Add exclusion list for environment variables

[DavidGOrtega]

Excludes CML credentials passed as environment variables

• Part of cml-runner self-hosted issues #721
• Needs Mark sensitive environment variables for runners terraform-provider-iterative#665
• Includes Retrieve exclusion list from environment variable #1164

[0x2b3bfa0]

@DavidGOrtega, I believe that $PATH is mandatory for runners to work. 🤔

[casperdcl]

The problem with whitelist-only is there are a few other things that a user would likely want preserved too...

• NVIDIA_VISIBLE_DEVICES
• CUDA_VISIBLE_DEVICES
• LANG

I'd prefer blacklisting CML config vars instead (AWS_*ACCESS_KEY etc)

(vis. #721 (comment))

[dacbd]

Consider using systemd-run to start the run.sh ? Should scrub vars set in the session with export but maintain system controlled ones like PATH

[dacbd]

Consider using systemd-run to start the run.sh ? Should scrub vars set in the session with export but maintain system controlled ones like PATH

Ehh don't think this plays nice when executed in a docker container, so probably not the best

[DavidGOrtega]

Im checking. It's happening something interesting.
I was counting with spawn( {shell:true, env: {} }) which should create its own shell with system vars being expanded by the node ones. Funny is that in Macos seems to be fine... however inside a linux container Its not very happy...

[dacbd]

Confirm that this is really only an issue for cloud-based runners; the fix might be in tpi?

[casperdcl]

I have this issue on on-prem as well as cloud...

[tasdomas]

This branch is now almost a year old. Should we make a decision on this?