# CLI v1.3.0 10 min read --- ## Using the CLI Control the Edera Protect daemon. ```bash protect [OPTIONS] ``` This CLI is under active development. Options and Commands are subject to change. Subcommands: - [`zone`](https://docs.edera.dev/reference/cli/v1.3.0/#zone) Manage the zones on Edera Protect. - [`workload`](https://docs.edera.dev/reference/cli/v1.3.0/#workload) Manage the workloads on Edera Protect. - [`image`](https://docs.edera.dev/reference/cli/v1.3.0/#image) Manage the images on Edera Protect. - [`network`](https://docs.edera.dev/reference/cli/v1.3.0/#network) Manage the network on Edera Protect. - [`device`](https://docs.edera.dev/reference/cli/v1.3.0/#device) Manage the devices on Edera Protect. - [`host`](https://docs.edera.dev/reference/cli/v1.3.0/#host) Manage the host of Edera Protect. - [`completion`](https://docs.edera.dev/reference/cli/v1.3.0/#completion) Output shell completion code for the specified shell. Options: - `-c`, `--connection ` The connection URL to the Edera Protect daemon [default value: `unix:///var/lib/edera/protect/daemon.socket`]. ## `zone` Manage the zones on Edera Protect. ```bash protect zone ``` Subcommands: - `attach` Attach to the zone console. - `list` List zone information. - `launch` Launch a new zone. - `destroy` Destroy a zone. - `exec` Execute a command inside the zone. - `logs` View the logs of a zone. - `metrics` Read metrics from the zone. - `top` Dashboard for running zones. - `watch` Watch for zone changes. - `update-resources` Update the available resources to a zone. - `configure-network` Configure the network of an external network backend zone. ### `attach` Attach to the zone console. ```bash protect zone attach ``` Arguments: - `` Zone to attach to, either the name or the uuid. ### `list` List zone information. ```bash protect zone list [OPTIONS] [ZONE] ``` Arguments: - `` Limit to a single zone, either the name or the uuid. Options: - `-o`, `--output ` Output format [default value: `table`] [possible values: `table`, `json`, `json-pretty`, `jsonl`, `yaml`, `key-value`, `simple`]. ### `launch` Launch a new zone. ```bash protect zone launch [OPTIONS] ``` Options: - `--pull-overwrite-cache` Overwrite image cache on pull. - `--pull-update` Update image on pull. - `-n`, `--name ` Name of the zone. - `--min-cpus ` Minimum vCPUs available for the zone [default value: `4`]. - `-C`, `--max-cpus ` Maximum vCPUs available for the zone [default value: `4`]. - `-c`, `--target-cpus ` Target vCPUs for the zone to use [default value: `1`]. - `--min-memory ` Minimum memory available to the zone, in megabytes [default value: `0`]. - `-M`, `--max-memory ` Maximum memory available to the zone, in megabytes [default value: `1024`]. - `-m`, `--target-memory ` Target memory for the zone to use, in megabytes [default value: `1024`]. - `--create-scratch-disk ` Create a scratch disk of size, in megabytes. - `--attach-scratch-disk ` Attach a host disk as a scratch disk. - `-D`, `--device ` Devices to request for the zone. - `-a`, `--attach` Attach to the zone after zone starts, implies –wait. - `-W`, `--wait` Wait for the zone to be ready, implied by –attach. - `-k`, `--kernel ` OCI kernel image for zone to use. - `-I`, `--initrd ` OCI initrd image for zone to use. - `-w`, `--working-directory ` Working directory. - `--kernel-verbose` Enable verbose logging on the kernel. - `--kernel-cmdline-append ` Additional kernel cmdline options. - `--assume-network-reservation ` Assume an already allocated network reservation. - `--retain-network-reservation` Retain network reservation after zone destruction. - `-R`, `--resource-adjustment-policy ` Resource adjustment policy [possible values: `static`, `dynamic`]. - `-V`, `--virt-backend ` Virtualization backend [possible values: `pv`, `pvh`]. - `-N`, `--network-backend ` Network backend [possible values: `default`, `none`, `external`]. ### `destroy` Destroy a zone. ```bash protect zone destroy [OPTIONS] ``` Arguments: - `` Zone to destroy, either the name or the uuid. Options: - `-W`, `--wait` Wait for the destruction of the zone to complete. - `-A`, `--all` Destroy all zones matching the input. - `-l`, `--selector ` A selector for filtering the result set. Currently only supports ‘=’ and the ‘status.state’ field. Supported states include ‘creating’, ‘created’, ‘ready’, ’exited’, ‘destroying’, ‘destroyed’ and ‘failed’, with or without the ‘zone _state_’ prefix. (e.g. `--selector status.state=failed` or `--selector status.state=ZONE_STATE_FAILED`). ### `exec` Execute a command inside the zone. ```bash protect zone exec [OPTIONS] [COMMAND]... ``` Arguments: - `` Zone to exec inside, either the name or the uuid. - `` Command to run inside the zone. Options: - `-e`, `--env ` Environment variables. - `-w`, `--working-directory ` Working directory. - `-t`, `--tty` Allocate tty. - `--privileged` Execute command with elevated privileges. ### `logs` View the logs of a zone. ```bash protect zone logs [OPTIONS] ``` Arguments: - `` Zone to show logs for, either the name or the uuid. Options: - `-f`, `--follow` Follow output from the zone. ### `metrics` Read metrics from the zone. ```bash protect zone metrics [OPTIONS] ``` Arguments: - `` Zone to read metrics for, either the name or the uuid. Options: - `-o`, `--output ` Output format [default value: `tree`] [possible values: `tree`, .`json`, `json-pretty`, `yaml`, `key-value`]. ### `top` Dashboard for running zones. ```bash protect zone top ``` ### `watch` Watch for zone changes. ```bash protect zone watch [OPTIONS] ``` Options: - `-o`, `--output ` Output format [default value: `simple`] [possible values: `simple`, .`json`, `key-value`]. ### `update-resources` Update the available resources to a zone. ```bash protect zone update-resources [OPTIONS] ``` Arguments: - `` Zone to update resources of, either the name or the uuid. Options: - `--min-cpus ` Minimum vCPUs available to the zone (0 means previous value) [default value: `0`]. - `-C`, `--max-cpus ` Maximum vCPUs available to the zone (0 means previous value) [default value: `0`]. - `-c`, `--target-cpus ` Target vCPUs for the zone to use (0 means previous value) [default value: `0`]. - `--min-memory ` Minimum memory available to the zone, in megabytes (0 means previous value) [default value: `0`]. - `-M`, `--max-memory ` Maximum memory available to the zone, in megabytes (0 means previous value) [default value: `0`]. - `-m`, `--target-memory ` Target memory for the zone to use, in megabytes (0 means previous value) [default value: `0`]. - `-p`, `--adjustment-policy ` Adjustment policy [possible values: `static`, .`dynamic`]. ### `configure-network` Configure the network of an external network backend zone. ```bash protect zone configure-network [OPTIONS] ``` Arguments: - `` Zone to update resources of, either the name or the uuid. Options: - `--zone-interface ` Zone Network Interface. - `--zone-ipv4 ` Zone IPv4 Network. - `--zone-ipv6 ` Zone IPv6 Network. - `--gateway-ipv4 ` Zone Gateway IPv4 Network. - `--gateway-ipv6 ` Zone Gateway IPv6 Network. - `--zone-mac ` Zone MAC Address. ## `workload` Manage the workloads on Edera Protect. ```bash protect workload ``` Subcommands: - `launch` Launch a new workload. - `exec` Execute a command inside the workload. - `attach` Attach to a workload console. - `start` Start a workload. - `stop` Stop a workload. - `destroy` Destroy a workload. - `list` List workload information. - `watch` Watch for workload changes. ### `launch` Launch a new workload. ```bash protect workload launch [OPTIONS] --zone [COMMAND]... ``` Arguments: - `` Container image for zone to