Rootless Auth.json vs Credential Helper: Which Minimizes Credential Exposure for Expired Tokens?

Goal

Determine the least‑privilege approach for handling authentication in rootless Podman when credentials become stale.

Constraints

Rootless mode relies on user namespaces and stores credentials in ~/.config/containers/auth.json. Credential helpers can offload tokens to system keyrings, but their integration with rootless authentication is unclear. Expired tokens must be refreshed automatically to avoid pull failures.

Uncertainty

The current behavior of automatic credential refresh differs between using a plaintext auth.json and a third‑party credential helper. It is not documented whether a helper can detect expiration and trigger a login without user intervention, or if the helper’s keyring integration fully protects the token from accidental exposure.

Questions

• Does rootless Podman automatically refresh expired tokens when using a credential helper, or is manual re‑login required?
• When using a credential helper, does the helper prevent the token from being stored in plaintext anywhere on the host?