From ea42b00d0a499e975f6013da79298f9ed5e8ff84 Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 21 Sep 2026 13:47:39 +0200 Subject: [PATCH] Issue 041: mongodb names its secrets' owner; the three conversions are proven --- .../00-report.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md b/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md index 526bec7..a845e43 100644 --- a/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md +++ b/04-ISSUES/041-a-sealed-credential-ends-up-in-the-process-environment/00-report.md @@ -81,7 +81,10 @@ convertible (baserow, mssql, only-office, umami, mailu's initial admin), 9 read Novox's own applications outside the mesh repositories (amqp-email-forwarder, de-spiegel, invoicing, photos), 4 unverifiable (keycloak's admin, letta, mailu's other containers), and 2 dead deliveries that nothing read. Converted and proven in a bed: amqp-ping, minio, mongodb, -mesh-catalog and model-usage; the two dead deliveries removed. The 25 that remain carry the +mesh-catalog and model-usage; the two dead deliveries removed. One image, mongodb's, drops to its +own user before it reads the file, so its manifest names that user as the owner of its secrets — the +first use of the owner field outside the controller, and the check any converted image needs: run it +with a file its user cannot read. The 25 that remain carry the surveyed reason on the container. Gitea, nextcloud, mailu-admin, influxdb, step-ca and n8n are convertible and wait for a bed that exercises their credential ([issue 073](../073-beds-carry-copies-of-catalogue-manifests/00-report.md)); icecast, keycloak's