docker/cli · error · invalidParameter

default context cannot be edited

Error message

default context cannot be edited

What it means

ContextStoreWithDefault.ResetTLSMaterial refuses to replace the TLS material of the context named 'default'. The default context's TLS data is derived at runtime from CLI flags and environment (DOCKER_CERT_PATH, DOCKER_TLS_VERIFY, --tlscacert etc.) rather than stored in the context store, so there is no stored TLS bundle to reset; mutating it through the store API is disallowed and returned as an invalid-parameter error.

Source

Thrown at cli/command/defaultcontextstore.go:149

	return s.Store.Remove(name)
}

// GetMetadata implements store.Store's GetMetadata
func (s *ContextStoreWithDefault) GetMetadata(name string) (store.Metadata, error) {
	if name == DefaultContextName {
		defaultContext, err := s.Resolver()
		if err != nil {
			return store.Metadata{}, err
		}
		return defaultContext.Meta, nil
	}
	return s.Store.GetMetadata(name)
}

// ResetTLSMaterial is not implemented for default context and fails
func (s *ContextStoreWithDefault) ResetTLSMaterial(name string, data *store.ContextTLSData) error {
	if name == DefaultContextName {
		return invalidParameter(errors.New("default context cannot be edited"))
	}
	return s.Store.ResetTLSMaterial(name, data)
}

// ResetEndpointTLSMaterial is not implemented for default context and fails
func (s *ContextStoreWithDefault) ResetEndpointTLSMaterial(contextName string, endpointName string, data *store.EndpointTLSData) error {
	if contextName == DefaultContextName {
		return invalidParameter(errors.New("default context cannot be edited"))
	}
	return s.Store.ResetEndpointTLSMaterial(contextName, endpointName, data)
}

// ListTLSFiles implements store.Store's ListTLSFiles
func (s *ContextStoreWithDefault) ListTLSFiles(name string) (map[string]store.EndpointFiles, error) {
	if name == DefaultContextName {
		defaultContext, err := s.Resolver()
		if err != nil {
			return nil, err

View on GitHub (pinned to e9452d6e78)

Solutions

1. Configure TLS for the default context via environment/flags instead: set DOCKER_CERT_PATH, DOCKER_TLS_VERIFY, DOCKER_HOST (or pass --tlscacert/--tlscert/--tlskey to docker).
2. Create a named context carrying the desired TLS config and switch to it: `docker context create mytls --docker "host=tcp://host:2376,ca=ca.pem,cert=cert.pem,key=key.pem" && docker context use mytls`.
3. In scripts that update all contexts, skip the 'default' name.

Example fix

# before
docker context update default --docker "host=tcp://remote:2376,ca=ca.pem"
# after
docker context create remote --docker "host=tcp://remote:2376,ca=ca.pem"
docker context use remote

When it happens

Trigger: Calling ResetTLSMaterial("default", ...) on a ContextStoreWithDefault — reached via `docker context update default` code paths or `docker context import default <file>` that attempt to replace the default context's TLS data.

Common situations: Trying to attach TLS certificates to the default context via `docker context update default --docker "..."`; importing a context export over the name 'default'; automation that iterates all contexts and rewrites their TLS material without skipping 'default'.

Related errors

• default context cannot be removed
• no context store initialized
• failed to parse hook template
• unexpected hook response type:
• plugin candidate path cannot be empty

AI-assisted analysis of docker/cli@e9452d6e78 (2026-08-01). Data as JSON: /data/errors/77d40f87cc9c6670.json. Report an issue: GitHub.