadata, error) {
	if name == DefaultContextName {
		defaultContext, err := s.Resolver()
		if err != nil {
			return store.Metadata{}, err
		}
		return defaultContext.Meta, nil
	}
	return s.Store.GetMetadata(name)
}

// ResetTLSMaterial is not implemented for default context and fails
func (s *ContextStoreWithDefault) ResetTLSMaterial(name string, data *store.ContextTLSData) error {
	if name == DefaultContextName {
		return invalidParameter(errors.New("default context cannot be edited"))
	}
	return s.Store.ResetTLSMaterial(name, data)
}

// ResetEndpointTLSMaterial is not implemented for default context and fails
func (s *ContextStoreWithDefault) ResetEndpointTLSMaterial(contextName string, endpointName string, data *store.EndpointTLSData) error {
	if contextName == DefaultContextName {
		return invalidParameter(errors.New("default context cannot be edited"))
	}
	return s.Store.ResetEndpointTLSMaterial(contextName, endpointName, data)
}

// ListTLSFiles implements store.Store's ListTLSFiles
func (s *ContextStoreWithDefault) ListTLSFiles(name string) (map[string]store.EndpointFiles, error) {
	if name == DefaultContextName {
		defaultContext, err := s.Resolver()
		if err != nil {
			return nil, err

View on GitHub (pinned to 4f84911bfe)