I'm wondering if we should rather use an allowlist rather than a denylist?
We know all of the env vars which are pertinent to coder; why not only include those?

I'm wondering if we should rather use an allowlist rather than a denylist? We know all of the env vars which are pertinent to coder; why not only include those?

That's interesting. This would also catch someone randomly adding an agent environment variable. I'll look into that.

EDIT: agent environment variables are likely not what we would need for debugging anyway; we'd be more interested in the underlying compute resource (e.g. Docker container).

I'll just scrub all the values and be done with it. WDYT?