Container Configuration - HiddenLayer Docs

The container options below can be used to authenticate to use the software (HL_LICENSE), to send data to the platform (HL_LLM_PROXY_CLIENT_ID and HL_LLM_PROXY_CLIENT_SECRET), or to configure networking behavior.

Variables

Environment Key	Required	Default	Example Value	Description
`HL_LICENSE`	True			License for use obtained from HiddenLayer.
`HL_LLM_PROXY_ENABLE_UNSECURED_ROUTE_PASSTHROUGH`	True	`true`		Flag to handle unmapped routes, the AI Runtime Security supports passing through all HTTP endpoints that are not explicitly mapped.
`HL_LLM_PROXY_CLIENT_ID`	False			The HiddenLayer API key. Required for an Runtime Security hybrid deployment.
`HL_LLM_PROXY_CLIENT_SECRET`	False			The HiddenLayer API secret. Required for an Runtime Security hybrid deployment.
`HL_LLM_PROXY_DOWNSTREAM_TIMEOUT_SECONDS`	False	`600`	`600`
`HL_LLM_PROXY_HTTP_HOST`	False		`0.0.0.0`
`HL_LLM_PROXY_HTTP_PORT`	False	`8000`	`8000`	While the port range is `1-65535`, the recommended port range is `1025-65535` since opening ports `1-1024` requires root permissions.
`HL_LLM_PROXY_LOG_LEVEL`	False	`INFO`	`DEBUG`
`HL_LLM_PROXY_LOG_LEVEL_PAYLOADS`	False	`parsed`	`parsed`	Excludes submitted prompts and LLM responses from INFO-level logging and above. Available values: `none` and `parsed`.
`HL_LLM_PROXY_MLDR_BASE_URL`	False	`https://api.us.hiddenlayer.ai`	`https://api.us.hiddenlayer.ai`
`HL_LLM_PROXY_MLDR_COLLECT_PROMPT`	False	`true`	`false`	Collects prompts and response with the security analysis sent to the HiddenLayer Console. This allows the review and evaluation of Interactions on the Console in the context of the user’s prompt and response. Setting to `false` disables this. If this setting is not configured, the default behavior is set to `true`.
`HL_LLM_PROXY_MLDR_CONNECTION_TYPE`	False	`disabled`	`hybrid` or `disabled`	Hybrid mode enables metadata to be sent to HiddenLayer to power the console experience. In hybrid mode, `HL_LLM_PROXY_CLIENT_ID` and `HL_LLM_PROXY_CLIENT_SECRET` must be set. Setting to disabled will remove any connections back to HiddenLayer.
`HL_LLM_PROXY_MLDR_DEFAULT_REQUESTER`	False	`unknown`	`unknown`
`HL_LLM_PROXY_MLDR_ENABLE_REMOTE_CONFIGURATION`	False	`true`	`false`	Enables policy support. Setting to false disables Policy support for Runtime Security.
`HL_LLM_PROXY_MLDR_RETRY_COUNT`	False	`3`	`3`
`HL_LLM_PROXY_OUTBOUND_PROXY_URL`	False		`https://outbound-proxy.example.com:8080`	As of 26.8.0, routes hybrid HiddenLayer traffic (token refresh and submit to `api.*.hiddenlayer.ai`) through a customer-managed forward proxy. Supports `http://`, `https://`, and `socks5://`. Unset means those calls go direct. `HTTP_PROXY` / `HTTPS_PROXY` are not a substitute for this variable. Helm: `aidr_genai.env.HL_LLM_PROXY_OUTBOUND_PROXY_URL` or `aidr_genai.proxy.outbound-proxy-url`. See Egress via HTTP/HTTPS Proxy.
`HL_LLM_PROXY_TOKEN_URL`	False	`https://api.us.hiddenlayer.ai`	`https://api.eu.hiddenlayer.ai`