{"record":{"id":"a7144f60c71c2373","repo":"docker/cli","slug":"invalid-field-in-secret-request-key","errorCode":null,"errorMessage":"invalid field in secret request: {key}","messagePattern":"invalid field in secret request: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"opts/swarmopts/secret.go","lineNumber":66,"sourceCode":"\t\t// TODO(thaJeztah): these options should not be case-insensitive.\n\t\tswitch strings.ToLower(key) {\n\t\tcase \"source\", \"src\":\n\t\t\toptions.SecretName = val\n\t\tcase \"target\":\n\t\t\toptions.File.Name = val\n\t\tcase \"uid\":\n\t\t\toptions.File.UID = val\n\t\tcase \"gid\":\n\t\t\toptions.File.GID = val\n\t\tcase \"mode\":\n\t\t\tm, err := strconv.ParseUint(val, 0, 32)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid mode specified: %v\", err)\n\t\t\t}\n\n\t\t\toptions.File.Mode = os.FileMode(m)\n\t\tdefault:\n\t\t\treturn errors.New(\"invalid field in secret request: \" + key)\n\t\t}\n\t}\n\n\tif options.SecretName == \"\" {\n\t\treturn errors.New(\"source is required\")\n\t}\n\tif options.File.Name == \"\" {\n\t\toptions.File.Name = options.SecretName\n\t}\n\n\to.values = append(o.values, options)\n\treturn nil\n}\n\n// Type returns the type of this option\nfunc (*SecretOpt) Type() string {\n\treturn \"secret\"\n}","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/opts/swarmopts/secret.go#L48-L84","documentation":"Thrown by SecretOpt.Set when a key=value field in a --secret request uses a key that is not one of source, src, target, uid, gid, mode. The switch statement falls to the default branch and rejects the unknown key verbatim.","triggerScenarios":"Passing --secret name=dbpw, or --secret file=/run/secrets/x, or any field with an unrecognized key.","commonSituations":"Confusing secret option keys with config keys, or assuming extra fields like 'name' or 'file' are accepted. Also case differences are tolerated (keys are lowercased), but unknown keys are not.","solutions":["Use only recognized keys: source/src, target, uid, gid, mode.","Rename any 'name' field to 'source'.","Use the short form --secret <secretname> when no overrides are needed."],"exampleFix":"// before\n--secret name=dbpw,target=/run/secrets/pw\n// after\n--secret source=dbpw,target=/run/secrets/pw","handlingStrategy":"validation","validationCode":"validSecretKeys := map[string]bool{\"source\": true, \"src\": true, \"target\": true, \"uid\": true, \"gid\": true, \"mode\": true}\nfor _, f := range strings.Split(spec, \",\") {\n    k, _, _ := strings.Cut(strings.ToLower(f), \"=\")\n    if !validSecretKeys[k] {\n        return fmt.Errorf(\"unknown secret field %q\", k)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := secretOpt.Set(spec); err != nil {\n    return err\n}","preventionTips":["Use only source/src, target, uid, gid, mode keys.","Use the short form --secret <name> when no overrides are needed."],"tags":["swarm","secrets","validation","opts"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}