Container settings
Environment variables and files read by shellz run inside containers.
shellz run needs only the fleet token. Everything else is optional.
Fleet token
| Source | Notes |
|---|---|
/run/secrets/shellz-fleet-token | Recommended. A file containing the szf_ token. |
SHELLZ_FLEET_TOKEN | Used if set, before the file. Visible to anyone who can exec into the container; shellz removes it from your app's and sessions' environments only. |
Metadata
These label members in the dashboard. shellz detects most of them on its own.
| Variable | Default | Meaning |
|---|---|---|
SHELLZ_FLEET_PLATFORM | Detected | kubernetes, ecs, cloudrun, docker, devcontainer or other |
SHELLZ_POD_NAME | POD_NAME, then the hostname | Kubernetes pod name |
SHELLZ_POD_NAMESPACE | POD_NAMESPACE, then the service account's namespace | Kubernetes namespace |
SHELLZ_NODE_NAME | NODE_NAME | Kubernetes node |
SHELLZ_CONTAINER_NAME | The hostname (ECS: from task metadata) | Container name on Docker, ECS and other platforms |
SHELLZ_IMAGE | Empty (ECS: from task metadata) | Image reference to show |
Platform detection, in order: KUBERNETES_SERVICE_HOST means Kubernetes, ECS_CONTAINER_METADATA_URI_V4 means ECS, K_SERVICE means Cloud Run, REMOTE_CONTAINERS or CODESPACES means a dev container, and /.dockerenv means Docker.
Behaviour
| Variable | Default | Meaning |
|---|---|---|
SHELLZ_DRAIN_SECONDS | 20 | How long to wait for your app to exit after a stop signal before ending remaining processes and uploading the rest of the recordings. Keep the platform's stop timeout about 10 seconds longer. |
Set by shellz
Inside a recorded session, shellz sets SHELLZ_SESSION to the session ID. Don't set it yourself.
Files
| Path | Contents |
|---|---|
/usr/local/bin/shellz | The shellz binary |
/run/shellz/broker.sock | The recorder socket (/tmp/shellz/ if /run isn't writable) |
/run/shellz/status.json | Current status: enrollment, fleet, sessions, upload state |
The member's signing key lives only in memory; nothing secret is written to the container's filesystem.
Network
Outbound HTTPS to api.shellz.dev and ingest.shellz.dev. Nothing listens for inbound connections.