storeenv run decrypts the environment and starts your command with the values in its environment. Nothing is written to disk.

$ storeenv run -- npm start
$ storeenv run --env production -- node server.js
$ storeenv run --service backend -- python manage.py migrate

Which environment#

The same as pull: --env, then STOREENV_ENV, then storeenv env use, then a branch rule, then default.

What run refuses#

• Process control variables (NODE_OPTIONS, PATH, LD_*, DYLD_*, BASH_ENV, GIT_SSH_COMMAND, PYTHONSTARTUP, JAVA_TOOL_OPTIONS, STOREENV_* and more), unless you allow one by name with --allow-env.
• Any value that isn't signed by a trusted writer. --allow-unsigned doesn't apply to run.

Signals and exit codes#

Ctrl+C, and SIGTERM and SIGHUP (for example from docker stop), are passed to your command; run waits for it and exits with its exit code, or 128 + the signal number if it was killed by a signal. That makes it safe as a container's main process.