Understand Environment Variables for Better DevOps

Most production bugs I’ve seen around environment variables aren’t caused by missing values. They’re caused by misunderstanding what environment variables actually are. A few things that have burned teams I know: - Environment variables are an OS primitive. Every process gets a flat key-value copy of its parent’s environment. A copy, not a reference. What your child process changes, your parent never sees. - Your .env file does nothing on its own. Something has to read it. And most tools, including dotenv, will NOT overwrite a variable that already exists. So if your shell profile already exports DATABASE_URL, your .env is silently ignored. This is probably the most common “works on my machine” culprit. - Docker starts with a clean slate. It does not inherit your shell environment. If you’re not explicitly passing variables with -e or –env-file, the container doesn’t know they exist. - React’s process.env is not real runtime config. The bundler replaces every reference with a literal string at build time. That value is now hardcoded in the JavaScript your users download. If you put a secret in REACT_APP_anything or NEXT_PUBLIC_anything, it is not a secret anymore. - Build time and runtime are fundamentally different. A frontend bundle bakes values in at build time. An Express server reads the actual process environment when it starts. You can change a backend variable and restart. You cannot do that with a bundled frontend without rebuilding. Deleted a committed secret in the next commit? The key is still in git history. git show will find it. The only fix is to rotate the credential. The mental model that fixes most of this: secrets always runtime, never build time, never committed to source code. #SoftwareEngineering #DevOps #WebDevelopment #BackendDevelopment #JavaScript #Docker #NodeJS #EngineeringLeadership

  • No alternative text description for this image

To view or add a comment, sign in

Explore content categories