5 ms·
> zerobox --secret OPENAI_API_KEY=$OPENAI_API_KEY Linux by default allows all users to read CLI arguments of running processes. While it looks like your bwrap
by lights0123 6mo ago
> zerobox --secret OPENAI_API_KEY=$OPENAI_API_KEY
Linux by default allows all users to read CLI arguments of running processes. While it looks like your bwrap invocation prevents the sandbox from looking at this process (--unshare-pid), any other process running on your system can read the secret.
- afshinmeh 6mo agoThat's true and the expected behaviour but I see your point. The example there is not great, I should've used `sk_s123...` to show that you are passing the env var to the sandbox as opposed to setting it on the host, then proxying it. I will update it.