foundation
Environment variables
Use env vars for deployment-specific config while handling parsing, missing values, secret exposure, and test isolation.
Environment variables are the deployment interface between orchestrator and Node process — strings only, inherited from parent shell, visible in `process.env`.
// Parsing matters — everything arrives as string
const port = Number(process.env.PORT ?? 3000);
const enabled = process.env.FEATURE_X === 'true'; // explicit, not truthy "false"
`.env` files via dotenv are dev convenience — never commit secrets; production should inject via platform (K8s secrets, IAM, vault). `NODE_ENV` affects caching, logging, and some libraries' behavior — set it deliberately (`production`, `development`, `test`).
Test isolation: reset or stub env in tests; avoid order-dependent suites mutating `process.env` without cleanup.
On interviews: string typing pitfalls; `NODE_ENV` effects; why env is poor for complex structured config without parsing.
Common pitfalls: `if (process.env.FLAG)` treating `"0"` as true; leaking env in error pages; child processes inheriting full parent env with secrets.
The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.
Checklist:
- Parse and validate env in one place.
- Never log full `process.env`.
- Use dotenv only locally; document production injection.
- Restore env after tests.