Rootless Auth.json vs Credential Helper: Which Minimizes Credential Exposure for Expired Tokens?

Direct answer

For rootless Podman with standard credential helpers, expired tokens are not refreshed automatically. Manual podman login is required after expiration, just as it is with a plaintext ~/.config/containers/auth.json. A credential helper reduces on-disk exposure by keeping the token in the user keyring instead of auth.json, but it does not guarantee that no plaintext copy exists anywhere on the host, and it does not change Podman's expiration behavior.

Confirmed behavior vs. implementation-dependent behavior

Confirmed in recent Podman releases (4.x and 5.x line, subject to version verification):

• Plaintext auth.json stores base64-encoded credentials on disk. Podman reads them as-is; when the registry returns 401, Podman surfaces an authentication error and does not silently retry with new credentials.
• When credential-helper is configured in containers-auth.json or via podman login --credential-helper, Podman delegates storage and retrieval to the helper. The standard helpers (docker-credential-secret-service, docker-credential-pass, docker-credential-osxkeychain) store the secret in the system keyring and do not write a token entry into auth.json.
• Standard helpers return the cached secret verbatim. They do not inspect token expiry, so Podman receives the same expired token and fails the pull or push until you re-authenticate.

Implementation-dependent (verify before relying on it):

• A custom helper that talks to an OIDC provider could, in principle, return a fresh token on each get call. That refresh logic lives in the helper, not in Podman.
• Some helper versions may create temporary files during retrieval. If true, the token could appear briefly on disk outside the keyring. This is not documented as a Podman guarantee and should be treated as a helper-specific risk.

Exposure comparison

Verification steps

1. Configure a helper and log in:

   podman login --username <user> registry.example.org

   Then confirm the registry key is absent from the auths map without printing the secret:

   jq '.auths | keys' ~/.config/containers/auth.json

2. Simulate an expired token by replacing the keyring item with a known-bad value, then run:

   PODMAN_DEBUG=1 podman pull registry.example.org/image:tag

   Observe whether the helper is queried again after a 401 or whether Podman exits with an auth error immediately.
3. Repeat with no helper configured to confirm the same manual re-login requirement.

Recommendation

If your goal is least privilege and reduced exposure, use a standard credential helper so tokens live in the keyring rather than auth.json. Accept that expired tokens still require podman login. If you need unattended refresh, you must supply a helper that implements token renewal; Podman will not do it for you.

Missing diagnostic: Which credential helper and version are you using? If it is a standard helper, the answer above holds. If it is a custom or OIDC-aware helper, the refresh behavior may differ and the recommendation changes.