{"id":"0fa32e9cbc221285","repo":"docker/cli","slug":"when-using-secret-driver-secret-data-must-be-empty","errorCode":null,"errorMessage":"when using secret driver secret data must be empty","messagePattern":"when using secret driver secret data must be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/secret/create.go","lineNumber":77,"sourceCode":"\t\tDisableFlagsInUseLine: true,\n\t}\n\tflags := cmd.Flags()\n\tflags.VarP(&options.labels, \"label\", \"l\", \"Secret labels\")\n\tflags.StringVarP(&options.driver, \"driver\", \"d\", \"\", \"Secret driver\")\n\tflags.SetAnnotation(\"driver\", \"version\", []string{\"1.31\"})\n\tflags.StringVar(&options.templateDriver, \"template-driver\", \"\", \"Template driver\")\n\tflags.SetAnnotation(\"template-driver\", \"version\", []string{\"1.37\"})\n\n\treturn cmd\n}\n\nfunc runSecretCreate(ctx context.Context, dockerCLI command.Cli, options createOptions) error {\n\tapiClient := dockerCLI.Client()\n\n\tvar secretData []byte\n\tif options.driver != \"\" {\n\t\tif options.file != \"\" {\n\t\t\treturn errors.New(\"when using secret driver secret data must be empty\")\n\t\t}\n\t} else {\n\t\tvar err error\n\t\tsecretData, err = readSecretData(dockerCLI.In(), options.file)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\tspec := swarm.SecretSpec{\n\t\tAnnotations: swarm.Annotations{\n\t\t\tName:   options.name,\n\t\t\tLabels: opts.ConvertKVStringsToMap(options.labels.GetSlice()),\n\t\t},\n\t\tData: secretData,\n\t}\n\tif options.driver != \"\" {\n\t\tspec.Driver = &swarm.Driver{","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/secret/create.go#L59-L95","documentation":"Raised by runSecretCreate (cli/command/secret/create.go:77) when `docker secret create` is invoked with a --driver but a secret data source (file argument, including '-' for stdin) is also provided. With a secret driver, the secret value is produced by the driver plugin at container-start time, so the Swarm secret spec must carry an empty Data field — supplying inline data would be contradictory.","triggerScenarios":"docker secret create --driver <plugin> <name> <file>, or docker secret create --driver <plugin> <name> - (stdin marker sets options.file to '-'). Any non-empty file argument combined with a non-empty --driver hits this check before the API call.","commonSituations":"Users adopting a secrets plugin (e.g. a Vault-backed driver) and keeping their old file-based create syntax; scripts that always append '-' and pipe data, then later add --driver; confusion between --driver (secret value provider) and --template-driver (templating of the secret contents), which have different data rules.","solutions":["Drop the file/stdin argument when using a driver: docker secret create --driver my-driver my_secret","If you actually have literal secret data, remove --driver and pass the file or stdin: docker secret create my_secret ./secret.txt","If you meant Go/EJS templating of secret content, use --template-driver instead of --driver (template-driver still takes secret data)"],"exampleFix":"# before\necho \"supersecret\" | docker secret create --driver vault my_secret -\n\n# after (driver-managed: no data)\ndocker secret create --driver vault my_secret\n# or (literal data: no driver)\necho \"supersecret\" | docker secret create my_secret -","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker-cli","swarm","secrets","flag-validation"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}