Run an Application¶

Use exec to resolve and validate configuration, then start an application without writing a dotenv file or printing shell exports.

dotenv-fusion exec -- application --serve

Everything after -- is passed directly to the application. No shell parses the arguments, and dotenv-fusion preserves the application's exit code. On POSIX, the application replaces the dotenv-fusion process.

Select a configuration¶

dotenv-fusion exec -f .env-fuse -- application --serve
dotenv-fusion exec --var ENV=production -- application --serve
dotenv-fusion exec --walk-up 3 -- application --serve

File values replace variables already present in the parent environment by default. With --no-override, a parent value wins. For a source-backed variable, preserving the parent value also avoids contacting its backend.

Resolve encrypted sources¶

exec is the preferred delivery path for encrypted secrets because it decrypts them immediately before process startup and creates no intermediate dotenv file.

dotenv-fusion exec \
  --age-identity /home/user/.config/age/keys.txt \
  -- application --serve

Configure the store, identities, and selectors in Get Started with age.

Validate before startup¶

exec performs normal parsing, source resolution, type conversion, and validation before starting the command. Use check when validation should be a separate pipeline step:

dotenv-fusion check -f .env-fuse
dotenv-fusion exec -f .env-fuse -- application --serve

Static CI can inspect the configuration without secret access:

dotenv-fusion check --no-resolve-sources -f .env-fuse

See exec in the CLI reference for all options and exit codes.