Secrets support

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+    "python-envs.defaultEnvManager": "ms-python.python:system"
+}

README.md

@@ -1,6 +1,6 @@
 # wslc-compose
 
-[![CI](https://github.com/bacarndiaye/wslc-compose/actions/workflows/ci.yml/badge.svg)](https://github.com/bacarndiaye/wslc-compose/actions/workflows/ci.yml)
+[![CI](https://github.com/yovannyr/wslc-compose/actions/workflows/ci.yml/badge.svg)](https://github.com/yovannyr/wslc-compose/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 ![Python](https://img.shields.io/badge/python-3.9%2B-blue)
 
@@ -82,25 +82,25 @@ Works even on WSL distros without `pip`, `venv` or `pipx` — it bootstraps a st
 [uv](https://docs.astral.sh/uv/) if no Python package manager is found:
 
 ```console
-curl -fsSL https://raw.githubusercontent.com/bacarndiaye/wslc-compose/main/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/yovannyr/wslc-compose/main/install.sh | sh
 ```
 
 Commands are installed into `~/.local/bin` (make sure it is on your `PATH`).
 
 ### With an existing package manager
 
 ```console
-pipx install git+https://github.com/bacarndiaye/wslc-compose
+pipx install git+https://github.com/yovannyr/wslc-compose
 # or
-uv tool install --from git+https://github.com/bacarndiaye/wslc-compose wslc-compose
+uv tool install --from git+https://github.com/yovannyr/wslc-compose wslc-compose
 # or
-pip install --user git+https://github.com/bacarndiaye/wslc-compose
+pip install --user git+https://github.com/yovannyr/wslc-compose
 ```
 
 ### From a local checkout
 
 ```console
-git clone https://github.com/bacarndiaye/wslc-compose
+git clone https://github.com/yovannyr/wslc-compose
 cd wslc-compose
 WSLC_COMPOSE_SOURCE=$PWD sh install.sh     # or: pip install -e .
 ```
@@ -251,6 +251,7 @@ Show the wslc-compose and wslc versions.
 | `environment` (list & map), `env_file` | `-e`, `--env-file` |
 | `ports` (short & long syntax, `ip:host:container`, `/udp`, ranges `8000-8005`) | `-p` |
 | `volumes` — named volumes | `wslc volume create` + `-v name:/path` |
+| `secrets` (file source; short & long service syntax) | read-only file mount at `/run/secrets/<name>` or `target` |
 | `volumes` — bind mounts (`./rel`, `/abs`, `~`, `E:\win\path`), `:ro` | `-v` with [path translation](#volumes-and-path-translation) |
 | `tmpfs` (top-level list or `type: tmpfs`) | `--tmpfs` |
 | `networks` incl. `aliases`, `external: true`, custom `name:` | `wslc network create`, `--network`, `--network-alias` |
@@ -268,12 +269,13 @@ Show the wslc-compose and wslc versions.
 
 Keys that wslc cannot honor yet are **accepted and reported as a warning** instead of
 failing, so your existing files keep working: `restart`, `healthcheck`, `privileged`,
-`cap_add`/`cap_drop`, `devices`, `extra_hosts`, `sysctls`, `secrets`, `configs`, `init`,
+`cap_add`/`cap_drop`, `devices`, `extra_hosts`, `sysctls`, `configs`, `init`,
 `pid`, `ipc`, `read_only`, `security_opt`, `logging`.
 
 Rejected with an explicit error (no silent surprise): anonymous volumes
 (`- /data` without a source), references to undeclared networks/volumes, circular
-`depends_on`, scaling a service that sets `container_name`.
+`depends_on`, scaling a service that sets `container_name`, unsupported secret
+sources, and build-time secrets.
 
 ## Variable interpolation
 
@@ -355,6 +357,62 @@ services on the next `up`.
   drive (`/mnt/c`, `/mnt/e`, ...).
 - `tmpfs` mounts map to `--tmpfs`.
 
+## Secrets
+
+File-backed runtime secrets use standard Compose syntax. Each secret is exposed only
+to services that explicitly request it and is mounted read-only. Short syntax mounts
+to `/run/secrets/<name>`:
+
+```yaml
+services:
+  restore:
+    image: mcr.microsoft.com/dotnet/sdk:10.0
+    working_dir: /src
+    volumes:
+      - .:/src
+    secrets:
+      - nuget_config
+    command:
+      - dotnet
+      - restore
+      - --configfile
+      - /run/secrets/nuget_config
+
+secrets:
+  nuget_config:
+    file: C:/Users/me/.nuget/private.NuGet.Config
+```
+
+Long syntax can choose a filename under `/run/secrets` or an absolute container path:
+
+```yaml
+services:
+  restore:
+    image: mcr.microsoft.com/dotnet/sdk:10.0
+    secrets:
+      - source: nuget_config
+        target: /root/.nuget/NuGet.Config
+
+secrets:
+  nuget_config:
+    file: ./private.NuGet.Config
+```
+
+Keep secret files outside source control and restrict their host permissions. Secret
+contents are never copied into the normalized model, labels, config hash, or generated
+command line; only the host path is passed to `wslc -v`.
+
+Current boundaries:
+
+- `file:` sources are supported; `environment:` and `external:` sources fail clearly.
+- `uid`, `gid`, and `mode` are accepted with a warning because wslc bind mounts cannot
+  enforce them.
+- `build.secrets` fails clearly. The current `wslc build` has no `--secret` option, so
+  a Dockerfile `RUN dotnet restore` cannot receive credentials safely. Do not replace
+  build secrets with `build.args`; use a runtime restore container or a builder with
+  native BuildKit secret support.
+- Every secret is a mount and counts toward the current wslc session mount limit.
+
 ## Known wslc preview limitations
 
 `wslc` is a public preview; `wslc-compose` warns at load time rather than failing:
@@ -384,7 +442,7 @@ services on the next `up`.
 - **Published ports bind the Windows loopback**, not the distro's: test them from
   the Windows side (browser, `powershell.exe Invoke-WebRequest`), not with a `curl
   localhost` inside WSL.
-- `privileged`, `cap_add`, `devices`, `sysctls`, `secrets`, `configs`, `extra_hosts`,
+- `privileged`, `cap_add`, `devices`, `sysctls`, `configs`, `extra_hosts`,
   `logging` — not configurable with wslc; ignored with a warning.
 
 When wslc gains native Compose support ([#40948](https://github.com/microsoft/WSL/issues/40948))
@@ -510,7 +568,7 @@ install.sh          curl-able installer, bootstraps uv when pip/pipx are missing
 ## Development
 
 ```console
-git clone https://github.com/bacarndiaye/wslc-compose
+git clone https://github.com/yovannyr/wslc-compose
 cd wslc-compose
 pip install -e . pytest ruff      # or the uv equivalent
 pytest                            # unit tests, no wslc required
@@ -525,4 +583,4 @@ since the CLI surface is still evolving.
 
 ## License
 
-[MIT](LICENSE) © Bacar Ndiaye
+[MIT](LICENSE) © Yovanny Rodríguez, 2026. See the LICENSE file for details.

docs/MIGRATION.md

@@ -61,7 +61,7 @@ this to map each container to a compose service and to know what to stop in step
 ## Step 2 — Install wslc-compose and prepare the compose file
 
 ```console
-curl -fsSL https://raw.githubusercontent.com/bacarndiaye/wslc-compose/main/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/yovannyr/wslc-compose/main/install.sh | sh
 ```
 
 If you already have a `docker-compose.yml` from Docker/Podman days, use it **unchanged**.