Environment variables
Variables are set per service, encrypted at rest and can reference other services in the same project.
Build-time and runtime
Every variable can apply at build time, at runtime, or both. Secrets are passed to builds as BuildKit secrets rather than build arguments, so they never end up in image layers, and they are masked as •••• in logs.
References
Use ${{service.VARIABLE}} to reference a value another service publishes:
| Service | Publishes |
|---|---|
| Postgres | DATABASE_URL, PGHOST, PGPORT, PGUSER, PGPASSWORD, PGDATABASE |
| Redis | REDIS_URL, REDIS_HOST, REDIS_PORT, REDIS_PASSWORD |
| Bucket | S3_ENDPOINT, S3_REGION, S3_BUCKET, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, S3_PUBLIC_URL |
| App | PRIVATE_HOST, PUBLIC_URL |
References only resolve within a project. Circular references are rejected when you save.
Paste a .env file
The variables editor accepts a pasted .env file and creates one variable per line. Revealing secret values is recorded in the audit log.