Problem

Secrets (MySQL root password, .mylogin.cnf, TLS keys) are uploaded via SFTP with default umask (typically 0644), then change_permissions_to_root() sets 0600 in a separate SSH command. Between upload and chmod, any process on the node can read the secrets.

Files: src/initialize.py, lines 169–171; src/container.py, lines 50–52

Fix

Set file permissions atomically via SFTP before writing content:

def upload_file(self, content, remote_file_path: str, mode: int = 0o644) -> None:
    if isinstance(content, str):
        content = content.encode()
    with self.sftp_client.open(remote_file_path, "wb") as remote_file:
        remote_file.set_pmode(mode)
        remote_file.write(content)

Call with mode=0o600 for all secret files. Remove the separate change_permissions_to_root() calls.

Acceptance Criteria

• upload_file() accepts a mode parameter (default 0o644)
• File permissions set atomically via SFTP before or during write
• All secret file uploads use mode=0o600
• Separate change_permissions_to_root() calls for secret files removed