docker/cli · error

%s: %w

Error message

%s: %w

What it means

Returned during tar context Import when an archive entry's path fails isValidFilePath: paths must be exactly 'meta.json' or start with 'tls/', must equal path.Clean(p) (no '..' or '.' traversal, no duplicates), and must contain no backslashes. The offending entry name is included in the message.

Solutions

1. Re-export the context from a known-good CLI (`docker context export`) and import that archive.
2. Inspect the archive (`tar -tvf file`) and remove disallowed entries.
3. Ensure all entry paths use forward slashes and a meta.json / tls/-prefixed layout.

// Pre-check a tar's entries before importing.
func safeTarEntries(r io.Reader) error {
    tr := tar.NewReader(r)
    for {
        h, err := tr.Next()
        if err == io.EOF { return nil }
        if err != nil { return err }
        if h.Name != "meta.json" && !strings.HasPrefix(h.Name, "tls/") {
            return fmt.Errorf("disallowed entry %q", h.Name)
        }
        if path.Clean(h.Name) != h.Name || strings.Contains(h.Name, `\`) {
            return fmt.Errorf("unsafe path %q", h.Name)
        }
    }
}

When it happens

Trigger: Calling store.Import / `docker context import` on a tar containing entries outside the allowed layout: '../escape', 'tls/../x', 'tls\docker\ca.pem' (backslashes), or stray top-level files.

Common situations: Hand-rolled or tampered context archives; archives from incompatible tools; path-traversal (tar-slip) attempts.

Related errors

• unexpected context file
• unexpected path format
• read exceeds the defined limit
• unexpected '\\' in path
• invalid context: no metadata found

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/f684e3f7934bc3a7. Report an issue: GitHub.

Appendix: source

Thrown at cli/context/store/store.go:403

	tr := tar.NewReader(&limitedReader{R: reader, N: maxAllowedFileSizeToImport})
	tlsData := ContextTLSData{
		Endpoints: map[string]EndpointTLSData{},
	}
	var importedMetaFile bool
	for {
		hdr, err := tr.Next()
		if err == io.EOF {
			break
		}
		if err != nil {
			return err
		}
		if hdr.Typeflag != tar.TypeReg {
			// skip this entry, only taking files into account
			continue
		}
		if err := isValidFilePath(hdr.Name); err != nil {
			return fmt.Errorf("%s: %w", hdr.Name, err)
		}
		if hdr.Name == metaFile {
			data, err := io.ReadAll(tr)
			if err != nil {
				return err
			}
			meta, err := parseMetadata(data, name)
			if err != nil {
				return err
			}
			if err := s.CreateOrUpdate(meta); err != nil {
				return err
			}
			importedMetaFile = true
		} else if strings.HasPrefix(hdr.Name, "tls/") {
			data, err := io.ReadAll(tr)
			if err != nil {
				return err

View on GitHub (pinned to 4f84911bfe)