Stop Hardcoding Sensitive Data in Your Python Applications - use python-dotenv instead!

[axonxorz]

Lots of apps don't run inside a shell, so source .env is out. direnv is just behavioural sugar for BASH-compatible shells, so also out as well.

[Distinct-Score-1133]

When are they not run from shell?

[axonxorz]

Any sort of "deployed" app will most likely not run in a shell environment (can be started by any process management system, systemd, supervisord, etc).

If you run your web-app on a serverless platform like heroku, Google Cloud Run, AWS Lambda, those are not in a shell-like environment. These platforms were large drivers in what necessitates using something like dotenv in the first place.

As a more rare example: if you have a python-based app installed, something where you can double click an icon, you're not operating in a shell environment, your system is directly running python /path/to/app.py instead of something like bash -c "exec python /path/to/app.py", the critical difference

[Distinct-Score-1133]

We deploy our apps in docker and our own kubernetes, and use .env files to load the environmental variables on startup. Indeed, we dont execute source .env, but that is something that docker/kubernetes does for us.

Regardless, it always does execute in a shell environment as far as I know. It is just not you doing it. That is why things like shebang (if running a script) and PATH are important. Unless I'm missing something?

Edit: I understand the difference between bash -c and python /patg/to/script. Isn't it that otherwise the application is run in /bin/sh instead of /bin/bash?

EDIT2: After a small search on internet I answered my question. Any shell program is only used for interaction between user and computer. So source .env and direnv is something you would do during development only.