How to hide sensitive parameters when running Bitbucket Shell Runner?

[KwanjungJU]

Hello,

I'm running a Bitbucket Shell Runner on Linux using systemd.

I already moved some parameters to an environment file, and that partially worked.
However, sensitive information such as OAuth client ID, OAuth client secret still appear in systemctl status output because they are passed as Java -D options.

Also, according to a chat-bot based search, there seems to be no official support for loading secrets automatically from an env file in start.sh

Is there an official or recommended way to securely pass secrets to the runner without exposing them in the process list?

Thanks

[Alexander Nilsson]

Hello KwanjungJU,

welcome to the community!

Unfortunately, there's no official way to hide OAuth client ID/secret from the Bitbucket Shell Runner's process list (ps/systemctl status). The start.sh passes them as -D Java options, making them visible.

Systemd env files help with unit files but not the final Java command line. The recommended approach is treating the runner host as trusted infrastructure:

• Dedicated VM/host with restricted SSH/sudo access
• OS hardening (limited users, SELinux/AppArmor)
• Regular OAuth credential rotation

For stricter isolation, we recommend using a dedicated hardened node per trust boundary. This means:

• Separate runner VMs or servers for different teams or departments to isolate access.
• Each node has its own OAuth credentials and is accessible only by its specific admins.
• Network segmentation to restrict access further, such as placing runner nodes in isolated subnets with limited external access.
• Optionally, use ephemeral VMs that can be re-provisioned regularly to reduce risk.

This approach ensures that, even if one node or team is compromised, OAuth secrets from other trust boundaries remain protected. Since Bitbucket Shell Runner has no built-in secret-hiding feature, isolating runners this way is the only practical method to protect secrets from local users on the host.

Greetings,

Alex