This topic is security related: it would be great to have @myyxl and you connect on this, e.g. at this year's Hacktoberfest in Kassel. Let me explain ✍️

Storing secrets in environment variables is generally considered insecure: https://blog.arcjet.com/storing-secrets-in-env-vars-considered-harmful/

Now, what I need to be educated on is the possibilities for attacks that end up with some kind of remote code execution inside the container:

1. how could an attacker print environment variables? Apparently this is easier than file reads - why?
2. does exporting environment variables in the entrypoint instead of having them set for the whole container change anything about the attack surface?
3. which file permissions on secret files would lead to which attack surface? which permissions would an attacker have if they got a remote code execution inside the container?
4. is there a way to read secrets at startup and unmount all secret sources afterwards so that the secret only lives in memory? How would a container need to be configured to not allow attackers to dump the memory?

Here are some suggestions on locking down containers: https://blog.arcjet.com/dont-just-deploy-defend-secure-container-deployments/
@myyxl if you're interested, I'd suggest this for some short presentation at Hacktoberfest on how you made the maevsi containers more secure. I imagine that being valuable and insightful for others 🙏