Pass secrets safely

Secrets are stored on the host and selected per cell by name. The host does not copy its .env file into the VM.

Declare names in the cell

secrets:
  - GITHUB_TOKEN
  - CLAUDE_API_KEY

Only these names are passed to the container as environment variables. A value may be present in the host's cell environment file and still remain unavailable to the cell unless it is declared here.

Set or rotate values

solitary up asks for missing values. Use the secrets command to set or rotate a value later:

solitary secrets my-cell

The dashboard shows which declared names are set without displaying their values.

Keep scopes narrow

Use one cell per task or trust boundary. A GitHub token for one repository should not be shared with every cell, and an API key should not be present in a cell that does not need it.

Understand the lifecycle

Selected values become environment variables inside the container, and container metadata may record them inside the VM. Destroying the cell removes that metadata with the VM. The host-held values remain so a replacement cell can be authenticated; rotate credentials if exposure is suspected.