Env Config Injection
Supply the full PraisonAI CLI config from the environment — no config.yaml on disk
Supply the whole user-config layer from a single environment variable — no config.yaml is read or written to disk. Pairs with PRAISONAI_AUTH_CONTENT so one CI secret set provides auth and config for a stateless run.
Quick Start
- Inline (YAML)
bash export PRAISONAI_CONFIG_CONTENT='agent: model: gpt-4o-mini permissions: deny: - "rm -rf /"' praisonai run "Summarise this repo"python from praisonaiagents import Agent # Model + permissions come from PRAISONAI_CONFIG_CONTENT — no ~/.praisonai/config.yaml agent = Agent(name="assistant", instructions="Be helpful.") agent.start("What model am I using?") - Inline (JSON)
bash export PRAISONAI_CONFIG_CONTENT='{"agent":{"model":"gpt-4o-mini"},"mcp":{"srv":{"url":"https://mcp.example.com"}}}' praisonai run "List MCP tools" - Explicit path (PRAISONAI_CONFIG)
bash export PRAISONAI_CONFIG=/etc/praisonai/prod.yaml praisonai run "Ship it" - Auth + config in one env set (zero-disk CI)
bash export PRAISONAI_AUTH_CONTENT='{"openai":{"api_key":"sk-...","auth_method":"apikey"}}' export PRAISONAI_CONFIG_CONTENT='agent: model: gpt-4o-mini' praisonai run "Run my CI task" # Nothing is written to ~/.praisonai — both auth and config live in memory only.
Which one should I use?
Pick the source that matches where your config already lives.
Precedence
The env-config layer occupies the same slot as the discovered global/project files, so higher layers still win.
Key rules:
PRAISONAI_CONFIG_CONTENT(inline) wins overPRAISONAI_CONFIG(path) — inline replaces the path layer entirely.- When either is set, no global/project
config.yamlon disk is read for the user-config layer. - Per-key env vars (
PRAISONAI_MODEL,OPENAI_API_BASE, …) and CLI flags still override the env blob. - Managed policy (
permissions,model_allowlist) is still enforced on top.
Configuration Options
| Variable | Type | Default | Description |
|---|---|---|---|
PRAISONAI_CONFIG_CONTENT | inline JSON or YAML blob | unset | Parsed in memory as the user-config layer. Supports ${VAR} / {env:VAR} / {file:...} interpolation, same as an on-disk file. |
PRAISONAI_CONFIG | file path | unset | Explicit config file loaded in place of global/project discovery. Ignored when PRAISONAI_CONFIG_CONTENT is set. |
Provenance
See which layer supplied each key with the env-config: label.
praisonai config show --sources
# agent.model env-config:env:PRAISONAI_CONFIG_CONTENT
# permissions.deny env-config:env:PRAISONAI_CONFIG_CONTENTfrom praisonai_code.cli.configuration.resolver import ConfigResolver
prov = ConfigResolver().resolve_with_provenance()
print(prov["agent.model"]["layer"]) # -> "env-config"Fallback & Warning Behaviour
| Situation | Behaviour |
|---|---|
PRAISONAI_CONFIG_CONTENT is not valid JSON/YAML | UserWarning (Ignoring PRAISONAI_CONFIG_CONTENT: value is not valid JSON/YAML.), fall back to file discovery |
PRAISONAI_CONFIG_CONTENT parses to a list/scalar (not a mapping) | UserWarning (value must be a mapping.), fall back to file discovery |
PRAISONAI_CONFIG_CONTENT is {} (empty mapping) | Authoritative — file discovery is not re-enabled |
PRAISONAI_CONFIG points at a missing file | UserWarning, fall back to file discovery |
PRAISONAI_CONFIG points at a valid but non-mapping file | UserWarning, fall back to file discovery |
PRAISONAI_CONFIG points at an empty (valid-YAML) file | Authoritative — file discovery is not re-enabled |
Best Practices
🔒 Treat the blob as a secret
It can contain provider URLs, tenant IDs, and deny rules. Inject only from a secrets manager; never commit it.
📦 Compose with PRAISONAI_AUTH_CONTENT
An auth blob plus a config blob together give a true zero-disk run — nothing touches ~/.praisonai.
🧭 Use PRAISONAI_CONFIG for mounted volumes
Kubernetes ConfigMaps mounted as files pair naturally with the explicit path variable.
🧪 Verify with praisonai config show –sources
The env-config: label confirms the env layer won for each key.