docker/cli · error

no unlock key is set

Error message

no unlock key is set

What it means

Thrown by runUnlockKey (cli/command/swarm/unlock_key.go:79) after SwarmGetUnlockKey returns an empty Key. An empty key means autolock is not enabled, so no unlock key was ever generated and there is nothing to display.

Solutions

1. Enable autolock: `docker swarm update --autolock`.
2. Retrieve the key after enabling: `docker swarm unlock-key`.
3. Store the returned key in a password manager — without it managers cannot restart.

Example fix

// before
docker swarm unlock-key   # autolock off -> no unlock key is set

// after
docker swarm update --autolock
docker swarm unlock-key   # prints the key

res, err := apiClient.SwarmInspect(ctx, client.SwarmInspectOptions{})
if err != nil { return err }
if !res.Swarm.Spec.EncryptionConfig.AutoLockManagers {
	return errors.New("autolock is off; no unlock key exists")
}

When it happens

Trigger: Running `docker swarm unlock-key` (without --rotate) on a swarm where autolock is disabled; the API returns an empty key string.

Common situations: Same root cause as [136] but the operator queries rather than rotates; default swarm with autolock off; checking for a key before enabling autolock.

Related errors

• cannot rotate because autolock is not turned on
• could not fetch unlock key
• could not fetch unlock key
• could not fetch unlock key
• node ID not found in /info

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/680e0c0f040c0ebb. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/swarm/unlock_key.go:79

			RotateManagerUnlockKey: true,
		})
		if err != nil {
			return err
		}

		if !opts.quiet {
			_, _ = fmt.Fprintln(dockerCLI.Out(), "Successfully rotated manager unlock key.")
		}
	}

	resp, err := apiClient.SwarmGetUnlockKey(ctx)
	if err != nil {
		return fmt.Errorf("could not fetch unlock key: %w", err)
	}

	if resp.Key == "" {
		return errors.New("no unlock key is set")
	}

	if opts.quiet {
		_, _ = fmt.Fprintln(dockerCLI.Out(), resp.Key)
		return nil
	}

	printUnlockCommand(dockerCLI.Out(), resp.Key)
	return nil
}

func printUnlockCommand(out io.Writer, unlockKey string) {
	if len(unlockKey) > 0 {
		_, _ = fmt.Fprintf(out, "To unlock a swarm manager after it restarts, "+
			"run the `docker swarm unlock`\ncommand and provide the following key:\n\n    %s\n\n"+
			"Remember to store this key in a password manager, since without it you\n"+
			"will not be able to restart the manager.\n", unlockKey)
	}

View on GitHub (pinned to 4f84911bfe)