Sidecar Environment Variables
The following environment variables configure an ALTR sidecar instance.
| Key | Required/Optional | Description | Example |
|---|---|---|---|
ALTR_PRIVATE_KEY_CONTENT | Optional | The private key from the RSA key pair used to authenticate the sidecar to ALTR’s control plane. The public key is registered in ALTR. Don’t set this variable if you’ve mounted the private key to the sidecar instead. | -----BEGIN PRIVATE KEY----- <KEY_CONTENT> -----END PRIVATE KEY----- |
ALTR_PRIVATE_KEY_PATH | Optional | The location of a mounted private key. If not set, the sidecar looks for a mounted key at /app/private.pem. | — |
AWS_DEFAULT_REGION | Required (AWS Secrets Manager only) | The AWS region for Secrets Manager and other AWS services. Required for database credential retrieval. | us-east-2 |
AWS_REGION | Required (AWS Secrets Manager only) | The AWS region for Secrets Manager and other AWS services. Required for database credential retrieval. | us-east-2 |
LOG_AUDITS_TO_STDOUT | Optional | Writes logs to stdout in JSON format. Default: false. | false |
LOG_LEVEL | Optional | The application logging level (DEBUG, INFO, WARN, ERROR). Default: INFO. | DEBUG |
LOG_MAX_FILE_SIZE | Optional | Maximum size of the active log file before the sidecar rotates it. Rotated files are compressed. Default: 100MB. | 250MB |
LOG_MAX_HISTORY | Optional | Number of rotated log archives kept before older ones are deleted. Default: 30. | 14 |
LOG_ROTATION_INTERVAL_DAYS | Optional | Time-based log rotation interval, in days. Rotation happens on time or size, whichever occurs first. Default: 1. | 7 |
SERVER_BIND_ADDRESS | Optional | The IP address the sidecar’s listener ports bind to. 0.0.0.0 allows external/Docker access; 127.0.0.1 limits access to the local machine. Default: 0.0.0.0. | 127.0.0.1 |
SIDECAR_CONFIG_REFRESH_INTERVAL | Optional | How often the sidecar polls ALTR’s control plane for updated configuration (listener ports, bindings, flags). Default: 5m. | 30s |
SIDECAR_DATAPLANE_BASE_URL | Required | The control-plane API base URL that manages configuration and policies. Copy this Data Plane URL from ALTRNet after registering the sidecar. | https://sc-data-<sidecar-id>.<org-id>.data.altr.com |
SIDECAR_HEALTH_CHECK_IP | Optional | The IP address the health-check endpoint binds to (the port is fixed at 8080). Set to 0.0.0.0 if a load balancer needs to reach it. Default: 127.0.0.1. | 0.0.0.0 |
SIDECAR_ID | Required | The unique identifier for this sidecar instance, used by the control plane to identify it. Copy this Sidecar ID from ALTRNet after registering the sidecar. | 1db4ee3c-0e1d-43cc-a5ef-ee8cb209a2ea |
SIDECAR_INSTANCE_ID | Optional | An identifier the sidecar uses when communicating with ALTR. If not set, the sidecar generates a random UUID on startup. Set an instance ID for a consistent identifier across reboots. | 4fc6f120-e666-4a9b-afe6-63a3914aa0ab |
SIDECAR_ORG_ID | Required | Your organization’s identifier in ALTR, used for auditing, telemetry, and configuration retrieval. Copy this ALTR Organization ID from ALTRNet after registering the sidecar. | 8cd73ffc-2826-4b87-a10b-f9b04afeb6c0 |
SIDECAR_POLICY_REFRESH_INTERVAL | Optional | How often the sidecar refreshes policies from the control plane. Accepts a duration string (e.g. 5m, 30s). Default: 5m. | 30s |
SIDECAR_TAGS | Optional | Comma-separated key=value telemetry tags used to label sidecar deployments, sent upstream and logged once at startup. Format: key1=value1,key2=value2. Each segment must contain exactly one unescaped =; use \= to include a literal = in a key or value. Keys are 1-128 characters and can’t start with altr:; values are 0-256 characters. Maximum 50 unique tags; duplicate keys keep the last value. Don’t include secrets or personal data in a tag. | env=prod,region=us-east-1,owner=platform-team1 |