Skip to main content

​
What to use when

Tinfoil Containers supports two different kinds of configuration values:
Secret values are accessible to Tinfoil infrastructure during deployment. If your threat model requires that Tinfoil cannot access certain values, use private secrets (Beta), which are released to the enclave by a keyserver you run.
Measured env values are set in tinfoil-config.yml. CLI and Admin API variables are a separate saved per-instance map. Secret values are managed outside the config in the dashboard or API.
Declaring a secret in tinfoil-config.yml does not create its value. For managed delivery, create the value in organization or project scope before deploying. Declared secrets that exist in that scope are included automatically. On create, --secret NAME explicitly selects additional secrets. On deploy or update, supplying --secret replaces the entire saved manual selection before merging declared secrets: repeat the flag for every manually selected name you still need, not just the new one. Omitting the flag preserves the saved selection. Check that every secret your application needs is available rather than relying on a missing value being injected. These creation and selection instructions are for Tinfoil-managed secrets. For non-debug configs with keyserver-url, keep declared workload, model, and volume secrets in your own keyserver instead. Do not upload or select them here. See private secrets, including explicit clearing of managed bindings when changing delivery mode. Debug mode intentionally uses managed delivery even if keyserver-url is present.

​
Environment variables

​
Config File

Define environment variables in the env field of your container configuration file:
tinfoil-config.yml

​
Dashboard

During deployment, the dashboard displays the environment variables (and secret names) defined in your tinfoil-config.yml. These values are read-only. To change them, update the config file in your repo and release a new version via the Tinfoil Release workflow. The CLI --variable KEY=VALUE flags and Admin API variables object set a separate per-instance map. When supplied to deploy or update, they replace that entire saved map; omitted variables preserve it. They do not replace the measured env values in the selected release.

​
Reserved variables

Tinfoil sets the reserved DOMAIN environment variable to your container’s public domain at deploy time. It uses this value to bind the enclave’s attested identity and TLS certificate to your domain and to scope request validation. Don’t define your own DOMAIN in env.

​
Secrets

Secrets are stored in AWS Secrets Manager and injected into your container as environment variables at deploy time. They are not exposed in the dashboard UI or your Git repository.

​
Scopes

Organization secrets are available to every project in your organization. Project secrets are available only to instances using that project’s config repository (owner/repo). The same name can exist in different projects, with a different value in each. A name cannot be shared between organization and project scope within the same organization.

​
Creating

To create an organization secret:
  1. Go to the Secrets tab in the Containers section of the dashboard
  2. Click Add Secret
  3. Enter a name (e.g. DATABASE_URL) and value
  4. Click Save
To create a project-scoped secret, open the repository’s config editor under Containers and add it in Project secrets, or use tinfoil repo secret create owner/repo NAME --value-file ./secret-value from the CLI.

​
Referencing

List secret names in the secrets field of your container spec. At deploy time, Tinfoil resolves each name from the instance’s project secrets or the organization secrets:
tinfoil-config.yml
When deploying a container, the dashboard shows which secrets your config references. If your config references a secret that doesn’t exist yet, the dashboard warns you and prevents deployment until it’s created.

​
Updating

Edit a secret’s value in the Secrets tab or the repository’s Project secrets section at any time. Updating a secret does not automatically update running containers. To pick up the new value, update the container. Blue/green containers switch over without downtime; containers that must be replaced go down while the new version deploys.
The dashboard shows a stale secrets indicator on containers that were deployed before their secrets were last updated.

​
Deleting

You cannot delete a secret that is referenced by any container in its scope. The dashboard shows which containers are using it. Remove the secret from those instances, then delete it.

​
Using the CLI

The Tinfoil CLI manages organization secrets with tinfoil secret:
Project secrets use tinfoil repo secret with the same subcommands, prefixed by the project’s config repository:
Reference secrets with --secret NAME on tinfoil container create, deploy, or update. See the CLI secrets section for details.