[{"data":1,"prerenderedAt":818},["ShallowReactive",2],{"docs-nav":3,"docs:\u002Fdocs\u002Fsecret-delivery":139},[4,7,10,13,16,19,22,25,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130,133,136],{"path":5,"title":6},"\u002Fdocs\u002Faccess-gating","Protect a local route",{"path":8,"title":9},"\u002Fdocs\u002Farchitecture\u002Fsecurity-and-trust","Security and trust",{"path":11,"title":12},"\u002Fdocs\u002Fconcepts\u002Fbuilds-and-deployments","Build and deploy",{"path":14,"title":15},"\u002Fdocs\u002Fconcepts\u002Fconfiguration-ownership","Where configuration belongs",{"path":17,"title":18},"\u002Fdocs\u002Fconcepts\u002Fenvironments-and-secrets","Environment values and secrets",{"path":20,"title":21},"\u002Fdocs\u002Fconcepts\u002Fmental-model","How projects fit together",{"path":23,"title":24},"\u002Fdocs\u002Fconcepts\u002Fplans-and-apply","Plans and apply",{"path":26,"title":27},"\u002Fdocs\u002Fconcepts\u002Ftargets-and-runtimes","Choose a target and runtime",{"path":29,"title":30},"\u002Fdocs\u002Fcontribute\u002Freleases","Publish a release",{"path":32,"title":33},"\u002Fdocs\u002Fdevelopment-mounts","Development mounts",{"path":35,"title":36},"\u002Fdocs\u002Fgetting-started","Getting started",{"path":38,"title":39},"\u002Fdocs\u002Fhelp\u002Ffaq","FAQ",{"path":41,"title":42},"\u002Fdocs\u002Fhelp\u002Ftroubleshooting","Troubleshooting",{"path":44,"title":45},"\u002Fdocs\u002Fhow-to\u002Fdeploy-production","Prepare a deployment environment",{"path":47,"title":48},"\u002Fdocs\u002Fhow-to\u002Fswarm-cluster","Run on a multi-node Swarm",{"path":50,"title":51},"\u002Fdocs","mm documentation",{"path":53,"title":54},"\u002Fdocs\u002Fjobs-and-schedules","Jobs and schedules",{"path":56,"title":57},"\u002Fdocs\u002Flocal-dashboard","Local dashboard",{"path":59,"title":60},"\u002Fdocs\u002Flocal-https","Local HTTPS",{"path":62,"title":63},"\u002Fdocs\u002Flocal-services","Local services",{"path":65,"title":66},"\u002Fdocs\u002Fmcp","Let an AI agent work on your project",{"path":68,"title":69},"\u002Fdocs\u002Fmulti-project-hosts","Run multiple projects on one host",{"path":71,"title":72},"\u002Fdocs\u002Fonboarding","Set up a project",{"path":74,"title":75},"\u002Fdocs\u002Fopenbao","Use OpenBao",{"path":77,"title":78},"\u002Fdocs\u002Fproject\u002Fcontributing","Contributing",{"path":80,"title":81},"\u002Fdocs\u002Fproject\u002Flicense","License",{"path":83,"title":84},"\u002Fdocs\u002Fproject\u002Fsecurity","Security",{"path":86,"title":87},"\u002Fdocs\u002Freference\u002Fcapability-matrix","Supported features and platforms",{"path":89,"title":90},"\u002Fdocs\u002Freference\u002Fcli","CLI command reference",{"path":92,"title":93},"\u002Fdocs\u002Freference\u002Fconfiguration","Configuration",{"path":95,"title":96},"\u002Fdocs\u002Freference\u002Fenvironment-variables","Environment variables",{"path":98,"title":99},"\u002Fdocs\u002Freference\u002Ferrors-and-exit-codes","Errors and exit codes",{"path":101,"title":102},"\u002Fdocs\u002Freference\u002Fknown-issues","Known limitations",{"path":104,"title":105},"\u002Fdocs\u002Fremote-access","Manage remote access",{"path":107,"title":108},"\u002Fdocs\u002Fremote-daemon","Set up a remote host",{"path":110,"title":111},"\u002Fdocs\u002Fruntime-observability","Status, logs, and commands",{"path":113,"title":114},"\u002Fdocs\u002Fsecret-delivery","Pass secrets to your app",{"path":116,"title":117},"\u002Fdocs\u002Fsecret-providers","Choose a secret store",{"path":119,"title":120},"\u002Fdocs\u002Fstart\u002Finstall","Install mm",{"path":122,"title":123},"\u002Fdocs\u002Fterminal-ui","Terminal UI",{"path":125,"title":126},"\u002Fdocs\u002Ftutorials\u002Fdotnet-web-api",".NET web API