Command Reference
Every git, docker, kubectl, npm, and CI command - what it does and the errors it throws.
A reference for the commands developers run in CI/CD: git, Docker, kubectl, Helm, npm, yarn, pnpm, pip, cargo, go, Maven, Gradle, Terraform, and the GitHub CLI - usage, flags, and the common failures of each.
git
Branching, history, remotes, recovery.
bb (Bitbucket)bb is a Bitbucket CLI for pull requests and pipelines. Reference for bb auth login, bb pr create,
gh attestation verifygh attestation verify checks an artifact build provenance attestation against a repo or owner.
gh cache deletegh cache delete removes a GitHub Actions cache by key or ID, or all of them.
gh cache listgh cache list shows GitHub Actions caches with their keys, sizes, and refs.
gh config setgh config set changes gh CLI settings like git_protocol, pager, and prompt.
gh extension installgh extension install adds a third-party or local gh extension.
gh label creategh label create adds a label with a color and description, idempotently with --force.
gh pr checksgh pr checks shows the status of CI checks on a pull request and can block until they finish.
gh pr closegh pr close closes a pull request and can delete its branch or add a comment.
gh pr diffgh pr diff prints the diff of a pull request, optionally name-only or in patch format.
gh pr editgh pr edit updates a pull request title, body, labels, reviewers, milestone, or base branch.
gh pr readygh pr ready toggles a pull request between draft and ready-for-review.
gh pr reviewgh pr review approves, requests changes, or comments on a pull request from CI.
gh pr statusgh pr status summarizes the PRs you created, are assigned, or are requested to review.
gh release deletegh release delete removes a release and optionally its git tag.
gh release downloadgh release download pulls assets or source tarballs from a GitHub release.
gh release listgh release list shows releases with their tags, types, and dates.
gh release viewgh release view shows a release notes, assets, and metadata. Reference for the latest-release default, --json
gh repo forkgh repo fork creates a fork and can clone it and set the remotes.
gh repo set-defaultgh repo set-default chooses which repository gh targets when remotes are ambiguous.
gh rulesetgh ruleset lists, views, and checks the rulesets that apply to a branch.
gh run cancelgh run cancel stops an in-progress workflow run. Reference for targeting a run by ID, the already-completed
gh run downloadgh run download retrieves artifacts uploaded by a workflow run.
gh run rerungh run rerun retries a workflow run, optionally only the failed jobs or with debug logging.
gh run watch --exit-statusgh run watch --exit-status blocks until a workflow run finishes and exits non-zero if it failed.
gh run referenceEvery gh run subcommand for inspecting GitHub Actions from the terminal, including how to get only the failed
gh search codegh search code finds code across repositories with qualifiers.
gh search prsgh search prs finds pull requests across repos by author, label, state, and more.
gh workflow enable/disablegh workflow enable and gh workflow disable toggle whether a workflow runs.
gh workflow viewgh workflow view shows a workflow definition, state, and recent runs.
gh-dashgh-dash is a gh extension showing a PR/issue dashboard. Reference for gh dash, its config file, and why it is
ghorg cloneghorg clone bulk-clones every repo in a GitHub/GitLab org. Reference for --token, --scm-type, --clone-type,
git absorbgit absorb creates fixup commits and squashes staged changes into the right ancestor.
git addgit add stages changes for the next commit. Reference for -A, -p, --update, and the pathspec and ignored-file
git amgit am applies a mailbox of patches as commits, the receiving end of format-patch.
git apply --3waygit apply applies a patch to the working tree; --check tests it first and --3way falls back to a merge on
git applygit apply applies a patch to the working tree or index. Reference for --check, --3way, and --index used to
git applygit apply applies a patch file to the working tree or index. Reference for --check, --3way, --index, -p, and
git archivegit archive exports a tree as a tar or zip. Reference for --format, --prefix, and pathspecs to build clean
git archivegit archive exports a tree as a tar or zip without the .git directory.
git bisect skip/termsgit bisect skip and custom good/bad terms let you binary-search a regression in CI even when some commits
git bisect rungit bisect run automates a bisect with a test script’s exit code.
git bisectgit bisect binary-searches history to find the commit that introduced a bug.
git blame --porcelaingit blame --porcelain gives stable machine-readable output, -L scopes to line ranges, and -C/-M follow moved
git blamegit blame shows which commit last changed each line. Reference for -L, --porcelain, and -w to attribute lines
git blamegit blame shows which commit and author last changed each line of a file.
git branch --set-upstream-togit branch --set-upstream-to links a local branch to a remote-tracking ref.
git branch -d / -Dgit branch -d deletes a merged branch; -D force-deletes any branch.
git branchgit branch lists, creates, renames, and deletes branches. Reference for -d, -D, -m, --set-upstream-to, and
git branchlessgit branchless (git-branchless) manages stacks with smartlog and submit.
git bundlegit bundle packs refs and objects into one file for offline transport.
git cat-filegit cat-file inspects Git objects - their type, size, and content.
git checkoutgit checkout switches branches or restores files. Reference for checking out a branch, --detach, and -b to
git checkoutgit checkout switches branches and restores files. Reference for -b, --detach, and pathspecs, plus the
git cherry-pick -x/-mgit cherry-pick -x records the source commit, and -m picks a side of a merge commit.
git cherry-pickgit cherry-pick applies the changes of specific commits onto the current branch.
git cherry-pickgit cherry-pick applies the changes from specific commits onto the current branch.
git cherrygit cherry shows which commits on a branch have or have not been applied upstream.
git clean -fdx/-fdXgit clean removes untracked files; -x clears ignored files too while -X removes only ignored ones.
git clean -fdxgit clean -fdx wipes untracked and ignored files plus directories for a pristine tree.
git cleangit clean deletes untracked files. Reference for -f, -d, and -x (git clean -fdx) to fully reset a working
git cleangit clean removes untracked files from the working tree. Reference for -n, -f, -d, -x, and the "would
git --shallow-sincegit clone/fetch --shallow-since limits history to commits after a date, an alternative to --depth for CI.
git clonegit clone copies a remote repository into a new directory. Reference for --depth, --branch, --filter, and
git clonegit clone copies a remote repository into a new local directory.
git commitgit commit records staged changes as a new commit. Reference for -m, --amend, --no-verify, and the
git config --globalgit config --global sets user-wide Git settings in ~/.gitconfig.
git config --localgit config --local writes settings into a single repo’s .git/config.
git configgit config reads and writes Git settings. Reference for user.email, --global, and credential.helper to set up
git configgit config gets and sets Git configuration at system, global, and local scope.
git count-objectsgit count-objects reports how many loose objects and packs a repo holds and their disk size.
git describe --tagsgit describe --tags --dirty builds a human version string from the nearest tag, the standard way CI stamps
git describegit describe builds a human-readable version from tags. Reference for --tags and --always to derive build
git describegit describe produces a readable name from the nearest tag, ideal for build versions.
git diff --name-onlygit diff --name-only lists changed paths, --name-status adds the change type, and --diff-filter selects by
git diffgit diff shows changes between commits or the working tree. Reference for --name-only, --stat, and
git diff-treegit diff-tree is the plumbing command that compares two tree objects.
git diffgit diff shows changes between commits, the index, and the working tree.
git fetch --deepengit fetch --deepen adds more commits to a shallow clone and --unshallow makes it complete.
git fetchgit fetch downloads objects and refs from a remote without merging.
git fetchgit fetch downloads remote objects and refs without touching your working tree.
git filter-repogit filter-repo rewrites repository history fast to strip files, paths, or secrets.
git for-each-refgit for-each-ref lists refs with custom formatting. Reference for --sort, --format, and --count to script
git for-each-refgit for-each-ref iterates over refs with a custom format. Reference for --format, --sort, --points-at, and
git format-patch --cover-lettergit format-patch --cover-letter adds a 0000 summary patch to a series.
git format-patchgit format-patch turns commits into one .patch file per commit (or a range), the input for git am.
git format-patchgit format-patch turns commits into mailbox patch files for review or git am.
git fsck --unreachablegit fsck checks object integrity and lists dangling/unreachable commits you can recover.
git fsckgit fsck verifies object-database integrity and finds dangling or corrupt objects.
git gc --prune=nowgit gc compacts the object store and prunes unreachable objects; --prune=now removes them immediately.
git gcgit gc compresses and cleans up a repository. Reference for --prune, --aggressive, and --auto to keep cached
git gcgit gc compresses and prunes the object database to keep the repo fast and small.
git grepgit grep searches tracked file contents fast, respecting the index and revisions.
git hash-objectgit hash-object computes the Git object id for content and can write it to the store.
git initgit init creates a new empty Git repository or reinitializes an existing one.
git interpret-trailersgit interpret-trailers adds or parses trailers like Signed-off-by in commit messages.
