Skip to main content
Profiles are an experimental feature. The vars commands are hidden by default — run machine0 config set USE_EXPERIMENTAL_FEATURES=true to enable them.
The vars commands manage the env variables stored on a profile. They are stored encrypted and injected into every VM created with machine0 new --profile <name> — written to /etc/environment (services and non-login shells) and /etc/profile.d/machine0-env.sh (interactive sessions).
Not the same as machine0 env: env sets are standalone, account-level groups of variables attached per VM with --env <set>. Profile variables ride along with everything else the profile injects (credentials, the MCP endpoint). A VM can use both.

​
vars ls

List a profile’s variables. Secret values render masked. 
machine0 vars ls <profile>
machine0 vars ls work --json

​
vars set

Set env variables in a profile (KEY=VALUE, space-separated, values may contain =). Aliased as vars add. 
machine0 vars set <profile> KEY=VALUE [KEY=VALUE ...] [--secret]
machine0 vars set work NODE_ENV=production API_URL=https://api.example.com
machine0 vars set work OPENAI_API_KEY=sk-... --secret
Secret variables — pass --secret to mark every key in that invocation as secret. Secret values are write-only: vars ls and profiles get (including --json) show them as ******** (secret) and no API read ever returns them again — they stay readable only inside a VM (e.g. in /etc/environment). Key names and their existence remain visible, as for any variable. Details:
  • Re-setting a key without --secret un-marks it (the new value displays in cleartext); re-setting with --secret keeps it masked.
  • Masked vars ls --json output is not round-trippable: piping it back into vars set is rejected (it would overwrite the real value with the placeholder). The literal ******** can never be stored as a variable value.
  • Variables set before this feature existed aren’t retroactively masked — re-set them with --secret to mark them.
Two things to know when combining sources:
  • Precedence — if a VM is created with both --env <set> and --profile <name> and they define the same key, the env set wins (it’s the explicit per-machine choice).
  • When changes apply — variables are written when a VM boots: at creation and on resume from suspend. A running VM does not pick up vars set/unset changes until its next suspend/resume cycle.
Profiles hold up to 100 variables (64KB serialized); keys are [A-Za-z_][A-Za-z0-9_]*, values up to 4096 characters with no newlines or double quotes. The combined variables of an env set and a profile attached to the same VM must also stay under 64KB.

​
vars unset

Remove env variables from a profile by key. Unknown keys are ignored. Aliased as vars rm. Removal asks for confirmation — secret values are write-only, so a removed secret can’t be recovered; pass --yes to skip the prompt (required in scripts). 
machine0 vars unset <profile> KEY [KEY ...]
machine0 vars unset work API_URL
machine0 vars rm work API_URL --yes   # skip the confirmation prompt