use. - `` Command to run the workload. Options: - `--image-format ` Image format [default value: `squashfs`] [possible values: `squashfs`, `erofs`] - `--pull-overwrite-cache` Overwrite image cache on pull. - `--pull-update` Update image on pull. - `-n`, `--name ` Name of the workload. - `-W`, `--wait` Wait for the workload to be started. - `-t`, `--tty` Allocate tty for the workload. - `-a`, `--attach` Attach to workload console. - `--strict-user-namespace` Enable strictness of user namespaces on the workload. - `-e`, `--env ` Environment variables set in the workload. - `-m`, `--mounts ` Mount host directories into the workload. - `--cap-add ` Capabilities to add. - `--cap-ambient-add ` Ambient capabilities to add. - `--cap-drop ` Capabilities to drop. - `--privileged` Run workload with elevated privileges. - `-w`, `--working-directory ` Working directory. - `--user ` User name or id. - `--group ` Group name or id. - `-z`, `--zone ` Zone to launch on, can be a name or id. - `--mount-scratch-disk ` Mount zone scratch disk on a certain directory. ### `exec` Execute a command inside the workload. ```bash protect workload exec [OPTIONS] [COMMAND]... ``` Arguments: - `` Workload to exec inside, either the name or the uuid. - `` Command to run inside the zone. Options: - `-e`, `--env ` Environment variables. - `-w`, `--working-directory ` Working directory. - `-t`, `--tty` Allocate tty. - `--user ` User name or id. - `--group ` Group name or id. - `--privileged` Execute with elevated privileges. ### `attach` Attach to a workload console. ```bash protect workload attach ``` Arguments: - `` Workload to attach to, either the name or the uuid. ### `start` Start a workload. ```bash protect workload start ``` Arguments: - `` Workload to start, either the name or the uuid. ### `stop` Stop a workload ```bash protect workload stop ``` Arguments: - `` Workload to stop, either the name or the uuid. ### `destroy` Destroy a workload ```bash protect workload destroy [OPTIONS] ``` Arguments: - `` Workload to destroy, either the name or the uuid. Options: - `-W`, `--wait` Wait for the destruction of the workload to complete. - `-a`, `--all` Destroy all workloads matching the input. - `-l`, `--selector ` A selector for filtering the result set. Currently only supports ‘=’ and the ‘status.state’ field. Supported states include ‘creating’, ‘created’, ‘running’, ‘completed’, ‘destroying’, ‘destroyed’ and ‘failed’, with or without the ‘workload _state_’ prefix. (e.g. `--selector status.state=failed` or `--selector status.state=WORKLOAD_STATE_FAILED`). ### `list` List workload information. ```bash protect workload list [OPTIONS] [WORKLOAD] ``` Arguments: - `` Limit to a single workload, either the name or the uuid. Options: - `-o`, `--output ` Output format [default value: `table`] [possible values: `table`, `json`, `json-pretty`, `jsonl`, `yaml`, `key-value`, `simple`]. - `-l`, `--selector ` A selector for filtering the result set. Currently only supports ‘=’ and the ‘status.state’ field. Supported states include ‘creating’, ‘created’, ‘running’, ‘completed’, ‘destroying’, ‘destroyed’ and ‘failed’, with or without the ‘workload _state_’ prefix. (e.g. `--selector status.state=failed` or `--selector status.state=WORKLOAD_STATE_FAILED`). ### `watch` Watch for workload changes. ```bash protect workload watch [OPTIONS] ``` Options: - `-o`, `--output ` Output format [default value: `simple`] [possible values: `simple`, .