Project settings reference

A project in Borago Board is one repository or folder with its own Docker container, its own AI credentials and its own queue of tasks. The project dialog creates and edits it. Open it for a new project with Add project in the board's filter bar (in the menu on a phone), which is headed New Project, or Create your first project on a board with no project yet. Open it for an existing project with Edit project among the project's controls, which is headed Edit Project. Creating a project walks the tabs in order as a wizard: Next moves one tab on and validates the tab being left, Previous goes back without checks, a tab unlocks once reached, and on the last tab Next becomes Create project. Editing keeps free tab navigation and ends with Save changes.

This page is true as of 2026-09-28. The tabs, in the order the dialog shows them, are Project Info, AI instructions, AI Auth, AI Roles, Environment Variables, Ports, Scripts, Containers, Docker Compose and Dockerfiles. Ports, Docker Compose and Dockerfiles appear only while the container name mode is Auto-generated (Containers tab). Labels below are the exact on-screen labels. The Syncs column says whether the value travels to the account's other devices through cloud sync or stays on one machine, following the rules in Cloud sync.

Validation, and what a refused save does

The dialog checks only things that would otherwise be lost silently. Next checks the tab being left. Create project and Save changes check every tab in tab order. A refused save writes the reason in the footer, switches to the tab the problem is on, scrolls to the field and puts the cursor in it. The rules are a project name, a task runner service, no environment variable with a value but no name, no duplicate variable name, a port row with both sides filled and each between 1 and 65535, no host port published twice, a container name when the mode is Custom, an API key typed without its 18+ confirmation, and a role set to a self-hosted service without saying which server when the account has more than one. Filled port rows are also checked against the machine when leaving the Ports tab or saving, and a clash lands on the row.

Project Info

What the project is and where its code lives. The container memory limit sits at the bottom of this tab for an Auto-generated container.

