Secrets

A secret is encrypted when saved and cannot be read back, only replaced or deleted. Bound to a computer, it reaches that computer’s desktop session as an environment variable or a file. Manage them in Settings or with the Secrets endpoints, and bind them to a computer with PUT /computers/{id}/secrets.

A replaced value is sent, best effort, to a running computer bound to it as a file, which replaces the file in place. Bound as an environment variable, on an image that supports it, it reaches new shells and every exec, plain (run as root) or with session: "desktop", so the next one sees it; programs already running, the desktop session among them, keep the value they started with until a restart, and older images wait for the restart. A change to which secrets a computer holds, or to the names they are published under, reaches its desktop at its next start or restart; a suspended computer resumes with the values it had. On an image that supports it, a changed set of environment variables is also sent, best effort, to a running computer: new shells and every exec see it, with a removed one unset. A file newly bound or renamed waits for the restart.

Deleting a secret is not refused while computers are bound to it, and the settings page lists them before you confirm. A computer still bound to a deleted secret will not start until that binding is removed from the computer’s secrets. Remove it in the computer’s Settings > Secrets, or with PUT /computers/{id}/secrets; a deleted secret cannot be replaced, and one created with the same name is a new secret with a new id. A computer left in a deleted workspace needs all of its bindings removed, with that call.

On any host that seals saved sessions, a computer with secrets bound restarts — from the dashboard, the API or inside it — and gets its secrets again as it comes back up; restarting a stopped one is refused, so start it instead, which delivers them. It suspends, by hand or when idle, and can be memory-snapshotted. A disk snapshot restored onto it starts it with its secrets delivered afresh; a memory snapshot resumes holding what it held when it was taken, and one taken without sealing is refused. Taking disk snapshots, cloning, moving between hosts and deletion work as usual. A clone starts with no secrets bound — a clone of one of its memory snapshots is built from the disk alone, lands stopped and boots fresh when you start it, unless you fork it with its secrets — and a computer you had running starts again by itself on the new host; one you had stopped stays stopped. Where the platform delivers secrets, a computer is started again automatically after a host restart; otherwise it stays stopped until you start it.