CLI Reference
Exact command reference for gstacks.
CLI reference
Use this page when you need exact command syntax.
Command namespaces in the operator CLI are singular. HTTP API endpoints use plural collection paths separately.
Each command card includes:
- usage
- flags
- required values
- defaults
- examples when available
Use the CLI guide for task-based workflows. Use this page for exact command details.
Validate a console-generated API key and store it in the local CLI config.
gstacks auth login --base-url URL --api-key KEY -
--base-urlControl plane base URL. Default: http://127.0.0.1:8080 -
--api-keyConsole-generated CLI API key. Required -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks auth login --base-url http://devops.local:8080 --api-key gsk_xxxxx Remove the local CLI config.
gstacks auth logout -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Verify the configured API key and print the authenticated user payload.
gstacks whoami -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Print the CLI version, branch, commit, and commit count.
gstacks version Download and install the latest CLI release over the current binary.
gstacks upgrade -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--base-urlOverride upgrade source base URL. -
--versionOptional release version to install instead of latest. -
--forceReinstall even when the current version already matches the target version.
gstacks upgradegstacks upgrade --version 0.1.339-6d0940dgstacks upgrade --force List connected hosts from the infrastructure inventory.
gstacks host list -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks host list Show one host record with routing-relevant metadata such as tags, traits, ownership, and eligibility state.
gstacks host info --host-id ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--host-idHost identifier to inspect. Required
gstacks host info --host-id agt_123 Update operator-managed host routing rules such as tags and eligibility flags. Ownership and classification remain control-plane managed.
gstacks host update --host-id ID [--tag TAG] -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--host-idHost identifier to update. Required -
--tagSet operator-managed host tags; repeat flag to pass multiple. -
--sandbox-eligibleSet sandbox eligibility to true or false. -
--host-access-eligibleSet host terminal access eligibility to true or false.
gstacks host update --host-id agt_123 --tag pool:edge --sandbox-eligible true Open an interactive host shell session proxied through the connected host agent.
gstacks host ssh HOST -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--host-idHost identifier or name to connect to. Optional when provided positionally. -
--session-idExisting terminal session to attach to. -
--colsRequested terminal width. Default: 120 -
--rowsRequested terminal height. Default: 32
gstacks host ssh devopsgstacks host ssh --host-id agent-123gstacks host ssh devops --session-id aterm_123 Schedule a typed managed upgrade for a connected host agent.
gstacks host upgrade HOST [--version VERSION] -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--host-idHost identifier or name to upgrade. Optional when provided positionally. -
--versionAgent version to install; use latest for the official release channel. Default: latest -
--forceReinstall even when the host reports the target version.
gstacks host upgrade devopsgstacks host upgrade --host-id agent-123 --version 0.1.1400 List current host shell sessions and whether they have an active viewer.
gstacks host sessions HOST -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--host-idHost identifier or name to inspect. Optional when provided positionally.
gstacks host sessions devops Attach to an existing host shell session.
gstacks host attach HOST SESSION_ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks host attach devops aterm_123 List control-plane volumes and summarize their current attachments.
gstacks volume list -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks volume list Show one volume record as JSON, including attachment records and runtime state where available.
gstacks volume info ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks volume info vol_123 Create a detached control-plane volume.
gstacks volume create --cluster-id ID VOLUME_ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--cluster-idCluster identifier to provision the volume in. Required
gstacks volume create --cluster-id cls_123 shared-media List attachment records for one volume.
gstacks volume attachment list ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks volume attachment list shared-media Create one attachment record for a volume.
gstacks volume attachment create ID --target-kind KIND --target-id TARGET -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--target-kindAttachment target kind. Required -
--target-idAttachment target identifier. Required -
--mount-pathTarget mount path when applicable. -
--access-modeAttachment access mode. -
--read-onlyCreate the attachment as read-only.
gstacks volume attachment create shared-media --target-kind host --target-id agt_123 Delete one attachment record from a volume.
gstacks volume attachment delete ID ATTACHMENT -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks volume attachment delete shared-media volatt_123 List tenant sandboxes from the infrastructure inventory. Archived sandboxes are hidden by default.
gstacks sandbox list -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--archivedInclude archived sandboxes. -
--stoppedList stopped sandboxes instead of active sandboxes.