Label	What it does	Default	Syncs	Notes
Project name	The name on the board. With the Auto-generated container mode it also derives the container name, and it names the folder the desktop keeps the project's Docker files in.	Empty. Required	Yes	The wizard refuses to leave this tab without one. Renaming moves the Docker folder on each device.
Local path	The folder on the machine that runs the containers, mounted into the container at `/app`. Empty is a supported choice when a Git repository URL is set, since the code is then cloned inside the container.	Empty	Yes, as the account's path	On the desktop a Browse button opens the operating system's folder dialog, which can create folders. A browser, on your network or the cloud, and the phone have no Browse: type the path, or let the desktop create a folder for you with Create a folder for me (see the last section). A project with neither a path nor a Git URL cannot run.
Browse	Opens a folder chooser and writes the chosen path into the field beside it.		Not stored	On Linux, when the portal dialog fails to open at all, the app falls back to another system chooser, then to its own picker, and says why. Pressing Browse again while a dialog is open joins the open dialog rather than opening a second one.
Folder on this device	This device's own folder for the project when the synced path does not exist here, such as a different home directory or an unmounted drive. Unfolds from the link Use a different folder on this device under the path.	Not set, the shared path is used	No, per machine	Editing only, desktop and local network browser. Has Create a folder for me and Use the shared one, which removes the override, and on the desktop its own Browse. A container Start refused because the folder is missing opens the dialog on this field and retries the Start after the save.
Create a folder for me	The desktop creates a workspace folder beside the project's Docker files and writes its path into the field.		Follows the field it fills	Saved projects only. Shown under the device folder on the desktop, and under the shared path on the cloud browser and phone, where the desktop must be connected. The result names the folder it created.
Git repository URL	Cloned into the container's `/app` on container start, only when `/app` is empty. An existing checkout is never touched.	Empty	Yes	An HTTPS URL pairs with a token, an SSH URL with a private key, and a public repository over HTTPS needs no credential. The How does authentication work? link opens that pairing table. Without a Local path the code exists only in the container, so a Restart or Rebuild discards uncommitted and unpushed work and re-clones a clean tree. A failed clone fails the start and raises a notification that opens this tab.
Git branch	The branch cloned. On later starts, a checkout sitting on another branch is switched to it.	Empty, the remote's default branch	Yes	A branch missing on the remote is reported as a warning. A working tree with uncommitted changes refuses the switch.
Commit name	The name on the commits the agent makes in this project.	Empty	Yes	Applied in every run, terminal, script and flow, and inside the container on every start and on save. Blank clears it.
Commit email	The email on the agent's commits.	Empty	Yes	Same as Commit name.
Git access	How the container authenticates to a private repository. Exactly one of three sources is in effect at a time, a forge sign-in, a saved key from the vault, or a pasted token or SSH private key. While one is set, only that one is shown with its Remove, Unlink or Disconnect button.	None	A pasted key syncs encrypted to the account's other desktops unless kept on this device. A vault link always syncs	A stored key is write-only and reads A key is stored (hidden). The credential rides the container's environment on every run, so the agent can use git normally. Prefer a dedicated least-privilege key or token. Earlier values kept on this device are listed under the field and can be restored.
Sign in with GitLab	Signs in to GitLab with a device code, lists the repositories you maintain, and creates a deploy key for the one you pick. The URL and the key are filled in together.		The result syncs like any key	The first step is an acknowledgement that a deploy key will be created and that the agent runs with the key in its environment. The sign-in token is spent on that one call and discarded. The browser is never opened automatically, the link is offered to open or copy. There is no GitHub sign-in, so GitHub users paste a token or a key instead. Needs the desktop connected. On a project not yet saved the key is held on the desktop for 30 minutes and written by Create project, and Disconnect removes the deploy key from the repository again.
Paste a token or key	Opens a box for a personal access token or a multi-line SSH private key.		Encrypted, unless kept on this device	A live warning names a key type that does not match the URL form. Cancel clears the box.
Or use a saved key	Links a key from the account's vault. The value is resolved on the machine that runs the containers, at clone time, and is never shown.	Not linked	Yes, the link	Works from a browser or phone with nothing decrypted. A key deleted elsewhere reads This saved key no longer exists. Manage saved keys opens the vault.
Keep this key on this device only	Removes the pasted key from the cloud on save and stops it reaching your other devices.	Off, the key syncs encrypted	The choice syncs	Shown beside the paste box. You enter the key again on each device.
Container memory limit	Caps the RAM the project container may use. With Automatic ticked the cap is derived from the RAM of whichever machine runs the container.	Automatic	A set value syncs. Automatic is recalculated per machine	Auto-generated container only. Automatic keeps a reserve for the machine itself and gives the container the rest. A hand-set value is at least 256 MiB and applies on the next Restart or Rebuild. The text states how much is left for everything else. A container that exceeds its limit is killed and restarted automatically, and the board raises a notice. When the machine has not reported its RAM the automatic value is unknown and any set value still applies.
Automatic	Switches the memory limit between derived and hand-set. Unticking seeds the slider and the number box with the derived value.	Ticked	As above	The slider stops at plausible values. The number box commits on leaving the field.
Who owns this project?	Desktop only, when creating a project while signed out of cloud sync with a known last account. Add it to that account, or leave it Unclaimed.	Add to the last account		An unclaimed project stays local until an account signs in and claims it. Not shown while signed in, when the account is stamped automatically.

AI instructions

Text the AI reads. The first box is paid for on every run, the second only by the reviews.

Label	What it does	Default	Syncs	Notes
Global AI instructions	Included in every task prompt for this project.	On create, a starter workflow. With a Git repository URL it lists branching per feature, publishing the branch, adding and verifying unit tests, merging to main and publishing main. Without one it is the single line about unit tests. Editing keeps the saved text	Yes	The starter text switches between its two variants as the Git URL is filled in or cleared, until the first keystroke makes it yours. The AI keeps its own notes about the codebase separately. Guidance for the reviews belongs in the next box.
Review instructions	Sent to the pre-run and post-run reviews only, never to the task runner. Silences review noise that does not fit this project, or names what the reviews should watch for.	Empty	Yes	The same field appears collapsed on the AI Roles tab. While both review phases are off, an amber note says nothing reads it yet.
MCP servers	Nothing. Runs have no MCP client, so the choice changes nothing.	Off	Yes	Listed so its presence is not read as a working feature.

