Secret files
Some secrets are files, not single values — a Google service-account JSON, a .pem key, a config file. Secret files let you store these encrypted and mount them into your service’s filesystem at deploy time.
How they work
Section titled “How they work”Add a secret file with a name and its contents. Helicarrier stores the contents encrypted and, at deploy, mounts the file read-only into your container at /etc/secrets/<filename>. Your app reads it from disk like any other file.
Dot-prefixed names (like .env) are allowed, so you can mount a full .env file if your framework expects one.
Custom mount path
Section titled “Custom mount path”By default a file lands at /etc/secrets/<name>. If your app expects it elsewhere, set a custom mount path (an absolute path such as /app/config/service-account.json) and Helicarrier mounts it there instead.
Group-level and service-level
Section titled “Group-level and service-level”Secret files come in two scopes:
- Environment group files — attach a file to an environment group and every service using that group gets it. Good for a shared credential.
- Service-direct files — attach a file to a single service without a group. A service-direct file overrides a group file of the same name, so a service can carry its own version.
When to use a secret file vs a variable
Section titled “When to use a secret file vs a variable”- Use an environment variable for a single value your app reads from the environment.
- Use a secret file when your app or an SDK expects a file on disk (many cloud SDKs read a credentials file by path).
- For single values, see Environment variables.
- Bulk-manage configuration with Import & export.