gstacks sandbox listgstacks sandbox list --archivedgstacks sandbox list --stopped Create an empty sandbox and optionally constrain placement with host routing inputs.
gstacks sandbox create --cluster-id ID [--host-id ID] [--require-tag TAG] [--require-trait TRAIT] -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--nameOptional sandbox name. -
--blueprintActive blueprint id or unique name to use as the sandbox source. -
--cpuRequested vCPU count. Default: 0.5 -
--memoryRequested memory. Default: 256MiB -
--cluster-idRequire placement in a specific cluster. Required -
--host-idRequire placement on a specific host. -
--require-tagRequire host tags for placement; repeat flag to pass multiple. -
--require-traitRequire host traits for placement; repeat flag to pass multiple. -
--sshPrint the follow-up sandbox ssh command after creation.
gstacks sandbox create --cluster-id cls_123 --name buildboxgstacks sandbox create --cluster-id cls_123 --blueprint dev-readygstacks sandbox create --cluster-id cls_123 --host-id agt_123 --require-trait docker --require-tag pool:edge Create a reusable blueprint from an existing sandbox.
gstacks sandbox blueprint SANDBOX --name NAME -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--sandbox-idSandbox identifier or name to capture. Optional when provided positionally. -
--nameBlueprint name. Required -
--descriptionBlueprint description.
gstacks sandbox blueprint devbox --name captured-devbox Attach an Access policy directly to one sandbox.
gstacks sandbox access attach SANDBOX POLICY -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--ttlTemporary sandbox attachment TTL in seconds. Default: 0
gstacks sandbox access attach gssbx_123 openai Show one sandbox record as JSON.
gstacks sandbox info ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--sandbox-idSandbox identifier to inspect. Optional when provided positionally.
gstacks sandbox info gssbx_123gstacks sandbox info --sandbox-id gssbx_123 Deprovision a sandbox runtime and archive the sandbox record.
gstacks sandbox delete ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--sandbox-idSandbox identifier to deprovision. Optional when provided positionally.
gstacks sandbox delete gssbx_123gstacks sandbox delete --sandbox-id gssbx_123 Stop one sandbox runtime.
gstacks sandbox stop ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--sandbox-idSandbox identifier to stop. Optional when provided positionally.
gstacks sandbox stop gssbx_123gstacks sandbox stop --sandbox-id gssbx_123 Start one stopped sandbox runtime.
gstacks sandbox start ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--sandbox-idSandbox identifier to start. Optional when provided positionally.
gstacks sandbox start gssbx_123gstacks sandbox start --sandbox-id gssbx_123 Create one sandbox fork.
gstacks sandbox fork [--name NAME] --mode MODE SANDBOX_ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--sandbox-idSandbox identifier to fork. Optional when provided positionally. -
--nameOptional child sandbox name. -
--modeFork mode (filesystem or live). Required -
--fallbackFallback mode when live fork is not possible. One of: none, filesystem. Default: none -
--purposeFork purpose. One of: branch, speculative, debug, review, temporary. Default: branch -
--ttlOptional TTL for disposable forks in seconds. Default: 0 -
--countNumber of forks to create. Default: 1
gstacks sandbox fork gssbx_123 --mode filesystem --name feature-authgstacks sandbox fork gssbx_123 --mode filesystem --name speculative --count 3gstacks sandbox fork --mode live --fallback filesystem --name quick-check gssbx_123 List forks created from one sandbox.
gstacks sandbox forks SANDBOX_ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--sandbox-idSandbox identifier whose forks should be listed. Optional when provided positionally. -
--archivedInclude archived forks.
gstacks sandbox forks gssbx_123gstacks sandbox forks --archived gssbx_123gstacks sandbox forks --sandbox-id gssbx_123 Show root, ancestor, current, and descendant fork lineage for one sandbox.
gstacks sandbox lineage SANDBOX_ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--sandbox-idSandbox identifier whose lineage should be shown. Optional when provided positionally.
gstacks sandbox lineage gssbx_123gstacks sandbox lineage --sandbox-id gssbx_123 Open an interactive sandbox terminal.
gstacks sandbox ssh ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--sandbox-idSandbox identifier to connect to. Optional when provided positionally. -
--session-idExisting terminal session to attach to. -
--colsRequested terminal width. Default: 120 -
--rowsRequested terminal height. Default: 32
gstacks sandbox ssh gssbx_123gstacks sandbox ssh --sandbox-id gssbx_123gstacks sandbox ssh gssbx_123 --session-id sterm_123 List current sandbox shell sessions and whether they have an active viewer.
