docker/cli · error

when using secret driver secret data must be empty

Error message

when using secret driver secret data must be empty

What it means

Thrown by runSecretCreate when an external secret driver (--driver) is specified AND a file/data argument is also provided. External secret drivers manage their own data store, so supplying inline secret data alongside a driver is contradictory (secret/create.go lines 75-78).

Solutions

1. Drop the file/stdin argument when using --driver.
2. Use 'docker secret create --driver mydriver mysecret' (name only).
3. If you need inline data, omit --driver entirely.

Example fix

# before
docker secret create --driver mydriver mysecret ./data.txt
# after
docker secret create --driver mydriver mysecret

// Enforce mutual exclusivity of driver and data source
if options.driver != "" && options.file != "" {
    return fmt.Errorf("--driver and a data file are mutually exclusive")
}

When it happens

Trigger: Running 'docker secret create --driver mydriver mysecret ./data.txt' (both a driver and a data source).

Common situations: Copying a file-based secret command and appending --driver without removing the file argument; misunderstanding that driver-backed secrets are externally sourced.

Related errors

• error reading from STDIN: data is empty
• secret file is required
• node ID not found in /info
• invalid field ' ' must be a key=value pair
• every ip-range or gateway must have a corresponding subnet

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/0fa32e9cbc221285. Report an issue: GitHub.

Appendix: source

Thrown at cli/command/secret/create.go:77

		DisableFlagsInUseLine: true,
	}
	flags := cmd.Flags()
	flags.VarP(&options.labels, "label", "l", "Secret labels")
	flags.StringVarP(&options.driver, "driver", "d", "", "Secret driver")
	flags.SetAnnotation("driver", "version", []string{"1.31"})
	flags.StringVar(&options.templateDriver, "template-driver", "", "Template driver")
	flags.SetAnnotation("template-driver", "version", []string{"1.37"})

	return cmd
}

func runSecretCreate(ctx context.Context, dockerCLI command.Cli, options createOptions) error {
	apiClient := dockerCLI.Client()

	var secretData []byte
	if options.driver != "" {
		if options.file != "" {
			return errors.New("when using secret driver secret data must be empty")
		}
	} else {
		var err error
		secretData, err = readSecretData(dockerCLI.In(), options.file)
		if err != nil {
			return err
		}
	}

	spec := swarm.SecretSpec{
		Annotations: swarm.Annotations{
			Name:   options.name,
			Labels: opts.ConvertKVStringsToMap(options.labels.GetSlice()),
		},
		Data: secretData,
	}
	if options.driver != "" {
		spec.Driver = &swarm.Driver{

View on GitHub (pinned to 4f84911bfe)