New machines that mount a Staged secret via files are destroyed within 1 second

Questions / Help
1

In two apps, any new machine that mounts a Staged secret as a file is destroyed by flyd about 1 second after creation. There is no error and no log output. Config changes to the one existing machine are also ignored, and secrets never move from Staged to Deployed.

Apps

  • App A has one running machine from Aug 30 (release v7), plus a stopped standby. It works and passes health checks.
  • App B is a new app that shows suspended. I don’t know why.

What I did, with results

  1. I set a new value for the secret that backs a files mount on App A, then ran fly deploy. Releases v8 to v17 all report complete, but the machine config is unchanged. It is still at release version 7, and the mount still references the original secret name. The secrets list shows Staged with the new digest.
  2. fly machine update <machine> --file-secret /path=<OTHER_SECRET>: the machine restarts, but --display-config still shows the old mount.
  3. fly machine clone <machine>: the machine is created, then destroyed. The event log shows only pending/launch, created/launch, then destroyed/destroy from flyd, 4 seconds apart. The CLI waited 5 minutes for it to start.
  4. On App B I ran fly machine run alpine sleep 600 with no mounts. It started fine.
  5. On the same app I ran the same command with --file-secret /secrets/k.pem=<SECRET_B>. The machine was destroyed within 1 second (events: pending, created, destroyed, all by flyd).
  6. fly secrets set without --stage: the status stays Staged.
  7. fly secrets deploy -a <app B>: “Error: no machines available to deploy”. App B’s only machine was created with fly machine run, so it isn’t part of Fly Launch.

Expected: a secret set with fly secrets set should become Deployed, and machines that mount it should start. Config updates should apply to the existing machine.

Questions

  • Why do the secrets stay Staged, and what moves them to Deployed in an app with no Fly Launch machines?
  • Why are machines referencing a Staged secret destroyed silently?
  • What does the suspended state on App B mean, and could it be related?

I can share machine IDs and timestamps privately if staff need them: the clone was destroyed at 2026-10-10 23:27Z and the secret-mount probe at 2026-10-11 00:09Z.

3

Hi… Make sure that you’re base64-encoding the secret’s value. A weird gotcha causes pretty odd behavior otherwise:

https://community.fly.io/t/machines-destroyed-by-flyd-immediately-on-fly-deploy/25433/2

If that was from the dashboard then it just means that the app has no Machines running. It shouldn’t really be affecting secrets…