What is the problem you're trying to solve

The current spec does not seem to allow an absolute path like /foo/bar as a secret target:

target: The name of the file to be mounted in /run/secrets/ in the service's task containers. Defaults to source if not specified.

However, this seems to have been allowed in docker-compose.

Describe the solution you'd like
Revise the spec to explicitly allow (or disallow) absolute path.