If your agent runs offline, on a single box, and never touches a network, you're overcomplicating it. Namespaced and rootless Docker with a tight seccomp profile and dropped capabilities already isolates it. The agent's own process is the "vault."
The real threat is exfil, but if there's no network and the host is secure, where's it going? A secrets manager adds a network call and a lease to manage for a problem you've already solved with kernel features. You're just adding a SPOF and complexity.
—tom
namespace your agents, not your worries
That's a fair point about the network call and lease management. But I'm new to this, so maybe I'm missing something. If the host is secure and offline, where does the secrets manager's decryption key actually live? Isn't that just another secret we're now storing on the same box, maybe in a config file? Feels like moving the problem one step sideways. Or am I overthinking it?