AI Auth

Who the project runs as. One credential card per provider, always all four, because a task can override the project's service. The card titles read Claude account (Anthropic), Codex account (OpenAI), Grok account (xAI) and Gemini account (Google). The card labelled Codex is the OpenAI provider. Every card is API key only. There is no subscription sign-in. Which model runs is chosen on the AI Roles tab, not here.

Label	What it does	Default	Syncs	Notes
AI credentials (this project)	The heading over the four provider cards. Each card holds the key field with Verify, the enhanced accuracy toggle on a saved project, that provider's cost budget and its keep-on-this-device choice.	No key on any card	See the rows below	A key belongs to the project. Two projects can hold different keys for one provider.
I confirm I am 18 years of age or older	The affirmation required before a key can be typed on that card. Each provider's line also affirms meeting that provider's own requirements.	Unticked, per session	No	The key field stays disabled until it is ticked, and unticking drops a typed key. A save with a key typed and no tick is refused and lands on the checkbox.
API key	The provider's API key. Stored encrypted and used from the desktop process to call the provider. Never shown again once stored.	None	Yes, encrypted, to the account's other desktops, unless kept on this device	Entered at creation and stored the moment the project is created, which the field says (Saved when you create the project). When editing, Save changes stores a typed key as well. If the project saves but the key does not, the dialog reopens on this tab with the reason rather than risking a duplicate project. A stored key shows API token configured with Verify, Replace and Remove. A run the provider rejects with HTTP 401 pauses the project's queue and marks the card.
Verify	Checks the typed key, or the stored one when nothing is typed, by listing the account's models at the provider. Free.			Works on a project that does not exist yet. The result reads This key works. or the provider's error.
Enhanced accuracy mode	Runs this project's tasks on that provider at its highest reasoning setting, on the models that accept one. Other models run unchanged. Spends noticeably more tokens per run.	Off	Yes	One switch per provider. Saved immediately, behind a confirmation that states the cost. On Claude it also gives each run a token budget the model paces itself against. Shown on a saved project that has a container name.
Cost budget (USD, this machine)	Pauses the auto-queue for that provider's tasks when this machine's estimated spend reaches the amount. The other providers keep running.	Blank, no limit	No, per machine, and so is the running total	Blank or zero means no limit. Changing the amount resets the spend. On a saved project with a budget the spend so far is shown with Reset spend. Manual runs are not gated. See Cost and usage.
Keep this API token on this device only	Removes that provider's key from the cloud on save and stops it reaching your other devices.	Off, the key syncs encrypted	The choice syncs	You enter the key again on each device.
Business shared keys	Links a key a business shared with this account into a provider slot. Runs use it instead of the project's own key, and you never see the key.	None (use this project's own token)	Yes, the link	Shown only when a business has shared a key with you or a link exists. A revoked key stays visible as no longer available, and runs fall back to the project's own key. See Business accounts.
Self-hosted AI services	A read-only list of the account's model servers with an online dot for each, and Manage in Settings, which opens Settings on Self-hosted services.		The servers sync, only the address can differ per machine	Nothing about the project is chosen here. Which server each role uses is picked on the AI Roles tab.

AI Roles

Which AI does what. Five roles, each a service and a model. The task runner is the only required role and nothing is preselected, so a project never inherits a provider you did not choose. Every service is listed, including each self-hosted server by name, and a service with no key on this device carries the suffix not set up on this device plus an amber warning that runs will fail until it is added on AI Auth. The warnings appear only once the dialog has checked what is set up.

The pre-run review defaults to the task runner's service, and the post-run review, chat and flows default to the pre-run review's pair. A role's model inherits only when both roles land on the same service, because model ids belong to one provider. Changing a role's service clears its model for the same reason, and a model saved under another provider is flagged and the provider's default runs instead. When a task runs and the task runner's service has no key, the run does not start. The task is moved to Blocked with a comment saying which key is missing and where to add it, and moving it back to To Do retries. The reviews never block a task. Without a usable key they return no verdict.

