When you execute a binary via bazel run it is not run in a sandbox, so it can read any env variable it wants to. IMO env_inherit in kt_jvm_binary can be removed, as it gives a false sense of security. java_binary rule does not have this attribute, for example.