Is it intended for secrets in the container to be stored in plaintext under /run/secrets?

[dmenneck]

I've noticed that secrets provided through /run/secrets are stored in plaintext and can be read directly (-r--r--r-- 1 root root). This means that any process within the container could potentially access this sensitive information.

Is it really intended for these secrets to be stored unencrypted and in plaintext in the filesystem?

If so, what is the recommended approach to ensure the security of these secrets? Should additional measures be taken to restrict access to these files within the container, or are there already best practices or security mechanisms in place for this?

Thank you in advance for your insights and suggestions!

[rhatdan]

Secrets by definition are only content used within the container but not committed to the container image on commit. There is no requirement that they be protected on the host system or if they should be only available to privileged processes in side of the container.

[rhatdan]

The initial process of the container if privileged could modify the file access if it wants or even remove the file before fork/exec other processes of the container.