Skip to content

Secret files

Some secrets are files, not single values — a Google service-account JSON, a .pem key, a config file. Secret files let you store these encrypted and mount them into your service’s filesystem at deploy time.

Add a secret file with a name and its contents. Helicarrier stores the contents encrypted and, at deploy, mounts the file read-only into your container at /etc/secrets/<filename>. Your app reads it from disk like any other file.

Dot-prefixed names (like .env) are allowed, so you can mount a full .env file if your framework expects one.

By default a file lands at /etc/secrets/<name>. If your app expects it elsewhere, set a custom mount path (an absolute path such as /app/config/service-account.json) and Helicarrier mounts it there instead.

Secret files come in two scopes:

  • Environment group files — attach a file to an environment group and every service using that group gets it. Good for a shared credential.
  • Service-direct files — attach a file to a single service without a group. A service-direct file overrides a group file of the same name, so a service can carry its own version.
  • Use an environment variable for a single value your app reads from the environment.
  • Use a secret file when your app or an SDK expects a file on disk (many cloud SDKs read a credentials file by path).