4 ms·
I like the simplicity of envars too, but they shouldn't be used for secrets. They are not designed to be secure, and are too easy to leak. Containers often al
by ensignavenger 2y ago
I like the simplicity of envars too, but they shouldn't be used for secrets. They are not designed to be secure, and are too easy to leak. Containers often allow placing secrets into files, and specifying the filepath in an envar. Files have access controls that are designed for security, so while it takes some thought, they are easier to secure.
- theozero 2y agoThere are tons of debates online about this. Realistically I think it's all tradeoffs and there are no silver bullets, so I won't really weigh in on the _right_ way to do it. But I think we can all agree that MANY people are using env vars for secrets because of their simplicity, so our hope is to help make those folks more secure and solve some of the related papercuts. Ultimately DMNO is designed in a way that we should be able to swap out how the config actually gets passed around, so we can hopefully help users use whatever is the most secure way to do things without having to think too much about it.