example",{"path":128,"title":129},"\u002Fdocs\u002Ftutorials\u002Ffirst-local-app","First local app",{"path":131,"title":132},"\u002Fdocs\u002Ftutorials\u002Flaravel-rust","Laravel and Rust example",{"path":134,"title":135},"\u002Fdocs\u002Ftutorials\u002Fnode-fullstack","Node full stack example",{"path":137,"title":138},"\u002Fdocs\u002Fvault","Use HashiCorp Vault",{"id":140,"title":114,"body":141,"description":812,"extension":813,"meta":814,"navigation":207,"path":113,"seo":815,"stem":816,"__hash__":817},"docs\u002Fdocs\u002Fsecret-delivery.md",{"type":142,"value":143,"toc":807},"minimark",[144,148,153,156,235,251,260,307,310,314,317,590,593,596,661,664,671,674,714,717,721,734,740,800,803],[145,146,147],"p",{},"Choose where a secret is stored with its provider declaration. Separately,\nchoose how your app reads it: as an environment variable or a mounted file.\nYou can change delivery without moving to a different secret store.",[149,150,152],"h2",{"id":151},"environment-delivery","Environment delivery",[145,154,155],{},"Secret-backed environment bindings use the environment's selected delivery\nmode along with non-secret values:",[157,158,163],"pre",{"className":159,"code":160,"language":161,"meta":162,"style":162},"language-yaml shiki shiki-themes mm","environment-delivery:\n  default: direct\n  development-default: env-file\n\nenvironments:\n  production:\n    environment-delivery: direct\n","yaml","",[164,165,166,178,191,202,209,217,225],"code",{"__ignoreMap":162},[167,168,171,174],"span",{"class":169,"line":170},"line",1,[167,172,151],{"class":173},"sWZmh",[167,175,177],{"class":176},"sIbZ0",":\n",[167,179,181,184,187],{"class":169,"line":180},2,[167,182,183],{"class":173},"  default",[167,185,186],{"class":176},":",[167,188,190],{"class":189},"sv8ni"," direct\n",[167,192,194,197,199],{"class":169,"line":193},3,[167,195,196],{"class":173},"  development-default",[167,198,186],{"class":176},[167,200,201],{"class":189}," env-file\n",[167,203,205],{"class":169,"line":204},4,[167,206,208],{"emptyLinePlaceholder":207},true,"\n",[167,210,212,215],{"class":169,"line":211},5,[167,213,214],{"class":173},"environments",[167,216,177],{"class":176},[167,218,220,223],{"class":169,"line":219},6,[167,221,222],{"class":173},"  production",[167,224,177],{"class":176},[167,226,228,231,233],{"class":169,"line":227},7,[167,229,230],{"class":173},"    environment-delivery",[167,232,186],{"class":176},[167,234,190],{"class":189},[236,237,238,245],"ul",{},[239,240,241,244],"li",{},[164,242,243],{},"direct"," passes values through the runtime process environment.",[239,246,247,250],{},[164,248,249],{},"env-file"," writes private temporary environment files for the operation.",[145,252,253,254,256,257,259],{},"When a development environment is declared, it defaults to ",[164,255,249],{}," and other\nenvironments default to ",[164,258,243],{},". Inspect the actual setting:",[157,261,265],{"className":262,"code":263,"language":264,"meta":162,"style":162},"language-sh shiki shiki-themes mm","mm env delivery show\nmm env review\nmm env delivery set production direct\n","sh",[164,266,267,282,291],{"__ignoreMap":162},[167,268,269,273,276,279],{"class":169,"line":170},[167,270,272],{"class":271},"svrjQ","mm",[167,274,275],{"class":189}," env",[167,277,278],{"class":189}," delivery",[167,280,281],{"class":189}," show\n",[167,283,284,286,288],{"class":169,"line":180},[167,285,272],{"class":271},[167,287,275],{"class":189},[167,289,290],{"class":189}," review\n",[167,292,293,295,297,299,302,305],{"class":169,"line":193},[167,294,272],{"class":271},[167,296,275],{"class":189},[167,298,278],{"class":189},[167,300,301],{"class":189}," set",[167,303,304],{"class":189}," production",[167,306,190],{"class":189},[145,308,309],{},"Environment