Hacker News Reader

Wait, what? How do environment variables end up in the public part of process table? There's no way one user can peek into the environment of another (without permissions, notwithstanding bugs) -- that's part of the design of Unix systems.

And the machine (vm) runs in a private VPC. So it's private.

How are they "public" across the entire machine?

I suppose it depends on your definition of public.

Any environment for a process will be accessible via /proc/<pid>/environ on a linux system. Of course other users cannot read these files, however in the case of something like a Docker image all processes likely share a username and this could be a risk (especially for a public webapp that one day may information leak/allow remote command execution).

At least that's my immediate take on it.