docker/cli · error

error importing key from

Error message

error importing key from %s: %w

What it means

In loadPrivKey (key_load.go:66-68), loadPrivKeyBytesToStore failed and is wrapped as 'error importing key from <path>'. loadPrivKeyBytesToStore (key_load.go:93-103) extracts private-key attributes, optionally decrypts an encrypted PEM, then calls trustmanager.ImportKeys to write the key into the trust file store. Failure here means the bytes were read fine but parsing/decryption/import into ~/.docker/trust/private failed.

Solutions

1. Ensure HOME is set and ~/.docker/trust/private is writable with mode 0700: mkdir -p ~/.docker/trust/private && chmod 700 ~/.docker/trust/private.
2. If a key with that ID is already imported, remove the conflicting file from ~/.docker/trust/private (or skip re-importing).
3. Provide the correct passphrase (set DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE or enter it correctly when prompted) so re-encryption on import succeeds.
4. Free disk space and confirm the filesystem is writable.
5. Run with -D to capture the wrapped ImportKeys error for specifics.

Example fix

# before: trust dir not writable, import fails
docker trust key load /tmp/priv.key
# after
mkdir -p ~/.docker/trust/private && chmod 700 ~/.docker/trust/private
docker trust key load /tmp/priv.key

// Ensure the trust private dir is writable and free of the conflicting key id before import.
func preflightImport(trustDir string) error {
    privDir := filepath.Join(trustDir, "private")
    if err := os.MkdirAll(privDir, 0o700); err != nil {
        return fmt.Errorf("cannot access trust private dir %s: %w", privDir, err)
    }
    return nil
}

if err := loadPrivKeyBytesToStore(keyBytes, privKeyImporters, keyPath, options.keyName, passRet); err != nil {
    return fmt.Errorf("error importing key from %s: %w", keyPath, err)
}

When it happens

Trigger: The file is not a supported private key format (but that has a dedicated message at 558, hit earlier); decryption of an encrypted key failed because the passphrase was wrong (but that has a dedicated message at 559, hit earlier); trustmanager.ImportKeys failed because the trust directory is not writable, a key with the same ID already exists, or the passphrase retriever returned an error during re-encryption on import.

Common situations: Trust directory ~/.docker/trust/private not writable or full; key with the same ID already imported; passphrase mismatch during import re-encryption; HOME unset; running in a restricted container/sandbox that blocks writes to the trust dir.

Related errors

• failed to generate key for
• failed to write public key to
• refusing to load key from
• private key file must not be readable or writable by others
• error: could not find signing keys for remote repository

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/4e19c5c924f8981b. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/key_load.go:67

		return fmt.Errorf("key name \"%s\" must start with lowercase alphanumeric characters and can include \"-\" or \"_\" after the first character", options.keyName)
	}
	trustDir := trust.GetTrustDirectory()
	keyFileStore, err := storage.NewPrivateKeyFileStorage(trustDir, notary.KeyExtension)
	if err != nil {
		return err
	}
	privKeyImporters := []trustmanager.Importer{keyFileStore}

	_, _ = fmt.Fprintf(streams.Out(), "Loading key from \"%s\"...\n", keyPath)

	// Always use a fresh passphrase retriever for each import
	passRet := trust.GetPassphraseRetriever(streams.In(), streams.Out())
	keyBytes, err := getPrivKeyBytesFromPath(keyPath)
	if err != nil {
		return fmt.Errorf("refusing to load key from %s: %w", keyPath, err)
	}
	if err := loadPrivKeyBytesToStore(keyBytes, privKeyImporters, keyPath, options.keyName, passRet); err != nil {
		return fmt.Errorf("error importing key from %s: %w", keyPath, err)
	}
	_, _ = fmt.Fprintln(streams.Out(), "Successfully imported key from", keyPath)
	return nil
}

func getPrivKeyBytesFromPath(keyPath string) ([]byte, error) {
	if runtime.GOOS != "windows" {
		fileInfo, err := os.Stat(keyPath)
		if err != nil {
			return nil, err
		}
		if fileInfo.Mode()&nonOwnerReadWriteMask != 0 {
			return nil, fmt.Errorf("private key file %s must not be readable or writable by others", keyPath)
		}
	}

	from, err := os.OpenFile(keyPath, os.O_RDONLY, notary.PrivExecPerms)
	if err != nil {

View on GitHub (pinned to 4f84911bfe)