
Security News
CVE Volume Surges Past 48,000 in 2025 as WordPress Plugin Ecosystem Drives Growth
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.
Bundle environment variables in create-react-app at build time launch time!
Create-react-app supports environment variable but they are bundled at build time when yarn build is run.
If we want to change anything like the URL of the backend the app should connect to, we have to rebuild, we can't ship customizable Docker image of our CRA apps.
In practice CRA-ENVS enable to turn a statically build React project into a configurable webapp.
The solution would be to be able to do:
docker run --env FOO="xyz" my-org/my-create-react-app
Then access FOO:
process.env["FOO"]public/index.html like <title>%FOO%</title> or <title><%= process.env.FOO %></title>cra-envs does just that, in a secure, performant and type safe way.
.env file.public/index.html (did you know?).Using cra-envs will complicate your Dockerfile and necessitate the inclusion of Node.js alongside
Nginx in your Docker image. This adds an additional 58MB for Node.js, which is necessary for server-rendering public/index.html at the container's startup.
If server-rendering index.html (as a EJS template) is not on your agenda (though it may become a requirement in the future), you may want
to consider import-meta-envs for a solution with a smaller impact on your Docker image's size.
Onyxia-web is a create-react-app distributed as a Docker image.
Sysadmins that would like to deploy Onyxia on their infrastructure can simply use the official Docker image and provide relevant environnement variable to adjust the theme/branding of the website to their usecase.
Here are two deployment example:
Click on the social media preview to access the websites
Find 👉here👈 a demo setup of:
cra-envs + create-react-app + TypeScript + Nginx + Docker
The recommended way to get started with cra-envs is to follow the instructions
provided in the cra-envs-demo-app.
Now, if you want to acquire a deeper understanding what the tool does and how
you can follow the following steps.
Start by installing the tool:
yarn add cra-envs
Then declare all the allowed environment variables into the .env file of your project
Example
REACT_APP_FOO="Default value of foo"
REACT_APP_BAR=
REACT_APP_BAZ=
REACT_APP_FIZZ=
Once it's done run the script npx generate-env-getter ( Use npx generate-env-getter js if you your project don't use TypeScript)
It will generate src/env.ts ( or src/env.js) looking like:
/*
* Automatically generated by cra-envs.
* If you wish to declare a new environment variable declare it in the .env file (prefixed by REACT_APP_)
* then run 'npx generate-env-getter' at the root of your project.
* This file will be updated.
*/
import { getEnvVarValue } from "cra-envs";
export const envNames = [
"FOO",
"BAR",
"BAZ",
"FIZZ"
] as const;
export type EnvNames = typeof envNames[number];
let env: Record<EnvNames, string> | undefined = undefined;
export function getEnv() {
if (env === undefined) {
env = {} as Record<EnvNames, string>;
for (const envName of envNames) {
env[envName] = getEnvVarValue(envName);
}
}
return env;
}
(This file should be gitignored)
Now let's test it by creating a .env.local file like:
REACT_APP_BAR="Value of bar defined in .env.local"
And let's do this somewhere in our code:
import { getEnv } from "./env.ts"
console.log(getEnv());
Now if we run REACT_APP_BAZ="Value of baz passed inline" yarn start we get this
in the console:
{
"FOO": "Default value of foo",
"BAR": "Value of bar defined in .env.local",
"BAZ": "Value of baz passed inline",
"FIZZ": ""
}
Now if you run yarn build then BAZ="Value of baz on the server" npx embed-environnement-variables
the value of BAZ will be injected in build/index.html (or html/index.html) so that if you
start statically serving
the build/ dir, for example with serve -s build you will get this in the console:
{
"FOO": "Default value of foo",
"BAR": "Value of baz on the server",
"BAZ": "",
"FIZZ": ""
}
Note that on the server the environment variable names don't need to be prefixed with REACT_APP_ (they can though).
Also note that the script runs very fast and thus represent virtually no overhead when starting your container.
By default embed-environnement-variables does not embed variables defined in .env.local, if you want to include
them use: --includes-.env.local or -i.
The next step is to set up a clean Dockerfile where there is both node and Ngnix available.
Node for being able to run npx embed-environnement-variables and Ngnix for serving the app.
It is also important to make sure cra-envs is not bootstrapped by npx in the entrypoint.
FAQs
Script for embedding server variable in CRA apps without having to rebuild.
The npm package cra-envs receives a total of 166 weekly downloads. As such, cra-envs popularity was classified as not popular.
We found that cra-envs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
CVE disclosures hit a record 48,185 in 2025, driven largely by vulnerabilities in third-party WordPress plugins.

Security News
Socket CEO Feross Aboukhadijeh joins Insecure Agents to discuss CVE remediation and why supply chain attacks require a different security approach.

Security News
Tailwind Labs laid off 75% of its engineering team after revenue dropped 80%, as LLMs redirect traffic away from documentation where developers discover paid products.