docker/cli · error

public key file already exists

Error message

public key file already exists: "%s"

What it means

In validateKeyArgs (key_generate.go:57-60), os.Stat(targetPath) succeeded (no error), meaning the public key file <keyName>.pub already exists in targetDir. The command refuses to overwrite an existing public key to avoid clobbering a previously generated keypair and breaking signers that depend on it.

Solutions

1. Choose a different key name, e.g. 'docker trust key generate mykey-v2'.
2. Remove or back up the existing file if you intentionally want to regenerate: mv <name>.pub <name>.pub.bak (and the corresponding private key), then re-run.
3. If regenerating because the private key was lost, also remove the old private key from ~/.docker/trust/private to avoid an orphan public key.

Example fix

# before
docker trust key generate mykey  # mykey.pub already exists
# after (option A: new name)
docker trust key generate mykey-v2
# after (option B: intentional overwrite)
mv mykey.pub mykey.pub.bak && docker trust key generate mykey

// Guard against overwriting an existing public key file.
func ensureNoExistingPubKey(dir, name string) error {
    p := filepath.Join(dir, name+".pub")
    if _, err := os.Stat(p); err == nil {
        return fmt.Errorf("public key file already exists: %q; choose a new name or back up the file", p)
    }
    return nil
}

targetPath := filepath.Join(targetDir, keyName+".pub")
if _, err := os.Stat(targetPath); err == nil {
    return fmt.Errorf("public key file already exists: %q", targetPath)
}

When it happens

Trigger: Running 'docker trust key generate <NAME>' twice with the same NAME in the same directory; a previous successful generation left <NAME>.pub on disk; a file with that exact name exists for another reason.

Common situations: Re-running a setup script that regenerates keys without cleanup; CI job reusing a workspace; developer forgot a key was already generated and tries again with the same name.

Related errors

• public key path does not exist
• refusing to load key from
• key name " " must start with lowercase alphanumeric…
• failed to generate key for
• failed to write public key to

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/5f1d722130103110. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/key_generate.go:59

}

// key names can use lowercase alphanumeric + _ + - characters
var validKeyName = lazyregexp.New(`^[a-z0-9][a-z0-9\_\-]*$`).MatchString

// validate that all of the key names are unique and are alphanumeric + _ + -
// and that we do not already have public key files in the target dir on disk
func validateKeyArgs(keyName string, targetDir string) error {
	if !validKeyName(keyName) {
		return fmt.Errorf("key name \"%s\" must start with lowercase alphanumeric characters and can include \"-\" or \"_\" after the first character", keyName)
	}

	pubKeyFileName := keyName + ".pub"
	if _, err := os.Stat(targetDir); err != nil {
		return fmt.Errorf("public key path does not exist: \"%s\"", targetDir)
	}
	targetPath := filepath.Join(targetDir, pubKeyFileName)
	if _, err := os.Stat(targetPath); err == nil {
		return fmt.Errorf("public key file already exists: \"%s\"", targetPath)
	}
	return nil
}

func setupPassphraseAndGenerateKeys(streams command.Streams, opts keyGenerateOptions) error {
	targetDir := opts.directory
	if targetDir == "" {
		cwd, err := os.Getwd()
		if err != nil {
			return err
		}
		targetDir = cwd
	}
	return validateAndGenerateKey(streams, opts.name, targetDir)
}

func validateAndGenerateKey(streams command.Streams, keyName string, workingDir string) error {
	freshPassRetGetter := func() notary.PassRetriever { return trust.GetPassphraseRetriever(streams.In(), streams.Out()) }

View on GitHub (pinned to 4f84911bfe)