administrator/frigate
1
0
Fork 0
mirror of https://github.com/blakeblackshear/frigate.git synced 2026-11-12 00:23:01 +03:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

only export allowlisted environment_vars

Browse Source 
apply_config_env_vars wrote every unprefixed environment_vars key into os.environ and exported every FRIGATE_ key, so a config could set LD_PRELOAD or LIGHTER_ANE_EP to load a library into Frigate or its children, or set FRIGATE_RUN_AS_ROOT to turn off the ffmpeg.path writable-tree guard. Only the documented names are now exported, each with a value check, and a name the container already sets is never overwritten. FRIGATE_ keys still feed substitution, but only FRIGATE_JWT_SECRET is exported. Anything else logs a warning naming the key.
This commit is contained in:
Josh Hawkins
2026-11-07 12:32:06 -06:00
parent 97696d0cbe
commit 40c27fb04f
5 changed files with 153 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/docs/configuration/advanced/reference.md
+1 -1
View File
@@ -240,7 +240,7 @@ logger:
# Optional: set environment variables
environment_vars:
EXAMPLE_VAR: value
LIBVA_DRIVER_NAME: i965
# Optional: birdseye configuration
# NOTE: Can (enabled, mode) be overridden at the camera level
docs/docs/configuration/advanced/system.md
+10 -1
View File
@@ -65,7 +65,16 @@ go2rtc:
This section sets environment variables in the Frigate process for those unable to modify the environment of the container, like within Home Assistant OS. It's meant for process settings such as `LIBVA_DRIVER_NAME` or the TensorFlow thread counts below. Docker users should set environment variables in their `docker run` command (`-e LIBVA_DRIVER_NAME=i965`) or `docker-compose.yml` file (`environment:` section) instead. Values set here are stored in plain text in your config file, so credentials belong in `secrets.yaml`, Docker environment variables, or Docker secrets instead.
Names prefixed with `FRIGATE_` set here also take part in `{FRIGATE_VARIABLE_NAME}` substitution (see [below](#substitution-sources-and-precedence)), but `secrets.yaml` is the better home for them.
Besides `FRIGATE_` names, only these are accepted, and a variable already set in the container environment keeps its container value:
- `LIBVA_DRIVER_NAME` and `HSA_OVERRIDE_GFX_VERSION`
- `TF_INTRA_OP_PARALLELISM_THREADS`, `TF_INTER_OP_PARALLELISM_THREADS`, `TF_DATASET_THREAD_POOL_SIZE`, and `SHM_MAX_FRAMES`
- `USE_FP16`, `HF_HUB_OFFLINE`, and `TRANSFORMERS_OFFLINE`
- `HF_ENDPOINT`, `GITHUB_ENDPOINT`, `GITHUB_RAW_ENDPOINT`, and `TF_KERAS_MOBILENET_V2_WEIGHTS_URL` (an `http://` or `https://` URL)
Any other name is ignored with a warning and must be set in the container environment.
Names prefixed with `FRIGATE_` set here take part in `{FRIGATE_VARIABLE_NAME}` substitution (see [below](#substitution-sources-and-precedence)), but `secrets.yaml` is the better home for them. Of these, only `FRIGATE_JWT_SECRET` is also set in the process environment.
<ConfigTabs>
<TabItem value="ui">