{"record":{"id":"2820d7e68ca0f936","repo":"docker/cli","slug":"error-reading-from-stdin-w-2820d7","errorCode":null,"errorMessage":"error reading from STDIN: %w","messagePattern":"error reading from STDIN: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/secret/create.go","lineNumber":131,"sourceCode":"}\n\n// maxSecretSize is the maximum byte length of the [swarm.SecretSpec.Data] field,\n// as defined by [MaxSecretSize] in SwarmKit.\n//\n// [MaxSecretSize]: https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/api/validation#MaxSecretSize\nconst maxSecretSize = 500 * 1024 // 500KB\n\n// readSecretData reads the secret from either stdin or the given fileName.\n//\n// It reads up to twice the maximum size of the secret ([maxSecretSize]),\n// just in case swarm's limit changes; this is only a safeguard to prevent\n// reading arbitrary files into memory.\nfunc readSecretData(in io.Reader, fileName string) ([]byte, error) {\n\tswitch fileName {\n\tcase \"-\":\n\t\tdata, err := io.ReadAll(io.LimitReader(in, 2*maxSecretSize))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading from STDIN: %w\", err)\n\t\t}\n\t\tif len(data) == 0 {\n\t\t\treturn nil, errors.New(\"error reading from STDIN: data is empty\")\n\t\t}\n\t\treturn data, nil\n\tcase \"\":\n\t\treturn nil, errors.New(\"secret file is required\")\n\tdefault:\n\t\t// Open file with [FILE_FLAG_SEQUENTIAL_SCAN] on Windows, which\n\t\t// prevents Windows from aggressively caching it. We expect this\n\t\t// file to be only read once. Given that this is expected to be\n\t\t// a small file, this may not be a significant optimization, so\n\t\t// we could choose to omit this, and use a regular [os.Open].\n\t\t//\n\t\t// [FILE_FLAG_SEQUENTIAL_SCAN]: https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea#FILE_FLAG_SEQUENTIAL_SCAN\n\t\tf, err := sequential.Open(fileName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading from %s: %w\", fileName, err)","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/secret/create.go#L113-L149","documentation":"Returned by readSecretData (secret/create.go:131) wrapping the error from io.ReadAll when reading the secret payload from STDIN (the `-` filename). Input is limited to 2*maxSecretSize (~1MB) via LimitReader; an I/O failure during that read produces this wrapped error.","triggerScenarios":"Running `echo $SECRET | docker secret create mysecret -` and the stdin pipe breaks or the reader returns an error mid-stream. Also possible if stdin is closed prematurely by the producing process.","commonSituations":"A piped producer exits non-zero before closing stdout, a broken pipe in CI, or redirecting from a special file that errors on read.","solutions":["Ensure the producer of the pipe writes the full payload and exits 0.","Write the secret to a temp file and pass the path instead of `-`.","Check the upstream command for errors when chaining into docker secret create."],"exampleFix":"// before\nproduce-secret | docker secret create mysecret -   # producer fails\n// after\nproduce-secret > /tmp/secret.txt && docker secret create mysecret /tmp/secret.txt && rm /tmp/secret.txt","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// On stdin read failure, fall back to a file source.\ndata, err := readSecretData(in, \"-\")\nif err != nil {\n    if strings.Contains(err.Error(), \"error reading from STDIN\") {\n        // producer pipe broke; retry from a temp file\n        return readSecretData(os.Open(tempFile))\n    }\n    return err\n}","preventionTips":["Check the exit status of piped producers before relying on stdin.","Prefer a file path over `-` in automated pipelines for reliability.","Use LimitReader-equivalent bounds when forwarding stdin."],"tags":["secret","stdin","swarm","io","docker-cli"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}