filter=lfs rule not taking effectFix files not going through LFS because the .gitattributes filter=lfs rule is not applied in CI - the
"Authentication required: ... info/lfs"Fix Git LFS "Authentication required" in CI - the LFS batch endpoint got no usable credentials, so the object
"batch request: missing protocol"Fix Git LFS "batch request: missing protocol: ..." in CI - the configured LFS endpoint URL has no scheme
"batch response: ... 403"Fix Git LFS "batch response: Forbidden" / 403 in CI - the LFS batch API authenticated the request but the
"Error downloading object ... (missing)"Fix Git LFS "Error downloading object: ... (missing)" in CI - the pointer references an object the LFS server
"should have been pointers, but weren't"Fix Git LFS "Encountered N file(s) that should have been pointers, but weren't" in CI - files matching an LFS
"413 Request Entity Too Large"Fix Git LFS push failing with HTTP 413 in CI - the LFS object upload exceeded a size limit imposed by the
"git-lfs filter-process: command not found"Fix "git: 'lfs' is not a git command" / "git-lfs: command not found" in CI - the git-lfs binary is not
"Fatal error: Server error"Fix Git LFS "LFS: Fatal error: Server error" in CI - the LFS object store returned a 5xx while streaming an
"Locking support detected on remote"Fix Git LFS lfs.locksverify prompts and "locking not supported" during push in CI - the push wants a decision
"Object does not exist on the server"Fix Git LFS "Object does not exist on the server or you don't have permissions" in CI - the batch API cannot
"smudge filter lfs failed"Fix "external filter git-lfs smudge failed" / "smudge filter lfs failed" in CI - LFS could not download an
"over its data quota"Fix Git LFS "This repository is over its data quota" / bandwidth quota errors in CI - the account exceeded
"locking not supported"Fix Git LFS "unable to lock" / "locking not supported" in CI - a lock command or lock verification ran
LFS clean filter stallingFix slow Git LFS clean-filter behavior in CI - committing or checking out many large files runs the
git lfsgit lfs manages large files stored outside Git. Reference for git lfs install and git lfs pull to fetch large
LFS filters not registeredFix Git LFS pointers left in the tree because "git lfs install" was never run in CI - without it, the
"git lfs migrate import" pitfallsFix common git lfs migrate import problems in CI - rewriting history to move large files into LFS can fail on
LFS re-fetched on every jobFix Git LFS objects being re-downloaded on every CI run - without caching .git/lfs, each job re-fetches the
Pointer text in place of the fileFix the case where CI has the LFS pointer text (version https://git-lfs...) instead of the real file - the
Old git-lfs on self-hosted runnerFix Git LFS failures caused by an old git-lfs version on a self-hosted runner in CI - stale binaries miss
git lfsgit lfs (Large File Storage) stores big files outside the repo via pointers.
git log --pretty=formatgit log --pretty=format:"..." emits exactly the fields a pipeline needs (SHA, author, subject), with -z for
git loggit log shows commit history. Reference for --oneline, -n, and --format to extract commit messages and
git loggit log shows commit history with flexible formatting. Reference for --oneline, --graph, --pretty, ranges,
git ls-filesgit ls-files lists files in the index. Reference for listing tracked, ignored, or modified files to drive
git ls-filesgit ls-files lists files Git knows about in the index. Reference for --others, --modified,
git ls-remotegit ls-remote lists refs on a remote without cloning, so CI can check a branch or tag exists first.
git ls-remotegit ls-remote lists refs on a remote without cloning. Reference for --tags, --heads, and resolving a branch
git ls-remotegit ls-remote lists refs on a remote without cloning. Reference for --heads, --tags, --exit-code, and the
git ls-treegit ls-tree lists the contents of a tree object - files, modes, and ids.
git machetegit machete tracks a tree of branches and rebases them with traverse.
.mailmapA .mailmap file canonicalizes author names and emails across log, shortlog, and blame.
git maintenancegit maintenance runs and schedules repository upkeep tasks like gc, commit-graph, and prefetch.
git merge-basegit merge-base finds the common ancestor of two branches; --fork-point and --is-ancestor power PR diffs and
git merge-basegit merge-base finds the best common ancestor of two commits. Reference for computing the PR base SHA that
git merge-basegit merge-base finds the common ancestor of two commits, the basis for diffing a PR.
git mergegit merge joins two branch histories into one. Reference for --no-ff, --squash, --abort, and how to detect
git mvgit mv moves or renames a tracked file and stages the change. Reference for -f, -k, and the "destination
git notesgit notes attaches metadata to commits without changing their SHA.
git pack-objectsgit pack-objects bundles objects into a compressed packfile. Reference for --stdout, --revs, --all, and the
git prunegit prune deletes unreachable objects from the object store. Reference for -n, --expire, and why gc is
git pullgit pull fetches from a remote and integrates the changes. Reference for --rebase, --ff-only, and the
"exceeds GitHub's file size limit of 100.00 MB"Fix "this exceeds GitHub's file size limit of 100.00 MB" in CI - a large file was committed as normal git
git pushgit push uploads commits and tags to a remote. Reference for --tags, --follow-tags, and --force-with-lease as
git pushgit push uploads local commits to a remote. Reference for -u, --force-with-lease, and tags, plus the rejected
git range-diffgit range-diff compares two versions of a commit series to show what changed between iterations.
git rebase --autosquashgit rebase -i --autosquash automatically reorders fixup! and squash! commits.
git rebase --ontogit rebase --onto <newbase> <upstream> <branch> moves a slice of commits onto a new base, the precise tool
git rebasegit rebase replays commits onto a new base to keep history linear.
git reflog expiregit reflog records where HEAD has been so you can recover "lost" commits, and reflog expire prunes it.
git refloggit reflog records where HEAD and branches have been, so you can recover lost commits.
git remote addgit remote add registers a new named remote URL. Reference for -f, -t, --tags, and the "remote already
git remotegit remote manages the set of tracked repositories. Reference for -v and set-url, used in CI to inspect or
git remote prunegit remote prune deletes local remote-tracking refs whose upstream branches are gone.
git remote set-urlgit remote set-url changes a remote’s URL, often to inject a CI token.
git remotegit remote manages the named connections to remote repositories.
git repackgit repack combines loose objects and packs into fewer, tighter packfiles.
git replacegit replace substitutes one object for another without rewriting history.
git request-pullgit request-pull generates a summary asking a maintainer to pull your changes.
git rereregit rerere records and replays conflict resolutions so repeated merges resolve automatically.
git reset modesgit reset --soft, --mixed, and --hard differ in whether they touch the index and working tree.
git resetgit reset moves HEAD and optionally the index and working tree.
git resetgit reset moves HEAD and optionally the index and working tree.
git restore --sourcegit restore --source pulls file contents from a specific commit into the working tree.
git restore --stagedgit restore --staged unstages files without touching the working tree, the modern replacement for git reset
git restoregit restore discards working-tree changes or unstages files. Reference for --staged, --source, --worktree,
git rev-list --countgit rev-list --count counts commits in a range and --left-right --count compares two branches (ahead/behind).
git rev-list --countgit rev-list --count returns the number of commits in a range.
git rev-listgit rev-list lists commit objects in reverse chronological order.
git rev-listgit rev-list lists commit objects in reverse order, the plumbing behind counting and walking history.
git rev-parse --show-*git rev-parse resolves repo paths, refs, and state flags that CI scripts depend on: --show-toplevel,
git rev-parseHow to use git rev-parse in CI: why --abbrev-ref HEAD returns HEAD instead of your branch name after
git rev-parsegit rev-parse resolves refs to SHAs and reports repo paths - core CI plumbing.
git revert -n/-mgit revert creates a new commit that undoes a previous one without rewriting history.
git revertgit revert undoes a commit by creating a new inverse commit, keeping history intact.
git rmgit rm removes files from the working tree and the index. Reference for --cached, -r, -f, and the "has staged
git send-emailgit send-email mails patch files to reviewers over SMTP. Reference for --to, --cc, --smtp-server, and the
git shortloggit shortlog groups commits by author. Reference for -s, -n, and ranges to build contributor summaries and
git shortlog (release notes)Using git shortlog to generate release notes and contributor summaries in CI.
git shortloggit shortlog summarizes commits grouped by author, perfect for changelogs and release notes.
git showgit show displays commits, tags, and file contents at a revision.
git show-ref --verifygit show-ref lists refs and --verify checks that a specific ref exists, the scriptable way CI tests for a
git show-refgit show-ref lists refs and their object ids, and verifies a ref exists.
git showgit show displays a commit, tag, or object with its diff. Reference for --stat, --name-only, blob viewing,
git sparse-checkout conegit sparse-checkout in cone mode checks out only chosen directories of a monorepo, cutting CI checkout time.
git sparse-checkoutgit sparse-checkout limits the working tree to selected paths.
git sparse-checkout setgit sparse-checkout set narrows the working tree to chosen paths.
