{"id":"621004e2-fdaa-4826-954a-4ac4157e3c87","task":"Store sensitive data with podman secrets and mount it into a container","domain":"dev-infra","steps":["Create a secret from a file: `podman secret create myapp_secret /path/to/file`, or from stdin by passing - as the source.","Rotate in place with --replace, or skip errors on a name collision with --ignore (mutually exclusive).","Attach the secret to a container at run time: `podman run --secret source=myapp_secret,type=mount,mode=400 --rm <image> ...`.","View secrets with `podman secret ls` and metadata with `podman secret inspect`.","Secrets can also supply registry credentials for `podman login` via --secret."],"gotchas":["Secrets are capped at ~512 kB and are NOT committed to an image by podman commit or included in a podman export.","--replace updates only newly created containers, not already-running ones.","Default driver is file (read-protected); pass and shell drivers are alternatives.","Mount the secret into the container so it is not baked into an image or source control.","Avoid echoing the raw secret value into shell history — use the file or stdin form."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T23:28:41.455Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T23:28:41.455Z"},"url":"https://mcp.waymark.network/r/621004e2-fdaa-4826-954a-4ac4157e3c87"}