Add an exec-replacement mode for environment-only secrets

[davdroman]

fnox exec currently spawns the target command, remains as its parent, forwards SIGINT/SIGTERM, and waits for it. That behavior is necessary when fnox must keep as_file temporary files alive, but it adds a supervision layer for workloads that only inject environment variables.

Would an opt-in Unix-only replacement mode fit fnox's scope?

For example:

fnox exec --replace -- node server.js

After resolving secrets, fnox would use std::os::unix::process::CommandExt::exec() so the target replaces fnox while keeping the same PID. The target would then receive signals and report exit status directly, which is useful when fnox exec is the container entrypoint.

I think the mode should:

• reject selected secrets using as_file, because fnox cannot run cleanup after a successful process replacement;
• initially reject leases unless their lifecycle semantics are explicitly defined for replacement;
• remove provider bootstrap credentials such as FNOX_AGE_KEY and FNOX_AGE_KEY_FILE from the target environment after resolution;
• preserve the existing spawn-and-wait behavior as the default;
• include container tests for PID preservation, signal delivery, exit statuses, missing secrets, and bootstrap-credential removal.

The current spawn mode would remain appropriate for file-backed secrets and any future resources requiring post-child cleanup. Replacement would be a narrower path for environment-only injection.

Does this direction fit the project, and should bootstrap-credential scrubbing be part of this mode or a separate exec behavior?

No implementation has been started. This discussion was prepared with AI assistance and reviewed by the author.

[jdx]

definitely cool with me

[davdroman]

Awesome! Implemented in #654. Thanks for your time.