git sparse-checkoutgit sparse-checkout limits the working tree to a subset of paths, speeding monorepo CI.
git stash applygit stash apply reapplies a stash but keeps it on the stack. Reference for stash@{n}, --index, and when to
git stashgit stash saves uncommitted changes aside. Reference for push, pop, and --include-untracked to clean the tree
git stash dropgit stash drop deletes a single stash entry; clear removes them all.
git stash listgit stash list shows the stash stack with log-style formatting.
git stash popgit stash pop reapplies the latest stash and removes it from the stack.
git stashgit stash saves uncommitted changes aside and restores a clean tree.
git statusgit status shows working tree and index state. Reference for --porcelain, the stable machine-readable format
git statusgit status shows staged, unstaged, and untracked changes plus branch state.
submodule update --init --recursivegit submodule update --init --recursive clones and checks out all nested submodules.
git submodule updategit submodule update fetches and checks out submodules. Reference for --init, --recursive, --depth, and the
git submodulegit submodule manages nested repositories pinned to specific commits.
git switch --detachgit switch --detach checks out a commit without attaching to a branch.
git switchgit switch changes the current branch. Reference for -c to create branches, --detach, and the safer
git switchgit switch changes branches with a focused, modern interface. Reference for -c, --detach, --track, and the
git symbolic-refgit symbolic-ref reads and sets symbolic refs like HEAD. Reference for finding a remote default branch
git symbolic-refgit symbolic-ref reads and writes symbolic refs like HEAD, used to find or set the default branch.
git tag -a / -dgit tag -a creates an annotated, metadata-rich tag; -d deletes a tag locally.
git taggit tag creates and lists tags. Reference for -a annotated tags and -l listing, used to cut releases and
git taggit tag creates and lists tags for releases. Reference for -a, -m, -d, pushing tags, and the "tag already
git town shipgit town ship merges a completed feature branch into trunk and removes it.
git town syncgit town sync pulls and merges trunk into your branch chain. Reference for --all, --stack, the config it
update-index --assume-unchangedgit update-index --assume-unchanged and --skip-worktree tell git to ignore changes to tracked files, with
git update-indexgit update-index manipulates the staging area directly. Reference for --assume-unchanged, --chmod, and
git update-indexgit update-index edits the index directly, including assume-unchanged and skip-worktree.
git update-refgit update-ref creates, updates, or deletes a ref with old-value checks.
git verify-commitgit verify-commit checks the GPG/SSH signature on a commit. Reference for --raw, -v, exit codes, and the
git verify-taggit verify-tag checks the signature on an annotated tag. Reference for --raw, -v, exit codes, and the
git whatchangedgit whatchanged lists commits with the files each one touched.
git worktree --detachgit worktree add --detach checks out a second working tree without claiming a branch, ideal for building two
git worktree addgit worktree add checks out an extra working tree from the same repo.
git worktreegit worktree manages multiple working trees from one repo. Reference for add, list, and remove to check out
git worktree listgit worktree list shows every working tree linked to the repo, with paths and branches.
git worktree removegit worktree remove deletes a linked working tree and its admin files.
git worktreegit worktree checks out multiple branches into separate directories from one repo.
actions/checkout without lfs: trueFix builds that get LFS pointers because actions/checkout ran without lfs: true in CI - the default checkout
glab auth loginglab auth login authenticates the GitLab CLI. Reference for token-based non-interactive login, --hostname for
glab ciglab ci runs, views, and traces GitLab CI pipelines from the terminal.
glab mr createglab mr create opens a GitLab merge request from the command line.
glab release createglab release create publishes a GitLab release and uploads assets.
glab repo cloneglab repo clone clones a GitLab project (or a whole group) using your token.
gt stackgt stack (and gt restack) shows and rebuilds a Graphite branch stack.
gt submitgt submit pushes a Graphite stack and opens or updates one PR per branch.
hub (legacy)hub is the legacy git wrapper for GitHub, superseded by gh. Reference for hub pull-request, hub ci-status,
lab (legacy)lab is the older zaquestion GitLab wrapper, superseded by glab.
sprspr (ejoffe/spr) turns each commit on a branch into a separate GitHub PR.
tea logintea login add authenticates the Gitea/Forgejo CLI with a token.
tea prtea pr create, list, and merge manage Gitea/Forgejo pull requests.
tea releasetea release create publishes a Gitea/Forgejo release and uploads assets.
Docker
build, run, compose, registry.
trivy-actionThe aquasecurity/trivy-action wraps Trivy for GitHub Actions. Reference for inputs like scan-type, severity,
buildah budbuildah bud (build-using-dockerfile) builds an OCI image from a Containerfile or Dockerfile without a daemon.
buildah frombuildah from creates a working container from a base image (or scratch) so you can build an image
buildah pushbuildah push uploads a locally built image to a registry or writes it to another transport, without a daemon.
cosign attestcosign attest attaches a signed SBOM or provenance attestation to an image.
cosign keyscosign generate-key-pair creates a signing key pair, optionally stored in a KMS or Kubernetes secret.
cosign signcosign sign attaches a signature to a container image by digest.
cosign verifycosign verify checks a container image signature against a key or a keyless identity.
cosign keylesscosign keyless signing uses a CI OIDC token and Fulcio/Rekor instead of a stored key.
crane appendcrane append adds a tarball as a new layer on top of a base image and pushes the result, no Dockerfile or
crane copycrane copy transfers images between registries quickly without a daemon.
crane copycrane copy (go-containerregistry) copies an image between registries without a daemon, preserving all
crane digestcrane digest prints the sha256 digest of an image reference so CI can pin by digest.
crane digestcrane digest resolves a tag to its immutable digest without pulling the image.
crane lscrane ls lists the tags in a registry repository without a daemon.
crane manifestcrane manifest prints the raw manifest JSON of an image reference, including multi-arch index entries.
crane pull/pushcrane pull saves a remote image to a tarball and crane push uploads a tarball to a registry, both without a
dive analyzedive inspects each image layer and reports wasted space and efficiency.
dive CI rulesdive in CI mode enforces efficiency and wasted-space thresholds.
docker buildReference for docker build in CI: tag, file, build-arg, target, platform, no-cache, and pull flags for
docker buildHow docker build works: building an image from a Dockerfile, tagging, build args, target stages, and the
docker builder pruneHow docker builder prune works: clearing BuildKit build cache, the -a flag, keep-storage, and freeing disk on
docker buildx bakeHow docker buildx bake works: building multiple images from an HCL/JSON bake file, target groups, variables,
docker buildx buildReference for docker buildx build in CI: --push, --cache-from, --cache-to type=gha, and multi-arch --platform
docker buildx buildHow docker buildx build works: BuildKit builds, multi-platform images, --push, and the GitHub Actions cache
buildx cache referenceEvery docker buildx cache backend compared for CI use: gha, registry, local, inline, s3.
docker buildx create / useReference for docker buildx create and docker buildx use in CI: provision a builder instance with the
buildx imagetoolsdocker buildx imagetools inspects a multi-arch image and creates or re-tags manifest lists on the registry,
docker commitHow docker commit works: snapshotting a container into a new image, setting CMD, and why Dockerfiles beat
docker compose buildReference for docker compose build in CI: build service images defined in a compose file with --no-cache,
docker compose buildHow docker compose build works: building images for services with a build section, --no-cache, build args,
docker compose configReference for docker compose config in CI: validate and render the merged compose configuration with --quiet
docker compose configHow docker compose config works: validating and rendering the merged compose file with variables resolved,
docker compose downReference for docker compose down in CI: stop and remove containers, networks, and with -v the volumes, to
docker compose downHow docker compose down works: stopping and removing services, networks, and volumes, the -v flag, and clean
docker compose execReference for docker compose exec in CI: run a command in a running service container with -T, -e, and -w to
docker compose execHow docker compose exec works: running a command in a running service container, the -T flag for CI, and
docker compose logsReference for docker compose logs in CI: view aggregated service logs with --tail, --no-color, and
docker compose logsHow docker compose logs works: viewing aggregated service logs, following, tailing per service, and debugging
docker compose psReference for docker compose ps in CI: list the status of project services with -a, --format, and --status to
docker compose psHow docker compose ps works: listing a stack services with state, health, ports, and reading exit codes in CI.
