jfraeysd/fetch_ml
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
fetch_ml/internal/jupyter
History
Jeremie Fraeys 5644338ebd
security: implement Podman secrets for container credential management 
Add comprehensive Podman secrets support to prevent credential exposure:

New types and methods (internal/container/podman.go):
- PodmanSecret struct for secret definitions
- CreateSecret() - Create Podman secrets from sensitive data
- DeleteSecret() - Clean up secrets after use
- BuildSecretArgs() - Generate podman run arguments for secrets
- SanitizeContainerEnv() - Extract sensitive env vars as secrets
- ContainerConfig.Secrets field for secret list

Enhanced container lifecycle:
- StartContainer() now creates secrets before starting container
- Secrets automatically mounted via --secret flag
- Cleanup on failure to prevent secret leakage
- Secrets logged as count only (not content)

Jupyter service integration (internal/jupyter/service_manager.go):
- prepareContainerConfig() uses SanitizeContainerEnv()
- JUPYTER_TOKEN and JUPYTER_PASSWORD now use secrets
- Maintains backward compatibility with env var mounting

Security benefits:
- Credentials no longer visible in 'podman inspect' output
- Secrets not exposed via /proc/*/environ inside container
- Automatic cleanup prevents secret accumulation
- Compatible with existing Jupyter authentication
2026-02-18 16:35:58 -05:00
..
config.go feat(core): API, worker, queue, and manifest improvements 2026-02-12 12:05:17 -05:00
health_monitor.go feat(jupyter): improve runtime management and update security/workflow docs 2026-01-05 12:37:27 -05:00
network_manager.go security: prevent Jupyter token exposure in logs 2026-02-18 16:11:50 -05:00
package_manager.go feat(jupyter): improve runtime management and update security/workflow docs 2026-01-05 12:37:27 -05:00
security_enhanced.go feat(jupyter): improve runtime management and update security/workflow docs 2026-01-05 12:37:27 -05:00
service_manager.go security: implement Podman secrets for container credential management 2026-02-18 16:35:58 -05:00
startup_blacklist_test.go feat(core): API, worker, queue, and manifest improvements 2026-02-12 12:05:17 -05:00
workspace_manager.go Slim and secure: move scripts, clean configs, remove secrets 2025-12-07 13:57:51 -05:00
workspace_metadata.go feat(jupyter): improve runtime management and update security/workflow docs 2026-01-05 12:37:27 -05:00