`config.json` inside the runtime directory contains secrets and should therefore not be world-readable.