docker/cli · error

conflicting options: cannot specify both --password and --pa

Error message

conflicting options: cannot specify both --password and --password-stdin

What it means

Raised by verifyLoginFlags (cli/command/registry/login.go:77) during flag validation of `docker login`. The command received both an explicit --password value and a request to read the password from stdin (--password-stdin, or the shorthand --password -). These are mutually exclusive sources for the same secret, so the CLI refuses to guess which one wins.

Source

Thrown at cli/command/registry/login.go:77

		DisableFlagsInUseLine: true,
	}

	flags := cmd.Flags()

	flags.StringVarP(&opts.user, "username", "u", "", "Username")
	flags.StringVarP(&opts.password, "password", "p", "", `Password or Personal Access Token (PAT), or "-" to read from stdin`)
	flags.BoolVar(&opts.passwordStdin, "password-stdin", false, "Take the Password or Personal Access Token (PAT) from stdin")

	return cmd
}

// verifyLoginFlags validates flags set on the command.
//
// TODO(thaJeztah); combine with verifyLoginOptions, but this requires rewrites of many tests.
func verifyLoginFlags(flags *pflag.FlagSet, opts loginOptions) error {
	if flags.Changed("password-stdin") || opts.password == "-" {
		if flags.Changed("password") && opts.password != "-" {
			return errors.New("conflicting options: cannot specify both --password and --password-stdin")
		}
		if !flags.Changed("username") {
			return errors.New("the --password-stdin option requires --username to be set")
		}
	}
	if flags.Changed("username") && opts.user == "" {
		return errors.New("username is empty")
	}
	if flags.Changed("password") && opts.password == "" {
		return errors.New("password is empty")
	}
	return nil
}

// readSecretFromStdin reads the secret from r and returns it as a string.
// It trims terminal line-endings (LF, CRLF, or CR), which may be added when
// inputting interactively or piping input. The value is otherwise treated as
// opaque, preserving any other whitespace, including newlines, per [NIST SP 800-63B §5.1.1.2].

View on GitHub (pinned to e9452d6e78)

Solutions

1. Remove the --password/-p flag and keep --password-stdin: echo "$PASSWORD" | docker login -u user --password-stdin
2. If stdin is not available in your environment, drop --password-stdin and use -p (accepting the insecure-CLI warning)
3. Audit CI templates/wrappers so exactly one password source is configured

Example fix

# before
echo "$PW" | docker login -u user -p "$PW" --password-stdin registry.example.com

# after
echo "$PW" | docker login -u user --password-stdin registry.example.com

When it happens

Trigger: docker login -u user --password secret --password-stdin; docker login -u user -p secret --password-stdin < token.txt. Note that `-p -` alone is treated as --password-stdin and does NOT trigger this error — only a non-'-' password combined with --password-stdin does.

Common situations: CI pipelines where a shared login step appends --password-stdin while a job also injects -p from a template; migrating scripts from the insecure -p pattern to --password-stdin and forgetting to remove the old flag; wrapper scripts that unconditionally add both flags.

Related errors

• the --password-stdin option requires --username to be set
• username is empty
• password is empty
• error: cannot perform an interactive login from a non-TTY de
• error: username is required

AI-assisted analysis of docker/cli@e9452d6e78 (2026-08-01). Data as JSON: /data/errors/bf5a4dc0865f9097.json. Report an issue: GitHub.