pgAdmin Environment Variables
You set up pgadmin environment variables by passing key-value pairs into your container at startup. These variables define the first admin login, web port, and server list before the app runs. Platform teams use this method to run the database tool across cloud clusters. Still, this static setup often leaves engineers with broad database roles and shared keys. How pgadmin environment variables work at startup When you run the tool in a container, the startup script reads system values first.
Environment Variables: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up pgadmin environment variables by passing key-value pairs into your container at startup. These variables define the first admin login, web port, and server list before the app runs. Platform teams use this method to run the database tool across cloud clusters. Still, this static setup often leaves engineers with broad database roles and shared keys.
How pgadmin environment variables work at startup
When you run the tool in a container, the startup script reads system values first. These values tell the app how to build its own internal settings database. You must pass a primary email and a password key so the first user can log in. If you skip those two values, the container will refuse to start up.
Beyond basic login keys, pgadmin environment variables also control how the web server behaves. Teams use them to pick network ports, enable TLS encryption, and set up mail servers for password resets. You can also point the app to an external file that lists your PostgreSQL databases. When the container boots, it reads that file and adds those servers to the dashboard.
For larger teams, variables can pass settings to the core Python config file. This lets admins turn on directory login or single sign-on without editing files inside the image. Once the container finishes its first boot, it saves many of these choices to a disk volume. On later restarts, the app reads from that saved disk instead of the initial startup values.
How teams manage database server lists and secrets
Most teams do not want to type database hostnames into the web interface by hand. Instead, they use variables to load a JSON file full of server details at boot time. This file holds the host address, port, database name, and username for each PostgreSQL instance. Every engineer who logs into the web app sees that pre-built list of servers right away.
To avoid plain text passwords in container specs, admins often mount secret files from their cluster. The startup process reads the secret path from a variable and loads the key into memory. This keeps the first admin password out of deployment logs and source control. Still, the database user still needs a password or passfile to talk to PostgreSQL itself.
Environment Variables: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What static startup variables solve and what they miss
Using variables to deploy your database admin tool makes container builds fast and repeatable. You can spin up a fresh instance in any cluster without clicking through setup screens. It also lets you tie web app logins to your company identity provider from day one. That solves the problem of who can open the web interface.
Still, startup variables only control the app shell and who logs into the dashboard. Once a user connects to a PostgreSQL server, the database role decides everything they can do. If five engineers share one admin role in the tool, the database logs show one generic user. You cannot tell which person ran a slow query or dropped a table.
Startup settings also cannot inspect or filter the SQL statements that users run in the query tool. If an engineer queries a customer table, the app returns raw emails, phone numbers, and card numbers. You cannot pause a risky delete statement for peer review through container variables alone. Governance stops the moment the database session begins.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Why did my container ignore changes to my startup variables?
The container saves your initial admin email and password to its storage volume on first boot. If you change those variables later, you must wipe the saved volume for new values to apply.
Can I store PostgreSQL database passwords inside startup variables?
The server list file only imports connection details like hostnames, ports, and usernames by default. For database passwords, you must mount a separate password file or ask users to type keys at login.
Do startup variables restrict which SQL queries a user can run?
No, container variables only set up the web app and its login method. Once a user opens the query tool, their PostgreSQL role controls all table reads and writes.