Environment variables

Your services receive configuration as environment variables, from two places: the env map in your manifest, and the Variables & Secrets you manage in the console.

In the manifest

Set environment variables for a service with its env map. Keys and values are strings:

services:
  web:
    type: container
    image: ghcr.io/example/app:latest
    env:
      NODE_ENV: production
      LOG_LEVEL: info

Use the manifest for defaults and non-sensitive configuration: it lives in your repository, versioned with your code.

Variables & Secrets in the console

For values that should stay out of your repository, open the app's Settings tab in the console and find Variables & Secrets. Click Add variable and choose the type:

• Variable: a plain value, visible in the console.
• Secret: encrypted at rest and write-only. Once saved, the value is never shown again, to anyone. See Security: secrets.

Both kinds are added to your services' environment on every deploy, and they take precedence over a value with the same name set in the manifest, so the manifest keeps the defaults and the console holds the real keys.

Connection references

env values can reference the connection details of a managed database in the same manifest, like ${service.db.url}. The references are resolved when your app starts, so credentials never appear in your repository. See Database: connection references.

To pass a literal ${ through to your app, escape it as $${.

Where to go next

• Database: the managed database and its connection references.
• Container services: the full service spec.
• Getting started: deploy your first app.