`podman secret create` needlessly requires a pipe for stdin

[matthijskooijman]

Issue Description

When you run podman secret create name_of_secret -, then it explicitly checks if stdin is a pipe, and otherwise shows an error message. This is needlessly restrictive (and I cannot actually see why this check is in place at all - it seems to have been there since secrets were first added).

$ podman secret create foo -
Error: if `-` is used, data must be passed into stdin

The current code restricts the input into a pipe, which encourages people to use a command like:

echo "my_secret" | podman secret create foo -

This is problematic, because the secret is now exposed in:

• .bash_history
• The running process list (only briefly, but other users on the same system could feasibly watch for these processes and capture the secret).

Additionally, this pattern ends up with a trailing newline in the secret, which might bite you in subtle ways (it did me just now).

What I would like to do, is generate/look up a secret somewhere, copy it into my clipboard, and then run podman secret create name_of_secret -, paste the secret into the terminal and then terminate with ^D (maybe twice).

This method of pasting the secret into the stdin of podman suffers from none of the above problems.

This restriction is implemented here:

podman/cmd/podman/secrets/create.go

Lines 89 to 91 in 78456c1

	if (stat.Mode() & os.ModeNamedPipe) == 0 {
	return errors.New("if `-` is used, data must be passed into stdin")
	}

As a workaround, you can now already use either of these:

cat | podman secret create foo -
podman secret create foo //dev/stdin

podman info output

host:
  arch: amd64
  buildahVersion: 1.42.1
  cgroupControllers:
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon_2.1.12-4_amd64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.12, commit: unknown'
  cpuUtilization:
    idlePercent: 97.91
    systemPercent: 0.45
    userPercent: 1.64
  cpus: 22
  databaseBackend: sqlite
  distribution:
    codename: plucky
    distribution: ubuntu
    version: "25.04"
  eventLogger: journald
  freeLocks: 2048
  hostname: zozo
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 6.14.0-36-generic
  linkmode: dynamic
  logDriver: journald
  memFree: 4379004928
  memTotal: 32511954944
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns_1.12.2-2_amd64
      path: /usr/lib/podman/aardvark-dns
      version: aardvark-dns 1.12.2
    package: netavark_1.12.1-9_amd64
    path: /usr/lib/podman/netavark
    version: netavark 1.12.1
  ociRuntime:
    name: runc
    package: runc_1.3.3-0ubuntu1~25.04.3_amd64
    path: /usr/bin/runc
    version: |-
      runc version 1.3.3-0ubuntu1~25.04.3
      spec: 1.2.1
      go: go1.24.2
      libseccomp: 2.5.5
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt_0.0~git20250217.a1e48a0-1_amd64
    version: ""
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns_1.2.1-1build2_amd64
    version: |-
      slirp4netns version 1.2.1
      commit: 09e31e92fa3d2a1d3ca261adaeb012c8d75a8194
      libslirp: 4.8.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.5
  swapFree: 27163275264
  swapTotal: 34359734272
  uptime: 599h 25m 50.00s (Approximately 24.96 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries: {}
store:
  configFile: /home/matthijs/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/matthijs/.local/share/containers/storage
  graphRootAllocated: 1055742447616
  graphRootUsed: 974458167296
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 0
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/matthijs/.local/share/containers/storage/volumes
version:
  APIVersion: 5.7.0
  BuildOrigin: Debian
  Built: 1764725792
  BuiltTime: Wed Dec  3 02:36:32 2025
  GitCommit: ""
  GoVersion: go1.24.9
  Os: linux
  OsArch: linux/amd64
  Version: 5.7.0

[matthijskooijman]

Just noticed this was previously mentioned as part of another issue as well. Consensus there (in 2023) was that removing the check would be fine, PR welcome: #18591 (comment)

[danishprakash]

I just realised I had taken up that issue way back and implemented it partly. If you're planning to open a PR for this, feel free to go ahead, else I can open one.

[matthijskooijman]

@danishprakash I have no plans (mostly no time) to pick this up soon or at all, so if you want to, please do. I'll gladly review if you tag me :-)