Support for docker secrets exported as environment variables

Docker secrets are intentionally mounted into containers as files under /run/secrets/, which is a secure default. However, many applications and frameworks expect configuration via environment variables rather than files. As a result, users frequently resort to workarounds like:

entrypoint: >
  sh -c "export API_KEY=$(cat /run/secrets/api_key) && exec myapp"

This pattern is widely used and effectively gives the container an environment variable anyway — just with more boilerplate and no additional security compared to a built-in feature.

Providing an optional way to export a secret as an environment variable would significantly improve ergonomics in cases where this pattern is required.

Kubernetes, for example, supports this functionality:
https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/#define-a-container-environment-variable-with-data-from-a-single-secret

Docker could offer an equivalent mechanism with a syntax like:

secrets:
  - secret: api_key
    as_env: APP_API_KEY

This would avoid shell-based workarounds while keeping the current file-mount behavior as the default.

For example, in co-op cloud, which packages open source applications using docker swarm, there are many applications which require secrets as environment variables and this would be a great improvement on app packaging.

Start by tracing how the Docker CLI parses and forwards secret definitions, then determine whether environment-variable export belongs in this repository or in Docker's engine or Swarm implementation. Done requires an agreed configuration syntax, clarified behavior alongside the existing file mount, and tests covering the proposed option.