---
title: Services
description: A long running container built from your repository, in one environment.
order: 1
---

A service is a container ops builds from a Dockerfile in your repository and keeps running.
Each environment has its own copy of it.

## Adding one

Declare it in [the project file](../concepts/project-file.md), or let the scan propose it
when you connect the repository. **Add service** in the console makes one by hand, from a
repository or from an image pinned by digest.

```ts
services: {
  api: { dockerfile: 'Dockerfile', port: 8080, env_group: 'api', healthcheck: '/readyz' },
},
```

## What its page shows

**Services** lists every service of the environment with its state. A service's page shows
the image it runs, its replicas and limits, its recent deployments, the domains that route
to it and its spec. From there:

- **Redeploy** builds the service again and opens the build.
- **Scale** changes the number of replicas, 1 to 20.
- **Open logs**, in the menu, opens the logs filtered to this service.

A deployment's own page has **Roll back now** while its rollout is unhealthy.

## Settings that matter

| field | default | notes |
| --- | --- | --- |
| replicas | 1 | 1 to 20; a service with a SQLite volume runs one |
| limits | 1 core, 512 MB | per replica, 0.1 to 8 cores, 64 to 32768 MB |
| deploy order | `stop-first` | `start-first` starts the new container before stopping the old one |
| health window | 120 s | how long a rollout may take to become healthy |
| env group | none | the secret group mounted at start |

A service's CPU and memory count against its environment's quota.

## Build time variables

A service built from a repository can read variables at build time from a secret group,
the build env group in the service's build settings. The group arrives as a build secret called
`build_env`, never as a layer of the image:

```dockerfile
RUN --mount=type=secret,id=build_env \
    sh -c 'set -a; . /run/secrets/build_env; set +a; npm ci && npm run build'
```

The same secret carries a read token for ops's package registries, so a build can install
your private packages. See [Packages](../publish/packages.md).

## There is no shell

Neither the console nor the CLI opens a shell inside a container. Use the logs, a
[job](jobs.md), or a step in the project file for one off work.