variables are visible to the process and may be exposed by\napplication diagnostics or privileged runtime inspection. Use mounted files\nwhen the application supports them and narrower exposure matters.",[149,311,313],{"id":312},"file-delivery","File delivery",[145,315,316],{},"Declare file consumers under the service. The map key is the file name under\nthe runtime's secret directory, not a host path:",[157,318,320],{"className":159,"code":319,"language":161,"meta":162,"style":162},"schema-version: 1\nproject:\n  id: 019c527b-6242-7b43-bfd4-bd60e27c1de3\n  name: secret-files\ntarget: local\nstacks:\n  app:\n    files: [compose.yaml]\nmodules:\n  api:\n    path: api\n    services:\n      api:\n        stack: app\n        secret-files:\n          database-password:\n            secret: database.password\n            uid: \"0\"\n            gid: \"0\"\n            mode: 292 # decimal form of 0444\nsecrets:\n  database.password:\n    storage:\n      provider: age\n      location: local\u002Fdatabase-password\nenvironments:\n  local:\n    bindings: {}\n",[164,321,322,333,340,350,360,370,377,384,401,409,417,428,436,444,455,463,471,482,493,503,518,526,534,542,553,564,571,579],{"__ignoreMap":162},[167,323,324,327,329],{"class":169,"line":170},[167,325,326],{"class":173},"schema-version",[167,328,186],{"class":176},[167,330,332],{"class":331},"s1Wbj"," 1\n",[167,334,335,338],{"class":169,"line":180},[167,336,337],{"class":173},"project",[167,339,177],{"class":176},[167,341,342,345,347],{"class":169,"line":193},[167,343,344],{"class":173},"  id",[167,346,186],{"class":176},[167,348,349],{"class":189}," 019c527b-6242-7b43-bfd4-bd60e27c1de3\n",[167,351,352,355,357],{"class":169,"line":204},[167,353,354],{"class":173},"  name",[167,356,186],{"class":176},[167,358,359],{"class":189}," secret-files\n",[167,361,362,365,367],{"class":169,"line":211},[167,363,364],{"class":173},"target",[167,366,186],{"class":176},[167,368,369],{"class":189}," local\n",[167,371,372,375],{"class":169,"line":219},[167,373,374],{"class":173},"stacks",[167,376,177],{"class":176},[167,378,379,382],{"class":169,"line":227},[167,380,381],{"class":173},"  app",[167,383,177],{"class":176},[167,385,387,390,392,395,398],{"class":169,"line":386},8,[167,388,389],{"class":173},"    files",[167,391,186],{"class":176},[167,393,394],{"class":176}," [",[167,396,397],{"class":189},"compose.yaml",[167,399,400],{"class":176},"]\n",[167,402,404,407],{"class":169,"line":403},9,[167,405,406],{"class":173},"modules",[167,408,177],{"class":176},[167,410,412,415],{"class":169,"line":411},10,[167,413,414],{"class":173},"  api",[167,416,177],{"class":176},[167,418,420,423,425],{"class":169,"line":419},11,[167,421,422],{"class":173},"    path",[167,424,186],{"class":176},[167,426,427],{"class":189}," api\n",[167,429,431,434],{"class":169,"line":430},12,[167,432,433],{"class":173},"    services",[167,435,177],{"class":176},[167,437,439,442],{"class":169,"line":438},13,[167,440,441],{"class":173},"      api",[167,443,177],{"class":176},[167,445,447,450,452],{"class":169,"line":446},14,[167,448,449],{"class":173},"        stack",[167,451,186],{"class":176},[167,453,454],{"class":189}," app\n",[167,456,458,461],{"class":169,"line":457},15,[167,459,460],{"class":173},"        secret-files",[167,462,177],{"class":176},[167,464,466,469],{"class":169,"line":465},16,[167,467,468],{"class":173},"          database-password",[167,470,177],{"class":176},[167,472,474,477,479],{"class":169,"line":473},17,[167,475,476],{"class":173},"            secret",[167,478,186],{"class":176},[167,480,481],{"class":189}," database.password\n",[167,483,485,488,490],{"class":169,"line":484},18,[167,486,487],{"class":173},"            