4 ms·
It would be neat if you could inject secrets as environment variables. Something like: --secret="my_secret:MY_SECRET" Obviously you could have a script th
by tlrobinson 10y ago
It would be neat if you could inject secrets as environment variables. Something like:
--secret="my_secret:MY_SECRET"
Obviously you could have a script that does
MY_SECRET=$(cat /run/secrets/my_secret) ./whatever
but a lot of existing containers can be configured via environment variables.
- diogomonicapt 10y agoWe explicitly chose not to support secrets as ENV variables, since they are prone to being leaked (child processes inhering parent's env; easy to leak ps -e; bug reports usually include ENV of the application; core dumps include ENV of the application, etc etc)
- tlrobinson 10y agoMakes sense, but how do child processes not have access to the secrets files?
- paulddraper 10y agoThey do. That point is less valid.
- diogomonicapt 10y agoMy unstated assumption was that when calling something like imagetragick you would be doing the appropriate privilege dropping using setuid and setgid. This is obviously not necessarily the case, but it's at least a lot more common than people cleaning up the ENV before creating a child process.