What causes "public key path does not exist: "%s"" in docker/cli?

Create the target directory first: mkdir -p , then re-run with --dir .

public key path does not exist

Error message

public key path does not exist: "%s"

What it means

In validateKeyArgs (key_generate.go:53-56), os.Stat(targetDir) returned an error, meaning the directory where the public key file would be written does not exist (or is inaccessible). targetDir comes from --dir flag or the current working directory (setupPassphraseAndGenerateKeys, key_generate.go:64-72).

Solutions

Create the target directory first: mkdir -p <dir>, then re-run with --dir <dir>.
Omit --dir to write to the current working directory, and ensure the cwd exists and is writable.
Check for typos and that the path is a directory (not a file): ls -ld <dir>.
Verify permissions/ownership of the directory and its parents.

Example fix

# before
docker trust key generate mykey --dir /tmp/keys  # /tmp/keys missing
# after
mkdir -p /tmp/keys && docker trust key generate mykey --dir /tmp/keys

Defensive patterns

Strategy: validation

Validate before calling

// Ensure the output directory exists and is writable before generating.
func ensureOutputDir(dir string) error {
    info, err := os.Stat(dir)
    if err != nil {
        return fmt.Errorf("public key path does not exist: %q", dir)
    }
    if !info.IsDir() {
        return fmt.Errorf("target path is not a directory: %q", dir)
    }
    return nil
}

Try / catch

if _, err := os.Stat(targetDir); err != nil {
    return fmt.Errorf("public key path does not exist: %q", targetDir)
}

Prevention

mkdir -p the target directory in provisioning scripts before key generation.
Default to cwd when --dir is omitted and ensure cwd is valid.
Validate --dir is a directory, not a file.

When it happens

Trigger: Running 'docker trust key generate NAME --dir /nonexistent/path'; the current working directory was deleted or is on an unmounted filesystem after the shell started; --dir points to a path the user lacks permission to stat; a relative --dir that does not resolve.

Common situations: Typo in --dir path; script cd'd into a temp dir that was cleaned up; --dir given a file instead of a directory; permission denied on a parent directory; running in a container with a volume not mounted at the expected path.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/cbe6bcbff02c0273. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/key_generate.go:55

	}
	flags := cmd.Flags()
	flags.StringVar(&options.directory, "dir", "", "Directory to generate key in, defaults to current directory")
	return cmd
}

// key names can use lowercase alphanumeric + _ + - characters
var validKeyName = lazyregexp.New(`^[a-z0-9][a-z0-9\_\-]*$`).MatchString

// validate that all of the key names are unique and are alphanumeric + _ + -
// and that we do not already have public key files in the target dir on disk
func validateKeyArgs(keyName string, targetDir string) error {
	if !validKeyName(keyName) {
		return fmt.Errorf("key name \"%s\" must start with lowercase alphanumeric characters and can include \"-\" or \"_\" after the first character", keyName)
	}

	pubKeyFileName := keyName + ".pub"
	if _, err := os.Stat(targetDir); err != nil {
		return fmt.Errorf("public key path does not exist: \"%s\"", targetDir)
	}
	targetPath := filepath.Join(targetDir, pubKeyFileName)
	if _, err := os.Stat(targetPath); err == nil {
		return fmt.Errorf("public key file already exists: \"%s\"", targetPath)
	}
	return nil
}

func setupPassphraseAndGenerateKeys(streams command.Streams, opts keyGenerateOptions) error {
	targetDir := opts.directory
	if targetDir == "" {
		cwd, err := os.Getwd()
		if err != nil {
			return err
		}
		targetDir = cwd
	}
	return validateAndGenerateKey(streams, opts.name, targetDir)

View on GitHub (pinned to 4f84911bfe)