Skip to content

Document the process.env handling and compat flags #19187

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 13 commits into
base: production
Choose a base branch
from
Open
19 changes: 19 additions & 0 deletions src/content/compatibility-flags/process-env.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
---
_build:
publishResources: false
render: never
list: never

name: "Populate process.env from environment variables"
sort_date: "2025-01-31"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sort_date is usually the same as enable_date
Is there any reason to have a difference here?

Suggested change
sort_date: "2025-01-31"
sort_date: "2025-04-01"

enable_flag: "nodejs_compat_populate_process_env"
enable_date: "2025-04-01"
disable_flag: "nodejs_compat_do_not_populate_process_env"
---

When the `nodejs_compat_populate_process_env` compatibility flag is used in conjunction with
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My understanding is that this also depends on disallow_importable_env in the latest impl.

ref: cloudflare/workerd#3778

the `nodejs_compat` compatibility flag, all environment variables configured for the
Worker are added as string values to the `process.env` global.

Refer to the [environment variables](/workers/configuration/environment-variables/) documentation
for more detail.
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,47 @@ Select the **Secret** type if your environment variable is a [secret](/workers/c

<Render file="env_and_secrets" />

## Environment variables and Node.js compatibility

When you enable both the [`nodejs_compat`](/workers/runtime-apis/nodejs/) and
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same comment as previously

[`nodejs_compat_populate_process_env`](/workers/configuration/compatibility-flags/)
compatibility flags, environment variables will also be available via the global
`process.env`. Note that the `nodejs_compat_populate_process_env` flag is
enabled automatically when `nodejs_compat` is used with a compatibility date
on or after April 1st, 2025.

The `process.env` will be populated lazily the first time that `process` is accessed
in the worker.

Text variable values are exposed directly.

JSON variable values that evaluate to string values are exposed as the parsed value.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I remember that there were changes wrt .toJson(), does the description here need to be updated.


JSON variable values that do not evaluate to string values are exposed as the raw
JSON string.

For example, imagine a Worker with three environment variables, two text values, and
one JSON value:

```
[vars]
FOO = "abc"
BAR = "abc"
BAZ = { "a": 123 }
```

Environment variables can be added using either the `wrangler.{json|jsonc|toml}` file or via the Cloudflare
dashboard UI.

The values of `process.env.FOO` and `process.env.BAR` will each be the
JavaScript string `"abc"`.

The value of `process.env.BAZ` will be the JSON-encoded string `"{ "a": 123 }"`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The value of `process.env.BAZ` will be the JSON-encoded string `"{ "a": 123 }"`.
The value of `process.env.BAZ` will be the JSON-encoded string `"{ \"a\": 123 }"`.


:::note
Note also that because secrets are a form of environment variable within the runtime,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The following should be updated there:

Secrets are used for storing sensitive information like API keys and auth tokens. Secrets are available on the env parameter passed to your Worker's fetch event handler.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have those comments been adressed?

secrets are also exposed via `process.env`.

## Related resources

* Learn how to access environment variables in [ES modules syntax](/workers/reference/migrate-to-module-workers/) for an optimized experience.
17 changes: 14 additions & 3 deletions src/content/docs/workers/runtime-apis/nodejs/process.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,15 @@ In the Node.js implementation of `process.env`, the `env` object is a copy of th

### Relationship to per-request `env` argument in `fetch()` handlers

Workers do have a concept of [environment variables](/workers/configuration/environment-variables/) that are applied on a per-Worker and per-request basis. These are not accessible automatically via the `process.env` API. It is possible to manually copy these values into `process.env` if you need to. Be aware, however, that setting any value on `process.env` will coerce that value into a string.
Workers have a concept of [environment variables](/workers/configuration/environment-variables/) that are applied on a per-Worker and per-request basis.

By default, these are not accessible automatically via the `process.env` API. It is
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
By default, these are not accessible automatically via the `process.env` API. It is
By default, these are not accessible automatically via the `process.env` API.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
By default, these are not accessible automatically via the `process.env` API. It is
By default, these are not accessible via the `process.env` API. It is

possible to have environment variables and secrets automatically populated into `process.env` using
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
possible to have environment variables and secrets automatically populated into `process.env` using
To automatically populate environment variables and secrets on `process.env`, enable

the `nodejs_compat_populate_process_env` compatibility flag. It is also possible to
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

again, does this depend on the disallow_importable_env flag?

manually copy these values into `process.env` if necessary -- but only within the context of
a request.

Setting any value on `process.env` will coerce that value into a string.

```js
import * as process from 'node:process';
Expand All @@ -48,7 +56,11 @@ export default {
};
```

It is strongly recommended that you *do not* replace the entire `process.env` object with the request `env` object. Doing so will cause you to lose any environment variables that were set previously and will cause unexpected behavior for other Workers running in the same isolate. Specifically, it would cause inconsistency with the `process.env` object when accessed via named imports.
It is strongly recommended that you *do not* replace the entire `process.env` object with
the request `env` object. Doing so will cause you to lose any environment variables that
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe expland "the cloudflare env object + passed the fetch handler, imported from cloudflare:workers or retrieved from an entry point"

Suggested change
the request `env` object. Doing so will cause you to lose any environment variables that
the cloudflare `env` object. Doing so will cause you to lose any environment variables that

were set previously and will cause unexpected behavior for other Workers running in the
same isolate. Specifically, it would cause inconsistency with the `process.env` object when
accessed via named imports.

```js
import * as process from 'node:process';
Expand All @@ -60,7 +72,6 @@ process.env === env; // false! they are no longer the same object

// From this point forward, any changes to process.env will not be reflected in env,
// and vice versa!
```

## `process.nextTick()`

Expand Down