docker/cli · warning · notFoundErr

TLS data for / / does not exist

Error message

TLS data for %s/%s/%s does not exist

What it means

Returned by ContextStoreWithDefault.GetTLSData (defaultcontextstore.go:190) when GetTLSData is called for the 'default' context but the requested endpoint/fileName combination is not present in the in-memory default context's TLS data. Because the default context is resolved from env/config (not disk), its TLS material is held in memory and a miss produces a notFound error.

Solutions

1. If you need TLS with the default context, set DOCKER_TLS_VERIFY=1 and DOCKER_CERT_PATH to a directory containing ca.pem, cert.pem, key.pem.
2. If you do not need TLS, treat this as informational and skip the TLS data fetch for the default context.
3. Create a named context with explicit TLS material instead of relying on the in-memory default: 'docker context create --docker host=...,ca=...,cert=...,key=... tls-ctx'.
4. In tooling, check ListTLSFiles first and only request files that are actually listed.

Example fix

# before: default context has no TLS data
docker context use default
# tool calls GetTLSData('default','docker','key.pem') -> error
# after: use a named context with explicit TLS
docker context create --docker host=tcp://host:2376,ca=~/certs/ca.pem,cert=~/certs/cert.pem,key=~/certs/key.pem tls-ctx
docker context use tls-ctx

// Before fetching TLS data for the default context, list what is available.
files, err := store.ListTLSFiles("default")
if err != nil { return err }
want := "key.pem"
found := false
for _, ef := range files["docker"] {
	if ef == want { found = true; break }
}
if !found { /* skip or set DOCKER_CERT_PATH */ }

if _, err := store.GetTLSData("default", ep, file); err != nil {
	var nf interface{ NotFound() bool }
	if errors.As(err, &nf) && nf.NotFound() {
		// default context has no TLS data; proceed without it or configure DOCKER_CERT_PATH
	}
}

When it happens

Trigger: Calling the store's GetTLSData('default', <endpoint>, <file>) when the default context has no TLS data for that endpoint/file. Typically invoked by tooling or plugins that enumerate TLS files; also reachable if DOCKER_CONTEXT=default or no context is set and a consumer requests a TLS artifact that was never resolved (e.g., no DOCKER_* TLS env vars set).

Common situations: A management tool or GUI iterating over contexts and querying TLS data for the default context that has no certificates configured; migrating a script that worked against a named context (with TLS) to the default context (without TLS); env vars DOCKER_CERT_PATH/DOCKER_TLS_VERIFY unset so no TLS data is materialized.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• unable to apply docker endpoint options
• context does not exist
• TLS data for / / does not exist
• failed to list TLS files for endpoint
• failed to retrieve TLS files for context

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/82e3d34864174d10. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/defaultcontextstore.go:190

			for filename := range epTLSData.Files {
				files = append(files, filename)
			}
			tlsfiles[epName] = files
		}
		return tlsfiles, nil
	}
	return s.Store.ListTLSFiles(name)
}

// GetTLSData implements store.Store's GetTLSData
func (s *ContextStoreWithDefault) GetTLSData(contextName, endpointName, fileName string) ([]byte, error) {
	if contextName == DefaultContextName {
		defaultContext, err := s.Resolver()
		if err != nil {
			return nil, err
		}
		if defaultContext.TLS.Endpoints[endpointName].Files[fileName] == nil {
			return nil, notFound(fmt.Errorf("TLS data for %s/%s/%s does not exist", DefaultContextName, endpointName, fileName))
		}
		return defaultContext.TLS.Endpoints[endpointName].Files[fileName], nil
	}
	return s.Store.GetTLSData(contextName, endpointName, fileName)
}

// GetStorageInfo implements store.Store's GetStorageInfo
func (s *ContextStoreWithDefault) GetStorageInfo(contextName string) store.StorageInfo {
	if contextName == DefaultContextName {
		return store.StorageInfo{MetadataPath: "<IN MEMORY>", TLSPath: "<IN MEMORY>"}
	}
	return s.Store.GetStorageInfo(contextName)
}

View on GitHub (pinned to 4f84911bfe)