{"record":{"id":"a89af2deaaa9eddc","repo":"docker/cli","slug":"error-reading-from-s-data-is-empty-a89af2","errorCode":null,"errorMessage":"error reading from %s: data is empty","messagePattern":"error reading from (.+?): data is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/secret/create.go","lineNumber":157,"sourceCode":"\tdefault:\n\t\t// Open file with [FILE_FLAG_SEQUENTIAL_SCAN] on Windows, which\n\t\t// prevents Windows from aggressively caching it. We expect this\n\t\t// file to be only read once. Given that this is expected to be\n\t\t// a small file, this may not be a significant optimization, so\n\t\t// we could choose to omit this, and use a regular [os.Open].\n\t\t//\n\t\t// [FILE_FLAG_SEQUENTIAL_SCAN]: https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea#FILE_FLAG_SEQUENTIAL_SCAN\n\t\tf, err := sequential.Open(fileName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading from %s: %w\", fileName, err)\n\t\t}\n\t\tdefer f.Close()\n\t\tdata, err := io.ReadAll(io.LimitReader(f, 2*maxSecretSize))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading from %s: %w\", fileName, err)\n\t\t}\n\t\tif len(data) == 0 {\n\t\t\treturn nil, fmt.Errorf(\"error reading from %s: data is empty\", fileName)\n\t\t}\n\t\treturn data, nil\n\t}\n}\n","sourceCodeStart":139,"sourceCodeEnd":162,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/secret/create.go#L139-L162","documentation":"Returned by readSecretData (secret/create.go:157) when the file was opened and read successfully but yielded zero bytes. A swarm secret must carry non-empty data, so an empty file is rejected explicitly with the filename interpolated.","triggerScenarios":"Running `docker secret create mysecret emptyfile` where emptyfile is a zero-length file, or piping an empty stdin (note: stdin's empty case uses a different message at create.go:134).","commonSituations":"Generating a secret file that produced no output, pointing at the wrong (empty) file, or a truncated template that rendered to nothing.","solutions":["Confirm the file actually contains the secret payload (`wc -c file`).","Regenerate the secret file if it is unexpectedly empty.","Point the command at the correct non-empty file."],"exampleFix":"// before\ndocker secret create mysecret /tmp/empty.txt\n// after\nprintf 's3cr3t' > /tmp/secret.txt && docker secret create mysecret /tmp/secret.txt","handlingStrategy":"validation","validationCode":"// Reject empty secret files before calling create.\nfunc validateSecretNonEmpty(path string) error {\n    fi, err := os.Stat(path)\n    if err != nil { return err }\n    if fi.Size() == 0 { return errors.New(\"secret file is empty\") }\n    return nil\n}","typeGuard":"// nonEmptyFile reports whether path exists and has size > 0.\nfunc nonEmptyFile(path string) bool {\n    fi, err := os.Stat(path)\n    return err == nil && fi.Size() > 0\n}","tryCatchPattern":null,"preventionTips":["Check file size (`wc -c`) before creating a secret.","Assert secret-generation steps produce non-empty output.","Validate in CI that secret artifacts are non-empty."],"tags":["secret","file","validation","swarm","docker-cli"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}