{"id":"ab5e75635cc2035f","repo":"docker/cli","slug":"error-reading-from-stdin-data-is-empty-ab5e75","errorCode":null,"errorMessage":"error reading from STDIN: data is empty","messagePattern":"error reading from STDIN: data is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/secret/create.go","lineNumber":134,"sourceCode":"// as defined by [MaxSecretSize] in SwarmKit.\n//\n// [MaxSecretSize]: https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/api/validation#MaxSecretSize\nconst maxSecretSize = 500 * 1024 // 500KB\n\n// readSecretData reads the secret from either stdin or the given fileName.\n//\n// It reads up to twice the maximum size of the secret ([maxSecretSize]),\n// just in case swarm's limit changes; this is only a safeguard to prevent\n// reading arbitrary files into memory.\nfunc readSecretData(in io.Reader, fileName string) ([]byte, error) {\n\tswitch fileName {\n\tcase \"-\":\n\t\tdata, err := io.ReadAll(io.LimitReader(in, 2*maxSecretSize))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading from STDIN: %w\", err)\n\t\t}\n\t\tif len(data) == 0 {\n\t\t\treturn nil, errors.New(\"error reading from STDIN: data is empty\")\n\t\t}\n\t\treturn data, nil\n\tcase \"\":\n\t\treturn nil, errors.New(\"secret file is required\")\n\tdefault:\n\t\t// Open file with [FILE_FLAG_SEQUENTIAL_SCAN] on Windows, which\n\t\t// prevents Windows from aggressively caching it. We expect this\n\t\t// file to be only read once. Given that this is expected to be\n\t\t// a small file, this may not be a significant optimization, so\n\t\t// we could choose to omit this, and use a regular [os.Open].\n\t\t//\n\t\t// [FILE_FLAG_SEQUENTIAL_SCAN]: https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea#FILE_FLAG_SEQUENTIAL_SCAN\n\t\tf, err := sequential.Open(fileName)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"error reading from %s: %w\", fileName, err)\n\t\t}\n\t\tdefer f.Close()\n\t\tdata, err := io.ReadAll(io.LimitReader(f, 2*maxSecretSize))","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cli/command/secret/create.go#L116-L152","documentation":"Raised by readSecretData in the docker CLI when `docker secret create NAME -` is used (file argument \"-\" means read from STDIN) and STDIN yields zero bytes after io.ReadAll. Swarm secrets cannot be empty, so the CLI fails fast instead of creating a useless empty secret. The read is capped at 2x maxSecretSize (1MB) as a safety limit.","triggerScenarios":"Running `docker secret create mysecret -` with no data piped to STDIN, with a closed/empty STDIN, or from a script where the upstream pipe produced nothing (e.g. `echo -n \"\" | docker secret create s -`, a failed command substitution, or an empty file redirected in).","commonSituations":"CI pipelines where the secret value comes from an unset environment variable (`echo \"$SECRET\" | ...` with SECRET empty), running the command interactively and forgetting the CLI expects piped input, or a preceding command in the pipe failing silently and emitting nothing.","solutions":["Verify the pipe actually carries data: `printf 'value' | docker secret create mysecret -`.","In scripts, guard against empty variables before piping: `[ -n \"$SECRET\" ] || exit 1`.","If the value is in a file, pass the file path instead of `-`: `docker secret create mysecret ./secret.txt`.","Check that the upstream command in the pipeline succeeded (set -o pipefail)."],"exampleFix":"# before (SECRET unset -> empty stdin)\necho \"$SECRET\" | docker secret create db_pass -\n# after\n: \"${SECRET:?SECRET must be set}\"\nprintf '%s' \"$SECRET\" | docker secret create db_pass -","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":["docker-cli","swarm","secrets","stdin","input-validation"],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}