Earlier quoted context omitted.
I guess you missed my "containerisation" point: if not restricted, every rogue package or agent has access to your full $HOME too. A secret is there to protect access to data you care about. If that data is there, well, not much achieved. Eg. imagine there's the source code for a service you deploy to AWS — rogue sw can modify it letting you unknowingly update it the next time (or why do you have those AWS keys anywa…
> I guess you missed my "containerisation" point: if not restricted, every rogue package or agent has access to your full $HOME too. A secret is there to protect access to data you care about. If that data is there, well, not much achieved. There can be multiple processes that might need access to a project root and thus you might still find utility in something like these even inside a container. In security, we cal…
They have different default behavior (and levels of isolation), which is why I mentioned a few popular choices, but there is more (LXD and Incus, for instance).
As far as "following any form of rigour", that's exactly what's happening for many with a move to coding agents — one-shotted diffs are so big, that people cannot keep the focus and introducing a tiny one-liner (eg. one that copied your AWS secret to innocent-file.sig) would likely go unnoticed. So yes, even if you used a VCS and glanced over your dry run IaC output, you'd easily be fooled.
Caring about reducing impact of human "mistakes" (due to lack of attention), we also call that defense in depth.