hf sandbox exec keeps secret values out of argv
Introduced 2026-09-17 · score 0.90
HOW TO USE IT
When passing secrets to a sandbox, use the name-only form to resolve values from the caller’s environment; however, v1.32.0 docs do not show a secrets option for `hf sandbox exec`. They document `--secrets` when creating a dedicated sandbox, then running commands with `hf sandbox exec`.
hf sandbox create -s <SECRET_NAME>hf sandbox exec <SANDBOX_ID> -- <COMMAND> [ARGS...]hf jobs run -s MY_SECRET python:3.12 python -c 'import os; print(os.environ["MY_SECRET"])'WHY THIS HELPS
Pass a secret to a sandbox command without placing its value in the process argument list.
BEFORE THIS CHANGE
The CLI accepted secret values as flag arguments, including `--secrets KEY=value`, which placed them in `argv`; shell history and Linux `/proc/<pid>/cmdline` could expose them.
REQUIREMENTS AND LIMITATIONS
- Version: v1.32.0
- SANDBOX_ID (required): Sandbox id printed by `hf sandbox create`.
- COMMAND... (required): Command to run in the sandbox.
- -s, --secrets SECRET: Set a secret environment variable; prefer a name to read its value from the environment. Documented for sandbox creation and Jobs run, not sandbox exec.
- --secrets-file TEXT: Read secret environment variables from a file; `-` reads stdin. Documented for sandbox creation and Jobs run, not sandbox exec.
- --pool: For pooled sandboxes, secrets are unavailable; use `--env` instead.
- Prerequisite: The name-only secret form reads the value from the caller’s environment. An unset requested secret is an error.
- Prerequisite: An env or secrets file should be readable only by you (`chmod 600`); the CLI warns if it is not.
- Prerequisite: Pooled sandboxes have no encrypted secrets channel; the CLI directs users to pass values with `--env` or `--env-file`.
- The name-only form reads the value from the calling environment.
- A secrets file should be readable only by you (`chmod 600`); the CLI warns if it is not.
- The `-s MY_SECRET=psswrd` form remains supported, but the value appears in shell history and the process listing and the CLI warns.
- The source says pooled sandboxes do not support the secrets channel; use `--env` for pooled sandboxes.
- Docs conflict: The release note names `hf sandbox exec --secrets`, but the v1.32.0 CLI source defines `hf sandbox exec` with `--env`/`--env-file` and no `--secrets`/`--secrets-file`; those secret options are on sandbox creation. The documented name-only secret example is `hf jobs run`. The exact task command `hf sandbox exec --secrets` is therefore not documented; see not_found.
FIRST-PARTY EVIDENCE
- https://github.com/huggingface/huggingface_hub/releases/tag/v1.32.0
- https://github.com/huggingface/huggingface_hub/pull/4835
- https://github.com/huggingface/huggingface_hub/blob/v1.32.0/docs/source/en/guides/cli.md
- https://github.com/huggingface/huggingface_hub/blob/v1.32.0/src/huggingface_hub/cli/sandbox.py
- https://huggingface.co/docs/huggingface_hub/package_reference/cli
Check the installed version and the source before using it. Entry JSON