docker compose pullReference for docker compose pull in CI: pre-pull service images defined in a compose file with --quiet and
docker compose pullHow docker compose pull works: pulling images for all services, --ignore-buildable, parallelism, and
docker compose runReference for docker compose run in CI: run a one-off command in a service container with --rm, -e, and
docker compose runHow docker compose run works: starting a one-off container for a service, --rm, dependencies, and running
docker compose upReference for docker compose up in CI: start services from a compose file with -d, --build, and --wait so
docker compose upHow docker compose up works: starting all services from a compose file, detached mode, --build, --wait, and
docker container pruneHow docker container prune works: bulk-removing all stopped containers, age filters, and CI cleanup between
docker contextReference for docker context in CI: create, list, and switch Docker endpoints to target a remote daemon over
docker contextHow docker context works: managing and switching between Docker daemon endpoints (local, remote, cloud) and
docker cpReference for docker cp in CI: copy files and directories between a container and the host, for extracting
docker cpHow docker cp works: copying files and directories between the host and a container, extracting CI artifacts,
docker execReference for docker exec in CI: run a command inside a running container with -e, -w, -u, and -i to drive
docker execHow docker exec works: running a command in a running container, opening a shell, env and user flags, and the
docker exportHow docker export works: flattening a container filesystem to a tar, how it differs from docker save, and CI
docker historyReference for docker history in CI: show the layers of an image with sizes and creating instructions to debug
docker historyHow docker history works: showing the layers of an image, the command and size of each, and finding what
docker image pruneHow docker image prune works: removing dangling or all unused images, the -a flag, age filters, and
docker imagesReference for docker images in CI: list local images with --filter, --format, and -q to inspect or script
docker imagesHow docker images works: listing local images, filtering dangling layers, custom formatting, and using it to
docker importHow docker import works: building a single-layer image from a filesystem tar, setting CMD on import, and the
docker initHow docker init works: scaffolding a Dockerfile, .dockerignore, and compose.yaml for a project, language
docker inspectReference for docker inspect in CI: print low-level JSON for containers, images, volumes, and networks, and
docker inspectHow docker inspect works: dumping JSON metadata for containers, images, volumes, and networks, with --format
docker killHow docker kill works: sending SIGKILL or a custom signal to a container immediately, and how it differs from
docker loadReference for docker load in CI: import images from a tar archive produced by docker save, restoring them
docker loadHow docker load works: restoring images saved with docker save, loading from stdin or a file, and CI
docker loginReference for docker login in CI: authenticate to a registry with -u and --password-stdin to avoid leaking
docker loginHow docker login works: authenticating to Docker Hub, GHCR, or ECR with a token from stdin, and the auth
docker logoutReference for docker logout in CI: remove stored registry credentials at the end of a job so cached auth does
docker logoutHow docker logout works: removing stored registry credentials, and why CI runners should clear credentials
docker logsReference for docker logs in CI: fetch container stdout and stderr with --tail, --since, --timestamps, and -f
docker logsHow docker logs works: viewing stdout/stderr from a container, following, tailing, timestamps, and using it
docker manifestReference for docker manifest in CI: create, annotate, inspect, and push multi-arch manifest lists so one tag
docker manifestHow docker manifest works: inspecting and creating multi-architecture manifest lists, the experimental flag,
docker network createReference for docker network create in CI: create a user-defined bridge network so containers can reach each
docker network createHow docker network create works: creating bridge networks for container DNS, drivers and subnets, and
docker network lsHow docker network ls works: listing networks, the default bridge/host/none, filtering, and debugging
docker network rmHow docker network rm works: deleting user-defined networks, the active-endpoints error, prune, and CI
docker pauseHow docker pause works: suspending all processes in a container via cgroup freezer, and when to use it versus
docker psReference for docker ps in CI: list running or all containers with -a, -q, --filter, and --format to inspect
docker psHow docker ps works: listing running and stopped containers, filters, format strings, and reading exit status
docker pullReference for docker pull in CI: fetch an image or all tags from a registry, pin by digest, and pull for a
docker pullHow docker pull works: fetching images from a registry, digests and platforms, and fixing Docker Hub
docker pushReference for docker push in CI: publish a tagged image or all tags to a registry, with notes on
docker pushHow docker push works: uploading a tagged image to a registry, naming requirements, and the
docker restartHow docker restart works: stopping then starting a container, the grace-period timeout, and using it to
docker rmReference for docker rm in CI: remove one or more containers with -f and -v to force-stop and clean up
docker rmHow docker rm works: removing stopped containers, force-removing running ones, removing volumes, and CI
docker rmiReference for docker rmi in CI: remove one or more images with -f to reclaim disk on runners and clear
docker rmiHow docker rmi works: deleting images by name or ID, force removal, untagging, and the conflict errors you
docker runReference for docker run in CI: --rm, -e, -v, --network, -w, and --entrypoint flags for creating and starting
docker runHow docker run works: starting a container from an image, port and volume mapping, env vars, --rm cleanup,
docker saveReference for docker save in CI: export one or more images to a tar archive with -o, for passing images
docker saveHow docker save works: serializing one or more images to a tar archive with layers and metadata, for caching
docker sbom / scoutHow docker sbom and docker scout work: generating an SBOM and scanning images for CVEs, and integrating image
docker scout / scanReference for docker scout in CI: scan an image for CVEs with cves and compare, plus the deprecated docker
docker startHow docker start works: restarting an existing stopped container, attaching, and why start differs from run
docker statsReference for docker stats in CI: stream or snapshot live CPU, memory, and network usage of containers with
docker statsHow docker stats works: streaming CPU, memory, network, and I/O per container, the --no-stream flag, and
docker stopHow docker stop works: sending SIGTERM then SIGKILL, the grace period, stopping multiple containers, and
docker system dfHow docker system df works: showing disk used by images, containers, volumes, and build cache, with -v for
docker system pruneReference for docker system prune in CI: reclaim disk by removing stopped containers, unused networks,
docker system pruneHow docker system prune works: removing stopped containers, unused networks, dangling images, and build
docker tagReference for docker tag in CI: add a new name and tag to an existing image so it can be pushed to a registry
docker tagHow docker tag works: giving an image a registry/repository name and tag before push, multiple tags, and
docker topHow docker top works: listing the processes running inside a container, ps options, and debugging hung
docker unpauseHow docker unpause works: resuming the processes of a container frozen by docker pause, the not-paused error,
docker volumeReference for docker volume in CI: create, list, inspect, remove, and prune named volumes for persisting or
docker volume createHow docker volume create works: creating named volumes for persistent data, drivers and labels, and using
docker volume lsHow docker volume ls works: listing volumes, filtering dangling ones, formatting, and spotting volume disk
docker volume pruneHow docker volume prune works: bulk-removing unused volumes, the -a flag, and reclaiming volume disk on CI
docker volume rmHow docker volume rm works: deleting named volumes, the volume-in-use error, removing dangling volumes, and
dockerd / DOCKER_BUILDKITReference for the dockerd daemon and the DOCKER_BUILDKIT environment variable in CI: enable BuildKit, control
grype --fail-ongrype --fail-on makes the scan exit non-zero at or above a severity.
grype dbgrype db update, status, and the cache directory control the vulnerability database.
grype scangrype scans container images, directories, and SBOMs for vulnerabilities.
jib buildJib builds container images for Java apps from Maven or Gradle without a Dockerfile or daemon.
kaniko executorkaniko /kaniko/executor builds a container image from a Dockerfile inside a container, no Docker daemon or
ko buildko build compiles a Go binary and packages it into a minimal container image, no Dockerfile or daemon.
manifest-toolmanifest-tool combines per-arch images into one multi-arch manifest list and pushes it, without a daemon.
nerdctl buildnerdctl build builds OCI images on containerd with BuildKit, Docker-compatible flags.
oras pulloras pull downloads the files of an OCI artifact from a registry.
oras pushoras push uploads arbitrary files as OCI artifacts to a registry (SBOMs, Helm values, configs).
podman buildpodman build builds an OCI image from a Containerfile or Dockerfile.
podman composepodman compose runs docker-compose.yml files via Podman. Reference for up, down, the podman-compose vs
podman cppodman cp copies files between a container and the host. Reference for the source:dest syntax, directories,
podman execpodman exec runs a command inside a running container. Reference for -it, -e, -u, -w, and the not-running and
podman healthcheckpodman healthcheck and --health-cmd let CI wait until a container is healthy.
podman imagespodman images lists images in local storage. Reference for --format, --filter, --quiet, --digests, and the
podman inspectpodman inspect prints detailed JSON for containers, images, volumes, and networks.
podman kube playpodman kube play creates pods and containers from a Kubernetes YAML.
podman loginpodman login stores registry credentials for pushes and private pulls.
podman logoutpodman logout removes cached registry credentials. Reference for logging out one or all registries and
podman logspodman logs prints a container stdout and stderr. Reference for -f, --tail, --since, --timestamps, and
podman machinepodman machine manages the Linux VM Podman uses on macOS and Windows.
podman manifestpodman manifest builds and pushes multi-architecture image lists.
podman networkpodman network creates and manages networks so containers can reach each other by name.
