foundation

Environment variables

Use env vars for deployment-specific config while handling parsing, missing values, secret exposure, and test isolation.

Environment variables are the deployment interface between orchestrator and Node process — strings only, inherited from parent shell, visible in `process.env`.

					// Parsing matters — everything arrives as string
const port = Number(process.env.PORT ?? 3000);
const enabled = process.env.FEATURE_X === 'true'; // explicit, not truthy "false"
				

`.env` files via dotenv are dev convenience — never commit secrets; production should inject via platform (K8s secrets, IAM, vault). `NODE_ENV` affects caching, logging, and some libraries' behavior — set it deliberately (`production`, `development`, `test`).

Test isolation: reset or stub env in tests; avoid order-dependent suites mutating `process.env` without cleanup.

On interviews: string typing pitfalls; `NODE_ENV` effects; why env is poor for complex structured config without parsing.

Common pitfalls: `if (process.env.FLAG)` treating `"0"` as true; leaking env in error pages; child processes inheriting full parent env with secrets.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

  • Parse and validate env in one place.
  • Never log full `process.env`.
  • Use dotenv only locally; document production injection.
  • Restore env after tests.