src/windows/wslc/services/ImageService.cpp:190

• WSLCBuildSecret.ValueSize is a ULONG, but this code blindly casts secret.Value.size() (size_t) to ULONG. For secrets larger than 4GiB this truncates the size sent to the service, potentially causing incorrect/partial writes or undefined behavior during marshaling. Add an explicit size check and fail fast before populating WSLCBuildSecret.

        secretEntries.push_back(WSLCBuildSecret{
            .Id = secretIdStrings.back().c_str(),
            .Value = secret.Value.empty() ? nullptr : secret.Value.data(),
            .ValueSize = static_cast<ULONG>(secret.Value.size()),
        });

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:364

• This secret test creates a unique build context directory, which contradicts the SharedSecretBuildContext rationale above (virtiofs share slots are not released for the session lifetime). Reuse SharedSecretBuildContext here too to avoid exhausting share slots across the secret test suite.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:498

• This secret test creates a unique build context directory, which contradicts the SharedSecretBuildContext rationale above (virtiofs share slots are not released for the session lifetime). Reuse SharedSecretBuildContext here too to avoid exhausting share slots across the secret test suite.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:695

• This secret test creates a unique build context directory, which contradicts the SharedSecretBuildContext rationale above (virtiofs share slots are not released for the session lifetime). Reuse SharedSecretBuildContext here too to avoid exhausting share slots across the secret test suite.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:363

• These secret E2E tests are intended to reuse SharedSecretBuildContext() to avoid exhausting per-session virtiofs share slots (per the comment above), but this test creates a per-test context directory instead. That can still consume an additional share slot and make the suite flaky as more secret tests are added.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:497

• This secret E2E test still creates and mounts a per-test context directory instead of reusing SharedSecretBuildContext(). That undermines the intent to limit virtiofs share consumption across the secret test suite and can lead to share-slot exhaustion over the session lifetime.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:694

• This secret E2E test mounts a unique per-test context directory rather than reusing SharedSecretBuildContext(), which can consume an additional virtiofs share slot for the session lifetime and make the overall secret test suite less reliable.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

src/windows/wslcsession/WSLCSession.cpp:1028

• WSLCSession::BuildImage validates secret.Id only for leading '-' and the presence of ','/'=' before interpolating it into docker's --secret spec. Because this is an API boundary (COM), callers other than the CLI can pass ids containing whitespace or other punctuation that Docker may reject or interpret unexpectedly. Consider validating the id character set to match the CLI validation (letters/digits plus '_', '-', '.') for defense-in-depth and consistent behavior.

        // Id is interpolated into docker's comma/'='-delimited --secret spec below, so reject any ','
        // or '=' a malicious caller could use to inject extra options.
        RETURN_HR_IF(E_INVALIDARG, std::string_view(secret.Id).find_first_of(",=") != std::string_view::npos);

src/windows/wslc/arguments/ArgumentValidation.cpp:233

• ParseSecretSpec accepts empty values for keys like 'type=', 'env=', or 'src=' (e.g. id=x,type=), which then get treated as if the key was omitted and can silently fall back to env-var resolution. That makes malformed --secret specs behave unexpectedly and diverges from typical Docker error handling for invalid secret specs.

        auto key = part.substr(0, eq);
        auto value = part.substr(eq + 1);

src/windows/wslcsession/WSLCSession.cpp:1029

• WSLCSession::BuildImage validates secret.Id only for emptiness, leading '-', and the presence of ','/'='. Since the id is interpolated into docker's --secret id=...,src=... spec, allowing other characters (e.g. whitespace/control chars) can still produce invalid docker invocations and inconsistent behavior between CLI callers and direct COM callers. Consider enforcing the same allowed character set as the CLI parser (letters/digits/_/-/.).

        RETURN_HR_IF(E_INVALIDARG, secret.Id[0] == '\0');
        RETURN_HR_IF(E_INVALIDARG, secret.Id[0] == '-');
        // Id is interpolated into docker's comma/'='-delimited --secret spec below, so reject any ','
        // or '=' a malicious caller could use to inject extra options.
        RETURN_HR_IF(E_INVALIDARG, std::string_view(secret.Id).find_first_of(",=") != std::string_view::npos);
        RETURN_HR_IF(E_INVALIDARG, secret.ValueSize != 0 && secret.Value == nullptr);

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:364

• This secret test creates a unique context directory instead of using SharedSecretBuildContext(). Since virtiofs shares are not released for the session lifetime, distinct context paths can exhaust the share slot budget across the secret test suite.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:498

• This secret test creates a unique context directory instead of using SharedSecretBuildContext(). Since virtiofs shares are not released for the session lifetime, distinct context paths can exhaust the share slot budget across the secret test suite.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:695

• This secret test creates a unique context directory instead of using SharedSecretBuildContext(). Since virtiofs shares are not released for the session lifetime, distinct context paths can exhaust the share slot budget across the secret test suite.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:363

• This test creates a unique context directory, but the file header comment says all secret tests must reuse a single shared context to avoid exhausting virtiofs share slots for the session lifetime. Reuse SharedSecretBuildContext() here as well so repeated secret tests don’t permanently consume additional share slots.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:497

• This secret test creates a per-test build context directory, but the shared-context helper above exists specifically to prevent exhausting the session’s limited virtiofs share slots. Using SharedSecretBuildContext() here avoids permanently consuming another share slot.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:694

