Read host keys from environment variables

[David Leadbeater]

On Tue, Aug 11, 2026 at 12:09:45PM +0200, Philipp Marek via openssh-unix-dev wrote:
[...]
> _In containers_ there is no other user,

This is incorrect, on two levels:

- There is no such thing as a "container", on Linux various runtimes
  implement slightly different things and call them a container.

- In Docker and Kubernetes (and most other OCI containers) you can have
  as many users as you want (even without user namespaces, which you
  mentioned elsewhere, that is a different concept).

> and passing secrets via the environment seems to be a normal usecase[1].

OK, you're referencing Kubernetes now, maybe that's what you're using?

It's supported, because there are apps which need it, but you can also
use files (and probably should):
https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod

> the memory contents of PID 1 need to be investigated,
> which sounds a bit harder to do from a minimal installation with no tools.

On Linux it's a read of /proc/1/environ, there's some details which are
offtopic here, but an environment variable is potentially worse than a
file as it allows easy reading as both a file and accidental leaking
into other processes.