--isolated user secrets

[Paulo Morgado (paulomorgado)]

Aspire CLI states that:

• --isolated
  Run in isolated mode with randomized ports and isolated user secrets, allowing multiple instances of the same AppHost to run simultaneously. This is useful for parallel testing or comparing different configurations side-by-side.

How do those "isolated user secrets" work?

[Joel Shearon (hippi345)]

It's basically copy-on-start. The CLI takes your AppHost's UserSecretsId, copies its secrets.json (if there is one) into a new store under a fresh GUID, starts the AppHost pointed at that id with randomized ports, and deletes the copy when the run ends (best effort). So each isolated run starts with your current secrets, but anything it writes back, like generated parameter values, goes to the throwaway copy.

One thing that looked off to me on main: the CLI passes the isolated id as DOTNET_USER_SECRETS_ID, but hosting seems to read ASPIRE_USER_SECRETS_ID, which the run command sets to the original id. If you ever see an isolated run writing into your real secrets, that's probably why, and worth an issue.

[Paulo Morgado (paulomorgado)]

I hope it's also delete-on-finish.