What causes "environment value for {key} exceeds 1048576-byte limit" in astrid-runtime/astrid?

Reduce the value below 1048576 bytes.

environment value for {key} exceeds 1048576-byte limit

Error message

environment value for {key} exceeds 1048576-byte limit

What it means

Fired by validate_values when a non-secret `--var` value passed to the capsule installer exceeds the 1 MiB (1048576-byte) environment value limit. It is a pre-flight size validation before values are sent to the daemon; the parallel secret limit is 64 KiB.

Source

Thrown at crates/astrid-cli/src/commands/capsule/install_daemon.rs:439

        }
    }

    let mut values = Vec::with_capacity(parsed.len());
    for (key, value) in parsed {
        let definition = manifest.env.get(&key).ok_or_else(|| {
            anyhow::anyhow!(
                "--var names no [env] field in {}: {key}",
                manifest.package.name
            )
        })?;
        let kind = if definition.env_type.eq_ignore_ascii_case("secret") {
            if value.len() > 64 * 1024 {
                bail!("secret value for {key} exceeds 65536-byte limit");
            }
            EnvValueKind::Secret
        } else {
            if value.len() > 1 << 20 {
                bail!("environment value for {key} exceeds 1048576-byte limit");
            }
            EnvValueKind::Text
        };
        if !definition.enum_values.is_empty()
            && !definition
                .enum_values
                .iter()
                .any(|allowed| allowed == &value)
        {
            bail!(
                "invalid value for {}.{}: expected one of {}, got {value:?}",
                manifest.package.name,
                key,
                definition.enum_values.join(", "),
            );
        }
        values.push(DaemonEnvValue { key, value, kind });
    }

View on GitHub (pinned to affd8760f4)

Solutions

Reduce the value below 1048576 bytes.
Mount or reference the large payload as a file/artifact instead of an env var.
Split the value across multiple keys if semantically appropriate.

Example fix

// before
--var CONFIG=$(cat huge.json)
// after
--var CONFIG_PATH=/etc/capsule/huge.json

Defensive patterns

Strategy: validation

Validate before calling

if value.len() > 1024 * 1024 { return Err("env value exceeds 1MiB"); }

Try / catch

on this error, switch to a file/artifact-based configuration channel instead of env vars, then retry.

Prevention

Measure generated values (e.g. with wc -c) before inlining.
Keep large configs as mounted files, not env vars.
Set a stricter local limit (e.g. 256 KiB) in your tooling.

When it happens

Trigger: Passing --var KEY=<value> where KEY's [env] definition is plain text and value.len() > 1 << 20, e.g. embedding a large config blob or dataset inline.

Common situations: Inlining a big JSON/YAML config or encoded file as an env var; a generated value (e.g. large JWT or dump) that ballooned past 1 MiB.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/7ae4f8c85f515022. Report an issue: GitHub.