docker/cli · error

error reading from : data is empty

Error message

error reading from %s: data is empty

What it means

Returned by readSecretData (secret/create.go:157) when the file was opened and read successfully but yielded zero bytes. A swarm secret must carry non-empty data, so an empty file is rejected explicitly with the filename interpolated.

Solutions

1. Confirm the file actually contains the secret payload (`wc -c file`).
2. Regenerate the secret file if it is unexpectedly empty.
3. Point the command at the correct non-empty file.

Example fix

// before
docker secret create mysecret /tmp/empty.txt
// after
printf 's3cr3t' > /tmp/secret.txt && docker secret create mysecret /tmp/secret.txt

// Reject empty secret files before calling create.
func validateSecretNonEmpty(path string) error {
    fi, err := os.Stat(path)
    if err != nil { return err }
    if fi.Size() == 0 { return errors.New("secret file is empty") }
    return nil
}

// nonEmptyFile reports whether path exists and has size > 0.
func nonEmptyFile(path string) bool {
    fi, err := os.Stat(path)
    return err == nil && fi.Size() > 0
}

When it happens

Trigger: Running `docker secret create mysecret emptyfile` where emptyfile is a zero-length file, or piping an empty stdin (note: stdin's empty case uses a different message at create.go:134).

Common situations: Generating a secret file that produced no output, pointing at the wrong (empty) file, or a truncated template that rendered to nothing.

Related errors

• error reading from
• error reading from STDIN
• invalid generic-resource format
• invalid generic resource specification
• invalid generic-resource request

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/a89af2deaaa9eddc. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/secret/create.go:157

	default:
		// Open file with [FILE_FLAG_SEQUENTIAL_SCAN] on Windows, which
		// prevents Windows from aggressively caching it. We expect this
		// file to be only read once. Given that this is expected to be
		// a small file, this may not be a significant optimization, so
		// we could choose to omit this, and use a regular [os.Open].
		//
		// [FILE_FLAG_SEQUENTIAL_SCAN]: https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea#FILE_FLAG_SEQUENTIAL_SCAN
		f, err := sequential.Open(fileName)
		if err != nil {
			return nil, fmt.Errorf("error reading from %s: %w", fileName, err)
		}
		defer f.Close()
		data, err := io.ReadAll(io.LimitReader(f, 2*maxSecretSize))
		if err != nil {
			return nil, fmt.Errorf("error reading from %s: %w", fileName, err)
		}
		if len(data) == 0 {
			return nil, fmt.Errorf("error reading from %s: data is empty", fileName)
		}
		return data, nil
	}
}

View on GitHub (pinned to 4f84911bfe)