gstacks sandbox sessions ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--sandbox-idSandbox identifier to inspect. Optional when provided positionally.
gstacks sandbox sessions gssbx_123 Attach to an existing sandbox shell session.
gstacks sandbox attach ID SESSION_ID -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks sandbox attach gssbx_123 sterm_123 List sandbox blueprints and their source artifact references.
gstacks blueprint list -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks blueprint list Create an image-backed blueprint from an external image source.
gstacks blueprint create IMAGE --name NAME [--registry REGISTRY] -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--nameBlueprint name. Required -
--descriptionBlueprint description. -
--registryRegistry connection id for the source image. -
--privateRequire a registry connection for this private source image. -
--waitWait until the blueprint import finishes. -
--timeoutMaximum time to wait with --wait. Default: 5m0s
gstacks blueprint create hello-world:latest --name hello-world --waitgstacks blueprint create ghcr.io/acme/dev:latest --name dev-ready --registry reg_123gstacks blueprint create registry.example.com/acme/dev:latest --name private-dev --registry reg_123 --private Show one blueprint as JSON.
gstacks blueprint get BLUEPRINT -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Mark a blueprint active for sandbox creation.
gstacks blueprint activate BLUEPRINT -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Mark a blueprint inactive.
gstacks blueprint deactivate BLUEPRINT -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Archive a blueprint and hide it from the active console inventory.
gstacks blueprint archive BLUEPRINT -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Delete a blueprint record.
gstacks blueprint delete BLUEPRINT -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Attach an Access policy to a blueprint so new sandboxes inherit it.
gstacks blueprint access attach BLUEPRINT POLICY -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--ttlTemporary attachment TTL in seconds. Default: 0
gstacks blueprint access attach dev-ready openai List write-only Access secrets.
gstacks access secret list -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks access secret list Create a write-only Access secret from an environment variable or stdin.
gstacks access secret create NAME --value-env ENV -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--value-envRead the secret value from this environment variable. -
--value-stdinRead the secret value from stdin.
gstacks access secret create openai-api-key --value-env OPENAI_API_KEY Rotate a write-only Access secret value while keeping policy references stable.
gstacks access secret rotate NAME --value-env ENV -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--value-envRead the new secret value from this environment variable. -
--value-stdinRead the new secret value from stdin.
gstacks access secret rotate openai-api-key --value-stdin Grant a stored Access secret to a sandbox or blueprint as an environment variable.
gstacks access secret grant TARGET SECRET ENV_NAME [--target-kind KIND] -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--target-kindGrant target kind: sandbox or blueprint. Default: sandbox -
--ttlTemporary sandbox grant TTL in seconds. Default: 0
gstacks access secret grant gssbx_123 openai-api-key OPENAI_API_KEY Create an Access egress policy with arbitrary safe injected headers.
gstacks access policy create NAME --host HOST --header NAME=VALUE -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--hostAllowed host; repeat for multiple. -
--pathAllowed path glob; repeat for multiple. -
--methodAllowed HTTP method; repeat for multiple. -
--headerInjected header as Name=Value; repeat for multiple. -
--ttlDefault access token TTL in seconds. Default: 3600
gstacks access policy create openai --host api.openai.com --path /v1/* --method POST --header 'Authorization=Bearer {{secret:openai-api-key}}'gstacks access policy create vendor --host api.vendor.example --header 'X-Tenant=customer-123' --header 'X-Api-Key={{secret:vendor-token}}' List Access egress policies.
gstacks access policy list -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Disable an Access egress policy without deleting it.
gstacks access policy disable POLICY -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
List external registry connections.
gstacks registry list -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Create an external registry connection for image-backed blueprints.
gstacks registry create NAME [--provider PROVIDER] [--url URL] -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--providerRegistry provider. -
--urlRegistry URL. -
--usernameRegistry username. -
--credential-secret-refSecret reference for registry credentials. -
--projectRegistry project, namespace, or account. -
--insecure-skip-tls-verifySkip TLS verification for this registry connection.
gstacks registry create ghcr --provider ghcr --url https://ghcr.io --username robot --credential-secret-ref secret://registry/ghcr Show one registry connection as JSON.
gstacks registry get REGISTRY -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Update an external registry connection.
gstacks registry update REGISTRY [--name NAME] -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--nameRegistry connection name. -
--providerRegistry provider. -
--urlRegistry URL. -
--usernameRegistry username. -
--credential-secret-refSecret reference for registry credentials. -
--projectRegistry project, namespace, or account. -
--insecure-skip-tls-verifySkip TLS verification for this registry connection.
