docker/cli · error

failed to retrieve TLS files for context

Error message

failed to retrieve TLS files for context %q: %w

What it means

Returned by LoadTLSData in cli/context/tlsdata.go when store.Reader.ListTLSFiles fails for the named context. It is the higher-level wrapper around the lower-level store error (e.g. error 520), annotating which context the TLS bundle load was attempted for so the user can target the right context store entry.

Solutions

1. Check `docker context ls` and `docker context inspect <name>` to confirm the context exists and points at a valid Docker endpoint.
2. Fix ownership/permissions of ~/.docker/contexts recursively: `sudo chown -R $USER ~/.docker`.
3. Recreate the context with `docker context rm <name>` and `docker context create`.
4. Re-import the context from a known-good file with `docker context import <name> <file>`.

Example fix

// before
tls, err := context.LoadTLSData(s, name, endpoint)

// after: verify the context resolves in the store first
if _, err := s.GetMetadata(name); err != nil {
    return fmt.Errorf("context %q unavailable, will not load TLS: %w", name, err)
}

// Confirm the context exists and its metadata dir is accessible before loading TLS
if _, err := s.GetMetadata(contextName); err != nil {
    return fmt.Errorf("context %q not resolvable; skip TLS load: %w", contextName, err)
}

When it happens

Trigger: Calling context.LoadTLSData(s, contextName, endpointName) where s.ListTLSFiles(contextName) errors. This happens when the context's TLS directory cannot be read at all (tlsstore.go listContextData returns a wrapped os.ReadDir error), i.e. permission denied or I/O failure on the top-level context TLS dir.

Common situations: Migrating ~/.docker between machines/owners, a partially-cloned docker config, docker running under a different UID than the one that created the context, or a corrupt context store after a crash during context create/import.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to list TLS files for endpoint
• failed to retrieve TLS data
• error reading content from
• error reading from
• error reading from : data is empty

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/f22fafdccb85a92c. Report an issue: GitHub.

Appendix: source

Thrown at cli/context/tlsdata.go:48

		Files: make(map[string][]byte),
	}
	if data.CA != nil {
		result.Files[caKey] = data.CA
	}
	if data.Cert != nil {
		result.Files[certKey] = data.Cert
	}
	if data.Key != nil {
		result.Files[keyKey] = data.Key
	}
	return &result
}

// LoadTLSData loads TLS data from the store
func LoadTLSData(s store.Reader, contextName, endpointName string) (*TLSData, error) {
	tlsFiles, err := s.ListTLSFiles(contextName)
	if err != nil {
		return nil, fmt.Errorf("failed to retrieve TLS files for context %q: %w", contextName, err)
	}
	if epTLSFiles, ok := tlsFiles[endpointName]; ok {
		var tlsData TLSData
		for _, f := range epTLSFiles {
			data, err := s.GetTLSData(contextName, endpointName, f)
			if err != nil {
				return nil, fmt.Errorf("failed to retrieve TLS data (%s) for context %q: %w", f, contextName, err)
			}
			switch f {
			case caKey:
				tlsData.CA = data
			case certKey:
				tlsData.Cert = data
			case keyKey:
				tlsData.Key = data
			default:
				logrus.Warnf("unknown file in context %s TLS bundle: %s", contextName, f)
			}

View on GitHub (pinned to 4f84911bfe)