3 ms·

"Containerize everything", they said. "What could go wrong?" Seriously, how could anyone, ever, think that putting any sensitive information like credentials i

• graemep 3y ago
  Where should you put them? They have to be somewhere the app can read them, which means if the app can be persuaded to reveal them they are readable. You probably should have extra restrictions on how those credentials are used (e.g. your database server should only accept connections from known IPs) or minimise the number (e.g. with a small install run the database and app on the same machine and accept only local connections).
  • KronisLV 3y ago
    > Where should you put them? This is probably the crux of the issue. Environment variables are available on most systems where you might want to run software, containers included. For lots of configuration, they seemed to make sense: https://12factor.net/config https://12factor.net/config Of course, most container solutions (Docker, Kubernetes, Nomad) nowadays include solutions for managing secrets better, as do most cloud platforms, but they're not exactly as standardized or simple as environment variables are, maybe like a file mounted inside of the container that the app can read, at best. That said, I'm not excusing the fact that the vulnerability is caused by a package that lets you run phpinfo, since that does leak a lot of information - it's more like you need to be careful every step of the way, both with how you store and access your secrets, as well what you include with your code.