Environment variables
This page lists every environment variable Alien sets in a Worker, Container, or Daemon (the resources that run your code), how to add your own variables and secrets, and which names are reserved.
Bindings
Each linked resource gets one variable holding its binding as JSON:
ALIEN_<ID>_BINDINGThe resource id is uppercased and - becomes _: linking Storage user-files sets ALIEN_USER_FILES_BINDING. The SDK reads these, so storage("user-files") resolves without configuration.
- A Worker or Container also gets its own binding.
- Cloud bindings carry no credentials. The workload's identity authorizes each call.
For features the Alien bindings don't cover, such as DynamoDB streams or Pub/Sub ordering keys, read the JSON yourself and call the cloud's own SDK, in any language. Both work side by side in one workload:
import json, os, boto3
binding = json.loads(os.environ["ALIEN_DOCUMENTS_BINDING"])
if binding["service"] == "s3":
boto3.client("s3").get_object(Bucket=binding["bucketName"], Key="contracts/msa.pdf")Injected variables
| Variable | Set in | Value |
|---|---|---|
ALIEN_DEPLOYMENT_TYPE | All | Platform: aws, gcp, azure, kubernetes, machines, or local |
ALIEN_DEPLOYMENT_ID, ALIEN_DEPLOYMENT_NAME | All | The deployment |
ALIEN_RESOURCE_ID | All | This workload's resource id |
ALIEN_PUBLIC_ENDPOINTS_JSON | Workloads with public endpoints | Endpoint names and URLs |
ALIEN_MANAGER_URL, ALIEN_DEPLOYMENT_TOKEN | Where the deployment talks to its manager | URL of the manager (the Alien service that updates the deployment) and the deployment's token for it |
ALIEN_CURRENT_WORKER_BINDING_NAME | Worker | The Worker's own binding name |
ALIEN_CURRENT_CONTAINER_BINDING_NAME | Container | The Container's own binding name |
ALIEN_TRANSPORT | Worker | lambda, cloud-run, container-app, http, or local |
ALIEN_LAMBDA_MODE | Worker on AWS | buffered |
ALIEN_WORKER_GRPC_ADDRESS | Worker | Address of the Worker runtime the SDK connects to |
ALIEN_WORKER_TIMEOUT_SECONDS | Worker | The configured timeout |
ALIEN_QUEUE_BATCH_CONFIG | Worker with a batched queue trigger | Batch limits per queue |
ALIEN_RUNTIME_SEND_OTLP | Worker | true |
ALIEN_AI_GATEWAY_URL | Workloads linked to an AI resource | Local endpoint. Append /<name>/v1. |
ALIEN_SECRETS, ALIEN_RUNTIME_SECRETS, ALIEN_SECRET_ENV_REVISION | Workloads with secret variables | Where secrets are loaded from, and a revision that rolls workloads when values change |
Commands
Set on Workers, Containers, and Daemons with .commandsEnabled(true). createCommandReceiver() reads them.
| Variable | Value |
|---|---|
ALIEN_COMMANDS_URL | Command API base URL |
ALIEN_COMMANDS_TOKEN, ALIEN_COMMANDS_TOKEN_FILE | Receiver token, or a file holding it (re-read after a 401) |
ALIEN_COMMANDS_TARGET_RESOURCE_ID, ALIEN_COMMANDS_TARGET_RESOURCE_TYPE | The resource commands are leased for (container or daemon) |
ALIEN_COMMANDS_LEASE_SECONDS, ALIEN_COMMANDS_MAX_LEASES | Lease duration and leases per poll |
ALIEN_COMMANDS_POLL_INTERVAL_MS, ALIEN_COMMANDS_POLL_MAX_INTERVAL_MS, ALIEN_COMMANDS_POLL_JITTER | Polling and backoff |
ALIEN_COMMANDS_DRAIN_TIMEOUT_MS | Drain time on shutdown |
Platform
| Variable | Platform |
|---|---|
AWS_ACCOUNT_ID | AWS |
GOOGLE_CLOUD_PROJECT, GCP_PROJECT_ID, GCP_REGION | Google Cloud |
AZURE_SUBSCRIPTION_ID, AZURE_TENANT_ID, AZURE_REGION | Azure. Workers also get AZURE_CLIENT_ID. |
OPERATOR_BASE_PLATFORM | Kubernetes. The cloud the cluster runs on, if any. |
AWS_ACCOUNT_ID and AWS_REGION, or the Google Cloud or Azure set | Kubernetes on a cloud base platform |
Sandbox
Inside a Sandbox: ALIEN_SANDBOX_EXEC_UID, ALIEN_SANDBOX_EXEC_GID, and ALIEN_SANDBOX_ROOT.
Your own variables
Set fixed values in alien.ts:
import * as alien from "@alienplatform/core"
const api = new alien.Worker("api")
.code({ type: "source", src: "./api", toolchain: { type: "typescript" } })
.environment({ LOG_LEVEL: "info" })
.permissions("execution")
.build()Map a stack input to a variable with its env option. Set per-deployment values from the CLI:
| Command | Flags |
|---|---|
alien deployments create | --env KEY=VALUE, --secret KEY=VALUE, --env-targeted KEY=VALUE:pattern1,pattern2, --secret-targeted KEY=VALUE:pattern1,pattern2 |
alien dev, alien onboard | --env KEY=VALUE[:target1,target2], --secret KEY=VALUE[:target1,target2] |
alien dev | --secret-file KEY=PATH[:targets], --secret-env KEY=SOURCE_ENV[:targets] |
Flags repeat. Targets limit a variable to matching workloads.
Secret values are synced into the deployment's internal secrets Vault in the cloud's secret service and loaded at startup, not written into the workload spec. For secrets the management identity (the identity Alien uses to update the deployment) should never see, use your own Vault or a deployer secret input.
Reserved names
These are refused in your own variables with "Environment variables use reserved Alien runtime names":
- Every variable in the injected, commands, and platform tables above except
ALIEN_AI_GATEWAY_URL, plusAWS_REGIONandALIEN_DEPLOYMENT_SERVICE_ACCOUNT - Any name matching
ALIEN_*_BINDING - Any name starting with
ALIEN_BINDING_