docker/cli · error

removing image ID file

Error message

removing image ID file: %w

What it means

Returned by runBuild (build.go:224) when os.Remove(options.imageIDFile) fails with an error other than os.IsNotExist, while trying to clear a stale --iidfile before the build starts. The pre-removal is intentional (to avoid writing a stale ID if the build later fails), so a failure here means the file exists but cannot be removed.

Solutions

1. Delete or fix permissions on the existing file: 'rm -f <path>' or 'chmod u+w <path>'.
2. Point --iidfile to a writable location owned by the current user.
3. Ensure the CI agent runs builds as the same user that owns the output directory.
4. Check for SELinux/AppArmor denials in the system journal if permissions look correct.

Example fix

# before
docker build --iidfile /tmp/builds/id .
# /tmp/builds/id owned by root, current user cannot remove
# after
rm -f /tmp/builds/id
docker build --iidfile /tmp/builds/id .

// Ensure the iidfile path is removable before building.
func ensureIidfileWritable(path string) error {
	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
		return err
	}
	return nil
}

if err := buildCmd.Execute(); err != nil {
	if strings.Contains(err.Error(), "removing image ID file") {
		// fix permissions on the existing iidfile, then re-run
	}
}

When it happens

Trigger: Running 'docker build --iidfile <path>' where <path> exists and the current user lacks permission to delete it, or the parent directory does not permit removal (read-only mount, immutable file, SELinux denial, or the path is a directory).

Common situations: CI workspace where a previous run created the iidfile as root and the current run is non-root; the iidfile path points into a read-only bind-mount; the path collides with a directory name; NFS/SELinux denying unlink.

Related errors

• error reading from
• failed to remove the CID file
• failed to create the container ID file
• opening seccomp profile
• unable to prepare context

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/f42d7da4c696cad6. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/image/build.go:224

	}

	if options.dockerfileFromStdin() {
		if contextType == build.ContextTypeStdin {
			return errors.New("invalid argument: can't use stdin for both build context and dockerfile")
		}
		dockerfileCtx = dockerCli.In()
	}

	progBuff = dockerCli.Out()
	buildBuff = dockerCli.Out()
	if options.quiet {
		progBuff = bytes.NewBuffer(nil)
		buildBuff = bytes.NewBuffer(nil)
	}
	if options.imageIDFile != "" {
		// Avoid leaving a stale file if we eventually fail
		if err := os.Remove(options.imageIDFile); err != nil && !os.IsNotExist(err) {
			return fmt.Errorf("removing image ID file: %w", err)
		}
	}

	switch contextType {
	case build.ContextTypeStdin:
		// buildCtx is tar archive. if stdin was dockerfile then it is wrapped
		buildCtx, relDockerfile, err = build.GetContextFromReader(dockerCli.In(), options.dockerfileName)
		if err != nil {
			return fmt.Errorf("unable to prepare context from STDIN: %w", err)
		}
	case build.ContextTypeLocal:
		contextDir, relDockerfile, err = build.GetContextFromLocalDir(options.context, options.dockerfileName)
		if err != nil {
			return fmt.Errorf("unable to prepare context: %s", err)
		}
		if strings.HasPrefix(relDockerfile, ".."+string(filepath.Separator)) {
			// Dockerfile is outside build-context; read the Dockerfile and pass it as dockerfileCtx
			dockerfileCtx, err = os.Open(options.dockerfileName)

View on GitHub (pinned to 4f84911bfe)