# Variables
> Configure an Ownkube deployment with plain and secret variables, share variables across an environment, and get database connection strings injected by linking.
Variables are how configuration reaches your container. Each deployment has its own on the **Variables** tab, every deployment in an [environment](/docs/deployments/environments) inherits the environment's shared variables, and [linking](/docs/data/postgres#connect-an-app) a database or cache adds its connection string as a secret.
## Three kinds of variable
| Kind | Where it is set | Who sees the value |
|---|---|---|
| **Plain** | The deployment's **Variables** tab | Anyone in the organization, in the UI and the activity diff |
| **Secret** | Same tab, with **Secret** on | Masked in the UI, redacted from logs and diffs; the container gets the real value |
| **Shared** | The environment's page | Every deployment in the environment, unless the deployment sets the same key itself |
A deployment's own variable always wins over a shared one with the same name.
## Set a variable on a deployment
1. **Open the Variables tab**
From the deployment's page, open **Variables**.
2. **Add or edit**
Add `KEY=value` pairs one at a time, or paste a block in `.env` format to add several at once. Keys are shell identifiers: letters, numbers and underscores, not starting with a number.
3. **Mark secrets**
Turn on **Secret** for passwords, tokens and keys.
4. **Save**
Saving creates a revision and rolls the deployment out with the new values. Nothing changes in the running container until the rollout completes.
From the terminal, `okctl deploy update` takes the same variables; see [CLI commands](/docs/cli/commands).
## Shared variables on an environment
Set a variable once for a whole stage, such as `LOG_LEVEL=info` on Production or `NODE_ENV=development` on Development.
1. **Open the environment**
Go to [**Settings**](https://app.ownkube.io/dashboard/settings), open **Environments**, and pick the environment. Its page lists the deployments in it and its shared variables.
2. **Add shared variables**
Add keys the same way as on a deployment, with **Secret** where needed. Save.
3. **Roll out**
Every deployment in the environment picks up the change on its next rollout. Deployments that set the same key keep their own value.
The CLI equivalent is `okctl environments set-env`, which replaces the environment's shared set.
## Variables Ownkube sets for you
Linking a database or cache to an app adds its connection details as secret variables on the app. For Postgres:
```bash
DATABASE_URL=postgresql://user:pass@host:5432/dbname
PGHOST=...
PGPORT=5432
PGUSER=...
PGPASSWORD=...
PGDATABASE=...
```
For Valkey:
```bash
REDIS_URL=redis://default:password@host:6379
REDIS_HOST=...
REDIS_PORT=6379
REDIS_PASSWORD=...
```
Link from the app's page or with `okctl deploy link `. The variables are private-network addresses; they are not reachable from outside Ownkube. See [Private networking](/docs/networking/private).
## How secrets are stored
Secret values are encrypted at rest, delivered to the container through the runtime's secret store, and never written to logs or the activity diff. Saving a secret with a blank value keeps the stored value, so you can edit other fields without re-entering it. Members can set and edit variables; revealing a database password needs an owner or admin. See [Security](/docs/security).
## Build-time values
Variables reach the running container, not the build. For a value the build needs (a private package registry token, a public API URL baked into a front end), use **Build arguments** on the **Builder** tab. See [Builds and source](/docs/deployments/builds#the-builder-tab).
## Good practice
- Keep secrets as secrets, including anything you would not paste into a public issue.
- Use shared variables for what a stage has in common, and deployment variables for what is specific to one app.
- Keep names and values small. Mount large configuration as a file in the image instead; values are limited to a few kilobytes.
- Never commit `.env` files. The `.env` paste box exists so you do not have to.
- [Environments](/docs/deployments/environments)
- [Postgres](/docs/data/postgres)
- [Security](/docs/security)
---
**Don't see a feature you need?** Email [support@ownkube.io](mailto:support@ownkube.io?subject=Feature%20request). Ownkube is shaped by the teams using it and we ship what our users ask for.
## Search
This site has a search endpoint: https://context7.com/api/v2/ask?siteKey=ask_c64dfe8ffaa8d3ad19576838&query=. It returns documentation that answers the question, with a source link for each part. No API key is needed. If nothing matches, it says so.