rune exec

Execute a command inside a running service or instance — interactive or one-off.

rune exec [flags] <service-or-instance> [command] [args...]

Three shapes are accepted:

No command — opens an interactive shell (bash if present, else sh): rune exec api
Simple command — written inline: rune exec api ps aux
Command with flags — use -- so rune doesn't try to parse the inner flags as its own: rune exec api -- ls -la /app

Rune's own flags (-n, --workdir, --env, --timeout, --no-tty, --api-server, -t) work in any position before --. The -- convention is the same one used by kubectl exec, git bisect run, ssh -- cmd, and sudo.

Examples

# Interactive shell (auto-picks bash, falls back to sh)
rune exec api
rune exec -n prod web
 
# Simple commands (no inner flags)
rune exec api ps aux
rune exec api-instance-7c2e env
 
# Commands with flags — '--' is required
rune exec api -- ls -la /app
rune exec api -- bash -c "echo $HOSTNAME"
 
# Workdir + env + command
rune exec api --workdir=/app --env=DEBUG=true -- python debug.py
 
# Non-interactive
rune exec api --no-tty -- python script.py
 
# Bound timeout
rune exec api --timeout=30s -- python long.py

Flags

Flag	Default	Notes
`-n, --namespace`	context	Target namespace.
`--workdir <dir>`	runner	Working directory inside the instance.
`--env k=v`	—	Extra env var (repeatable).
`--no-tty`	false	Disable TTY allocation.
`--timeout <dur>`	—	Bound the session.

Behavior

A service-name argument picks any healthy instance.
An instance ID targets that exact instance.
Stdin/stdout are forwarded full-duplex when a TTY is allocated.
Exit code is forwarded — rune exec exits with the same status as the inner command.

Permissions

Gated by the exec verb on service (or instance). Lock this down in production policies — exec is effectively root inside the container.