docker/cli · error

failed to generate key for

Error message

failed to generate key for %s: %w

What it means

In validateAndGenerateKey (key_generate.go:88-92), generateKeyAndOutputPubPEM returned an error and it is wrapped as 'failed to generate key for <name>'. generateKeyAndOutputPubPEM (key_generate.go:104-122) calls tufutils.GenerateKey(data.ECDSAKey) to create an ECDSA private key, then privKeyStore.AddKey(...) to persist it encrypted in the trust key file store - failure in either step yields this error.

Solutions

1. Ensure HOME is set and ~/.docker/trust/private is writable: mkdir -p ~/.docker/trust/private && chmod 700 ~/.docker/trust/private.
2. When prompted, enter the same passphrase twice (or pre-set DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE to skip the interactive confirm).
3. Free disk space and check the filesystem is not read-only.
4. If a key with the same role/ID already exists in the private store, remove the stale entry or pick a distinct key name.
5. Run with debug (-D) to see the wrapped underlying error from AddKey/GenerateKey.

Example fix

# before: interactive passphrase mismatch -> AddKey fails
docker trust key generate mykey
# after: pre-set passphrase to avoid mismatch
export DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE='correct horse battery staple'
docker trust key generate mykey

// Pre-check trust dir writability and passphrase availability before generation.
func preflightKeyGen(trustDir string) error {
    if err := os.MkdirAll(filepath.Join(trustDir, "private"), 0o700); err != nil {
        return fmt.Errorf("trust private dir not writable: %w", err)
    }
    return nil
}

pubPEM, err := generateKeyAndOutputPubPEM(keyName, privKeyFileStore)
if err != nil {
    return fmt.Errorf("failed to generate key for %s: %w", keyName, err)
}

When it happens

Trigger: tufutils.GenerateKey fails due to an entropy/crypto subsystem error (rare); trustmanager.NewKeyFileStore could not create the trust directory; privKeyStore.AddKey fails because the passphrase retriever returned an error (passphrase mismatch on confirm), the trust dir is read-only, disk full, or a key with that ID already exists in the store.

Common situations: Passphrase confirmation mismatch when prompted interactively (the prompt asks twice); ~/.docker/trust/private not writable (permissions, read-only mount); disk full; entropy depleted in a constrained container; existing key collision in the private store; HOME env var unset so config.Dir() resolves oddly.

Related errors

• error importing key from
• failed to write public key to
• refusing to load key from
• private key file must not be readable or writable by others
• error: could not find signing keys for remote repository

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/abf9953f7902b37f. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/key_generate.go:91

	return validateAndGenerateKey(streams, opts.name, targetDir)
}

func validateAndGenerateKey(streams command.Streams, keyName string, workingDir string) error {
	freshPassRetGetter := func() notary.PassRetriever { return trust.GetPassphraseRetriever(streams.In(), streams.Out()) }
	if err := validateKeyArgs(keyName, workingDir); err != nil {
		return err
	}
	_, _ = fmt.Fprintf(streams.Out(), "Generating key for %s...\n", keyName)
	// Automatically load the private key to local storage for use
	privKeyFileStore, err := trustmanager.NewKeyFileStore(trust.GetTrustDirectory(), freshPassRetGetter())
	if err != nil {
		return err
	}

	pubPEM, err := generateKeyAndOutputPubPEM(keyName, privKeyFileStore)
	if err != nil {
		_, _ = fmt.Fprint(streams.Out(), err)
		return fmt.Errorf("failed to generate key for %s: %w", keyName, err)
	}

	// Output the public key to a file in the CWD or specified dir
	writtenPubFile, err := writePubKeyPEMToDir(pubPEM, keyName, workingDir)
	if err != nil {
		return err
	}
	_, _ = fmt.Fprintln(streams.Out(), "Successfully generated and loaded private key. Corresponding public key available:", writtenPubFile)

	return nil
}

func generateKeyAndOutputPubPEM(keyName string, privKeyStore trustmanager.KeyStore) (pem.Block, error) {
	privKey, err := tufutils.GenerateKey(data.ECDSAKey)
	if err != nil {
		return pem.Block{}, err
	}

View on GitHub (pinned to 4f84911bfe)