{"record":{"id":"61742a120eb06c7b","repo":"docker/cli","slug":"failed-to-update-secret-s-w","errorCode":null,"errorMessage":"failed to update secret %s: %w","messagePattern":"failed to update secret (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/stack/deploy_composefile.go","lineNumber":123,"sourceCode":"\t\t}\n\t}\n\treturn nil\n}\n\nfunc createSecrets(ctx context.Context, dockerCLI command.Cli, secrets []swarm.SecretSpec) error {\n\tapiClient := dockerCLI.Client()\n\n\tfor _, secretSpec := range secrets {\n\t\tres, err := apiClient.SecretInspect(ctx, secretSpec.Name, client.SecretInspectOptions{})\n\t\tswitch {\n\t\tcase err == nil:\n\t\t\t// secret already exists, then we update that\n\t\t\t_, err := apiClient.SecretUpdate(ctx, res.Secret.ID, client.SecretUpdateOptions{\n\t\t\t\tVersion: res.Secret.Meta.Version,\n\t\t\t\tSpec:    secretSpec,\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to update secret %s: %w\", secretSpec.Name, err)\n\t\t\t}\n\t\tcase errdefs.IsNotFound(err):\n\t\t\t// secret does not exist, then we create a new one.\n\t\t\t_, _ = fmt.Fprintln(dockerCLI.Out(), \"Creating secret\", secretSpec.Name)\n\t\t\t_, err := apiClient.SecretCreate(ctx, client.SecretCreateOptions{\n\t\t\t\tSpec: secretSpec,\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to create secret %s: %w\", secretSpec.Name, err)\n\t\t\t}\n\t\tdefault:\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc createConfigs(ctx context.Context, dockerCLI command.Cli, configs []swarm.ConfigSpec) error {","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/stack/deploy_composefile.go#L105-L141","documentation":"Raised by createSecrets when a swarm secret already exists (found via SecretInspect) but the subsequent SecretUpdate API call fails. The wrapped %w error carries the underlying daemon error (e.g. version conflict, immutable field change, permission).","triggerScenarios":"Redeploying a stack where a secret in compose.yml was modified, causing SecretUpdate at deploy_composefile.go:118 to return an error. Common when changing a field that the daemon rejects on update, or when the secret's version/meta is stale due to concurrent modification.","commonSituations":"Concurrent stack deploys racing on the same secret; changing an immutable attribute (e.g. driver labels) of an existing secret; manager node temporarily unhealthy; removing a secret out-of-band between the Inspect and Update calls.","solutions":["Inspect the wrapped error message for the daemon's specific reason (e.g. 'update out of sequence').","Retry the deploy; transient version conflicts often resolve on the next attempt.","If the secret is truly malformed, remove it (`docker secret rm <name>`) and redeploy so it is recreated.","Ensure no concurrent deploys are modifying the same stack's secrets."],"exampleFix":"// before: concurrent deploys cause version conflict\n// after: serialize deploys or retry\nfor i in 1 2 3; do docker stack deploy -c compose.yml mystack && break || sleep 2; done","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Retry on transient secret update failures (e.g. version conflict)\nvar lastErr error\nfor attempt := 0; attempt < 3; attempt++ {\n    if err := stackDeploy(ctx, cli, opts, cfg); err == nil {\n        return nil\n    } else if strings.Contains(err.Error(), \"failed to update secret\") {\n        lastErr = err\n        continue // likely a transient version conflict\n    } else {\n        return err\n    }\n}\nreturn lastErr","preventionTips":["Serialize concurrent stack deploys to avoid version conflicts.","Treat wrapped 'update out of sequence' errors as retriable.","Avoid changing immutable secret fields; recreate the secret instead."],"tags":["docker","stack","secret","swarm","update"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}