{"id":4074,"date":"2026-09-15T16:01:57","date_gmt":"2026-09-15T20:01:57","guid":{"rendered":"https:\/\/drkeithjones.com\/?p=4074"},"modified":"2026-09-15T16:02:02","modified_gmt":"2026-09-15T20:02:02","slug":"introducing-zenv-venv-for-zeek","status":"publish","type":"post","link":"https:\/\/drkeithjones.com\/index.php\/2026\/09\/15\/introducing-zenv-venv-for-zeek\/","title":{"rendered":"Introducing zenv:\u00a0venv\u00a0for Zeek"},"content":{"rendered":"\n

If you’ve worked with Zeek for more than a few months, you’ve probably lived this: one ~\/zeek<\/code> install, one ~\/.zkg<\/code>, and a constant juggling act every time you need to test a package against a different Zeek version, try a dev branch, or keep a stable release untouched while you experiment. Switching means rebuilding, reconfiguring, or just crossing your fingers.<\/p>\n\n\n\n

zenv<\/strong> fixes that by doing for Zeek what venv<\/code> does for Python: it lets you keep multiple, fully isolated Zeek installs on one machine and pick which one is “active” per shell.<\/p>\n\n\n\n

https:\/\/github.com\/keithjjones\/zenv<\/a><\/p>\n\n\n\n

What it actually does<\/h3>\n\n\n\n

Each environment is just a directory with its own install prefix and its own zkg<\/code> state:<\/p>\n\n\n\n

zenv new dev<\/code><\/pre>\n\n\n\n
This creates ~\/zenv\/dev\/zeek<\/code> (an empty install prefix) and ~\/zenv\/dev\/zkg<\/code> (an empty zkg state directory), then prints the prefix so you know where to point --prefix<\/code>.<\/p>\n\n\n\n
You build Zeek exactly like you always do \u2014 zenv doesn’t run configure<\/code>, doesn’t run make<\/code>, and has zero opinion about your build flags:<\/p>\n\n\n\n
.\/configure --prefix=\"$(zenv prefix dev)\"<\/code><\/pre>\n\n\n\n
Once it’s built, zenv autoconfig dev<\/code> wires zkg<\/code> to that install, and zenv activate dev<\/code> sets up your shell \u2014 PATH<\/code>, PYTHONPATH<\/code>, MANPATH<\/code>, ZEEKPATH<\/code>, ZEEK_PLUGIN_PATH<\/code>, all pointed at that one environment. Activation is shell-local, so a second terminal can have a completely different environment active at the same time, with no symlink games.<\/p>\n\n\n\n
Switching is a one-liner:<\/p>\n\n\n\n
zenv activate default\nzenv deactivate<\/code><\/pre>\n\n\n\n
deactivate<\/code> restores your shell exactly as it was \u2014 including leaving variables unset if they started unset.<\/p>\n\n\n\n
What it deliberately doesn’t do<\/h3>\n\n\n\n
zenv never builds Zeek.<\/strong> No configure<\/code>, no build tool, no build-flag opinions. It’s purely the bookkeeping layer: create the directories, tell you the right --prefix<\/code>, wire up zkg<\/code> afterward, and manage your shell’s environment on activate\/deactivate. Your build process stays entirely yours.<\/p>\n\n\n\n
Already have installs lying around?<\/h3>\n\n\n\n
zenv adopt<\/code> brings an existing ~\/zeek<\/code> and ~\/.zkg<\/code> under zenv’s management without touching them. And zenv doctor<\/code> will diagnose common problems \u2014 the wrong zkg<\/code> winning, packages that seem to have disappeared, plugins that won’t load \u2014 for one environment or all of them at once.<\/p>\n\n\n\n
Getting started<\/h3>\n\n\n\n
.\/install.sh<\/code><\/pre>\n\n\n\n
That’s it \u2014 it installs the zenv<\/code> binary, shell completions, and one clearly marked block in your rc file (with a backup made first). .\/install.sh --dry-run<\/code> shows you what would happen without changing anything.<\/p>\n\n\n\n
If you’ve ever lost an afternoon to a Zeek install that quietly broke because two projects wanted different versions in the same ~\/zeek<\/code>, zenv is built to make that problem disappear.<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
If you’ve worked with Zeek for more than a few months, you’ve probably lived this: one ~\/zeek install, one ~\/.zkg, and a constant juggling act every time you need to test a package against a different Zeek version, try a dev branch, or keep a stable release untouched while you experiment. Switching means rebuilding, reconfiguring, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[91,4,6],"tags":[],"class_list":["post-4074","post","type-post","status-publish","format-standard","hentry","category-open-source","category-zeek","category-zkg"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t