Label	What it does	Default	Syncs	Notes
Task runner	The service and model that run this project's tasks. The model is the project's default for that service, and a task can override both.	Select a service. Required	Yes	The wizard refuses to continue without a service. On a self-hosted server, instruct-tier models are excluded because they cannot drive a tool loop. A blank model means the provider's default model.
Model	The model dropdown beside every role. Disabled until a service is chosen, lists only that service's catalog, and is cleared when the service changes.	Select a model, or the role's inherit label	Yes	On a self-hosted server the list shows what the chosen server has first, then other known models, then Other (type a model name) for an id the list does not have. A saved model missing from the catalog still shows as the selection.
Review tasks before they run	Switches the pre-run review on. A cheap call reads a task when it is created or edited and leaves questions, a suggested rewrite or a duplicate warning as comments.	On	Yes	Questions hold the queue until answered. A rewrite is never applied by itself. Usually saves money, since a question raised mid-run restarts the task from the beginning. See When the agent asks a question.
Pre-run review	The service and model for that review.	The task runner's service, with the model Cheapest for this service	Yes	Shown while the checkbox above is ticked.
Review the result after a run	Switches the post-run review on. It reads what actually changed and leaves a note if the work looks incomplete. Never changes the task or re-runs it.	Off	Yes	Adds a call to every run and cannot save you one, which the note under it says. Needs a git repository at `/app` to have anything to read, a local one is enough. The cost note is hidden when the role resolves to a self-hosted server.
Post-run review	The service and model for that review. A coding model suits it, since it judges a diff.	Same as the pre-run review	Yes	Shown while the checkbox above is ticked.
Review instructions	The same field as on the AI instructions tab, collapsed.	Empty	Yes	Shown while at least one review phase is on. Marked (set) when it has text.
Plan tasks by chatting	Switches chat for this project on. Talk a requirement through, then turn the conversation into tasks.	On	Yes	Costs nothing until a conversation is opened. Chat reads the repository only when you mention a file or type `@/`, and pulls in an earlier conversation only when you mention it. See Chat to tasks.
Chat	The service and model for chat. A general model suits a conversation.	Same as the pre-run review	Yes	Shown while the checkbox above is ticked.
Flows	The service and model that read a flow and write the code for its deterministic steps.	Same as the pre-run review	Yes	No on or off switch, because nothing runs until a flow is built and enabled. The only role that writes code that later runs, so it is worth more than the cheapest model. A flow step can override it. See Flows.
Self-hosted AI services (your hardware)	The group in every role's service list with one entry per server on the account. Picking one sets the role to that server.		The server's name syncs, its address never does	With exactly one server, a role set to self-hosted without naming it is written down as that server on save. With several and none picked, the save is refused with the reason and lands on this tab. A server the project names that this account lacks stays selectable and says so.

From the cloud browser or the phone all five roles can be set. A note says they run on your desktop app, which picks them up on the next sync.

Environment Variables

Values injected into the container's process environment every time a run, a terminal, a script or a flow starts. They are never written into the compose file or the Dockerfile, and a process started by any other means inside the container does not see them. Encrypted at rest. The two per-variable flags share one invariant. Neither changes what the container receives.

Label	What it does	Default	Syncs	Notes
+ Add variable	Adds an empty row.			A row with a value and no name, or a name used twice, is refused at save and the cursor lands on it.
Import	Unfolds a paste box for a dotenv file, YAML (including a compose environment block) or a JSON object. Add variables merges the rows into the list, updating existing names.	Closed		Nothing is saved until the dialog's own Save. A bad paste costs nothing.
Name	The variable's name. Copy button beside it.		Yes, always	Vault links are keyed by name, so renaming moves the link.
Value	The variable's value. Always masked. The eye reveals one row until the dialog closes, and the copy button copies it.		Yes, encrypted, to the account's other desktops, unless flagged or opted out below	Masking is not a setting. Reveal state never persists. A write-only value that is stored but not sent shows a placeholder saying so, and leaving it blank keeps the stored value.
Write only (Never show again)	The value keeps working in every run but is never sent back to any screen, including this one. From then on it can be replaced, never read.	Off	The flag syncs	The right choice for a credential you never need to read back.
Do not sync this one	Keeps the value on this computer. Your other devices get the variable's name but no value, and you enter it again there.	Off	The flag syncs, the value never leaves the machine	The name still travels so the other device knows the variable exists and why it is empty.
Saved key	Links this variable to a key in the vault. The typed value is disabled while linked and returns when the link is removed.	Not linked	Yes, the link	Shown once the row has a name and the account has a saved key. Unlink and Use a different key manage it. A link that cannot be resolved contributes nothing rather than an empty value. See Secrets and environment variables.
Remove variable	Removes the row and its vault link.
Keep these variables on this device only	Removes the whole set from the cloud on save and stops it reaching your other devices.	Off, the set syncs encrypted	The choice syncs	Under the heading All variables in this project, at the end of the list.
earlier values kept on this device	The history of earlier values for the set, folded away. Restore re-encrypts one and saves it as the current value. Forget this history deletes them from this device after a confirmation.	Folded	Never synced	Shown only when a version other than the current one exists. Nothing else keeps a copy.
+ Add or replace a variable	Cloud browser and phone only. Adds one name and value that is sent to the desktop after the save, one pair at a time, so the variables this client cannot see are left exactly as they are. Remove this variable instead removes the named one.		Written by the desktop, then synced	Existing values cannot be shown there because they are encrypted under a key the cloud does not store. Up to 20 rows per save. The desktop must be running.

