Skip to content
Brig docs

Secrets

Secrets are workspace-scoped named values you reference from a workload instead of hardcoding them in TOML or env files. Brig seals them at rest under your tenant key and injects them into containers as environment variables at deploy time.

Create a secret

Section titled “Create a secret”

The value never goes on the command line — that would leak it through /proc/cmdline and shell history. Pass it out-of-band with exactly one of --from-file, --from-env, or --from-stdin:

Terminal window
# from a file (trailing newline trimmed)
brig secret create db-password --from-file ./db-password.txt


# from an environment variable
export DB_PASSWORD='s3cr3t'
brig secret create db-password --from-env DB_PASSWORD


# piped on stdin
printf 's3cr3t' | brig secret create db-password --from-stdin

create is upsert — run it again with the same name to rotate the value.

Reference from a workload

Section titled “Reference from a workload”

List the secret names you want injected. Each becomes an environment variable of the same name inside the container:

name    = "api"
image   = "ghcr.io/me/api:v13"
secrets = ["db-password", "stripe-key"]

Secret names can’t collide with keys in the inline env map. Values are wrapped on the wire and only unsealed inside the workload’s environment — they never appear in brig output.

List and delete

Section titled “List and delete”
Terminal window
brig secret list                 # names and last-updated only — never values
brig secret delete db-password

There is no command that prints a secret’s value back; once stored it’s write-only from the CLI’s perspective.

Private registry images

Section titled “Private registry images”

Workload secrets are for values your app consumes. Credentials for pulling a private image are configured separately, in the dashboard under Settings → Registries (not via the CLI — there is no brig registry command, despite what older docs claimed).

Add the registry host, username, and password once. When a workload’s image starts with a registered host — e.g. ghcr.io/acme/api:v13 — Brig attaches those credentials to the agent’s docker pull automatically:

image = "ghcr.io/acme/private-api:v13"   # pulled with stored ghcr.io credentials

Public images need nothing. Common hosts: ghcr.io, docker.io (Docker Hub private), registry.gitlab.com, AWS ECR endpoints, and self-hosted registries.