docker/cli · error

secret file is required

Error message

secret file is required

What it means

Thrown by readSecretData when no external driver is set and the fileName argument is empty (secret/create.go lines 137-138). Without a driver, the CLI requires an explicit data source (a file path or '-' for stdin); providing only the secret name is insufficient.

Solutions

1. Provide a file path as the second argument: 'docker secret create mysecret ./secret.txt'.
2. Use '-' to read from stdin: 'printf %s "$VAL" | docker secret create mysecret -'.
3. Or specify --driver if the secret is externally managed.

Example fix

# before
docker secret create mysecret
# after
printf '%s' "$VAL" | docker secret create mysecret -

// Require a data source (file or '-') when no driver is set
if options.driver == "" && options.file == "" {
    return fmt.Errorf("provide a secret file or '-' for stdin, or use --driver")
}

When it happens

Trigger: Running 'docker secret create mysecret' with only the name argument and no --driver, no file, and no '-' for stdin.

Common situations: Forgetting the data source argument; assuming stdin is read by default; command-arg parsing dropping the second argument.

Related errors

• when using secret driver secret data must be empty
• error reading from STDIN: data is empty
• node ID not found in /info
• invalid field ' ' must be a key=value pair
• every ip-range or gateway must have a corresponding subnet

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/b136053dbb392238. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/secret/create.go:138

// readSecretData reads the secret from either stdin or the given fileName.
//
// It reads up to twice the maximum size of the secret ([maxSecretSize]),
// just in case swarm's limit changes; this is only a safeguard to prevent
// reading arbitrary files into memory.
func readSecretData(in io.Reader, fileName string) ([]byte, error) {
	switch fileName {
	case "-":
		data, err := io.ReadAll(io.LimitReader(in, 2*maxSecretSize))
		if err != nil {
			return nil, fmt.Errorf("error reading from STDIN: %w", err)
		}
		if len(data) == 0 {
			return nil, errors.New("error reading from STDIN: data is empty")
		}
		return data, nil
	case "":
		return nil, errors.New("secret file is required")
	default:
		// Open file with [FILE_FLAG_SEQUENTIAL_SCAN] on Windows, which
		// prevents Windows from aggressively caching it. We expect this
		// file to be only read once. Given that this is expected to be
		// a small file, this may not be a significant optimization, so
		// we could choose to omit this, and use a regular [os.Open].
		//
		// [FILE_FLAG_SEQUENTIAL_SCAN]: https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea#FILE_FLAG_SEQUENTIAL_SCAN
		f, err := sequential.Open(fileName)
		if err != nil {
			return nil, fmt.Errorf("error reading from %s: %w", fileName, err)
		}
		defer f.Close()
		data, err := io.ReadAll(io.LimitReader(f, 2*maxSecretSize))
		if err != nil {
			return nil, fmt.Errorf("error reading from %s: %w", fileName, err)
		}
		if len(data) == 0 {

View on GitHub (pinned to 4f84911bfe)