{"id":"434314a7389a98b2","repo":"docker/cli","slug":"invalid-credential-spec-value-must-be-prefixed-wi","errorCode":null,"errorMessage":"invalid credential spec: value must be prefixed with \"config://\", \"file://\", or \"registry://\"","messagePattern":"invalid credential spec: value must be prefixed with \"config://\", \"file://\", or \"registry://\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/service/opts.go","lineNumber":401,"sourceCode":"\t\t// Therefore, this isn't the definitive location for the value of\n\t\t// Config that is passed to the API.\n\t\tc.value = &swarm.CredentialSpec{\n\t\t\tConfig: val,\n\t\t}\n\t\treturn nil\n\tcase credentialSpecFile:\n\t\tc.value = &swarm.CredentialSpec{\n\t\t\tFile: val,\n\t\t}\n\t\treturn nil\n\tcase credentialSpecRegistry:\n\t\tc.value = &swarm.CredentialSpec{\n\t\t\tRegistry: val,\n\t\t}\n\t\treturn nil\n\tdefault:\n\t\tc.value = &swarm.CredentialSpec{}\n\t\treturn errors.New(`invalid credential spec: value must be prefixed with \"config://\", \"file://\", or \"registry://\"`)\n\t}\n}\n\nfunc (*credentialSpecOpt) Type() string {\n\treturn \"credential-spec\"\n}\n\nfunc (c *credentialSpecOpt) String() string {\n\treturn c.source\n}\n\nfunc (c *credentialSpecOpt) Value() *swarm.CredentialSpec {\n\treturn c.value\n}\n\nfunc resolveNetworkID(ctx context.Context, apiClient client.NetworkAPIClient, networkIDOrName string) (string, error) {\n\tres, err := apiClient.NetworkInspect(ctx, networkIDOrName, client.NetworkInspectOptions{Scope: \"swarm\"})\n\tif err != nil {","sourceCodeStart":383,"sourceCodeEnd":419,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/service/opts.go#L383-L419","documentation":"Raised by credentialSpecOpt.Set when parsing --credential-spec for `docker service create/update`. Credential specs (used for Windows gMSA / Active Directory identity) must name their source with one of three URI-style prefixes: config:// (a swarm config), file:// (a file under the daemon's CredentialSpecs directory), or registry:// (a Windows registry key). Any other prefix or a bare value is rejected.","triggerScenarios":"`docker service create --credential-spec ./spec.json ...` or `--credential-spec mycred` — any value not starting with config://, file://, or registry://; also typos like files:// or a missing prefix in compose `credential_spec` translation scripts.","commonSituations":"Windows Swarm gMSA setups where operators pass a raw host path to the JSON credential spec instead of `file://name.json` (the file:// form is relative to the daemon's CredentialSpecs directory, not an arbitrary path), or migrating from docker run's --security-opt syntax which differs.","solutions":["Prefix the value correctly, e.g. `--credential-spec 'file://spec.json'` with the file placed in the daemon's CredentialSpecs directory (C:\\ProgramData\\docker\\CredentialSpecs on Windows).","To source from a swarm config, create it first (`docker config create credspec spec.json`) and use `--credential-spec 'config://credspec'`.","Use `registry://<key>` if the spec is stored in the Windows registry under HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Virtualization\\Containers\\CredentialSpecs."],"exampleFix":"# before\ndocker service create --credential-spec C:\\\\specs\\\\gmsa.json myimage\n# after\ndocker service create --credential-spec 'file://gmsa.json' myimage  # file lives in daemon's CredentialSpecs dir","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker-cli","swarm","services","credential-spec","windows","gmsa","input-validation"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}