Choose which variables your build can read, run migrations before a release takes traffic, and ship the exact image you tested in one environment to another without rebuilding it.
Build, runtime, or both
Every variable and secret now has a scope: Build & runtime, Runtime only, or Build only. Plain variables default to Build & runtime; secrets default to Runtime only and reach the build only when you opt them in.
| Build type | How build-scoped values arrive |
|---|---|
| From source, no Dockerfile | Environment variables of your build command, any name. Handed over as a build secret, so they aren't written into the image. |
| From your Dockerfile | Plain variables as build args (declare them with ARG); secrets as build secrets at /run/secrets/<KEY> via RUN --mount=type=secret. |
The console flags browser-bundle variables (NEXT_PUBLIC_*, VITE_*, and friends) as visible to anyone, warns when a secret is added to the build, and offers Save & rebuild when a change only a new build can apply. Read the guide →
Pre-deploy commands
Set pre_deploy_command on a service's build manifest and it runs once per build, in the new image, with the service's variables and secrets and access to its datastores — after the build, before any traffic moves. Exit 0 and the rollout proceeds; anything else fails the build and the current version keeps serving. 30-minute limit, output on the build in the Builds tab. Read the guide →
Promote
Deploy the image running in one environment to another — dev to production, or any pair you use — by digest, with no rebuild. The target keeps its own variables, secrets, and pre-deploy command. If a value baked into the image at build time differs from the target's, the promotion stops and names the variables so you can decide. Available from Promote to… in the console and POST /v2/deployments/{id}/promote. Read the guide →
Also
- Cancel build stops the build immediately, including a running pre-deploy command.
- Pushes while auto-deploy is paused after a rollback now show in the service's activity as "Push to <branch> (<sha>) skipped: auto-deploy is paused" instead of disappearing silently.