Skip to main content

Environment variables

Configuration reaches your application as environment variables — the ones you set, and the ones bound services inject.

Setting variables​

cf set-env orders-api LOG_LEVEL debug
cf restart orders-api

The restart is required. Environment changes apply when the app starts, so a set-env against a running app has no effect until you restart it. The CLI reminds you; it is still the most common thing people forget.

Reading what is set​

cf env orders-api

This shows variables you set, variables injected by service bindings, and the ones the platform provides.

Removing a variable​

cf unset-env orders-api LOG_LEVEL
cf restart orders-api

Setting them at push time​

In manifest.yml, so the configuration travels with the app:

applications:
  - name: orders-api
    env:
      NODE_ENV: production
      LOG_LEVEL: info

Platform-provided variables​

VariableWhat it is
PORTThe port your app must listen on
MEMORY_LIMITThe memory limit for this instance
CF_INSTANCE_INDEXWhich instance this is — 0, 1, 2…
VCAP_SERVICESFull details of every bound service, as JSON
VCAP_APPLICATIONMetadata about the app itself

CF_INSTANCE_INDEX is useful when exactly one instance should do something — a scheduled job, a migration — without introducing a lock:

if (process.env.CF_INSTANCE_INDEX === '0') {
  startScheduler();
}

Service credentials​

Binding a service injects its credentials. Most services also provide a convenient single-variable form, such as DATABASE_URL for Postgres.

The full detail is always in VCAP_SERVICES, which is JSON:

const services = JSON.parse(process.env.VCAP_SERVICES);
const db = services.postgres[0].credentials;

Prefer the simple variable when it exists; reach for VCAP_SERVICES when you need something it does not expose, such as a specific host or port.

Secrets​

Environment variables are the mechanism for secrets today, and they are visible to anyone with access to the space. Scope space membership accordingly.

note

A dedicated secret store, separate from ordinary configuration, is not available yet. If your compliance posture requires one, raise it with us — it is a known gap rather than a decision.