Secrets, Hardware Tiers, and Persistent Storage

~24 min · spaces, ops, secrets

Level 0Scout

0 XP0/50 lessons0/10 achievements

0/120 XP to next level120 XP to go0% complete

Secrets are environment variables

The Space settings page has a "Secrets" panel. Anything you put there is exposed as an environment variable in the running container — available via os.environ['HF_TOKEN'], os.environ['OPENAI_API_KEY'], etc. They're encrypted at rest, masked in logs, and never appear in the repo.

Hardware tiers

Tier	Hardware	Use case
CPU Basic (free)	2 vCPU, 16GB RAM	Demos, small Transformers, classical ML.
CPU Upgrade	8 vCPU, 32GB RAM	Bigger CPU workloads.
T4 small	1 T4 (16GB)	1-3B inference, simple Stable Diffusion.
A10G	1 A10 (24GB)	7B inference, SDXL, Whisper-large.
A100 / H100	1 A100 (80GB) / 1 H100 (80GB)	30-70B inference (with quantization), training jobs.

Persistent storage

Free tier: scratch only — the container's filesystem evaporates on rebuild. Paid tiers (Persistent Storage Small/Medium/Large): a real disk at /data. Use it for: model caches, user uploads, fine-tune outputs you want to survive a redeploy.

Code

Use a secret in app code·python

import os
from huggingface_hub import InferenceClient

# 'HF_TOKEN' set in Space settings → Secrets
client = InferenceClient(token=os.environ["HF_TOKEN"])

Hardware + persistent storage in manifest·yaml

---
title: My Big Demo
sdk: docker
app_port: 7860
hardware: a10g-small
storage: small
---

External links

Exercise

Add a secret to one of your Spaces and verify it works in code. Upgrade a Space to T4 or A10G hardware (briefly — paid). Add persistent storage. Push a small model snapshot to /data. Restart the Space and verify the snapshot survives.