Skip to main content

​
What to use when

Tinfoil Containers supports two different kinds of configuration values:
Secret values are accessible to Tinfoil infrastructure during deployment. If your threat model requires that Tinfoil cannot access certain values, use private secrets, which are released to the enclave by a keyserver you run.
Measured env values are set in tinfoil-config.yml. CLI and Admin API variables are a separate saved per-instance map. Secret values are managed outside the config in the dashboard or API.
Declaring a secret in tinfoil-config.yml and selecting it for a deployment are separate steps. The declaration identifies the environment variable expected by the container. During deployment, select every declared secret that should be injected. With the CLI, pass each name using --secret NAME.

​
Environment variables

​
Config File

Define environment variables in the env field of your container configuration file:
tinfoil-config.yml

​
Dashboard

During deployment, the dashboard displays the environment variables (and secret names) defined in your tinfoil-config.yml. These values are read-only. To change them, update the config file in your repo and release a new version via the Tinfoil Release workflow. The CLI --variable KEY=VALUE flags and Admin API variables object set a separate per-instance map. When supplied to start or relaunch, they replace that entire saved map; omitted variables preserve it. They do not replace the measured env values in the selected release.

​
Reserved variables

DOMAIN is a reserved environment variable set to your container’s public domain. Tinfoil populates it automatically at deploy time and uses it to bind the enclave’s attested identity and TLS certificate to your domain, and to scope request validation. You don’t need to set it — and you shouldn’t define your own DOMAIN in env, since it’s managed for you.

​
Secrets

Secrets are stored in AWS Secrets Manager and injected into your container as environment variables at deploy time. They are not exposed in the dashboard UI or your Git repository.

​
Scopes

Organization secrets are available to every repository in your organization. Repository secrets are available only to containers deployed from one owner/repo. The same name can exist in different repositories, with a different value in each. A name cannot be shared between organization and repository scope within the same organization.

​
Creating

To create an organization secret:
  1. Go to the Secrets tab in the Containers section of the dashboard
  2. Click Add Secret
  3. Enter a name (e.g. DATABASE_URL) and value
  4. Click Save
To create a repository secret, open the repository in the Repositories tab and add it in the Repository secrets section.

​
Referencing

List secret names in the secrets field of your container spec. At deploy time, Tinfoil resolves each name from the container’s repository secrets or the organization secrets:
tinfoil-config.yml
When deploying a container, the dashboard shows which secrets your config references. If your config references a secret that doesn’t exist yet, the dashboard warns you and prevents deployment until it’s created.

​
Updating

Edit a secret’s value in the Secrets tab or the repository’s Repository secrets section at any time. Updating a secret does not automatically update running containers. To pick up the new value you must redeploy. CPU-only and single-GPU instances use the blue-green flow without downtime; multi-GPU instances use a disruptive delete-and-queue update.
The dashboard shows a stale secrets indicator on containers that were deployed before their secrets were last updated.

​
Deleting

You cannot delete a secret that is referenced by any container in its scope. The dashboard shows which containers are using it. Remove the secret from those deployments, then delete it.

​
Using the CLI

The Tinfoil CLI manages organization secrets with tinfoil secret:
Manage repository secrets from the repository’s Repository secrets section under Containers → Repositories in the dashboard. Reference secrets at deploy time with --secret NAME on tinfoil container create, relaunch, or start. See the CLI secrets section for details.