docker/cli · error

failed to remove TLS data

Error message

failed to remove TLS data: %w

What it means

Returned by tlsStore.remove (reached via ContextStore.Remove -> 511, and ResetTLSMaterial) when os.RemoveAll of the context's whole TLS directory fails. The wrapped error is the OS error.

Solutions

1. Fix ownership/permissions on ~/.docker/contexts/tls/<hash>.
2. Remove the TLS directory manually as the appropriate user.
3. Confirm the filesystem is writable and not mounted read-only.

if err := store.ResetTLSMaterial(name, data); err != nil {
    if errors.Is(err, os.ErrPermission) {
        // chown the tls dir, or rm -rf ~/.docker/contexts/tls/<hash> as the owner
    }
    return err
}

When it happens

Trigger: Removing a context or resetting its TLS material when the TLS dir cannot be deleted — permissions, read-only filesystem, or locked files.

Common situations: Ownership mismatch between the user and the TLS dir files; read-only mount; files locked by another process.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to remove TLS data for endpoint
• failed to remove metadata
• failed to remove context
• failed to read TLS data for endpoint
• failed to list TLS files for context

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/c20adb14ece7333b. Report an issue: GitHub.

Appendix: source

Thrown at cli/context/store/tlsstore.go:51

	}
	return atomicwriter.WriteFile(filepath.Join(endpointDir, filename), data, 0o600)
}

func (s *tlsStore) getData(name, endpointName, filename string) ([]byte, error) {
	data, err := os.ReadFile(filepath.Join(s.endpointDir(name, endpointName), filename))
	if err != nil {
		if os.IsNotExist(err) {
			return nil, notFound(fmt.Errorf("TLS data for %s/%s/%s does not exist", name, endpointName, filename))
		}
		return nil, fmt.Errorf("failed to read TLS data for endpoint %s: %w", endpointName, err)
	}
	return data, nil
}

// remove deletes all TLS data for the given context.
func (s *tlsStore) remove(name string) error {
	if err := os.RemoveAll(s.contextDir(name)); err != nil {
		return fmt.Errorf("failed to remove TLS data: %w", err)
	}
	return nil
}

func (s *tlsStore) removeEndpoint(name, endpointName string) error {
	if err := os.RemoveAll(s.endpointDir(name, endpointName)); err != nil {
		return fmt.Errorf("failed to remove TLS data for endpoint %s: %w", endpointName, err)
	}
	return nil
}

func (s *tlsStore) listContextData(name string) (map[string]EndpointFiles, error) {
	contextDir := s.contextDir(name)
	epFSs, err := os.ReadDir(contextDir)
	if err != nil {
		if os.IsNotExist(err) {
			return map[string]EndpointFiles{}, nil
		}

View on GitHub (pinned to 4f84911bfe)