What is an environment variable?

An environment variable is a named text value, such as LOG_LEVEL=debug, that the operating system hands to a program when the program starts, so the same code can behave differently on a laptop, in CI and in production.

How it works

Every process on Linux and macOS starts with a list of NAME=value pairs. A child process inherits a copy of its parent's list unless the parent decides otherwise. Shells read .env-style files with export lines, systemd reads Environment= and EnvironmentFile= settings, and CI systems inject variables into each job. The program reads them at startup, usually once.

The Twelve-Factor App popularized this pattern: keep configuration out of the codebase and pass it through environment variables, so the same build can run anywhere. That advice is still sound for ordinary settings like LOG_LEVEL or a region name.

Why secrets need extra care

Environment variables were designed for configuration, not for confidential data. A few properties make them leaky when they hold API keys or database passwords:

• They travel down the process tree. Every child process gets a copy, including tools that have no reason to see your Stripe key.
• They are readable from outside the process. On Linux, /proc/<pid>/environ exposes the environment the program started with to anyone who passes the kernel's ptrace read check, which usually means the same user or root (proc_pid_environ(5)).
• Service managers may expose them. The systemd manual says variables set for a unit are visible to unprivileged clients over D-Bus and are not suitable for secrets (systemd.exec(5)).
• They end up in logs. Debug output, crash reports and env dumps in CI logs are common ways values escape.

The OWASP Secrets Management Cheat Sheet makes the same point and suggests narrowing who can read them.

How Crunu uses it

Crunu stores a team's .env files and other config files encrypted, and delivers them as environment variables only to the program that needs them. crunu run starts your command with a clean environment: a short allowlist (PATH, HOME, LANG and a few others) plus the variables of the environments you name. Crunu's own credentials, such as CRUNU_TOKEN, are never passed to the child.

crunu run --env payments-api/production --restart on-change -- /opt/payments/bin/server

On a machine with the agent, the decrypted values live in the memory of the agent service, not in a file on disk. With --restart on-change, the program restarts when a value changes. A running process still keeps the variables it started with until it restarts, and root on the machine can read anything that machine was given. See machines and leases, files and variables and the crunu run reference.

In Crunu's vocabulary, an environment (such as payments-api / production) is a unit of encryption and access, which is different from a process environment. The product always says "environment variables" for the second meaning.

Sources

• The Twelve-Factor App: Config, checked October 27, 2026.
• proc_pid_environ(5), Linux manual page, checked October 27, 2026.
• systemd.exec(5), checked October 27, 2026.
• OWASP Secrets Management Cheat Sheet, checked October 27, 2026.