Add --secret flag to image build command

localization/strings/en-US/Resources.resw

@@ -2327,6 +2327,10 @@ For privacy information about this product please visit https://aka.ms/privacy.<
     <value>Image '{}' not found.</value>
     <comment>{FixedPlaceholder="{}"}Command line arguments, file names and string inserts should not be translated</comment>
   </data>
+  <data name="MessageWslcSecretInvalidSpec" xml:space="preserve">
+    <value>Invalid --secret value '{}': {}</value>
+    <comment>{FixedPlaceholder="{}"}{Locked="--secret "}Command line arguments, file names and string inserts should not be translated</comment>
+  </data>
   <data name = "MessageWslcMissingVolumeOption" xml:space = "preserve" >
     <value>Missing required option: '{}'</value>
     <comment>{FixedPlaceholder="{}"}Command line arguments, file names and string inserts should not be translated</comment>
@@ -2868,6 +2872,10 @@ On first run, creates the file with all settings commented out at their defaults
   <data name="WSLCCLI_BuildTargetArgDescription" xml:space="preserve">
     <value>Set the target build stage to build</value>
   </data>
+  <data name="WSLCCLI_SecretArgDescription" xml:space="preserve">
+    <value>Expose secret to the build (id=NAME[,type=env|file][,env=VAR|,src=PATH]; defaults to env var NAME)</value>
+    <comment>{Locked="id=NAME"}{Locked="type=env|file"}{Locked="env=VAR"}{Locked="src=PATH"}Command line arguments should not be translated</comment>
+  </data>
   <data name="WSLCCLI_CommandArgDescription" xml:space="preserve">
     <value>The command to run</value>
   </data>

src/windows/common/wslutil.cpp

@@ -1457,6 +1457,19 @@ void wsl::windows::common::wslutil::PrintMessage(_In_ const std::wstring& messag
     fwprintf(stream, L"%ls\n", message.c_str());
 }
 
+std::optional<std::wstring> wsl::windows::common::wslutil::ReadEnvironmentVariable(_In_ LPCWSTR Name)
+{
+    std::wstring value;
+    const HRESULT hr = wil::GetEnvironmentVariableW(Name, value);
+    if (hr == HRESULT_FROM_WIN32(ERROR_ENVVAR_NOT_FOUND))
+    {
+        return std::nullopt;
+    }
+
+    THROW_IF_FAILED(hr);
+    return value;
+}
+
 void wsl::windows::common::wslutil::SetCrtEncoding(int Mode)
 {
     // Configure the CRT to manipulate text as the specified mode.

src/windows/common/wslutil.h

@@ -311,6 +311,10 @@ void PrintMessage(_In_ const std::wstring& message, _Inout_ FILE* const stream =
     PrintMessageImpl(message, stream, std::forward<Args>(args)...);
 }
 
+// Reads an environment variable. Returns nullopt iff the variable is not defined; an engaged
+// (possibly empty) string otherwise.
+std::optional<std::wstring> ReadEnvironmentVariable(_In_ LPCWSTR Name);
+
 void SetCrtEncoding(int Mode);
 
 void SetThreadDescription(LPCWSTR Name);

src/windows/service/inc/wslc.idl

@@ -169,6 +169,22 @@ typedef struct _WSLCStringArray
     ULONG Count;
 } WSLCStringArray;
 
+typedef struct _WSLCBuildSecret
+{
+    [string] LPCSTR Id; // Value for docker's --secret id= field.
+    // Raw secret bytes (never cross into argv). Carried as a counted byte array so arbitrary binary
+    // content - including embedded NULs - round-trips losslessly; the server materializes it into a
+    // root-only tmpfs file inside the VM and references it with docker's --secret src=.
+    [unique, size_is(ValueSize)] const byte* Value;
+    ULONG ValueSize;
+} WSLCBuildSecret;
+
+typedef struct _WSLCBuildSecretArray
+{
+    [unique, size_is(Count)] const WSLCBuildSecret* Values;
+    ULONG Count;
+} WSLCBuildSecretArray;
+
 typedef struct _WSLCProcessOptions
 {
     [unique] LPCSTR CurrentDirectory;
@@ -523,6 +539,7 @@ typedef struct _WSLCBuildImageOptions
     LPCSTR Target;             // Target build stage name passed as --target to docker.
     WSLCBuildImageFlags Flags; // WSLCBuildImageFlags
     WSLCStringArray Labels;    // KEY=VALUE pairs passed as --label to docker.
+    WSLCBuildSecretArray Secrets; // --secret entries; the server writes each secret's bytes to a root-only tmpfs file in the VM and emits the corresponding id=...,src=... spec.
 } WSLCBuildImageOptions;
 
 typedef struct _WSLCTagImageOptions

src/windows/wslc/arguments/ArgumentDefinitions.h

@@ -105,6 +105,7 @@ _(PublishAll,     "publish-all",         L"P",              Kind::Flag,        L
 _(Quiet,          "quiet",               L"q",              Kind::Flag,        Localization::WSLCCLI_QuietArgDescription()) \
 _(Remove,         "rm",                  NO_ALIAS,          Kind::Flag,        Localization::WSLCCLI_RemoveArgDescription()) \
 /*_(Scheme,         "scheme",              NO_ALIAS,          Kind::Value,       Localization::WSLCCLI_SchemeArgDescription())*/ \
+_(Secret,         "secret",              NO_ALIAS,          Kind::Value,       Localization::WSLCCLI_SecretArgDescription()) \
 _(Server,         "server",              NO_ALIAS,          Kind::Positional,  Localization::WSLCCLI_LoginServerArgDescription()) \
 _(Session,        "session",             NO_ALIAS,          Kind::Value,       Localization::WSLCCLI_SessionIdArgDescription()) \
 _(ShmSize,        "shm-size",            NO_ALIAS,          Kind::Value,       Localization::WSLCCLI_ShmSizeArgDescription()) \