What causes "failed to write public key to %s: %w" in docker/cli?

Confirm the output directory is writable by the current user: touch /.write-test && rm /.write-test.

failed to write public key to

Error message

failed to write public key to %s: %w

What it means

In writePubKeyPEMToDir (key_generate.go:124-131), os.WriteFile to pubFilePath (<workingDir>/<keyName>.pub) failed and is wrapped as 'failed to write public key to <path>'. The file is written with notary.PrivNoExecPerms (0600). The private key was already generated and stored, but the public key PEM could not be written to the working/output directory.

Solutions

Confirm the output directory is writable by the current user: touch <dir>/.write-test && rm <dir>/.write-test.
Free disk space if the volume is full (df -h <dir>).
Re-run with the correct --dir or from a writable cwd; if the private key was already generated, note that it remains in ~/.docker/trust/private and you can export the public key separately.
Check SELinux/AppArmor context if on a hardened system.

Example fix

# before: --dir is read-only, write fails
docker trust key generate mykey --dir /mnt/readonly
# after: use a writable directory
docker trust key generate mykey --dir ./keys

Defensive patterns

Strategy: validation

Validate before calling

// Verify the output directory is writable before attempting the public key write.
func ensureDirWritable(dir string) error {
    f, err := os.CreateTemp(dir, ".wk-")
    if err != nil {
        return fmt.Errorf("cannot write to %q: %w", dir, err)
    }
    f.Close()
    os.Remove(f.Name())
    return nil
}

Try / catch

if err := os.WriteFile(pubFilePath, pem.EncodeToMemory(&pubPEM), notary.PrivNoExecPerms); err != nil {
    return "", fmt.Errorf("failed to write public key to %s: %w", pubFilePath, err)
}

Prevention

Provision the output directory with correct ownership before key generation.
In CI, write to a known writable workspace rather than a mounted read-only volume.
Check df -h and directory permissions if writes start failing.

When it happens

Trigger: The output directory became read-only or was removed between validateKeyArgs and the write; disk full; permission denied (directory owned by another user); path-too-long; filesystem error; SELinux/AppArmor denying the write.

Common situations: Running in CI where the workspace was made read-only after validation; --dir on a mounted volume that dropped permissions; out of disk; running as a different uid than the directory owner; the .pub path conflicts with a directory entry.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/d3a6878b528eab76. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/key_generate.go:129

		return pem.Block{}, err
	}

	pubKey := data.PublicKeyFromPrivate(privKey)
	return pem.Block{
		Type: "PUBLIC KEY",
		Headers: map[string]string{
			"role": keyName,
		},
		Bytes: pubKey.Public(),
	}, nil
}

func writePubKeyPEMToDir(pubPEM pem.Block, keyName, workingDir string) (string, error) {
	// Output the public key to a file in the CWD or specified dir
	pubFileName := strings.Join([]string{keyName, "pub"}, ".")
	pubFilePath := filepath.Join(workingDir, pubFileName)
	if err := os.WriteFile(pubFilePath, pem.EncodeToMemory(&pubPEM), notary.PrivNoExecPerms); err != nil {
		return "", fmt.Errorf("failed to write public key to %s: %w", pubFilePath, err)
	}
	return pubFilePath, nil
}

View on GitHub (pinned to 4f84911bfe)