Environment variables
These are the production settings an operator may need to change in /etc/labpod/labpod.env.
Some installer/preflight values in the same file, such as shared image-store mode, are read by
the install scripts or admin doctor. CLI flags (--port, --db, --dev) override the
corresponding server variables when set.
Boolean variables accept true / 1 (on) or false / 0 (off) only - other values cause a
startup error.
Duration variables (LABPOD_API_TIMEOUT, LABPOD_SESSION_TTL, LABPOD_WORKSPACE_START_TIMEOUT,
LABPOD_LAUNCHER_READINESS_TIMEOUT) use Go’s time.ParseDuration format: a number followed by a
unit, ns, us/µs, ms, s, m, or h (units can be combined, e.g. 24h30m). There is no
d (days) unit and a bare number without a unit is rejected - to set a 7-day TTL, write 168h.
An invalid or non-positive value is logged and LabPod falls back to the default.
This page lists supported operator settings. Use the shipped /etc/labpod/labpod.env comments as
the host-local source for rarely changed advanced defaults.
| Variable | Default | Notes |
|---|---|---|
LABPOD_PORT | 24680 | Platform HTTP/HTTPS port. The workspace gateway uses the next port (24681 by default); keep both outside the workspace port range. |
LABPOD_DB | labpod.db | SQLite database path, resolved from the service working directory when relative |
LABPOD_JWT_SECRET | (required) | Session signing secret; 32+ bytes. Server refuses to start without it in production |
LABPOD_LICENSE_PATH | /var/lib/labpod/license.lic | Installed signed license path. If absent, LabPod resolves to the built-in 90-day trial |
LABPOD_API_TIMEOUT | 15m | Per-request handler timeout (e.g. 15m, 30m) |
LABPOD_SESSION_TTL | 168h | Login lifetime for JWTs, browser cookies, and CLI sessions. Sessions remain revocable when a user logs out, changes password, or is disabled |
LABPOD_WORKSPACE_START_TIMEOUT | 15m | Deadline for the podman run -d workspace start call |
| Variable | Default | Notes |
|---|---|---|
LABPOD_TLS_SELF_SIGNED | false | Auto-generate and cache a self-signed cert |
LABPOD_TLS_CERT | (unset) | Path to operator-supplied TLS certificate |
LABPOD_TLS_KEY | (unset) | Path to operator-supplied TLS private key |
LABPOD_TLS_DIR | /var/lib/labpod/tls | Cache directory for self-signed cert and key |
LABPOD_TLS_HOSTS | (unset) | Comma-separated extra SANs for self-signed cert (e.g. 192.168.1.10,labpod.lan) |
| Variable | Default | Notes |
|---|---|---|
LABPOD_GPU_SHARING_LIB_PATH | (unset) | Host path to the software GPU sharing runtime library. When set, enables fractional GPU mode. Server fails at startup if the file doesn’t exist |
LABPOD_GPU_INVENTORY | nvidia-smi | GPU enumeration source. Set to none on CPU-only hosts |
LABPOD_MIG_INVENTORY | nvidia-smi | MIG slice enumeration. Set to none on non-MIG hosts |
LABPOD_GPU_PROCESS_INSPECTOR | nvidia-smi | Source for the untracked-GPU-usage indicator: nvidia-smi or none |
Storage
Section titled “Storage”| Variable | Default | Notes |
|---|---|---|
LABPOD_SHARED_MOUNT_ROOTS | (unset) | Comma-separated allowed roots for admin-defined shared mounts. Empty = any non-blocked path |
LABPOD_SHARED_IMAGE_STORE_MODE | auto | Shared image-store setup mode: auto, imagestore, or root |
LABPOD_SHARED_IMAGE_STORE | (unset) | Root-managed shared image store path used for admin shared pulls when configured |
LABPOD_DISK_ROOT | (the account-home filesystem) | Absolute path selecting the filesystem shown for host disk capacity. If unset, LabPod measures the filesystem holding LABPOD_FILEOP_HOME_BASE. |
LABPOD_FILEOP_HOME_BASE | /home | Canonical base for provisioned account homes, workspace-private homes, archives, file roots, directory pickers, and per-user disk scans. Changing it never moves existing data automatically. |
LABPOD_WORK_BASE | Same as LABPOD_FILEOP_HOME_BASE | Base directory for each user’s shared /work tree. Use a dedicated data volume here when work data should live outside the account home. Per-user disk totals include it when relocated. |
Security and network
Section titled “Security and network”| Variable | Default | Notes |
|---|---|---|
LABPOD_PORT_GUARD | none | Shared-host loopback hardening: none or nft. nft requires the LabPod service to run as root |
LABPOD_TRUST_PROXY_HEADERS | false | Honor X-Forwarded-Host/Proto. Only enable behind a trusted reverse proxy |
LABPOD_WS_ALLOWED_ORIGINS | (unset) | Comma-separated extra WebSocket Origin values for the terminal endpoint |
LABPOD_NOTIFY_ALLOW_PRIVATE | false | Allow crash-notification webhooks to dial private/loopback/link-local destinations (only for a self-hosted LAN messenger) |
LABPOD_LAUNCHER_READINESS_TIMEOUT | 60s | How long launcher Start waits for the app port to become ready |
See also Runtime settings for the DB-backed settings that can be changed without a restart.