{"record":{"id":"b136053dbb392238","repo":"docker/cli","slug":"secret-file-is-required","errorCode":null,"errorMessage":"secret file is required","messagePattern":"secret file is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/secret/create.go","lineNumber":138,"sourceCode":"\n// readSecretData reads the secret from either stdin or the given fileName.\n//\n// It reads up to twice the maximum size of the secret ([maxSecretSize]),\n// just in case swarm's limit changes; this is only a safeguard to prevent\n// reading arbitrary files into memory.\nfunc readSecretData(in io.Reader, fileName string) ([]byte, error) {\n\tswitch fileName {\n\tcase \"-\":\n\t\tdata, err := io.ReadAll(io.LimitReader(in, 2*maxSecretSize))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading from STDIN: %w\", err)\n\t\t}\n\t\tif len(data) == 0 {\n\t\t\treturn nil, errors.New(\"error reading from STDIN: data is empty\")\n\t\t}\n\t\treturn data, nil\n\tcase \"\":\n\t\treturn nil, errors.New(\"secret file is required\")\n\tdefault:\n\t\t// Open file with [FILE_FLAG_SEQUENTIAL_SCAN] on Windows, which\n\t\t// prevents Windows from aggressively caching it. We expect this\n\t\t// file to be only read once. Given that this is expected to be\n\t\t// a small file, this may not be a significant optimization, so\n\t\t// we could choose to omit this, and use a regular [os.Open].\n\t\t//\n\t\t// [FILE_FLAG_SEQUENTIAL_SCAN]: https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea#FILE_FLAG_SEQUENTIAL_SCAN\n\t\tf, err := sequential.Open(fileName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading from %s: %w\", fileName, err)\n\t\t}\n\t\tdefer f.Close()\n\t\tdata, err := io.ReadAll(io.LimitReader(f, 2*maxSecretSize))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading from %s: %w\", fileName, err)\n\t\t}\n\t\tif len(data) == 0 {","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/secret/create.go#L120-L156","documentation":"Thrown by readSecretData when no external driver is set and the fileName argument is empty (secret/create.go lines 137-138). Without a driver, the CLI requires an explicit data source (a file path or '-' for stdin); providing only the secret name is insufficient.","triggerScenarios":"Running 'docker secret create mysecret' with only the name argument and no --driver, no file, and no '-' for stdin.","commonSituations":"Forgetting the data source argument; assuming stdin is read by default; command-arg parsing dropping the second argument.","solutions":["Provide a file path as the second argument: 'docker secret create mysecret ./secret.txt'.","Use '-' to read from stdin: 'printf %s \"$VAL\" | docker secret create mysecret -'.","Or specify --driver if the secret is externally managed."],"exampleFix":"# before\ndocker secret create mysecret\n# after\nprintf '%s' \"$VAL\" | docker secret create mysecret -","handlingStrategy":"validation","validationCode":"// Require a data source (file or '-') when no driver is set\nif options.driver == \"\" && options.file == \"\" {\n    return fmt.Errorf(\"provide a secret file or '-' for stdin, or use --driver\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass a second argument (file path or '-') when creating inline secrets.","Add a wrapper check that errors if neither file nor driver is supplied.","Distinguish driver-backed vs inline secret creation in runbooks."],"tags":["secret","swarm","docker","go","cli"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}