`json`, `key-value`]. ## `image` Manage the images on Edera Protect. ```bash protect image ``` Subcommands: - `pull` Pull an image into the cache. - `import` Import an image into the cache. - `remove` Remove an image from the cache. - `list` List cached images. ### `pull` Pull an image into the cache. ```bash protect image pull [OPTIONS] ``` Arguments: - `` Image name. Options: - `-s`, `--image-format ` Image format [default value: `squashfs`] [possible values: `squashfs`, `erofs`, `tar`, `directory`]. - `-n`, `--no-update` Don't update from registry. - `-o`, `--overwrite-cache` Overwrite image cache. ### `import` Import an image into the cache. ```bash protect image import [OPTIONS] --digest --image ``` Options: - `-d`, `--digest ` Image digest. - `-n`, `--image ` Image name. - `-s`, `--image-format ` Image format [default value: `squashfs`] [possible values: `squashfs`, `erofs`, `tar`, `directory`]. - `-o`, `--overwrite-cache` Overwrite image cache. - `-i ` Input image tar [default value: `/dev/stdin`]. ### `remove` Remove an image from the cache. ```bash protect image remove [OPTIONS] ``` Arguments: - `` Image digest. Options: - `-s`, `--image-format ` Image format [default value: `squashfs`] [possible values: `squashfs`, `erofs`, `tar`, `directory`]. ### `list` List cached images. ```bash protect image list [OPTIONS] ``` Options: - `-o`, `--output ` Output format [default value: `table`] [possible values: `table`, `json`, `json-pretty`, `jsonl`, `yaml`, `key-value`, `simple`]. ## `network` Manage the network on Edera Protect. ```bash protect network ``` Subcommands: - `reservation` Manage network reservations. ### `reservation` Manage network reservations. ```bash protect network reservation ``` Subcommands: - `create` Create network reservation. - `destroy` Destroy network reservation. - `list` List network reservation information. ### `reservation create` Create network reservation. ```bash protect network reservation create ``` ### `reservation destroy` Destroy network reservation. ```bash protect network reservation destroy ``` Arguments: - `` Reservation to destroy. ### `reservation list` List network reservation information. ```bash protect network reservation list [OPTIONS] ``` Options: - `-o`, `--output ` Output format [default value: `table`] [possible values: `table`, `json`, `json-pretty`, `jsonl`, `yaml`, `key-value`, `simple`]. ## `device` Manage the devices on Edera Protect. ```bash protect device ``` Subcommands: - `list` List device information. ### `list` List device information. ```bash protect device list [OPTIONS] ``` Options: - `-o`, `--output ` Output format [default value: `table`] [possible values: `table`, `json`, `json-pretty`, `jsonl`, `yaml`, `key-value`, `simple`]. ## `host` Manage the host of Edera Protect. ```bash protect host ``` Subcommands: - `cpu-topology` Display information about the host CPU topology. - `status` Get information about the host. - `idm-snoop` Snoop on the IDM bus. - `hv-console` Display hypervisor console output. - `hv-debug-info` Read hypervisor debug information. ### `cpu-topology` Display information about the host CPU topology. ```bash protect host cpu-topology [OPTIONS] ``` Options: - `-o`, `--output ` Output format [default value: `table`] [possible values: `table`, `json`, `json-pretty`, `jsonl`, `yaml`, `key-value`]. ### `status` Get information about the host. ```bash protect host status [OPTIONS] ``` Options: - `-o`, `--output ` Output format [default value: `simple`] [possible values: `simple`, .`json`, `json-pretty`, `yaml`, `key-value`]. ### `idm-snoop` Snoop on the IDM bus. ```bash protect host idm-snoop [OPTIONS] ``` Options: - `-o`, `--output ` Output format [default value: `simple`] [possible values: `simple`, .`jsonl`, `key-value`]. ### `hv-console` Display hypervisor console output. ```bash protect host hv-console ``` ### `hv-debug-info` Read hypervisor debug information. ```bash protect host hv-debug-info ``` ## `completion` Output shell completion code for the specified shell. ```bash protect completion ``` Arguments: - `` [possible values: `bash`, `elvish`, `fish`, `powershell`, `zsh`]. Last updated on 2026-02-18.