# Container settings

URL: https://shellz.dev/docs/reference/container-settings

> Environment variables and files read by shellz run inside containers.

`shellz run` needs only the fleet token. Everything else is optional.

## Fleet token

| Source | Notes |
|---|---|
| `/run/secrets/shellz-fleet-token` | Recommended. A file containing the `szf_` token. |
| `SHELLZ_FLEET_TOKEN` | Used if set, before the file. Visible to anyone who can exec into the container; shellz removes it from your app's and sessions' environments only. |

## Metadata

These label members in the dashboard. shellz detects most of them on its own.

| Variable | Default | Meaning |
|---|---|---|
| `SHELLZ_FLEET_PLATFORM` | Detected | `kubernetes`, `ecs`, `cloudrun`, `docker`, `devcontainer` or `other` |
| `SHELLZ_POD_NAME` | `POD_NAME`, then the hostname | Kubernetes pod name |
| `SHELLZ_POD_NAMESPACE` | `POD_NAMESPACE`, then the service account's namespace | Kubernetes namespace |
| `SHELLZ_NODE_NAME` | `NODE_NAME` | Kubernetes node |
| `SHELLZ_CONTAINER_NAME` | The hostname (ECS: from task metadata) | Container name on Docker, ECS and other platforms |
| `SHELLZ_IMAGE` | Empty (ECS: from task metadata) | Image reference to show |

Platform detection, in order: `KUBERNETES_SERVICE_HOST` means Kubernetes, `ECS_CONTAINER_METADATA_URI_V4` means ECS, `K_SERVICE` means Cloud Run, `REMOTE_CONTAINERS` or `CODESPACES` means a dev container, and `/.dockerenv` means Docker.

## Behaviour

| Variable | Default | Meaning |
|---|---|---|
| `SHELLZ_DRAIN_SECONDS` | `20` | How long to wait for your app to exit after a stop signal before ending remaining processes and uploading the rest of the recordings. Keep the platform's stop timeout about 10 seconds longer. |

## Set by shellz

Inside a recorded session, shellz sets `SHELLZ_SESSION` to the session ID. Don't set it yourself.

## Files

| Path | Contents |
|---|---|
| `/usr/local/bin/shellz` | The shellz binary |
| `/run/shellz/broker.sock` | The recorder socket (`/tmp/shellz/` if `/run` isn't writable) |
| `/run/shellz/status.json` | Current status: enrollment, fleet, sessions, upload state |

The member's signing key lives only in memory; nothing secret is written to the container's filesystem.

## Network

Outbound HTTPS to `api.shellz.dev` and `ingest.shellz.dev`. Nothing listens for inbound connections.