Skip to content

Environment Variables

Configure a Private Location with environment variables. The agent reads them when it starts, so restart or redeploy it after changing a value.

Authentication and Connection

Variable Default Description
ESCAPE_API_KEY Required unless ESCAPE_AUTHORIZATION is set API key used to register the location and call the Escape API. The Helm chart can read it from existingSecret instead.
ESCAPE_AUTHORIZATION Unset Advanced authentication override. Its value is sent unchanged as the Authorization header and takes precedence over ESCAPE_API_KEY.
ESCAPE_API_URL https://public.escape.tech Escape API base URL. Use this only when Escape provides a different API endpoint.
ESCAPE_PRIVATE_LOCATION_URL private-location.escape.tech:2222 SSH tunnel destination. Use this only when Escape provides a different tunnel endpoint.

Runtime and Health

Variable Default Description
ESCAPE_CLI_RESTART_INTERVAL Unset. Helm: 24h. Schedules a clean process exit after a Go duration such as 24h. The delay has a random jitter of plus or minus 10%, followed by 30 seconds before exit. With a restart policy, Kubernetes or Docker Compose then starts a new container. Invalid, zero, negative, and unset values disable the scheduled restart. This setting doesn't detect a disconnection: the agent retries its SSH connection independently.
HEALTH_CHECK_PORT Unset. Helm: 8080. Starts the health server on this port. GET /health returns 200 OK when the tunnel is connected and 503 Not connected otherwise. No health server starts when the value is empty. Use a port of 1024 or higher because the image runs as a non-root user.
ESCAPE_ENABLE_LOGS_ENDPOINT false Set to true to add POST /log to the health server for a local log-forwarding proxy. It requires HEALTH_CHECK_PORT.
ESCAPE_K8S_INTEGRATION true Set to false to disable the Kubernetes API proxy and Kubernetes integration registration. Any other value enables it. Docker Compose and local CLI still skip registration when no kubeconfig and no in-cluster config are available.
KUBECONFIG Unset Path to the kubeconfig used by Kubernetes integration. Used only when Kubernetes integration is enabled. If unset, the agent uses in-cluster config when KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT are set. If both are missing, Kubernetes integration is skipped and the agent logs that skip instead of treating it as a connection failure.

Proxy and TLS

Variable Default Description
ESCAPE_FRONTEND_PROXY_URL Unset HTTP, HTTPS, or SOCKS5 proxy between the Private Location and Escape.
ESCAPE_REPEATER_PROXY_URL Unset Legacy name for the frontend proxy. If set, it takes precedence over ESCAPE_FRONTEND_PROXY_URL. Use ESCAPE_FRONTEND_PROXY_URL for new deployments.
ESCAPE_BACKEND_PROXY_URL Unset HTTP, HTTPS, or SOCKS5 proxy between the Private Location and the target API.
ESCAPE_SSL_INSECURE Secure TLS verification Set to true to skip TLS certificate verification. Use this only for troubleshooting or when you understand the risk.
ESCAPE_SSL_CERT_PATH System trust store Path to a PEM file containing one or more custom root CA certificates.

The Private Location doesn't use HTTP_PROXY, HTTPS_PROXY, or NO_PROXY. Use ESCAPE_FRONTEND_PROXY_URL and ESCAPE_BACKEND_PROXY_URL instead.

Logging and Output

Variable Default Description
ESCAPE_VERBOSITY 0 Logging level: 0 for essential output, 1 for debug logs, 2 for trace logs, and 3 for trace logs with raw HTTP request and response details. Invalid values use 0.
ESCAPE_COLOR_DISABLED false Set to true to disable ANSI color output.

Helm Values

The following are Helm values, not environment variables in the running container.

Helm value Default Description
ESCAPE_PRIVATE_LOCATION Helm release name Private Location name passed to escape-cli locations start.
ESCAPE_API_KEY 00000000-0000-0000-0000-000000000000 Placeholder API key. Replace it or configure existingSecret.
existingSecret.name and existingSecret.key Empty Existing Kubernetes Secret and key that supply ESCAPE_API_KEY. This takes precedence over the chart value.
container.env [] Additional environment variables to inject into the Private Location container.