Documentation not clear on passing Secrets Store secrets into container

[brianhardeman]

The examples for passing secrets store secrets into containers do not work. The syntax in both of these variations does not seem to be correct:
https://developers.cloudflare.com/containers/examples/env-vars-and-secrets/#using-envvars-on-the-container-class
https://developers.cloudflare.com/containers/examples/env-vars-and-secrets/#setting-environment-variables-per-instance

In both cases, env.SECRET_STORE.ACCOUNT_API_KEY does not appear to be the correct way to access the secret shown in the binding as

  "secrets_store_secrets": [
    {
      "binding": "SECRET_STORE",
      "store_id": "demo",
      "secret_name": "ACCOUNT_API_KEY"
    }

I believe the correct way to retrieve the secret is with env.SECRET_STORE.get() for the strange naming used in this example. This will work for the per-instance example, as the get() call is inside the asynchronous worker fetch, but it will not work in the Container class envVars example since get() does not work in that context.

Is there a recommended way to get secret store secrets into the container without having to set them per-instance and manually start?

[emily-shen]

Ah that's a good spot, thanks for pointing it out - will update the docs.

This might work, if i've understood correctly and what you want is to be able to do env.MY_CONTAINER.fetch() from your worker and the secret just to be there?

export class MyContainer extends Container {

  override async fetch(request, env): Promise<Response> {
    this.envVars = {
      SECRET: await env.SECRET_STORE.get(),
    };
    return this.containerFetch(request);
  }
}

[brianhardeman]

Thanks for the response. I was hoping to have variables available at container startup and if using auto start for things like the load-balance (getRandom) options. I'm not sure if this is the best approach, but what I ended up doing for now is to move the envVars definition from the Container class declaration into a constructor override...

export class MyContainer extends Container<Env> {
  defaultPort = 8080;
  sleepAfter = "2m";
  // Environment variables passed to the container
  // envVars = {
  //   MESSAGE: "I was passed in via the container class!",
  // };

  constructor(ctx: any, env: any) {
    super(ctx, env);
    this.ctx.blockConcurrencyWhile(async () => {
      this.envVars =  {
        MESSAGE: "I was passed in via the constructor!",
        SECRET_ENV: await env.<MY_SECRET_BINDING>.get(),
        };
    });
  }
}

[vinerz]

I had this exact thought when trying to modify the sleepAfter that comes from the Container definition which its instantiation isn't exactly controlled by us. Consider that @cloudflare/containers is an awesome framework of tons of sugar on top of barebones DurableObjects. If you get inside the source code, you will find some lifecycle, monitoring and other tools they created to make our lives easier. It's a great place to have some ideas to override behaviour.

--

With that being said, without further derailing, you could use either .start({...}) manually before calling fetch for the first time to warm up the container. that .start method allows you to set your env vars right at its startup.

Need to make sure the Container is ready before dispatching the request? Here's an example with what you need + some sugar coating too. It's heavily just blindly extracted from my codebase with too much sleep deprivation and without too much cleanup, so I'm sorry if something isn't part of the general API. But its soul is there:

export async function getContainerRandom(env: Cloudflare.Env): ContainerStub<MySuperContainer> {
  const objectId = namespace.idFromName('my-super-container')
  const container = namespace.get(objectId)
  
  try {
    const state = await container.getState()
  
    if (state.status === 'running' || state.status === 'healthy') {
      return container as ContainerStub<MySuperContainer>
    }
  
    console.log(`Container 'my-super-container' currently ${state.status}, waiting for readiness...`)
  } catch (error) {
    console.warn(`Failed to fetch state for container my-super-container:`, error)
  }
  
  const envVars = {
    ...getEnvVars(env), // my codebase internal helper
    DB_URL: env.DB_URL,
    HARDCODED: 'hello, container!',
  }
  
  await container.startAndWaitForPorts({
    ports: [8080],
  
    startOptions: {
      enableInternet: true,
      envVars, // here is your gold
    },
  
    // these here are just random waits, make sure it's closer to your reality
    cancellationOptions: {
      instanceGetTimeoutMS: 18_000,
      portReadyTimeoutMS: 18_000,
      waitInterval: 500,
    },
  })
  
  return container as ContainerStub<MySuperContainer>
}

[dhruvrajan]

I'm running into a lot of flakiness with this code, the containers fail to spin up with secrets 40% of the time. Wondering if y'all have any insights? Thanks!

This is running a basic fastapi backend, for a UI being served by cloudflare pages, and passing secrets for supabase / openai / etc from the cloudflare secrets store. I'm trying to simulate the getRandom library function with the ability to pass secrets to the container on startup. Am I doing this right?

import { Container, getContainer } from "@cloudflare/containers";

export class MyApi extends Container<Env> {
  // Port the container listens on (default: 8080)
  defaultPort = 8080;
  // Time before container sleeps due to inactivity (default: 30s)
  sleepAfter = "10m";
  // Environment variables passed to the container
  envVars = {
    MESSAGE: "I was passed in via the container class!",
  };

  // Optional lifecycle hooks
  override onStart() {
    console.log(`Container successfully started`);
  }

  override onStop() {
    console.log("Container successfully shut down");
  }

  override onError(error: unknown) {
    console.log("Container error:", error);
  }
}

/**
 * Get a random container instances across N instances. This is useful for load balancing.
 * @param binding The Container's Durable Object binding
 * @param instances Number of instances to load balance across
 * @returns A promise resolving to a container stub ready to handle requests
 *
 * Based on Cloudflare implementation https://github.com/cloudflare/containers/blob/23286c4dfe83268d7123cd58d00f0ccba6c71236/src/lib/utils.ts#L3C1-L22C2
 */
export function getRandom<T extends Container>(
  binding: DurableObjectNamespace<T>,
  instances: number = 3
): DurableObjectStub<T> {
  // Generate a random ID within the range of instances
  const id = Math.floor(Math.random() * instances).toString();

  // Always use idFromName for consistent behavior
  // idFromString requires a 64-hex digit string which is hard to generate
  return getContainer(binding, `worker-${id}`);
}

const isHealthy = async (
  container: DurableObjectStub<MyApi>
): Promise<boolean> => {
  const containerState = await container.getState();
  console.log(
    `Found container ${container.id} with status ${containerState.status}`
  );
  return (
    containerState.status === "running" || containerState.status === "healthy"
  );
};

const startWorker = async (
  container: DurableObjectStub<MyApi>,
  env: Env
) => {
  const supabaseUrl = await env.SUPABASE_URL.get();
  const supabaseKey = await env.SUPABASE_KEY.get();
  const openaiApiKey = await env.OPENAI_API_KEY.get();
  const logfireToken = await env.LOGFIRE_TOKEN.get();

  await container.startAndWaitForPorts({
    ports: 8080,
    startOptions: {
      envVars: {
        SUPABASE_URL: supabaseUrl,
        SUPABASE_KEY: supabaseKey,
        OPENAI_API_KEY: openaiApiKey,
        LOGFIRE_TOKEN: logfireToken,
        ENVIRONMENT: "production",
      },
    },
  });
};

export default {
  async fetch(request: Request, env: Env) {
    const myWorker = getRandom(env.MY_API);
    if (!(await isHealthy(myWorker))) {
      await startWorker(myWorker, env);
    }
    myWorker.renewActivityTimeout();
    return await myWorker.fetch(request);
  },
};