podman pspodman ps lists containers and their status. Reference for -a, --filter, --format, --quiet, and reading exit
podman pullpodman pull downloads an image from a registry. Reference for fully qualified names, --platform, --creds, and
podman pushpodman push uploads a local image to a registry. Reference for destination references, --creds, --tls-verify,
podman rmpodman rm deletes stopped containers. Reference for -f, -a, --volumes, and the in-use and name-conflict
podman rmipodman rmi deletes images from local storage. Reference for -f, -a, --ignore, and the image-in-use and
podman runpodman run creates and starts a container from an image. Reference for -d, --rm, -e, -v, -p, and the rootless
podman save/loadpodman save exports an image to a tar archive and podman load imports it.
podman system prunepodman system prune removes stopped containers, unused images, networks, and build cache.
podman systemdpodman generate systemd and Quadlet run containers as systemd services.
podman tagpodman tag gives an existing image an additional name. Reference for tagging images for a registry push and
podman volumepodman volume creates and manages named volumes for persistent data.
regctl image copyregctl image copy mirrors an image between registries without a daemon, preserving the multi-arch index.
regctl manifest getregctl manifest get prints the manifest or multi-arch index for a reference and resolves digests, all without
regctl tag lsregctl tag ls lists the tags of a remote repository without a daemon.
rootless podmanRootless Podman runs containers as an unprivileged user via user namespaces.
skopeo copyskopeo copy transfers images between registries without a daemon.
skopeo deleteskopeo delete removes an image tag or digest from a remote registry.
skopeo inspectskopeo inspect reads an image manifest, config, and digest without pulling it.
skopeo inspectskopeo inspect prints an image manifest, config, and labels straight from a registry without pulling it.
skopeo list-tagsskopeo list-tags lists all tags in a repository without pulling images.
skopeo loginskopeo login authenticates to a container registry for later copy/inspect.
skopeo syncskopeo sync mirrors a repository, a set of tags, or a YAML list of images between registries.
syft -osyft -o selects the SBOM format and can write several at once.
syft sbomsyft catalogs packages in an image or directory to produce an SBOM.
SPDX vs CycloneDXsyft emits both SPDX and CycloneDX SBOMs. Reference for when each format fits, how to produce them, and the
trivy exit-codetrivy --exit-code and --severity turn a scan into a build gate.
trivy ignoretrivy --ignore-unfixed hides CVEs with no fix; .trivyignore allowlists specific IDs.
trivy configtrivy config scans Terraform, Kubernetes, Dockerfiles, and Helm for misconfigurations.
trivy fstrivy fs scans a directory for vulnerable dependencies, secrets, and misconfigurations.
trivy imagetrivy image scans a container image for OS and language vulnerabilities.
trivy DB cacheCaching the Trivy vulnerability database avoids slow downloads and registry rate limits in CI.
trivy sbomtrivy can emit a CycloneDX or SPDX SBOM and scan an existing SBOM for CVEs.
umoci unpackumoci unpack extracts an OCI image layout into a runnable root filesystem bundle.
kubectl & Helm
Deploy, inspect, debug, release.
argocd app createargocd app create registers an Argo CD Application from a repo path or Helm chart.
argocd app diffargocd app diff shows the difference between live cluster state and Git for an Application.
argocd app rollbackargocd app rollback reverts an Application to a previous deployed revision from its history.
argocd app setargocd app set updates an existing Application: image tags, Helm values, revision, and sync policy.
argocd app syncargocd app sync applies an Application to the cluster and reports the result.
argocd app waitargocd app wait blocks until an Application reaches a target health or sync state.
argocd loginargocd login authenticates the CLI to an Argo CD API server. Reference for --grpc-web, --auth-token,
argocd repo addargocd repo add registers a Git repo with Argo CD, with HTTPS or SSH credentials.
checkov (overview)checkov scans Terraform, Kubernetes, and other IaC for policy violations.
cilium connectivity testcilium connectivity test runs end-to-end network tests across the cluster.
cilium installcilium install deploys Cilium as the cluster CNI with the cilium-cli.
cilium statuscilium status reports the health of the Cilium agent, operator, and Hubble.
conftest --policyThe conftest --policy/-p flag selects which Rego directory or bundle to evaluate.
conftest testconftest test runs Rego policies against config files (YAML, JSON, HCL) and fails on deny rules.
conftest verifyconftest verify runs the Rego tests (test_ rules) that ship with your conftest policies.
consul connectconsul connect runs the Connect service-mesh sidecar proxy and manages CA config.
consul membersconsul members lists the agents in a Consul datacenter with their status.
consul validateconsul validate checks Consul agent configuration files for errors without starting the agent.
datree (deprecated)datree test policy-checked Kubernetes manifests but the project is discontinued.
envoy validateenvoy --mode validate parses an Envoy bootstrap config and exits without serving traffic.
flux bootstrap githubflux bootstrap github installs Flux and commits its manifests to a GitHub repo.
flux create helmreleaseflux create helmrelease deploys a Helm chart through Flux. Reference for --source, --chart, --values,
flux create kustomizationflux create kustomization tells Flux to apply a path from a source.
flux create source gitflux create source git defines a GitRepository source for Flux to pull from.
flux get kustomizationsflux get kustomizations lists Kustomizations with their ready status and last applied revision.
flux reconcileflux reconcile triggers an immediate reconciliation instead of waiting for the interval.
gator testgator test evaluates OPA Gatekeeper ConstraintTemplates and Constraints against resources without a cluster.
gator verifygator verify runs Gatekeeper suite test files that assert expected allow/deny per constraint.
helm dependency updateReference for helm dependency update: resolve and download subcharts into charts/, rebuild Chart.lock, the
helm dependency updatehelm dependency update downloads a chart's subcharts into charts/.
helm gethelm get retrieves the values, manifest, notes, or hooks of a deployed release.
helm historyhelm history lists a release's revisions with status and description.
helm installReference for helm install: install a chart as a release, set values, and use --wait and --atomic so a failed
helm installhelm install deploys a chart as a new release. Setting values, --wait and --atomic for CI, --dry-run, and the
helm lintReference for helm lint: validate a chart for structural and best-practice issues before deploy, strict mode,
helm linthelm lint checks a chart for problems before packaging or install.
helm listhelm list shows releases and their status. All-namespaces, status filters, output formats for scripting, and
helm packagehelm package builds a chart into a versioned .tgz archive. Setting the version in CI, dependency bundling,
helm pluginhelm plugin installs and manages Helm CLI extensions like helm-diff and helm-secrets.
helm pullhelm pull downloads a chart archive from a repo or OCI registry.
helm repo addReference for helm repo add: register a chart repository, authenticate private repos, force-update an
helm repo addhelm repo add registers a chart repository locally. Private-repo auth, --force-update in CI, and the
helm repo updateReference for helm repo update: refresh local chart-repo indexes so installs resolve the latest versions,
helm repo updatehelm repo update refreshes cached repository indexes. Why CI must update before install, and the stale-index
helm rollbackReference for helm rollback: revert a release to a previous revision, find the target with helm history, the
helm rollbackhelm rollback reverts a release to a previous revision. Finding the target with helm history, --wait and
helm searchhelm search finds charts in your repos (search repo) or on Artifact Hub (search hub).
helm showhelm show displays a chart's metadata, default values, README, and CRDs without installing.
helm statusReference for helm status: inspect a release state, revision, and resources, machine-readable output for CI
helm statushelm status shows a release's current state, resources, and notes.
helm templateReference for helm template: render a chart to plain Kubernetes YAML without a cluster, validate with
helm templatehelm template renders a chart to manifests locally without a cluster.
helm testReference for helm test: run a release embedded test hooks to verify a deploy actually works, fetching logs
helm testhelm test runs a release's test hooks to verify it works. Writing test pods, --logs in CI, and the no-tests
helm uninstallReference for helm uninstall: remove a release and its resources, --keep-history and --wait flags, and a CI
helm uninstallhelm uninstall removes a release and its resources. Keeping history with --keep-history, the --wait flag, and
helm upgradeReference for helm upgrade: update a release or install it if absent with --install, atomic rollback, --wait
helm upgradehelm upgrade changes a release to a new chart or values. The --install idempotent pattern, --atomic
helmfile applyhelmfile apply runs a diff and only upgrades releases that changed.
helmfile destroyhelmfile destroy uninstalls every release defined in the helmfile.
helmfile diffhelmfile diff shows what helmfile apply would change. Reference for --detailed-exitcode, --suppress-secrets,
helmfile inithelmfile init checks for and installs helm and the plugins helmfile needs (diff, secrets).
helmfile templatehelmfile template renders all releases to plain YAML without touching the cluster.
istioctl analyzeistioctl analyze detects configuration problems in Istio resources before they cause outages.
istioctl installistioctl install deploys the Istio control plane using a profile or IstioOperator config.
istioctl proxy-configistioctl proxy-config dumps the live Envoy config (clusters, listeners, routes, endpoints) from a sidecar.
istioctl proxy-statusistioctl proxy-status shows whether Envoy sidecars are in sync with istiod.
