fnox exec

• Usage: fnox exec [FLAGS] [COMMAND]…
• Aliases: x

Run a command with secrets in its environment

Resolves the active profile's secrets and runs COMMAND with them set as environment variables. Secrets with env = true (the default) or env = "exec" are set; env = false secrets are not, and are removed if the parent environment has them. An as_file secret is written to a private temporary file whose path becomes the variable's value; the file is deleted when the command exits. Configured lease backends add short-lived credentials.

fnox also removes FNOX_AGE_KEY, FNOX_AGE_KEY_FILE, and the Enpass master password from the inherited environment, forwards Ctrl-C and SIGTERM to the command, and exits with the command's exit status. Put fnox options before --; everything after it is the command.

With --redact (or redact_exec = true / FNOX_EXEC_REDACT=1), secret values are replaced with [REDACTED] in the command's stdout and stderr, but only for a stream that is piped or redirected; a terminal is left untouched so interactive programs keep working. This is not a sandbox: a command can transform a value before printing it.

Arguments

• [COMMAND]… — Command to run, with its arguments

Flags

• --except <NAME> — Do not resolve these secrets; repeatable

  Takes names and globs like --only and applies after it. A secret that a selected secret depends on is still resolved, but not passed to the command unless it is selected itself. A lease is skipped when NAME matches a variable it produces.

• --no-redact — Never redact output, even if the config or FNOX_EXEC_REDACT enables it

• --only <NAME> — Resolve only these secrets, plus the secrets they depend on; repeatable

  Each NAME is a secret name or a glob such as AWS_*; comma-separate several. Other secrets are not resolved, so their providers are never called and they cannot fail the run. if_missing still applies to the selected secrets. An unknown name, or a glob that matches nothing, is an error. Leases run only when NAME matches a variable they produce; command leases are skipped.

• --redact — Replace secret values with [REDACTED] in piped or redirected output

  Applies to each of stdout and stderr only when that stream is not a terminal. Values shorter than 3 characters are not redacted. Overrides redact_exec in the config and FNOX_EXEC_REDACT. Not allowed with --replace (use --no-redact).

• --refresh <KEY> — Re-fetch KEY from its provider instead of the daemon cache; repeatable

  The fresh value replaces the cached one. Other secrets are still served from the cache.

• --replace — Replace the fnox process with the command (Unix only)

  The command keeps fnox's process ID and receives signals directly. Not allowed when the command would receive an as_file secret or the profile configures lease backends, because fnox must clean those up after the command exits.

• -h --help — Print help

Examples

Run a command

fnox exec -- npm start

Use the production profile and fail on any missing secret

fnox exec -P production --if-missing error -- ./deploy.sh

Expand a secret in a shell expression (single quotes defer expansion)

fnox exec -- sh -c 'test -n "$DATABASE_URL"'

Re-fetch one secret instead of using the daemon cache

fnox exec --refresh API_TOKEN -- ./script.sh

Resolve only some secrets; unrelated secrets are never fetched

fnox exec --only DATABASE_URL,'AWS_*' -- ./migrate.sh

Skip one secret, for example one whose provider is unreachable

fnox exec --except LEGACY_API_KEY -- npm start

See also

• Running commands
• Profiles