uid",[167,489,186],{"class":176},[167,491,492],{"class":189}," \"0\"\n",[167,494,496,499,501],{"class":169,"line":495},19,[167,497,498],{"class":173},"            gid",[167,500,186],{"class":176},[167,502,492],{"class":189},[167,504,506,509,511,514],{"class":169,"line":505},20,[167,507,508],{"class":173},"            mode",[167,510,186],{"class":176},[167,512,513],{"class":331}," 292",[167,515,517],{"class":516},"sP7nD"," # decimal form of 0444\n",[167,519,521,524],{"class":169,"line":520},21,[167,522,523],{"class":173},"secrets",[167,525,177],{"class":176},[167,527,529,532],{"class":169,"line":528},22,[167,530,531],{"class":173},"  database.password",[167,533,177],{"class":176},[167,535,537,540],{"class":169,"line":536},23,[167,538,539],{"class":173},"    storage",[167,541,177],{"class":176},[167,543,545,548,550],{"class":169,"line":544},24,[167,546,547],{"class":173},"      provider",[167,549,186],{"class":176},[167,551,552],{"class":189}," age\n",[167,554,556,559,561],{"class":169,"line":555},25,[167,557,558],{"class":173},"      location",[167,560,186],{"class":176},[167,562,563],{"class":189}," local\u002Fdatabase-password\n",[167,565,567,569],{"class":169,"line":566},26,[167,568,214],{"class":173},[167,570,177],{"class":176},[167,572,574,577],{"class":169,"line":573},27,[167,575,576],{"class":173},"  local",[167,578,177],{"class":176},[167,580,582,585,587],{"class":169,"line":581},28,[167,583,584],{"class":173},"    bindings",[167,586,186],{"class":176},[167,588,589],{"class":176}," {}\n",[145,591,592],{},"The deployment plan shows secret names, versions, permissions, and consuming\nservices, without printing values. If a secret changes after review, make a\nnew plan.",[145,594,595],{},"Runtime behavior differs:",[597,598,599,614],"table",{},[600,601,602],"thead",{},[603,604,605,609,611],"tr",{},[606,607,608],"th",{},"Runtime",[606,610,313],{},[606,612,613],{},"Important constraint",[615,616,617,629,640],"tbody",{},[603,618,619,623,626],{},[620,621,622],"td",{},"Podman Compose",[620,624,625],{},"Versioned native Podman secret",[620,627,628],{},"Native store; UID\u002FGID\u002Fmode supported",[603,630,631,634,637],{},[620,632,633],{},"Docker Swarm",[620,635,636],{},"Versioned immutable Swarm secret",[620,638,639],{},"Available on every node; UID\u002FGID\u002Fmode supported",[603,641,642,645,648],{},[620,643,644],{},"Docker Compose",[620,646,647],{},"Private operation-scoped source file",[620,649,650,651,654,655,657,658],{},"No native store; requires UID ",[164,652,653],{},"0",", GID ",[164,656,653],{},", mode ",[164,659,660],{},"0444",[145,662,663],{},"Podman and Swarm receive material on standard input. Rotation creates a new\nowned revision, updates workloads, and retains the previous revision for\nrollback. Inspection and cleanup use labels and metadata and do not read secret\ncontent.",[145,665,666,667,670],{},"Docker Compose writes a ",[164,668,669],{},"0600"," source in a private operation directory and\nremoves the path after container creation; the mounted inode remains available\nto that container. Compose cannot enforce requested file ownership or mode, so\nother values fail before material is written. Rotation also fails early when a\nrollback-safe update cannot be guaranteed.",[145,672,673],{},"Check metadata without revealing values:",[157,675,677],{"className":262,"code":676,"language":264,"meta":162,"style":162},"mm secret status\nmm env review\nmm deploy plan --output