istioctl validateistioctl validate checks Istio custom resources against their schema without a cluster.
istioctl verify-installistioctl verify-install checks that an Istio installation matches its manifest and is running correctly.
istioctl x precheckistioctl x precheck verifies the cluster is ready for an Istio install or upgrade.
k9s (read-only)k9s is a terminal UI for navigating clusters interactively; in CI it is used read-only since it needs a TTY.
kics scankics scan finds misconfigurations across Terraform, Kubernetes, Docker, and more using queries.
kind create clusterkind create cluster spins up a Kubernetes cluster in Docker for tests.
kind delete clusterkind delete cluster removes a kind cluster and its kubeconfig context.
kind load imagekind load docker-image pushes a locally built image into the kind nodes so pods can run it without a
krew (install)krew is the kubectl plugin manager: search, install, upgrade, and list plugins like ns, ctx, and neat.
kube-linter lintkube-linter checks manifests and Helm charts for security and reliability misconfigurations.
kube-linter lintkube-linter lint runs static security and correctness checks on manifests and Helm charts.
kube-linter configA .kube-linter.yaml selects which checks run, sets exclusions, and defines custom checks.
kube-score scorekube-score score analyzes manifests for reliability and security best practices.
kubeconform schemaskubeconform -schema-location points validation at a self-hosted mirror or local CRD schemas, for air-gapped
kubeconform -strictkubeconform -strict fails on fields not present in the schema, catching typos the API server would silently
kubeconformkubeconform validates Kubernetes manifests against JSON schemas, fast and offline.
kubeconform + kustomizePipe kustomize build into kubeconform - to validate the rendered manifests, not the raw overlays.
kubeconform (validate)kubeconform validates Kubernetes manifests against the OpenAPI schemas quickly and offline-capable.
kubectl annotate --overwritekubectl annotate --overwrite updates an annotation idempotently.
kubectl annotateReference for kubectl annotate: attach non-identifying metadata to resources, the change-cause annotation for
kubectl annotatekubectl annotate sets or removes annotations on resources. Reference for --overwrite, the key- removal
kubectl annotatekubectl annotate attaches non-identifying metadata to resources.
kubectl api-resourceskubectl api-resources lists every resource type the cluster serves, with short names and groups.
kubectl api-resourceskubectl api-resources lists the resource types a cluster serves, with short names and API groups.
kubectl api-versionskubectl api-versions lists the API group/versions the cluster serves.
kubectl apply --server-sidekubectl apply --server-side computes the merge on the API server and tracks field ownership.
kubectl apply --server-sidekubectl apply --server-side moves the merge to the API server with field managers.
kubectl apply -kkubectl apply -k builds a kustomization and applies it to the cluster in one step.
kubectl apply -kkubectl apply -k builds and applies a kustomize overlay in one step.
kubectl applyReference for kubectl apply: declarative create-or-update from manifests, server-side apply, dry-run
kubectl applykubectl apply declaratively creates or updates resources from manifests.
kubectl attachkubectl attach connects to a running container's process streams.
kubectl auth can-iReference for kubectl auth can-i: check whether the current credentials may perform an action before
kubectl auth can-ikubectl auth can-i checks whether the current (or impersonated) identity may perform an action.
kubectl auth can-ikubectl auth can-i checks RBAC permissions before you run a command.
kubectl auth can-ikubectl auth can-i checks whether the current credentials may perform an action.
kubectl autoscalekubectl autoscale creates a HorizontalPodAutoscaler. Reference for --min, --max, --cpu-percent, the metrics
kubectl certificatekubectl certificate approves or denies CertificateSigningRequests.
kubectl cluster-infokubectl cluster-info shows control-plane endpoints and checks connectivity.
kubectl config set-contextReference for kubectl config set-context: create or modify a context and pin a default namespace so CI
kubectl config set-contextkubectl config set-context creates or edits a context and pins a default namespace.
kubectl config use-contextReference for kubectl config use-context: switch the active kubeconfig context in CI, verify with
kubectl config use-contextkubectl config use-context switches the active context (cluster, user, namespace).
kubectl config use-contextkubectl config use-context switches the active kubeconfig context.
kubectl configkubectl config views and edits kubeconfig - contexts, clusters, namespaces.
kubectl cordon / drainReference for kubectl cordon and drain: stop new pods on a node and safely evict running ones, the DaemonSet
kubectl cordon / uncordonkubectl cordon marks a node unschedulable; uncordon reverses it.
kubectl cp (from pod)kubectl cp pulling files out of a container to the runner. The tar dependency, path syntax, the leading-slash
kubectl cpReference for kubectl cp: copy files into or out of a container, the tar dependency that breaks distroless
kubectl cpkubectl cp copies files between a pod and the local filesystem.
kubectl cpkubectl cp copies files between your machine and a container. The tar dependency, path syntax, and why cp
create configmap --from-filekubectl create configmap --from-file builds a ConfigMap from files or a directory.
kubectl create configmapReference for kubectl create configmap: build a ConfigMap from literals, files, or a directory, the
kubectl create configmapkubectl create configmap builds a ConfigMap from literals, files, or env files.
kubectl create deploymentkubectl create deployment scaffolds a Deployment from an image.
kubectl create jobkubectl create job runs a one-off Job, optionally from a CronJob template.
kubectl create namespacekubectl create namespace makes a namespace for isolated CI environments.
create secret docker-registrykubectl create secret docker-registry builds a dockerconfigjson pull secret.
kubectl create secretReference for kubectl create secret: build generic, docker-registry, and tls Secrets from literals or files,
kubectl create secretkubectl create secret builds generic, docker-registry, and TLS Secrets.
kubectl createReference for kubectl create: imperative resource creation, the create-then-apply pattern, --dry-run YAML
kubectl createkubectl create imperatively creates resources and scaffolds manifests.
kubectl debugkubectl debug attaches an ephemeral debug container to a running pod.
kubectl delete --grace-periodkubectl delete --grace-period controls termination time; --grace-period=0 --force removes a stuck pod.
kubectl delete -lkubectl delete -l removes every resource matching a label. Scoped teardown in CI, the dangerous
kubectl deleteReference for kubectl delete: remove resources by name, label, or manifest, graceful vs force deletion,
kubectl deletekubectl delete removes resources by name, label, or manifest. Graceful termination, force deletes, finalizers
kubectl describe nodekubectl describe node shows taints, conditions, allocatable, and pod pressure.
kubectl describeReference for kubectl describe: render a resource plus its Events to debug ImagePullBackOff,
kubectl describekubectl describe shows a resource plus its events. Read the Events section to debug ImagePullBackOff,
kubectl diffReference for kubectl diff: preview what an apply would change against the live cluster, the meaning of its
kubectl diffkubectl diff shows what an apply would change against the live cluster.
kubectl diffkubectl diff previews what an apply would change against the live cluster.
kubectl drain --forcekubectl drain --force evicts pods including unmanaged bare pods.
kubectl drainkubectl drain cordons a node and evicts its pods for maintenance.
kubectl drainkubectl drain safely evicts pods from a node before maintenance.
kubectl editkubectl edit opens a resource in your editor for in-place changes.
kubectl eventskubectl events lists cluster events with filtering and watch. Sorting chronologically, scoping to one object,
kubectl exec -itkubectl exec runs a command in a container; -it allocates a TTY.
kubectl execReference for kubectl exec: run a command inside a running container, the -- separator, container selection,
kubectl execkubectl exec runs a command inside a running container. Interactive shells, the -- separator, and the
kubectl explainkubectl explain documents the fields of a resource type from the live API schema.
kubectl explainkubectl explain documents a resource's fields from the live API schema.
kubectl exposekubectl expose creates a Service for a Deployment or pod. Service types, target-port mapping, and the
kubectl get custom-columnskubectl get -o custom-columns builds a table from jsonpath expressions.
kubectl get -o jsonpathkubectl get -o jsonpath pulls a single field for scripts and gates.
kubectl get -o jsonpathkubectl get -o jsonpath extracts exact fields for scripting. Range syntax, quoting in CI shells, and the
kubectl get -o widekubectl get -o wide adds node, IP, and nominated-node columns to the table.
kubectl get -o yamlkubectl get -o yaml dumps a resource's full spec and status as YAML.
kubectl get componentstatuseskubectl get componentstatuses (cs) reports control-plane component health.
kubectl get events -wkubectl get events -w streams cluster events live. Watching a deploy unfold, sorting and field-selecting, and
kubectl getReference for kubectl get: list resources, output formats, label and field selectors, jsonpath extraction,
kubectl getkubectl get lists and displays Kubernetes resources. Output formats, label selectors, watch mode, and the
kubectl ingress-nginxThe kubectl ingress-nginx plugin inspects the ingress-nginx controller: backends, conf, and generated
kubectl krew installkubectl krew install adds kubectl plugins from the krew index.
