{"record":{"id":"0fa32e9cbc221285","repo":"docker/cli","slug":"when-using-secret-driver-secret-data-must-be-empty","errorCode":null,"errorMessage":"when using secret driver secret data must be empty","messagePattern":"when using secret driver secret data must be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/secret/create.go","lineNumber":77,"sourceCode":"\t\tDisableFlagsInUseLine: true,\n\t}\n\tflags := cmd.Flags()\n\tflags.VarP(&options.labels, \"label\", \"l\", \"Secret labels\")\n\tflags.StringVarP(&options.driver, \"driver\", \"d\", \"\", \"Secret driver\")\n\tflags.SetAnnotation(\"driver\", \"version\", []string{\"1.31\"})\n\tflags.StringVar(&options.templateDriver, \"template-driver\", \"\", \"Template driver\")\n\tflags.SetAnnotation(\"template-driver\", \"version\", []string{\"1.37\"})\n\n\treturn cmd\n}\n\nfunc runSecretCreate(ctx context.Context, dockerCLI command.Cli, options createOptions) error {\n\tapiClient := dockerCLI.Client()\n\n\tvar secretData []byte\n\tif options.driver != \"\" {\n\t\tif options.file != \"\" {\n\t\t\treturn errors.New(\"when using secret driver secret data must be empty\")\n\t\t}\n\t} else {\n\t\tvar err error\n\t\tsecretData, err = readSecretData(dockerCLI.In(), options.file)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tspec := swarm.SecretSpec{\n\t\tAnnotations: swarm.Annotations{\n\t\t\tName:   options.name,\n\t\t\tLabels: opts.ConvertKVStringsToMap(options.labels.GetSlice()),\n\t\t},\n\t\tData: secretData,\n\t}\n\tif options.driver != \"\" {\n\t\tspec.Driver = &swarm.Driver{","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/secret/create.go#L59-L95","documentation":"Thrown by runSecretCreate when an external secret driver (--driver) is specified AND a file/data argument is also provided. External secret drivers manage their own data store, so supplying inline secret data alongside a driver is contradictory (secret/create.go lines 75-78).","triggerScenarios":"Running 'docker secret create --driver mydriver mysecret ./data.txt' (both a driver and a data source).","commonSituations":"Copying a file-based secret command and appending --driver without removing the file argument; misunderstanding that driver-backed secrets are externally sourced.","solutions":["Drop the file/stdin argument when using --driver.","Use 'docker secret create --driver mydriver mysecret' (name only).","If you need inline data, omit --driver entirely."],"exampleFix":"# before\ndocker secret create --driver mydriver mysecret ./data.txt\n# after\ndocker secret create --driver mydriver mysecret","handlingStrategy":"validation","validationCode":"// Enforce mutual exclusivity of driver and data source\nif options.driver != \"\" && options.file != \"\" {\n    return fmt.Errorf(\"--driver and a data file are mutually exclusive\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When using --driver, supply only the secret name.","When using inline data, omit --driver.","Document the two modes clearly in internal runbooks."],"tags":["secret","swarm","docker","go","cli"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}