json\n",[164,678,679,689,697],{"__ignoreMap":162},[167,680,681,683,686],{"class":169,"line":170},[167,682,272],{"class":271},[167,684,685],{"class":189}," secret",[167,687,688],{"class":189}," status\n",[167,690,691,693,695],{"class":169,"line":180},[167,692,272],{"class":271},[167,694,275],{"class":189},[167,696,290],{"class":189},[167,698,699,701,704,707,711],{"class":169,"line":193},[167,700,272],{"class":271},[167,702,703],{"class":189}," deploy",[167,705,706],{"class":189}," plan",[167,708,710],{"class":709},"sbRf1"," --output",[167,712,713],{"class":189}," json\n",[145,715,716],{},"These views omit credentials and secret values. Host and container-engine\nadministrators can still access secrets used by workloads.",[149,718,720],{"id":719},"build-secrets","Build secrets",[145,722,723,724,727,728,733],{},"For sensitive build inputs, use ",[164,725,726],{},"modules.\u003Cname>.build.secrets"," to map a BuildKit\nsecret ID to a declared mm secret. Do not use public build arguments for tokens.\nmm passes build secrets through private files after plan review. See the\n",[729,730,732],"a",{"href":731},".\u002Freference\u002Fconfiguration#modules-services-and-builds","build configuration reference",".",[145,735,736,737,186],{},"A build secret can change the image, and its value can differ between\nenvironments, so mm never reuses or promotes a build that mounts one. When a\nsecret only authenticates fetching inputs, such as a Composer or npm token for\nprivate packages, list it under ",[164,738,739],{},"credential-only-secrets",[157,741,743],{"className":159,"code":742,"language":161,"meta":162,"style":162},"modules:\n  web:\n    build:\n      secrets: { composer_auth: composer.auth }\n      credential-only-secrets: [composer_auth]\n",[164,744,745,751,758,765,786],{"__ignoreMap":162},[167,746,747,749],{"class":169,"line":170},[167,748,406],{"class":173},[167,750,177],{"class":176},[167,752,753,756],{"class":169,"line":180},[167,754,755],{"class":173},"  web",[167,757,177],{"class":176},[167,759,760,763],{"class":169,"line":193},[167,761,762],{"class":173},"    build",[167,764,177],{"class":176},[167,766,767,770,772,775,778,780,783],{"class":169,"line":204},[167,768,769],{"class":173},"      secrets",[167,771,186],{"class":176},[167,773,774],{"class":176}," {",[167,776,777],{"class":173}," composer_auth",[167,779,186],{"class":176},[167,781,782],{"class":189}," composer.auth",[167,784,785],{"class":176}," }\n",[167,787,788,791,793,795,798],{"class":169,"line":211},[167,789,790],{"class":173},"      credential-only-secrets",[167,792,186],{"class":176},[167,794,394],{"class":176},[167,796,797],{"class":189},"composer_auth",[167,799,400],{"class":176},[145,801,802],{},"The secret is still mounted, but it is left out of the build fingerprint, so the\nsame inputs reuse the same image whoever builds them and however often the token\nrotates. Only list a secret here when the image does not depend on its value.",[804,805,806],"style",{},"html pre.shiki code .sWZmh, html code.shiki .sWZmh{--shiki-default:var(--mm-code-key)}html pre.shiki code .sIbZ0, html code.shiki .sIbZ0{--shiki-default:var(--mm-code-punctuation)}html pre.shiki code .sv8ni, html code.shiki .sv8ni{--shiki-default:var(--mm-code-string)}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .svrjQ, html code.shiki .svrjQ{--shiki-default:var(--mm-code-function)}html pre.shiki code .s1Wbj, html code.shiki .s1Wbj{--shiki-default:var(--mm-code-constant)}html pre.shiki code .sP7nD, html code.shiki .sP7nD{--shiki-default:var(--mm-code-comment)}html pre.shiki code .sbRf1, html code.shiki .sbRf1{--shiki-default:var(--mm-code-option)}",{"title":162,"searchDepth":180,"depth":180,"links":808},[809,810,811],{"id":151,"depth":180,"text":152},{"id":312,"depth":180,"text":313},{"id":719,"depth":180,"text":720},"Choose environment variables or mounted files for application secrets.","md",{},{"title":114,"description":812},"docs\u002Fsecret-delivery","IMF4KIwJSLzRChv5dyfjfxXm_wRfeymdaWLBoX5GnF0",1794512546198]