Ports

Auto-generated container only. A published port lets you reach the container at localhost on the host port. Changes take effect on restart, keep your compose edits, and stay on this machine unless Expose to LAN is on. With no rows the container is isolated.

Label	What it does	Default	Syncs	Notes
+ Add port	Adds a row. The first row is blank. Each row after it proposes the previous row's host port plus one.			The proposal is a starting value, not a claim that the port is free.
Host	The port on your machine you open in a browser.	Empty	Yes	Required with the container port. 1 to 65535. A port that browsers refuse to load, such as 6000 or 6667, gets an amber warning suggesting another, and saving is not blocked.
Container	The port the server listens on inside the container.	Empty	Yes	Required with the host port.
Check	Confirms the host port is free: no other project on this board publishes it, a stopped project included, and this machine can bind it right now, which catches programs outside the board.			Names the project holding a port. The project's own running container does not count against itself. Also run for every filled row when leaving the tab or saving, and a clash is refused and lands on the row. A machine that cannot answer, such as the cloud with no Docker, does not block the save.
Expose to LAN	Publishes the port on every network interface instead of 127.0.0.1 only.	Off, loopback only	Yes	A Docker-published port bypasses the host firewall, which is why loopback is the default. Settings, then Docker, Keep project containers off the local network keeps every project on that computer on loopback whatever this says. See Ports and LAN access.
Remove port	Removes the row.

Scripts

Named shell scripts that run in a container of the project's family with the project's environment variables, git credential and, on a container-managing project, its Docker access. This tab edits them. They are run from the Scripts button in the top bar. Available in both container name modes. Output streams live to the board and is never stored, so the panel showing it is the only copy. A run has no time limit, and Stop ends the process inside the container.

Label	What it does	Default	Syncs	Notes
+ Add script	Adds an empty script.	Trigger Manual, the project container	Yes	Up to 25 scripts per project, 20,000 characters each. Names are unique per project.
Add startup script	The empty-state button. Creates a script named Startup with the Startup trigger, prefilled for the project container.		Yes	The commonest first script, for installs, migrations and seeds.
Import	Reads a text file (.sh, .txt or no extension) into a new script named after the file.		Yes	A binary file is refused with a reason.
Script name	The script's name.	Empty	Yes
Container	Which container the script runs in, one of the project container, a configured sibling, or a container the agent created.	The project container	Yes	The list is the live family plus configured siblings, so a stopped sibling is still selectable.
Trigger	Manual runs only when pressed. Startup runs after that container starts and after any git clone, in list order, one after another.	Manual	Yes	A startup script can still be run by hand. A failing one does not stop the others. A container stop never runs them.
Run this script now to test it	The play button. Runs the current, possibly unsaved, text in the target container and shows the output under the editor. Turns into Stop while running.			Needs a saved project and the desktop connected. Disabled with the reason otherwise.
Export this script to a .sh file	Downloads the body verbatim, with no shebang added.
Insert file path	Browses the target container's files and inserts a shell-quoted path at the cursor.			Saved projects only, since browsing needs the container.
Remove script	Removes the script after a confirmation. The body is gone once the project saves.