kubectl kustomizeReference for kubectl kustomize: render a kustomize overlay to YAML, the difference from apply -k, and a CI
kubectl kustomizekubectl kustomize builds rendered manifests from a kustomization directory.
kubectl kustomizekubectl kustomize renders a kustomization to stdout without applying it.
kubectl label --overwritekubectl label --overwrite changes an existing label idempotently.
kubectl labelkubectl label adds, changes, or removes labels on resources. Reference for --overwrite, the key- removal
kubectl labelReference for kubectl label: add, change, or remove labels, --overwrite for idempotent re-runs, the
kubectl labelkubectl label adds, changes, or removes labels on resources. Overwriting, selector-targeted bulk labelling,
kubectl logs --previouskubectl logs --previous reads the log of a crashed, restarted container.
kubectl logs -lkubectl logs -l streams logs from every pod matching a selector.
kubectl logs -lkubectl logs -l streams logs from every pod matching a label. The max-log-requests cap, prefixing by pod, and
kubectl logsReference for kubectl logs: stream container output, read previous-container logs for crash loops, select
kubectl logskubectl logs streams container logs. Previous-container logs for crash loops, multi-container selection,
kubectl patch (json)kubectl patch --type=json applies RFC 6902 add/replace/remove operations by path.
kubectl patch --type=jsonkubectl patch --type=json applies an RFC 6902 operation list at explicit paths.
kubectl patchReference for kubectl patch: apply strategic-merge, JSON-merge, or JSON-patch updates from a script, when to
kubectl patch (strategic)kubectl patch with the default strategic merge type updates a resource in place.
kubectl patchkubectl patch applies strategic-merge, JSON-merge, or JSON-patch updates.
kubectl port-forwardReference for kubectl port-forward: tunnel a local port to a pod or service for CI smoke tests, the readiness
kubectl port-forwardkubectl port-forward tunnels a local port to a pod or service.
kubectl port-forwardkubectl port-forward tunnels a local port to a pod or service.
kubectl proxykubectl proxy opens an authenticated local proxy to the API server.
kubectl replace --forcekubectl replace --force deletes and recreates a resource to get past immutable-field errors.
kubectl replace --forcekubectl replace --force deletes and recreates a resource to change immutable fields.
kubectl replacekubectl replace overwrites a resource wholesale from a manifest.
kubectl rollout historykubectl rollout history lists a Deployment's revisions and their change-cause.
kubectl rollout pausekubectl rollout pause freezes a Deployment so multiple edits batch into one rollout.
kubectl rollout restartReference for kubectl rollout restart: trigger a fresh rolling restart with no spec change, to pick up a
kubectl rollout restartkubectl rollout restart triggers a rolling restart without changing the spec.
kubectl rollout resumekubectl rollout resume un-pauses a Deployment and ships the batched changes as one rollout.
kubectl rollout statuskubectl rollout status blocks until a Deployment, StatefulSet, or DaemonSet finishes rolling out.
kubectl rollout statusReference for kubectl rollout status: block until a rollout completes and exit non-zero on failure, the
kubectl rollout undoReference for kubectl rollout undo: roll a Deployment back to a previous revision, with rollout history,
kubectl rollout undokubectl rollout undo rolls a Deployment back to its previous or a specific revision.
kubectl rolloutkubectl rollout manages Deployment rollouts. rollout status as a deploy gate, undo to roll back, restart, and
kubectl runkubectl run launches a single pod imperatively. One-off debug pods, --rm -it throwaway containers, --restart
kubectl scaleReference for kubectl scale: set replica counts, conditional scaling with --current-replicas, why an HPA
kubectl scalekubectl scale sets the replica count of a workload. Reference for --replicas, --current-replicas,
kubectl scalekubectl scale sets the replica count on Deployments and StatefulSets.
kubectl set envkubectl set env adds, changes, or removes env vars on a workload.
kubectl set imageReference for kubectl set image: promote a Deployment to a new image tag in one command, why immutable tags
kubectl set imagekubectl set image updates the image of a container in a workload and triggers a rollout.
kubectl set imagekubectl set image promotes a Deployment to a new image tag and triggers a rollout.
kubectl set resourceskubectl set resources patches CPU and memory requests and limits on a workload.
kubectl setkubectl set updates specific fields on existing resources - image, env, resources.
kubectl taint nodeskubectl taint nodes adds or removes node taints that repel pods without tolerations.
kubectl taintkubectl taint adds or removes node taints with NoSchedule/NoExecute effects.
kubectl taintkubectl taint adds or removes node taints that repel pods without tolerations.
kubectl top podskubectl top pods shows live CPU and memory from the metrics API.
kubectl topReference for kubectl top: show live CPU and memory for nodes and pods, sorting and per-container breakdown,
kubectl topkubectl top shows live CPU and memory usage for pods and nodes.
kubectl uncordonkubectl uncordon makes a previously cordoned node schedulable again.
kubectl versionkubectl version reports client and server versions. The skew policy, scripting with -o json, and the
kubectl waitkubectl wait blocks until a resource reaches a condition, the way a pipeline gates a deploy.
kubectl wait --for=conditionkubectl wait --for=condition blocks until a resource reaches a condition.
kubectl waitReference for kubectl wait: block on a condition (Ready, Available, complete, delete) with a timeout, the
kubectl waitkubectl wait blocks until a resource meets a condition. Waiting for Ready, deletion, or custom conditions in
kubectl-neatkubectl neat removes server-added fields (status, managedFields, default values) from get -o yaml output for
kubectx (rename)kubectx renames long EKS/GKE context names to short aliases and deletes stale ones.
kubectx (switch)kubectx switches between kubeconfig contexts, lists them, and jumps back with the - shortcut.
kubens (switch)kubens sets the default namespace for the current context so you stop typing -n everywhere.
kubentkubent (kube-no-trouble) finds deprecated and removed Kubernetes APIs in a live cluster or manifests.
kubeseal --fetch-certkubeseal --fetch-cert exports the controller public certificate so you can seal secrets without cluster
kubeseal (seal)kubeseal encrypts a Kubernetes Secret into a SealedSecret safe to commit.
kubeval to kubeconformkubeval is archived; kubeconform is the maintained replacement.
kubeval (deprecated)kubeval validated Kubernetes manifests against schemas but is deprecated in favor of kubeconform.
kubeval (validate)kubeval validates Kubernetes manifests against JSON schemas. Reference for --strict, --kubernetes-version,
kumactl applykumactl apply creates or updates Kuma resources and policies from YAML.
kumactl inspectkumactl inspect shows the state of Kuma dataplanes, meshes, and policies.
kustomization.yamlkustomization.yaml is the file Kustomize reads to render manifests.
Kustomize load restrictorThe --load-restrictor flag controls whether Kustomize may read files outside the kustomization directory.
Kustomize basesA Kustomize base is a directory of shared manifests that overlays reference.
kustomize build overlaykustomize build renders a directory into final manifests on stdout.
kustomize build (note)The standalone kustomize build renders an overlay to plain manifests, often piped into validators.
commonAnnotationsThe commonAnnotations field adds annotations to every resource.
Kustomize componentsA Kustomize Component is a reusable, composable unit of patches and resources.
configMapGeneratorconfigMapGenerator builds ConfigMaps from files, literals, or env files with a content hash suffix.
kustomize createkustomize create scaffolds a kustomization.yaml in the current directory.
kustomize edit addkustomize edit add and set modify kustomization.yaml from the command line.
kustomize edit set imagekustomize edit set image pins an image tag in kustomization.yaml from CI.
generatorOptionsgeneratorOptions tunes ConfigMap and Secret generators: disable the hash suffix, add labels and annotations.
kustomize helmChartsKustomize can inflate Helm charts via helmCharts when run with --enable-helm.
Kustomize imagesThe images field rewrites container image names, tags, and digests across manifests.
JSON 6902 patchJSON 6902 patches apply precise add/replace/remove operations to manifests.
Kustomize labelsThe labels and commonLabels fields add labels across resources.
namePrefix / nameSuffixnamePrefix and nameSuffix prepend or append to every resource name and update references.
Kustomize namespaceThe namespace field sets metadata.namespace on every namespaced resource.
Kustomize replacementsThe replacements field copies a value from a source field into target fields across resources.
Kustomize resourcesThe resources field lists the manifests and directories Kustomize includes.
secretGeneratorsecretGenerator builds Secrets from files, literals, or env files with a hash suffix.
Strategic-merge patchStrategic-merge patches let Kustomize overlay partial manifests onto resources.
