https://solo.hiero.org/tags/security/Recent content in Security on SoloHugoenhttps://solo.hiero.org/docs/advanced-solo-setup/subprocess-environment-filtering/Mon, 01 Jan 0001 00:00:00 +0000https://solo.hiero.org/docs/advanced-solo-setup/subprocess-environment-filtering/<h2 id="overview">Overview<a class="td-heading-self-link" href="#overview" aria-label="Heading self-link"></a></h2> <p>Solo runs external commands on your behalf — <code>helm</code>, <code>kubectl</code>, <code>kind</code>, <code>docker</code>/<code>podman</code>, <code>npm</code>, <code>gh</code> and <code>brew</code>. It does <strong>not</strong> hand those commands your whole environment. Each command receives only the variables it is known to need, built from an allowlist.</p> <p>The reason is that Solo is frequently run from a shell or CI runner holding credentials that have nothing to do with deploying a network — registry tokens, cloud keys, SSH agent sockets. Passing the whole environment would forward all of it to every tool, and onward to anything those tools spawn: Helm plugins, kubectl credential plugins, package lifecycle scripts.</p>