See The terminal, scripts and the file browser.

Containers

The container the agent works in, and what it may do with Docker. This tab is always listed because it holds the name mode switch.

Label	What it does	Default	Syncs	Notes
Dev container name	The name of the container tasks run in. Auto-generated derives it from the project name, so it always matches the generated compose file. Custom points the project at a container you build and run yourself, and the board only runs the agent inside it.	Auto-generated	Yes. Each device runs its own container under the name	Tasks are blocked while this container is not running. Custom hides the Ports, Docker Compose and Dockerfiles tabs, uses no published ports, and needs a name that matches the container's own. A custom name is required.
Base image	The system the generated Dockerfile starts from. Ubuntu 26.04 LTS, Ubuntu 24.04 LTS or Debian 13 (trixie).	Ubuntu 26.04 LTS for a new project. A project created before the setting existed stays on Ubuntu 24.04 LTS	Yes	Auto-generated only. Takes effect the next time the container is started, restarted or rebuilt, and a running container is offered a rebuild on save. A hand-edited Dockerfile decides for itself. When its first FROM line names one of the three images, the picker rewrites that line. When it names anything else the picker is disabled and says the Dockerfile decides. See Change the base image or pin an architecture.
Container CPU architecture	Builds the container for x64 (Intel/AMD) or arm64 (Apple Silicon, ARM). Default builds for whatever machine runs the container.	Default (this machine)	A forced value syncs. Default is decided per machine	Auto-generated only. Force one only for a dependency that exists for a single architecture. On a machine of the other kind a forced architecture runs emulated, slower and without gVisor, and a notice says so once. Where the machine cannot emulate it the start is refused and the message names the fix. Hints in a Dockerfile (a pinned platform, i386 packages, an architecture in a download URL) and matching build failures are reported as notices that point here. Nothing is changed automatically.
Sibling containers	Names of containers you run yourself, such as a database, so that Start all, Stop all and the container list include them.	None	Only the names sync	Up to 20. The board never creates, builds or removes a sibling. On another device a sibling that is not there is listed as not on this machine, with no buttons.
Allow this container to manage Docker containers	Lets the agent create, run and delete containers from inside this one, for dockerized apps. Its Docker access goes through a policy proxy that forces gVisor where installed, denies privileged mode and host mounts, tracks everything it creates and lets it touch only this project's own containers.	Off	Yes. The proxy port and the firewall rule are per machine	Auto-generated only. Widens the trust boundary, and a warning says so. Saving with it on installs the Docker client into the running container in the background and adds it to the Dockerfile so a rebuild keeps it. Containers the agent creates are placed on the project's own network, once a project created on an older version has been moved onto it. See Container management.
Let other devices reach containers the AI creates	Publishes the ports of containers the agent creates on the local network. Off keeps them on this computer.	Off	Yes	Shown while management is on.
Connected projects	Other projects this container can reach by name, each over a private pair network the board creates between the two once both projects are on their own networks. The connection is symmetric and shows on the other project too.	None	Yes. Each computer builds its own networks	Saved projects only. Connect a project picks from the board's other projects. Applies once both containers restart, and a change offers the restart. See Connected projects.
Docker container management	The firewall panel under the management switch. Shows the proxy's address and port, whether the container can reach it, the firewall tool detected, and Allow through firewall, Remove firewall rule, Copy command and Check.		The rule is per machine	Linux only, because macOS and Windows have no host firewall in the path. Status is measured from inside the container, by whether it can reach the proxy, never by reading the firewall. Applying the rule raises one administrator prompt, or opens a terminal, or hands you the command to run, and the exact command is shown afterwards either way. After an apply the panel re-checks itself until the container reaches the proxy. Save the project first, then come back to check. See Firewall.
Install gVisor	Shown with a warning on a Linux machine whose Docker has no gVisor runtime registered. Opens the Docker setup wizard in gVisor mode. Install guide opens the upstream instructions.			Without gVisor the container runs without sandbox isolation. Nothing is blocked. Not shown on macOS and Windows, where Docker Desktop's virtual machine isolates the host.

Docker Compose

Auto-generated container only. The compose file the container is started from.

