- AES-256-GCM encryption at rest with your own DOCKXO_SECRET
- Table editor or raw .env editor with syntax highlighting
- Comments, blank lines and order are preserved
- Save & redeploy in one click, or PATCH single keys through the API
- Optionally write the env as a .env file into the build context
- Template credentials are generated for you and shown on the Connect tab
Two editors, one source of truth
Env is stored as raw .env text, so what you type is what the container gets. Switch between a key/value table for quick edits and a full editor that highlights keys, values, quotes and comments. Comments, blank lines and the order of your variables are preserved across saves; the panel never rewrites your file into something you did not write.
Encrypted before it is stored
Every value is encrypted with AES-256-GCM using the panel’s DOCKXO_SECRET before it is written to the database. The same key protects GitHub tokens, registry passwords, Cloudflare tokens, storage credentials and Telegram bot tokens. If the database leaks, your secrets do not.
Change one key from a script
PATCH /api/services/:id/env sets or unsets keys in place, so CI can rotate a token or flip a flag without touching the rest of the file. Combine it with POST …/deploy?wait=1 to redeploy and get the outcome in the same call.
Connect tab
Template services (databases, Redis, RabbitMQ…) generate their own credentials. The Connect tab shows the internal address (db on the project network, db.project from other projects), the generated user and password, and ready-to-paste connection strings for common clients. Optionally publish the port on a fixed or random free host port and restrict who can reach it with the port allowlist.