New feature: Add --build-secret argument

issue に示されている devcontainer build コマンドから始め、feature のビルドがどのように Dockerfile を合成するかを追跡します。--build-secret とローカル feature の install.sh を使って例を再現します。feature が /run/secrets/compose_file を読み取ることができ、結果のイメージに期待される secret の内容が含まれていれば完了です。

In our CI pipeline, we use build secrets to inject secrets for our internal registries into our Dockerfile. However, the devcontainer CLI currently doesn't support using those secrets from within a feature. This limitation exists because the synthesized Dockerfile for building features requires additional parameters like --mount=type=secret,id=aws.

I created a PR that addresses this issue and allows providing secrets to features in the same way as with a regular docker buildx command. Here's an example of how it works:

In the feature install.sh:

#!/bin/bash
set -e
if [ -f /run/secrets/compose_file ]; then
    echo "Contents of secret file:"
    cat /run/secrets/compose_file
    echo "Writing secret file contents to /secret_file.txt"
    cat /run/secrets/compose_file > /secret_file.txt
else
    echo "Secret file not found!"
    exit 1
fi

On the terminal:

devcontainer build --workspace-folder test-build-secrets --build-secret id=compose_file,src=./my_cred.txt --image-name test-build-secrets-image --no-cache
docker run --rm --entrypoint="cat" test-build-secrets-image /secret_file.txt

This will build the devcontainer with the local feature and print out the secret content.

Note: Writing the secret to a file is obviously the opposite of what one would actually do with the build-secret flag, but it demonstrates that the secret can be read and used just like with regular Docker secrets.