{"record":{"id":"d6f18b0610d3de13","repo":"docker/cli","slug":"error-reading-from-s-w-d6f18b","errorCode":null,"errorMessage":"error reading from %s: %w","messagePattern":"error reading from (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/secret/create.go","lineNumber":149,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"error reading from STDIN: %w\", err)\n\t\t}\n\t\tif len(data) == 0 {\n\t\t\treturn nil, errors.New(\"error reading from STDIN: data is empty\")\n\t\t}\n\t\treturn data, nil\n\tcase \"\":\n\t\treturn nil, errors.New(\"secret file is required\")\n\tdefault:\n\t\t// Open file with [FILE_FLAG_SEQUENTIAL_SCAN] on Windows, which\n\t\t// prevents Windows from aggressively caching it. We expect this\n\t\t// file to be only read once. Given that this is expected to be\n\t\t// a small file, this may not be a significant optimization, so\n\t\t// we could choose to omit this, and use a regular [os.Open].\n\t\t//\n\t\t// [FILE_FLAG_SEQUENTIAL_SCAN]: https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea#FILE_FLAG_SEQUENTIAL_SCAN\n\t\tf, err := sequential.Open(fileName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading from %s: %w\", fileName, err)\n\t\t}\n\t\tdefer f.Close()\n\t\tdata, err := io.ReadAll(io.LimitReader(f, 2*maxSecretSize))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading from %s: %w\", fileName, err)\n\t\t}\n\t\tif len(data) == 0 {\n\t\t\treturn nil, fmt.Errorf(\"error reading from %s: data is empty\", fileName)\n\t\t}\n\t\treturn data, nil\n\t}\n}\n","sourceCodeStart":131,"sourceCodeEnd":162,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/secret/create.go#L131-L162","documentation":"Returned by readSecretData (secret/create.go:149) wrapping the error from sequential.Open when the supplied file path cannot be opened. This is the file-open failure path; it fires before any bytes are read. The filename is interpolated so the message names the offending path.","triggerScenarios":"Running `docker secret create mysecret /path/that/does/not/exist` or pointing at a file with no read permission. The open call fails and is wrapped with %w.","commonSituations":"Wrong path, typo, file not yet created, permission denied, or a relative path resolved against an unexpected working directory.","solutions":["Verify the file path exists and is readable before running the command.","Use an absolute path to avoid working-directory ambiguity.","Check file permissions if you get a permission-denied cause."],"exampleFix":"// before\ndocker secret create mysecret ./secrets/db.pass   # wrong cwd\n// after\ndocker secret create mysecret /srv/secrets/db.pass","handlingStrategy":"validation","validationCode":"// Ensure the secret file is openable before creating the secret.\nfunc validateSecretFile(path string) error {\n    f, err := os.Open(path)\n    if err != nil {\n        return fmt.Errorf(\"cannot open secret file %q: %w\", path, err)\n    }\n    return f.Close()\n}","typeGuard":"// fileExists reports whether path is openable for reading.\nfunc fileExists(path string) bool {\n    f, err := os.Open(path)\n    if err != nil { return false }\n    _ = f.Close()\n    return true\n}","tryCatchPattern":null,"preventionTips":["Use absolute paths for secret files to avoid cwd issues.","Verify the file exists and is readable before invoking create.","Generate secret files with explicit error checks in scripts."],"tags":["secret","file","io","swarm","docker-cli"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}