docker/cli · error

error reading from STDIN: data is empty

Error message

error reading from STDIN: data is empty

What it means

Raised by readSecretData in the docker CLI when `docker secret create NAME -` is used (file argument "-" means read from STDIN) and STDIN yields zero bytes after io.ReadAll. Swarm secrets cannot be empty, so the CLI fails fast instead of creating a useless empty secret. The read is capped at 2x maxSecretSize (1MB) as a safety limit.

Source

Thrown at cli/command/secret/create.go:134

// as defined by [MaxSecretSize] in SwarmKit.
//
// [MaxSecretSize]: https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/api/validation#MaxSecretSize
const maxSecretSize = 500 * 1024 // 500KB

// readSecretData reads the secret from either stdin or the given fileName.
//
// It reads up to twice the maximum size of the secret ([maxSecretSize]),
// just in case swarm's limit changes; this is only a safeguard to prevent
// reading arbitrary files into memory.
func readSecretData(in io.Reader, fileName string) ([]byte, error) {
	switch fileName {
	case "-":
		data, err := io.ReadAll(io.LimitReader(in, 2*maxSecretSize))
		if err != nil {
			return nil, fmt.Errorf("error reading from STDIN: %w", err)
		}
		if len(data) == 0 {
			return nil, errors.New("error reading from STDIN: data is empty")
		}
		return data, nil
	case "":
		return nil, errors.New("secret file is required")
	default:
		// Open file with [FILE_FLAG_SEQUENTIAL_SCAN] on Windows, which
		// prevents Windows from aggressively caching it. We expect this
		// file to be only read once. Given that this is expected to be
		// a small file, this may not be a significant optimization, so
		// we could choose to omit this, and use a regular [os.Open].
		//
		// [FILE_FLAG_SEQUENTIAL_SCAN]: https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea#FILE_FLAG_SEQUENTIAL_SCAN
		f, err := sequential.Open(fileName)
		if err != nil {
			return nil, fmt.Errorf("error reading from %s: %w", fileName, err)
		}
		defer f.Close()
		data, err := io.ReadAll(io.LimitReader(f, 2*maxSecretSize))

View on GitHub (pinned to e9452d6e78)

Solutions

1. Verify the pipe actually carries data: `printf 'value' | docker secret create mysecret -`.
2. In scripts, guard against empty variables before piping: `[ -n "$SECRET" ] || exit 1`.
3. If the value is in a file, pass the file path instead of `-`: `docker secret create mysecret ./secret.txt`.
4. Check that the upstream command in the pipeline succeeded (set -o pipefail).

Example fix

# before (SECRET unset -> empty stdin)
echo "$SECRET" | docker secret create db_pass -
# after
: "${SECRET:?SECRET must be set}"
printf '%s' "$SECRET" | docker secret create db_pass -

When it happens

Trigger: Running `docker secret create mysecret -` with no data piped to STDIN, with a closed/empty STDIN, or from a script where the upstream pipe produced nothing (e.g. `echo -n "" | docker secret create s -`, a failed command substitution, or an empty file redirected in).

Common situations: CI pipelines where the secret value comes from an unset environment variable (`echo "$SECRET" | ...` with SECRET empty), running the command interactively and forgetting the CLI expects piped input, or a preceding command in the pipe failing silently and emitting nothing.

Related errors

• secret file is required
• when using secret driver secret data must be empty
• placement preference must be of the format "<strategy>=<arg>
• invalid credential spec: value must be prefixed with "config
• error reading from STDIN: data is empty

AI-assisted analysis of docker/cli@e9452d6e78 (2026-08-01). Data as JSON: /data/errors/ab5e75635cc2035f.json. Report an issue: GitHub.