docker/cli · error

error reading from STDIN: data is empty

Error message

error reading from STDIN: data is empty

What it means

Raised by readConfigData in cli/command/config/create.go when `docker config create` is told to read the config payload from stdin (file argument "-") but stdin yields zero bytes. Swarm configs must carry content, so an empty payload is rejected before any API call is made.

Source

Thrown at cli/command/config/create.go:118

// as defined by [MaxConfigSize] in SwarmKit.
//
// [MaxConfigSize]: https://pkg.go.dev/github.com/moby/swarmkit/v2@v2.0.0-20250103191802-8c1959736554/manager/controlapi#MaxConfigSize
const maxConfigSize = 1000 * 1024 // 1000KB

// readConfigData reads the config from either stdin or the given fileName.
//
// It reads up to twice the maximum size of the config ([maxConfigSize]),
// just in case swarm's limit changes; this is only a safeguard to prevent
// reading arbitrary files into memory.
func readConfigData(in io.Reader, fileName string) ([]byte, error) {
	switch fileName {
	case "-":
		data, err := io.ReadAll(io.LimitReader(in, 2*maxConfigSize))
		if err != nil {
			return nil, fmt.Errorf("error reading from STDIN: %w", err)
		}
		if len(data) == 0 {
			return nil, errors.New("error reading from STDIN: data is empty")
		}
		return data, nil
	case "":
		return nil, errors.New("config file is required")
	default:
		// Open file with [FILE_FLAG_SEQUENTIAL_SCAN] on Windows, which
		// prevents Windows from aggressively caching it. We expect this
		// file to be only read once. Given that this is expected to be
		// a small file, this may not be a significant optimization, so
		// we could choose to omit this, and use a regular [os.Open].
		//
		// [FILE_FLAG_SEQUENTIAL_SCAN]: https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea#FILE_FLAG_SEQUENTIAL_SCAN
		f, err := sequential.Open(fileName)
		if err != nil {
			return nil, fmt.Errorf("error reading from %s: %w", fileName, err)
		}
		defer f.Close()
		data, err := io.ReadAll(io.LimitReader(f, 2*maxConfigSize))

View on GitHub (pinned to e9452d6e78)

Solutions

1. Verify the data you are piping is non-empty before invoking docker: `test -s config.txt` or inspect the generator's output first.
2. Fix the producing command in the pipeline (check its exit code and stdout — output going to stderr is not piped).
3. If the content lives in a file, pass the filename directly instead of piping: `docker config create myconfig ./config.txt`.

Example fix

# before (generator wrote to stderr, stdin empty)
some-generator 2>&1 >/dev/null | docker config create app-config -
# after
some-generator > config.txt
test -s config.txt
docker config create app-config ./config.txt

When it happens

Trigger: Running `docker config create <name> -` with nothing piped to stdin, piping a command that produces no output (e.g. an empty file via `cat empty | docker config create name -`), or a redirect from a zero-byte file.

Common situations: CI scripts where the upstream command generating the config (envsubst, jq, vault read) failed silently or printed to stderr instead of stdout; heredocs with wrong delimiters; running the command interactively and immediately hitting Ctrl-D; a pipeline stage whose file path variable expanded to an empty file.

Related errors

• config file is required
• cannot supply extra formatting options to the pretty templat
• content size not available for stdin
• invalid argument: can't use stdin for both build context and
• requested load from stdin, but stdin is empty

AI-assisted analysis of docker/cli@e9452d6e78 (2026-08-01). Data as JSON: /data/errors/ae64a524d4684d3b.json. Report an issue: GitHub.