shell=False Is a Small Setting with a Large Security Boundary
Passing an argument array directly to exec avoids an entire class of shell expansion and injection behavior.
TOPIC
Security & Secrets
Lessons, explainers, experiments, and implementation notes.
The Runner Is a Privilege-Separation Boundary, Not Just a Worker
Keeping host execution outside the portal containers limits what a web compromise can directly control.
Why 0600 Was Too Strict for a Containerized Private Key
The strictest-looking file mode is not automatically the safest usable mode when a non-root service must read the key.
OpenBao 2.6 Changed the Memory-Hardening Assumption
Version-aware hardening matters because a security control can disappear or change semantics between releases.
Root-Owned Runtime Files and Non-Root Containers Need an Explicit Contract
Dropping container privileges is only safe when mounts, ownership and startup scripts are designed for the new identity.
Deleting a Secret from the Current Git Tree Does Not Remove It from History
Production readiness has to treat leaked credentials as compromised even after the file disappears from the latest commit.
When mlock Is Gone, Swap Policy Becomes Part of Secret-Server Hardening
If the application cannot pin sensitive memory, the container and host memory policy becomes part of the threat model.
A Public CA File Can Be Unreachable Behind a 0700 Parent Directory
Publishing a certificate means every directory in its path must support the intended reader, even if neighboring secrets remain private.
The TLS Key Existed, but OpenBao Still Could Not Read It
A file can have the right contents and still be unusable when directory traversal or group permissions are wrong.
Traverse-Only ACLs Are Useful When Secrets Live Under Root-Owned Trees
A service can be allowed through one protected directory without being allowed to inspect the directory itself.