docker/cli · error · notFoundErr

TLS data for / / does not exist

Error message

TLS data for %s/%s/%s does not exist

What it means

Returned as an errdefs NotFound error by ContextStore.GetTLSData / tlsStore.getData when the requested file (e.g. ca.pem, cert.pem, key.pem) does not exist for the given context/endpoint. The notFound() wrapper makes it satisfy errdefs.IsNotFound.

Solutions

1. Call store.ListTLSFiles(ctx) first to see which files actually exist before fetching a specific one.
2. If TLS is expected, (re)import the TLS material into the context.
3. Treat the NotFound case as 'no TLS configured' when that is a valid state for your flow.

// List TLS files before fetching a specific one.
files, err := store.ListTLSFiles(ctxName)
if err != nil { return err }
for ep, fs := range files {
    for _, f := range fs {
        // f exists and is safe to GetTLSData
    }
}

data, err := store.GetTLSData(ctx, ep, "ca.pem")
if err != nil {
    if errors.Is(err, errdefs.ErrNotFound) {
        // no CA configured for this endpoint — proceed without it
    }
}

When it happens

Trigger: Calling store.GetTLSData(ctx, endpoint, file) for a context that has no TLS material stored, or where that specific file was never written. The endpoint dir or the file is absent.

Common situations: Querying TLS for a context that uses plain TCP / no TLS; referencing a filename (e.g. 'cert.pem') that was never imported; after partial cleanup removed some TLS files.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to retrieve context tls info: ca.pem seems invalid
• failed to retrieve context tls info
• default context cannot be edited
• no valid private key found
• private key is encrypted - support for encrypted private…

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/5637cdc272f77858. Report an issue: GitHub.

Appendix: source

Thrown at cli/context/store/tlsstore.go:41

}

func (s *tlsStore) createOrUpdate(name, endpointName, filename string, data []byte) error {
	parentOfRoot := filepath.Dir(s.root)
	if err := os.MkdirAll(parentOfRoot, 0o755); err != nil {
		return err
	}
	endpointDir := s.endpointDir(name, endpointName)
	if err := os.MkdirAll(endpointDir, 0o700); err != nil {
		return err
	}
	return atomicwriter.WriteFile(filepath.Join(endpointDir, filename), data, 0o600)
}

func (s *tlsStore) getData(name, endpointName, filename string) ([]byte, error) {
	data, err := os.ReadFile(filepath.Join(s.endpointDir(name, endpointName), filename))
	if err != nil {
		if os.IsNotExist(err) {
			return nil, notFound(fmt.Errorf("TLS data for %s/%s/%s does not exist", name, endpointName, filename))
		}
		return nil, fmt.Errorf("failed to read TLS data for endpoint %s: %w", endpointName, err)
	}
	return data, nil
}

// remove deletes all TLS data for the given context.
func (s *tlsStore) remove(name string) error {
	if err := os.RemoveAll(s.contextDir(name)); err != nil {
		return fmt.Errorf("failed to remove TLS data: %w", err)
	}
	return nil
}

func (s *tlsStore) removeEndpoint(name, endpointName string) error {
	if err := os.RemoveAll(s.endpointDir(name, endpointName)); err != nil {
		return fmt.Errorf("failed to remove TLS data for endpoint %s: %w", endpointName, err)
	}

View on GitHub (pinned to 4f84911bfe)