Environment variables

Environment variables let you configure your app without changing code or rebuilding the container image.

Setting variables

You can set environment variables from the Environment tab of your app in the dashboard. Each app has two sets of variables:

Set	Purpose	Permissions
Runtime	Injected into the running container.	Read: app.env.read, Write: app.env.write
Build-time	Available during the build step for GitHub, GitLab, and upload sources.	Read: app.build_env.read, Write: app.build_env.write

Build-time variables are useful for supplying dependencies or credentials needed at build time without committing them to your repository.

Secret values

Mark sensitive values such as API keys and database passwords as secret by toggling the visibility control in the dashboard. Secret values are stored encrypted in Kubernetes secrets, masked in logs, and hidden from view in the dashboard.

Runtime injection

When a container starts, the platform injects environment variables for the active deployment. Changes to environment variables trigger a rolling update of the affected app.

Per-environment values

Environment variables are set at the app level. To use different values for different contexts, create separate apps (e.g. myapp-staging and myapp-production) with their own variable sets.

Best practices

• Rotate secrets regularly.
• Avoid committing secrets to source control - use the platform’s secret store instead.
• Use build-time variables for build-only dependencies.
• Keep variable counts manageable; each one adds to the container’s environment.