Configuration

CLI flags

light-run serve accepts --port, --host, --token and --body-limit. Each maps to an env var below.

Variable	Default	Purpose
`LIGHT_RUN_TOKEN`	(none)	Bearer token required on every route except `/health`. Unset = open server with a startup warning. CLI-only; library users pass `createServer({ token })`.
`LIGHT_RUN_PORT`	`3000`	Listen port. CLI-only.
`LIGHT_RUN_HOST`	`127.0.0.1`	Listen host. CLI-only.
`LIGHT_RUN_BODY_LIMIT`	`10485760` (10 MiB)	Max POST body. CLI-only; library users pass `createServer({ bodyLimit })`.
`LIGHT_RUN_ARTIFACTS_DIR`	`~/.light-run/artifacts`	Artifact root. Read lazily.
`LIGHT_RUN_MAX_ARTIFACTS_BYTES`	`21474836480` (20 GiB)	Total-size cap before oldest-run auto-eviction.

light-run auto-traces every route (@fastify/otel) and emits business spans. Nothing is exported unless you opt in:

Variable	Effect
`OTEL_EXPORTER_OTLP_ENDPOINT`	Export traces + metrics (OTLP/HTTP) to this URL. Set it on every layer so a trace stitches across light-process -> light-run -> light-runner.
`LIGHT_RUN_OTEL_DEBUG=1`	Print spans to stdout (ConsoleSpanExporter), no backend needed.
`OTEL_SERVICE_NAME`	Identity on every span/metric (default `light-run`).
`LIGHT_RUN_VERSION`	Override the `service.version` attached to spans.

With neither OTEL_EXPORTER_OTLP_ENDPOINT nor LIGHT_RUN_OTEL_DEBUG set, the SDK never starts: zero runtime cost.

Container stdout/stderr is a separate channel from OTel: read it from GET /runs/:id (the logs array), not from your tracing backend.

light-run forwards the env you pass in POST /run straight into the container. A few things to know:

Container output is returned verbatim. The logs array on GET /runs/:id (and the sync response and the callback body) is the container's raw stdout/stderr. If your workload prints a secret (echo $API_KEY, a stack trace), it lands in those responses. light-run does not scrub it - keep secrets out of what your code prints.
Use TLS for a remote light-run. The POST /run body, including env values, travels in clear HTTP. On localhost that is fine; if light-run is reachable over a network, put it behind TLS (a reverse proxy) and keep the port off the public internet.
env is visible on the host. Values passed as container env are readable via docker inspect for the container's lifetime by anyone with Docker socket access. For stronger isolation, prefer file-based secrets mounted into the container over env vars.