docker/cli · warning

error: swarm is not locked

Error message

error: swarm is not locked

What it means

Thrown by runUnlock (cli/command/swarm/unlock.go:55) when LocalNodeState is Pending, Active, or Error — i.e. the swarm is reachable without an unlock key. Only the Locked state requires unlocking; any other live state means the operation is unnecessary, so the command refuses to prompt for a key.

Solutions

1. No action needed — the swarm is already accessible.
2. If you expected a locked state, verify autolock is enabled: `docker swarm unlock-key` (it will tell you if autolock is off).
3. For an Error state, inspect `docker info` and address the underlying swarm problem first.

Example fix

// before
docker swarm unlock   # swarm already active -> error: swarm is not locked

// after
# nothing to do; optionally confirm autolock status
docker swarm unlock-key

res, err := apiClient.Info(ctx, client.InfoOptions{})
if err != nil { return err }
if res.Info.Swarm.LocalNodeState != swarm.LocalNodeStateLocked {
	// nothing to unlock; treat as a no-op rather than an error.
	return nil
}

When it happens

Trigger: Running `docker swarm unlock` when the manager is already active (autolock off, or already unlocked), in Pending (mid-operation), or in Error state.

Common situations: Operator runs unlock out of habit on an already-running swarm; autolock is disabled so the manager never locks; the node is mid-convergence.

Related errors

• error: this node is not part of a swarm
• node ID not found in /info
• when using secret driver secret data must be empty
• error reading from STDIN: data is empty
• secret file is required

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/2413fd6ad9aaa05d. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/swarm/unlock.go:55

}

func runUnlock(ctx context.Context, dockerCLI command.Cli) error {
	apiClient := dockerCLI.Client()

	// First see if the node is actually part of a swarm, and if it is actually locked first.
	// If it's in any other state than locked, don't ask for the key.
	res, err := apiClient.Info(ctx, client.InfoOptions{})
	if err != nil {
		return err
	}

	switch res.Info.Swarm.LocalNodeState {
	case swarm.LocalNodeStateInactive:
		return errors.New("error: this node is not part of a swarm")
	case swarm.LocalNodeStateLocked:
		break
	case swarm.LocalNodeStatePending, swarm.LocalNodeStateActive, swarm.LocalNodeStateError:
		return errors.New("error: swarm is not locked")
	}

	key, err := readKey(dockerCLI.In(), "Enter unlock key: ")
	if err != nil {
		return err
	}

	_, err = apiClient.SwarmUnlock(ctx, client.SwarmUnlockOptions{
		Key: key,
	})
	return err
}

func readKey(in *streams.In, prompt string) (string, error) {
	if in.IsTerminal() {
		fmt.Print(prompt)
		dt, err := term.ReadPassword(int(in.FD()))
		fmt.Println()

View on GitHub (pinned to 4f84911bfe)