• This secret test uses a unique context directory even though the class comment states all secret builds should reuse SharedSecretBuildContext() to avoid exhausting virtiofs share slots. Switching to the shared context keeps the session from permanently consuming additional mounts.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

src/windows/wslc/arguments/ArgumentValidation.cpp:116

• Argument validation currently calls ParseSecretSpec(), which materializes the secret bytes (including reading src= files). BuildImage() later calls ParseSecretSpec() again to actually send the bytes to the service, so file/env secrets get read twice and validation can fail if the file changes/disappears after validation. Consider splitting this into a lightweight ValidateSecretSpec() (syntax/keys/type/id checks only) and doing the actual byte materialization only once in the build path.

    case ArgType::Since:
        validation::ValidateTimestamp(execArgs.GetAll<ArgType::Since>(), m_name);
        break;

    case ArgType::Until:
        validation::ValidateTimestamp(execArgs.GetAll<ArgType::Until>(), m_name);

src/windows/wslc/arguments/ArgumentValidation.cpp:109

• ArgType::Secret validation currently calls ParseSecretSpec(), which resolves the secret (reads files / env vars). The build path (ImageTasks::BuildImage) parses secrets again to actually forward them, so file/env secrets get read twice and can hit TOCTOU issues (file modified/deleted between validation and execution) and unnecessary I/O.

    case ArgType::Secret:
    {
        for (const auto& spec : execArgs.GetAll<ArgType::Secret>())
        {
            std::ignore = validation::ParseSecretSpec(spec);
        }
        break;
    }

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:364

• These failing secret tests create a unique contextDir, which will be mounted into the VM and consume an additional virtiofs share slot for the whole session (WSLCVirtualMachine::UnmountWindowsFolder keeps shares mounted in virtiofs mode). To avoid exhausting share slots, reuse SharedSecretBuildContext() here as well, since the Dockerfile is already streamed via -f.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:498

• This test creates a per-test contextDir that will be mounted and consume a virtiofs share slot for the session lifetime (UnmountWindowsFolder keeps shares mounted under virtiofs). Since the Dockerfile is streamed via -f, reuse SharedSecretBuildContext() to avoid share-slot exhaustion as more tests are added.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:695

• Like the other secret tests, this failure-case test mounts a unique contextDir into the VM, consuming another virtiofs share slot for the whole session (virtiofs shares are intentionally kept mounted in UnmountWindowsFolder). Reuse SharedSecretBuildContext() to keep share usage bounded.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

src/windows/wslc/arguments/ArgumentValidation.cpp:106

• ArgType::Secret validation currently calls ParseSecretSpec(), which resolves the secret value (reads env var / reads the source file into memory). The build path later parses the same specs again to actually pass secrets to the service, so this can read secret sources twice and unnecessarily materialize secret bytes during argument validation.

    case ArgType::Secret:
    {
        for (const auto& spec : execArgs.GetAll<ArgType::Secret>())
        {
            std::ignore = validation::ParseSecretSpec(spec);

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:362

• These secret tests create a per-test context directory, which contradicts the SharedSecretBuildContext() comment and can still consume additional virtiofs share slots for the session lifetime. Use the shared context directory here as well to avoid share exhaustion/flaky runs.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:496

• This test creates a unique build context directory even though the file documents that secret tests must reuse a single shared context to avoid exhausting virtiofs share slots for the session lifetime. Reuse SharedSecretBuildContext() here too.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:689

• This secret test uses a per-test context directory, which can consume additional virtiofs share slots and contradicts the intent of SharedSecretBuildContext(). Switch to the shared context directory to keep secret tests from exhausting the share budget.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

src/windows/wslc/arguments/ArgumentValidation.cpp:109

• Argument::Validate currently calls ParseSecretSpec for ArgType::Secret, but BuildImage later calls ParseSecretSpec again to actually collect secrets. Because ParseSecretSpec resolves secret values (reads env vars and possibly reads secret files), this duplicates I/O and can make behavior depend on whether the env/file changed between validation and execution. Consider making validation syntax-only, or (simplest) don’t resolve secrets in Argument::Validate and let BuildImage be the single place that parses/resolves them.

    case ArgType::Secret:
    {
        for (const auto& spec : execArgs.GetAll<ArgType::Secret>())
        {
            std::ignore = validation::ParseSecretSpec(spec);
        }
        break;
    }

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:362

• This secret test creates a per-test context directory (unique host path). The file-level comment above explains that distinct context directories permanently consume virtiofs share slots for the session lifetime, so this can still contribute to exhausting the share budget. Reuse SharedSecretBuildContext() here as well (the Dockerfile is already passed via -f).

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:495

• This secret test creates a per-test context directory (unique host path). Since secret tests are intended to share a single context directory to avoid exhausting virtiofs share slots, this should also use SharedSecretBuildContext().

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

test/windows/wslc/e2e/WSLCE2EImageBuildTests.cpp:689

• This secret test creates a per-test context directory (unique host path). To match the SharedSecretBuildContext() rationale and avoid consuming additional virtiofs share slots, reuse the shared context here too.

        auto contextDir = testRoot / L"context";
        std::error_code ec;
        std::filesystem::create_directories(contextDir, ec);
        THROW_HR_IF(E_FAIL, ec.value() != 0 || !std::filesystem::exists(contextDir));

src/windows/wslcsession/WSLCSession.cpp:1052

• --secret support adds secret identifiers and internal src paths to buildArgs. BuildImageStart currently logs Join(buildArgs), so these identifiers/paths will be emitted to ETL/telemetry. Even though the secret bytes aren’t logged, IDs can still be sensitive; consider redacting the --secret payloads from the logged command string.

        buildArgs.push_back("--secret");
        buildArgs.push_back(std::format("id={},src={}", secret.Id, secretPath));