# Machine Files

**URL:** <https://community.fly.io/t/machine-files/14453>\
**Category:** Fresh Produce\
**Tags:** appsv2, machines, flyctl\
**Created:** [July 27, 2023, 4:57pm UTC](https://community.fly.io/t/machine-files/14453 "2023-07-27T16:57:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![JP\_Phillips](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jp_phillips/32/18337_2.png) [@JP\_Phillips](https://community.fly.io/u/JP_Phillips)\
**Post date:** [July 27, 2023, 4:57pm UTC](https://community.fly.io/t/machine-files/14453/1 "2023-07-27T16:57:10Z")

</div>

We’ve just rolled out some changes to the config definition used for creating Machines to make it easier to have files created and populated from two data sources in the config. All data must be provided to the system as a base64 encoded string.

Below are two examples of how you can take advantage of this new feature when working with the Machines API directly:

### Raw Data

```json
{
  ...
  "files": [
    {
      "guest_path": "/etc/foo/bar.json",
      "raw_value": "ewogICJjb25maWciOiB7CiAgICAic29tZXRoaW5nIjogImNvbmZpZ3VyYWJsZSIKICB9Cn0K"
    }
  ]
}

```

With the above example, a file will be created at `/etc/foo/bar.json` populated with the following content:

```json
{
  "config": {
    "something": "configurable"
  }
}

```

### Secret Data

```json
{
  ...
  "files": [
    {
      "guest_path": "/etc/db/config.json",
      "secret_name": "DB_CONFIG"
    }
  ]
}

```

If you have added a secret `DB_CONFIG` to the app, with the above example, a file will be created at `/etc/db/config.json` populated the content from the secret. If you had previously been relying on the `DB_CONFIG` environment variable to access the secret, it would no longer be set in this scenario and the only way to access the secret is in the `/etc/db/config.json` file.

**REMINDER** : the value must be base64 encoded before creating it:

```auto
fly secrets set --app my-awesome-fly-app DB_CONFIG="<BASE_64_ENCODED>"

```

We’ve also made it possible to define files for the machine using CLI flags and in`fly.toml` for use with `fly deploy`.

The following flags have been added to `fly machine run`, `fly machine update` and `fly deploy`:

```auto
--file-local=/path/inside/machine=<local/path>
--file-literal=/path/inside/machine=VALUE
--file-secret=/path/inside/machine=SECRET

```

And below is an example for defining files via `fly.toml`:

```toml
[[files]]
  guest_path = "/path/to/hello.txt"
  raw_value = "aGVsbG8gd29ybGQK"

[[files]]
  guest_path = "/path/to/secret.txt"
  secret_name = "SUPER_SECRET"

[[files]]
  guest_path = "/path/to/config.yaml"
  local_path = "/local/path/config.yaml"
  processes = ["web"]

```

---

<div class="post-metadata">

**Author:** ![lubien](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/lubien/32/41919_2.png) [@lubien](https://community.fly.io/u/lubien)\
**Post date:** [July 27, 2023, 5:20pm UTC](https://community.fly.io/t/machine-files/14453/2 "2023-07-27T17:20:59Z")

</div>

I’ve been eagerly waiting on this because I feel like 90% (if not all) of the manual work I’ve done to [make MongoDB work on Fly](https://community.fly.io/t/how-to-self-host-mongodb-on-fly-io/13397) was generating files [as you can see on the docker entrypoint](https://github.com/lubien/mongo-template/blob/e344fe756a339bd90da12ef3ae2fbd1abd8345af/fly-start.sh#L1-L14) so having this as a built-in feature for machines **and** fly.toml is amazing. I might revisit that project at some other point.

---

<div class="post-metadata">

**Author:** ![containerops](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/containerops/32/13053_2.png) [@containerops](https://community.fly.io/u/containerops)\
**Post date:** [July 28, 2023, 5:33pm UTC](https://community.fly.io/t/machine-files/14453/3 "2023-07-28T17:33:47Z")

</div>

Thanks 💜

I came across this feature a few days ago while checking `fly deploy --help`, and I must say, it’s a game changer! Now you don’t even need a custom Dockerfile to deploy most of the infra stuff.

Look at how easy it is to use Fly’s proxy (i.e. `.flycast` addresses) to run a formation of opentelemetry collectors in [gateway mode](https://opentelemetry.io/docs/collector/deployment/gateway):

```bash
fly launch --image="otel/opentelemetry-collector-contrib:0.81.0"
           --file-local="/etc/otelcol-contrib/config.yaml=infra/otel.yaml"
           --no-public-ips

```

Or to forward logs in a single command:

```bash
fly launch --image="timberio/vector:0.31.0-alpine"
           --file-local="/etc/vector/vector.toml=infra/vector.toml"
           --no-public-ips

```

---

<div class="post-metadata">

**Author:** ![charsleysa](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/charsleysa/32/16002_2.png) [@charsleysa](https://community.fly.io/u/charsleysa)\
**Post date:** [August 21, 2023, 4:34am UTC](https://community.fly.io/t/machine-files/14453/4 "2023-08-21T04:34:45Z")

</div>

Is there a way to set file permissions? Some apps require files (especially files with secrets) to have certain permissions, e.g. 0600

---

<div class="post-metadata">

**Author:** ![JP\_Phillips](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/jp_phillips/32/18337_2.png) [@JP\_Phillips](https://community.fly.io/u/JP_Phillips)\
**Post date:** [August 24, 2023, 3:34pm UTC](https://community.fly.io/t/machine-files/14453/5 "2023-08-24T15:34:45Z")

</div>

There’s not currently a way to set the permissions in the API right now. A possible option until then would be to set them as part of the entrypoint.