3 ms·
The secrets aren't in a shared location. They're stored in an ephemeral volume specific to each container which other processes cannot access.
by dharmab 3y ago
The secrets aren't in a shared location. They're stored in an ephemeral volume specific to each container which other processes cannot access.
- marwis 3y agoIf someone has enough privileges to access /proc/*/environ of another process (i.e. root or the same user or process or child process) then they should be easily able to reach inside the container, no?
- lmm 3y agoOther processes running as the same user can be blocked from reading /var/run/secrets via the likes of SELinux/AppArmor whereas they can't be blocked from reading /proc/environ. It's a pretty fine distinction and I don't know how many people actually bother doing SELinux etc. in practice, but theoretically it's marginally better.
- marwis 3y agoAppArmor can restrict /proc, see example from docker: https://github.com/moby/moby/blob/master/contrib/apparmor/template.go#L41 https://github.com/moby/moby/blob/master/contrib/apparmor/te...