Pure-Go off-heap secret memory: mmap/mlock, memfd_secret L4 isolation, guard pages, fail-closed by default
-
Updated
Aug 23, 2026 - Go
Pure-Go off-heap secret memory: mmap/mlock, memfd_secret L4 isolation, guard pages, fail-closed by default
Can a Kubernetes secret be used without leaving a copy in a memory dump? Measured, not argued: ~3,900 data points across C, Rust, Go and Java, with real dumps and a canary. For file and env delivery: yes. When fetching over HTTPS: only without a standard-library HTTP client.
Add a description, image, and links to the memfd-secret topic page so that developers can more easily learn about it.
To associate your repository with the memfd-secret topic, visit your repo's landing page and select "manage topics."