docker/cli · error

tag can't be used with --all-tags/-a

Error message

tag can't be used with --all-tags/-a

What it means

runPush() applies the same all-tags guard as pull: pushing with -a only makes sense for a name-only repository reference. Specifying a tag/digest together with --all-tags is contradictory, so it is rejected before the push API call.

Solutions

1. Drop the tag to push all tags: `docker push -a myimage`
2. Drop -a to push one tag: `docker push myimage:latest`
3. Decide between pushing all tags or one specific tag

Example fix

// before
docker push -a myimage:latest
// after
docker push -a myimage

ref, err := reference.ParseNormalizedNamed(opts.remote)
if err != nil { return err }
if opts.all && !reference.IsNameOnly(ref) {
    return errors.New("--all-tags requires a name-only reference without tag/digest")
}

func isNameOnlyRef(s string) bool {
    ref, err := reference.ParseNormalizedNamed(s)
    if err != nil { return false }
    return reference.IsNameOnly(ref)
}

When it happens

Trigger: `docker push -a myimage:latest` or `docker push --all-tags myimage@sha256:...`.

Common situations: Reusing a tagged reference from a pull/build in an all-tags push; CI templating that always emits a tag.

Related errors

• tag can't be used with --all-tags/-a
• refusing to amend an existing manifest list with no --amend…
• unrecognized config key
• --quiet is not yet supported with --tree
• --no-trunc is not yet supported with --tree

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/cf749087c6307d88. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/image/push.go:102

			_, _ = fmt.Fprintf(dockerCli.Err(), "Invalid platform %s", opts.platform)
			return err
		}
		platform = &p

		out.PrintNote(`Using --platform pushes only the specified platform manifest of a multi-platform image index.
Other components, like attestations, will not be included.
To push the complete multi-platform image, remove the --platform flag.
`)
	}

	ref, err := reference.ParseNormalizedNamed(opts.remote)
	if err != nil {
		return err
	}

	switch {
	case opts.all && !reference.IsNameOnly(ref):
		return errors.New("tag can't be used with --all-tags/-a")
	case !opts.all && reference.IsNameOnly(ref):
		ref = reference.TagNameOnly(ref)
		if tagged, ok := ref.(reference.Tagged); ok && !opts.quiet {
			_, _ = fmt.Fprintln(dockerCli.Out(), "Using default tag:", tagged.Tag())
		}
	}

	// Resolve the Auth config relevant for this server
	encodedAuth, err := command.RetrieveAuthTokenFromImage(dockerCli.ConfigFile(), ref.String())
	if err != nil {
		return err
	}

	responseBody, err := dockerCli.Client().ImagePush(ctx, reference.FamiliarString(ref), client.ImagePushOptions{
		All:           opts.all,
		RegistryAuth:  encodedAuth,
		PrivilegeFunc: nil,
		Platform:      platform,

View on GitHub (pinned to 4f84911bfe)