msd-core/.changeset/lively-lynx-hum.md at 1e3e1f7cd8dd6eca32c3ce93bb71fffea802b7ee

Files

Tom Boucher f0a1745e29 fix(#4639 ): exempt the container --env-file value from the secret-read guard (#4789 )

* fix(#4639): exempt the container --env-file value from the secret-read guard

* test(#4639): adopt the suite assertions and pin the reclassified row

* docs(#4639): document and pin the container-env printenv residual

* docs(#4639): backfill changeset PR number

---------

Co-authored-by: sim <sim@local>

2026-09-16 06:44:55 -04:00

320 B

Raw Blame History

type, pr

type	pr
Fixed	4789

The secret-read guard no longer blocks container --env-file — docker/docker compose/podman/nerdctl --env-file passes a file to the runtime without its contents ever reaching the conversation, so the operational rebuild works again; direct reads of secrets still block. (#4639)

320 B Raw Blame History

320 B

Raw Blame History