Kustomize varsThe vars field injects a value from one resource into fields of others.
kyverno applykyverno apply runs Kyverno policies against manifests outside a cluster, ideal for PR gates.
kyverno testkyverno test runs declarative test cases (kyverno-test.yaml) asserting expected policy results.
linkerd checklinkerd check runs extensive health checks against a Linkerd install and control plane.
linkerd injectlinkerd inject adds the Linkerd proxy sidecar annotation to Kubernetes manifests.
linkerd installlinkerd install renders the Linkerd control-plane manifests to apply with kubectl.
linkerd vizlinkerd viz installs the metrics extension and queries live traffic stats.
meshctl checkmeshctl check validates a Gloo (Gloo Mesh / Gloo Gateway) install and its config.
meshctl installmeshctl install deploys Gloo (Gloo Mesh / Gloo Gateway) with the meshctl CLI.
minikube image loadminikube image load makes a locally built image available to the cluster without a registry.
minikube startminikube start launches a single-node Kubernetes cluster via a driver (docker, kvm2, etc.).
opa evalopa eval evaluates a Rego query against input data, the core of policy-as-code checks.
opa fmtopa fmt formats Rego to a canonical style and, with --fail, gates PRs on unformatted files.
opa testopa test runs Rego unit tests (rules prefixed test_) and reports pass/fail.
pluto detect-filespluto detect-files scans manifests and charts for deprecated or removed Kubernetes APIs before an upgrade.
polaris auditpolaris audit checks manifests against configurable best-practice policies and can fail on a score threshold.
regula runregula run evaluates OPA/Rego rules against Terraform IaC and reports rule results.
sops --decryptsops --decrypt decrypts a sops file to stdout for use in a pipeline.
sops --encryptsops --encrypt encrypts values in YAML, JSON, and env files while leaving keys readable.
sops exec-envsops exec-env decrypts a file and runs a command with its values as environment variables.
stern (namespaces)stern can tail pods across many namespaces with -A or repeated -n flags.
stern (tail logs)stern tails logs from multiple pods matching a regex, with color-coded prefixes.
terrascan scanterrascan scan runs Rego policies against Terraform, Kubernetes, and other IaC.
npm / yarn / pnpm
Install, scripts, publish.
npm audit fixnpm audit fix updates vulnerable dependencies to safe versions.
npm cinpm ci does a clean, reproducible install from package-lock.json - the right command for CI.
npm unlinknpm unlink removes a symlinked package created by npm link and restores the real dependency.
pnpm runpnpm run executes package.json scripts, with --filter and -r to run across workspaces.
pnpm updatepnpm update (pnpm up) upgrades dependencies within or across ranges with --latest, and -r across workspaces.
yarn addyarn add installs and records a dependency. Learn dev, exact, and peer flags, and why CI rarely runs it.
yarn installyarn install resolves and installs dependencies from yarn.lock.
yarn workspacesyarn workspaces runs commands across a monorepo and yarn workspace targets one package.
cargo / go / Maven / Gradle
Build and test toolchains.
actionlintactionlint statically checks .github/workflows YAML for syntax, expression, and shell errors.
bazel runReference for bazel run in CI/CD: build then execute a runnable target, pass program arguments after a
datadog-ci sourcemapsdatadog-ci sourcemaps upload sends JS source maps to Datadog so RUM error stack traces deminify.
dotnet ef migrationsdotnet ef migrations and database update apply EF Core schema changes.
go mod downloadgo mod download fetches module dependencies into the module cache.
mvn dependency:treeWhat dependency:tree does - prints the full transitive dependency graph so you can find version conflicts and
mvn help:effective-pomWhat help:effective-pom does - prints the fully resolved POM after inheritance, profiles, and defaults merge
mvn release:prepareWhat release:prepare does - sets the release version, tags the SCM, and bumps to the next SNAPSHOT via the
pip & Python
Install and manage packages.
Terraform / gh / cloud
IaC, GitHub CLI, cloud CLIs.
argocd app syncWhat argocd app sync does, how to sync an Argo CD app non-interactively in CI with login and wait, and the
aws eks update-kubeconfigWhat aws eks update-kubeconfig does, how to wire kubectl to an EKS cluster in CI, and the auth and
az keyvault secret showWhat az keyvault secret show does, how to read a Key Vault secret value in CI, RBAC vs access policies, and
cdk deployReference for cdk deploy in CI/CD: synthesize and deploy AWS CDK stacks non-interactively with
cdk synthWhat cdk synth does, how to produce CloudFormation templates as a CI artifact, and the context and synthesis
gcloud auth configure-dockerConfigure Docker to authenticate to Artifact Registry and GCR via gcloud: flags, a CI example, and the auth
gcloud print-access-tokengcloud auth print-access-token prints a short-lived OAuth token for API calls and Docker logins.
gcloud config setWhat gcloud config set does, how to set the active project and region/zone for CI, configurations, and the
gh apiReference for gh api in CI/CD: call any REST or GraphQL endpoint with authentication handled, pass fields,
gh auth loginReference for gh auth login in CI/CD: authenticate the GitHub CLI non-interactively with a token via stdin or
gh auth loginWhat gh auth login does, how to authenticate the GitHub CLI interactively or with a token in CI, and the auth
gh pr commentReference for gh pr comment in CI/CD: post or update a comment on a pull request from a pipeline, ideal for
gh pr listWhat gh pr list does, how to filter pull requests by state, author, and label, format them as JSON in CI, and
gh pr mergeWhat gh pr merge does, how to merge, squash, or rebase a PR non-interactively in CI with auto-merge, and the
gh pr viewWhat gh pr view does, how to read a pull request’s details, review status, and checks as JSON for CI gating,
gh workflow listWhat gh workflow list does, how to enumerate GitHub Actions workflows with their states and IDs in CI, and
gh workflow runWhat gh workflow run does, how to trigger a workflow_dispatch with inputs and a ref in CI, and the errors you
helm lintLint a Helm chart in CI before deploying: values and strict flags, an example, and the lint errors that
terraform destroyWhat terraform destroy does, how to tear down infrastructure safely in CI, target a subset, and the
terraform force-unlockReference for terraform force-unlock in CI/CD: clear a stale state lock left by a crashed run, with the
vault kv metadatavault kv metadata manages KV v2 version history, max_versions, and full deletion.
vault kv putWhat vault kv put does, how to write secrets to the KV engine safely in CI from stdin, and the permission and
Shell & Unix tools
curl, jq, ssh, tar, make, sed, and friends.
apk add --no-cacheapk add --no-cache installs Alpine packages without leaving an index cache, keeping images small.
apt-keyReference for apt-key: add, adv, the modern signed-by keyring replacement, and a CI example that installs a
awk nextawk next stops processing the current line and moves to the next record, used to skip headers, comments, or
brew bundlebrew bundle installs everything listed in a Brewfile. Reference for --file, --no-lock, brew bundle check, and
grpcurlgrpcurl is curl for gRPC services. Reference for -plaintext, -d, -import-path, list/describe, and the
iperf3iperf3 measures network bandwidth between two hosts. Reference for -s, -c, -u, -t, -P, and the "Connection
jaegerjaeger-all-in-one runs a full tracing backend for tests. Reference for collector/OTLP ports,
jq --argjq --arg binds a string and --argjson binds parsed JSON into a variable.
kafka-console-consumerkafka-console-consumer.sh reads messages from a Kafka topic to stdout.
ldconfigldconfig rebuilds the shared library cache so newly installed .so files are found at runtime.
ldconfigldconfig rebuilds the shared-library cache so the loader finds new .so files.
microdnf installmicrodnf is the tiny dnf for Red Hat UBI minimal images. Reference for install, clean all, --nodocs, and the
mysqladminmysqladmin administers a MySQL/MariaDB server from the shell. Reference for ping, status, create, --wait, and
npxnpx runs a package binary without a global install. Reference for --yes, --no-install, and the install prompt
pacman -Syupacman -Syu refreshes the database and upgrades all packages on Arch.
promtool checkpromtool check validates Prometheus configs and rules. Reference for check config, check rules,
rbenv installrbenv install builds a Ruby version via ruby-build. Reference for build deps, .ruby-version, and the "BUILD
rsync protocol version mismatchrsync "protocol version mismatch -- is your shell clean?" means the remote shell prints output before rsync
tailtail prints the last lines of input or follows a growing file in CI.
yq front matteryq --front-matter processes the YAML front matter block in Markdown files while preserving the body.
yq Go vs PythonTwo unrelated tools are both called yq. Reference for telling mikefarah/yq (Go) from kislyuk/yq (Python jq
zizmorzizmor is a static security auditor for GitHub Actions workflows, flagging injection, unpinned actions, and
Explore other topics
GitHub ActionsWorkflow, runner, and YAML errors - diagnosed and fixed.
Node.js & npmnpm, yarn, and pnpm failures in CI - solved.
DockerBuild, run, compose, and registry errors - explained.
Pythonpip, poetry, venv, and pytest failures - fixed.
Java & JVMMaven, Gradle, and JVM failures in CI - resolved.
GoGo build, module, and test failures - diagnosed.