Linux Basics: Reproduce a Command with a Small Explicit Environment

An exported setting can make a local command behave differently from the same command in a scheduled job. GNU env -i starts a child with an empty environment before adding the values you supply. This is a focused way to reproduce an environment-sensitive issue without editing shell startup files.

Prepare a scratch directory

Tested on Linux with GNU Bash 5.2.37 and GNU coreutils 9.7. You need Bash, a text editor, and the utilities shown below. The script creates and removes its own temporary fixture directory.

Keep the same terminal open. Stop if setup fails, before saving the source:

start_dir="$PWD"
work_dir="$(mktemp -d)" || exit 1
cd -- "$work_dir" || exit 1

Run the example

Save this as demonstrate-gnu-env-clean-child.sh:

#!/usr/bin/env bash
set -euo pipefail
export LC_ALL=C
fixture_dir="$(mktemp -d)"
trap 'rm -rf -- "$fixture_dir"' EXIT
cd -- "$fixture_dir"
export BLOG_COLOR=blue
export BLOG_TRACE=enabled
env -i PATH=/usr/bin:/bin LC_ALL=C BLOG_COLOR=green \
    /bin/bash --noprofile --norc -c '
        printf "Child color: %s\n" "$BLOG_COLOR"
        printf "Child trace: %s\n" "${BLOG_TRACE-unset}"
        printf "Child locale: %s\n" "$LC_ALL"
        test "$BLOG_COLOR" = green
        test "${BLOG_TRACE+x}" != x
    '
printf 'Parent color: %s\n' "$BLOG_COLOR"
printf 'Parent trace: %s\n' "$BLOG_TRACE"

Run it:

bash demonstrate-gnu-env-clean-child.sh

Observed output:

Child color: green
Child trace: unset
Child locale: C
Parent color: blue
Parent trace: enabled

Read the result

-i drops inherited environment entries for the child. The assignments following it add the explicit replacement values. The child sees green and no BLOG_TRACE, while the script’s parent shell still has blue and enabled. Single quotes around the -c program defer variable expansion to the child. Double quotes there would allow the calling shell to substitute its own values before the child starts.

Apply it carefully

An empty inherited environment is not a sandbox: the program retains filesystem access, credentials associated with its process, working directory, and open file descriptors. A shell can also create its own variables after it starts. The explicit path is suitable for this Linux example; applications may need other deliberate settings, including locale, home-directory, proxy, or certificate configuration. Do not use a stripped environment to evade required network controls. Here the child runs only local shell builtins, and no parent settings or startup files are changed.

The command reference documents the available options.

Clean up

Remove the saved script, return to the starting directory, and remove the empty practice directory:

rm -- demonstrate-gnu-env-clean-child.sh
cd -- "$start_dir" || exit 1
rmdir -- "$work_dir"
unset start_dir work_dir

If the directory is not empty, inspect what remains rather than deleting unknown files.

Acknowledgements

This post was created with assistance from AI.