Delete an external registry connection.
gstacks registry delete REGISTRY -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Show internal blueprint registry settings as JSON.
gstacks registry status -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
List internal blueprint registry repositories.
gstacks registry repositories -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
List internal blueprint registry artifacts.
gstacks registry artifacts -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
List extensions visible to the current tenant.
gstacks extensions list -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Install an extension into the authenticated control plane tenant.
gstacks extensions install EXTENSION -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks extensions install cloudflare-r2 Invoke an installed extension operation through the control plane.
gstacks extensions invoke EXTENSION OPERATION -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--target-kindControl-plane target kind for the operation. Default: cluster -
--target-idControl-plane target ID for the operation. Default: default -
--connection-idOptional extension connection ID. -
--input-jsonJSON object input for the operation. Default: {} -
--input-filePath to a JSON object input file.
gstacks extensions invoke cloudflare-r2 cloudflare-r2.bucket.create --target-id default --input-json '{"bucket_name":"globalstacks-dev"}' Validate a local extension manifest, permissions, egress, artifact metadata, and compatibility.
gstacks extensions validate Verify generated SDKs match committed OpenAPI and JSON Schema files.
gstacks extensions sdk check List runtime networks.
gstacks network list -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks network list Create a runtime network.
gstacks network create --cluster-id ID NAME -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--cluster-idCluster identifier to provision the network in. Required -
--slugDNS-safe network slug. -
--dns-domainNetwork DNS suffix.
gstacks network create --cluster-id cls_123 dev Show one runtime network as JSON.
gstacks network inspect NETWORK -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Attach a sandbox to a network and publish an alias.
gstacks network attach NETWORK SANDBOX --alias NAME --port PORT -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--aliasDNS alias to publish on the network. Required -
--portPort to expose for the alias; repeat to pass multiple. Required
gstacks network attach dev gssbx_123 --alias api --port 8080 Detach a sandbox from a network.
gstacks network detach NETWORK SANDBOX -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
List network aliases.
gstacks network alias list NETWORK -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Add an alias to a sandbox network member.
gstacks network alias add NETWORK SANDBOX ALIAS --port PORT -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--portPort to expose for the alias; repeat to pass multiple. Required
gstacks network alias add dev gssbx_123 worker --port 9090 Remove a network alias.
gstacks network alias remove NETWORK ALIAS -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
List network policies.
gstacks network policy list NETWORK -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Allow traffic within a network.
gstacks network policy allow NETWORK --from SOURCE --to TARGET --port PORT -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--fromSource alias or selector. Required -
--toTarget alias or selector. Required -
--portAllowed port; repeat to pass multiple. Required
gstacks network policy allow dev --from local --to api --port 8080 Resolve a network alias.
gstacks network resolve NETWORK NAME -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
Test whether a network route is allowed by policy.
gstacks network test NETWORK SOURCE TARGET:PORT -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json
gstacks network test dev local api:8080 Join a network from this machine.
gstacks mesh join NETWORK -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--state-dirDirectory for local mesh state. Default: ~/.config/gstacks/mesh
gstacks mesh join dev Show local mesh join status.
gstacks mesh status [NETWORK] -
--state-dirDirectory for local mesh state. Default: ~/.config/gstacks/mesh
Forward a local port to one network service.
gstacks mesh forward NETWORK ALIAS:PORT --local PORT -
--config-filePath to the persisted CLI config file. Default: ~/.config/gstacks/config.json -
--state-dirDirectory for local mesh state. Default: ~/.config/gstacks/mesh -
--localLocal TCP port to listen on. Required
gstacks mesh forward dev api:8080 --local 18080 Generate a Bash completion script.
gstacks completion bash Generate a Zsh completion script.
gstacks completion zsh Generate a Fish completion script.
gstacks completion fish Generate a PowerShell completion script.
gstacks completion powershell