Split default env and user's env

Right now, user’s env (passed with commands) are overriding default env (the one in the mesg.yml).
The problem is user’s env should be considered as sensitive data (cannot be exposed publicly). So, we cannot add them in the protobuf service definition.

One solution will be to no override the default env but simply to have a dedicated arrays to store them outside the service definition (as “metadata”).
Like this, the service definition will holds the default env defined by the mesg.yml that can be exposed to the network.

Draft todo:

I shared my ideas about this before, I don’t think that we should keep env variables on deploy time. It should be moved to start time of services. These kind of configurations are specific to user of service, a service deployed with user’s configuration is unlikely to be used by others and cannot be published on marketplace because of our policies.

Can’t we just not display them?

This has been implemented with the instances. A service has now multiple instances based on env variable that are hashed and stored. No env variables are saved, only the hash that combine them.