Label	What it does	Default	Syncs	Notes
docker-compose.yml	The compose text. While untouched it is a live preview that regenerates as the project name, ports, architecture and base image change, and it is not stored. Editing it stores your text verbatim and stops the preview.	Generated	Yes, once edited	A stored file still receives the board's injected parts on every start, which are published ports with the loopback rule, the sandbox runtime, the memory cap, a pinned architecture and the project network, once a project created on an older version has been moved onto it. Environment variables are never written into it. A compose change on a running container offers a Restart on save. Read-only on the cloud browser and phone until the desktop is connected, because the desktop generates it.
Generate Docker Boilerplate	Regenerates both files from the form and resumes the live preview, discarding hand edits.			Preview only. Nothing is written to disk until the project is saved.

Dockerfiles

Auto-generated container only. The files the container image is built from.

Label	What it does	Default	Syncs	Notes
Dockerfiles	One editor per file, each with a filename and its content. Live preview until edited, then stored verbatim.	One generated Dockerfile	Yes, once edited	An edited Dockerfile's first FROM line decides the base image. Turning container management on adds the Docker client to a stored file in the same save. A change offers a Rebuild on save. Read-only until the desktop is connected.
+ Add Dockerfile	Adds an empty file editor.			Each needs a filename.
Remove file	Removes that file.

Label	What it does	Notes
Cancel	Closes without saving.	A click on the backdrop does not close the dialog.
Previous	Wizard only. Goes back one tab with no checks.
Next	Wizard only. Validates the current tab and moves to the next.	Becomes Create project on the last tab. Disabled until the project has a name.
Create project	Creates the project after checking every tab, stores any typed API keys, and then asks Start the container now?	The first start builds the image, which can take minutes, so it is asked rather than done. Start container starts it in the background and Not now leaves it stopped. Both close the dialog. Asked for an Auto-generated container when some machine can start it.
Save changes	Saves after checking every tab. When a change needs the running container recreated, the dialog stays open and asks Restart the container? or Rebuild the container?	A Dockerfile or base image change needs a rebuild. A name, path, port, compose, startup or connected-project change needs a restart. Environment variables need neither. Later saves without acting. When the code lives only in the container the prompt warns that a recreate discards uncommitted and unpushed work. The prompt appears on the desktop and the local network browser, not on the cloud browser.
Delete project	Moves the project and its tasks to the recycle bin for 30 days and stops its container.	Type the project name to confirm. See Recovering things.

From the cloud browser or the phone

The dialog is the same on every surface. What differs is where the work happens.

Secrets are written through the desktop. An API key, a pasted git key or an environment variable typed on the cloud browser or the phone travels over TLS through the cloud, which holds it in memory only and never stores it, to your own desktop app, which encrypts it under the account key and syncs it back. The desktop must be running with cloud sync on. The field says so, and existing values cannot be shown because the cloud never stores the key that would decrypt them.
Environment variables are added or replaced one pair at a time there, never as a list, so the values that client cannot see are never deleted.
Linking a saved key from the vault, and linking a business shared key, work everywhere with no desktop awake. A link names a credential without being one.
The folder is chosen by the desktop. There is no Browse. Create a folder for me asks the desktop to create a workspace folder beside the project's Docker files and reports where it went. Typing a full path also works, and the desktop creates it when the project arrives.
Controls whose work happens on the desktop are shown and disabled with one reason when the desktop is not connected, never hidden. The reason reads Your desktop app is not connected. Open it (with cloud sync on) to use this. This covers the script test run, the firewall panel, the container start prompt, GitLab sign-in, verifying and storing keys, and Create a folder for me.
The Docker Compose and Dockerfiles editors are read-only until the desktop is connected, because a preview generated anywhere else would not match what the desktop writes.
The container memory limit and CPU architecture describe the machine that runs the containers, so their automatic values are unknown until the desktop reports them, and any value you set still applies.
The AI roles can be set from a browser or phone and take effect on the desktop at the next sync.
The restart or rebuild prompt after a save appears only on the desktop and the local network browser. From the cloud, use the board's container controls, which relay to the desktop.

Source as Markdown: /docs/reference/project-settings.md · Updated 2026-10-11 · Was this right? Tell us