{"record":{"id":"e3d9d28d17478a93","repo":"docker/cli","slug":"failed-to-create-secret-s-w","errorCode":null,"errorMessage":"failed to create secret %s: %w","messagePattern":"failed to create secret (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/stack/deploy_composefile.go","lineNumber":132,"sourceCode":"\t\tres, err := apiClient.SecretInspect(ctx, secretSpec.Name, client.SecretInspectOptions{})\n\t\tswitch {\n\t\tcase err == nil:\n\t\t\t// secret already exists, then we update that\n\t\t\t_, err := apiClient.SecretUpdate(ctx, res.Secret.ID, client.SecretUpdateOptions{\n\t\t\t\tVersion: res.Secret.Meta.Version,\n\t\t\t\tSpec:    secretSpec,\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to update secret %s: %w\", secretSpec.Name, err)\n\t\t\t}\n\t\tcase errdefs.IsNotFound(err):\n\t\t\t// secret does not exist, then we create a new one.\n\t\t\t_, _ = fmt.Fprintln(dockerCLI.Out(), \"Creating secret\", secretSpec.Name)\n\t\t\t_, err := apiClient.SecretCreate(ctx, client.SecretCreateOptions{\n\t\t\t\tSpec: secretSpec,\n\t\t\t})\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to create secret %s: %w\", secretSpec.Name, err)\n\t\t\t}\n\t\tdefault:\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc createConfigs(ctx context.Context, dockerCLI command.Cli, configs []swarm.ConfigSpec) error {\n\tapiClient := dockerCLI.Client()\n\n\tfor _, configSpec := range configs {\n\t\tres, err := apiClient.ConfigInspect(ctx, configSpec.Name, client.ConfigInspectOptions{})\n\t\tswitch {\n\t\tcase err == nil:\n\t\t\t// config already exists, then we update that\n\t\t\t_, err := apiClient.ConfigUpdate(ctx, res.Config.ID, client.ConfigUpdateOptions{\n\t\t\t\tVersion: res.Config.Meta.Version,","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/stack/deploy_composefile.go#L114-L150","documentation":"Raised by createSecrets when a secret does not exist yet (NotFound after SecretInspect) and the SecretCreate API call then fails. The wrapped %w carries the underlying error (e.g. secret name conflict surfaced at create, data too large, or driver error).","triggerScenarios":"First-time deploy of a stack with secrets defined in compose.yml, where SecretCreate at deploy_composefile.go:128 returns an error. Also when a secret was removed between the Inspect (NotFound) and Create, causing a name collision.","commonSituations":"Secret payload exceeding the 500KB limit; invalid secret name (e.g. uppercase or illegal chars); concurrent deploy creating the same secret name; external secret driver misconfigured on the Swarm.","solutions":["Check the wrapped error for the daemon reason (size limit, invalid name).","Ensure secret names are lowercase, match [a-zA-Z0-9_.-], and are <= 64 chars (compose prefixes them with the stack name).","Verify the secret data is <= 500KB.","Retry; if a concurrent deploy won the race, the next deploy will treat it as an update."],"exampleFix":"// before: secret name too long after stack prefix\nsecrets:\n  my_incredibly_long_secret_name_exceeding_limits:\n    file: ./secret.txt\n// after: shorten the name\nsecrets:\n  my_secret:\n    file: ./secret.txt","handlingStrategy":"validation","validationCode":"// Validate secret names and sizes before deploy\nconst maxSecretBytes = 500 * 1024\nvar validName = regexp.MustCompile(`^[a-zA-Z0-9](?:[a-zA-Z0-9_.-]{0,63})$`)\n\nfunc validateSecret(name, data string, stackNS string) error {\n    full := stackNS + \"_\" + name\n    if !validName.MatchString(full) || len(full) > 64 {\n        return fmt.Errorf(\"invalid secret name %q\", full)\n    }\n    if len(data) > maxSecretBytes {\n        return fmt.Errorf(\"secret %q too large: %d bytes\", name, len(data))\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep secret data under 500KB.","Use lowercase names matching [a-zA-Z0-9_.-].","Validate in CI before pushing secrets/deploying."],"tags":["docker","stack","secret","swarm","create"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}