Cheatsheet

Todos os grupos de comandos e subcomandos, num só sítio. Gerado do --help real do binário.

Tarefas comuns

Serviço web, sem root, sem daemon

delonix container run -d --name web -p 8080:80 nginx

Shell descartável

delonix container run --rm -it alpine sh

Rede própria + publicar pelo ingress

delonix network create backend
delonix container run -d --net backend -p 8443:443 caddy

Trocar uma porta a QUENTE (sem reiniciar)

delonix container update web --publish-add 9090:80

Firewall: só deixar entrar Postgres da SDN

delonix net ingress allow db tcp/5432 --from 10.219.0.0/16
delonix net ingress policy db deny

Firewall: egress da rede só p/ DNS + CIDRs

delonix net egress net backend allowlist --to 10.0.0.0/8

Tráfego por container ao vivo (eBPF)

sudo delonix net flow --watch

Volume de rede de um NAS (NFS)

delonix storage create media --type nfs --server 10.0.0.5 --share /mnt/pool/media

Segredo no cofre (não no argv)

printf 'password=s3nha' | delonix secret create db-pass --from-env-file -

Expor um container à internet pública (sem conta, sem router)

delonix container run -d --name web --expose 80 nginx
delonix net tunnel expose --provider pinggy --local-port 8080

tunnel/tunnel-8080: running — https://oxipg-197-148-40-67.free.pinggy.net

NAS partilhado por vários tenants, cada um com a sua quota

delonix storage create nas --type nfs --server 10.0.0.5 --share /pool/data
delonix sharevolume apply -f sharevolume.yaml

microVM com cloud-init

delonix vm create node1 --disk base.qcow2 --ssh-key @~/.ssh/id_ed25519.pub

Cluster Kubernetes do zero

delonix cluster kubeadm --name lab --control-plane 1 --workers 2

Aplicar um manifesto inteiro

delonix stack apply -f delonix-manifest.yaml

Persistir os containers no arranque

delonix net boot enable

Recuperar espaço (GC)

delonix system prune

Todos os grupos

`delonix container`

Comando	O que faz
`container dash`	Dashboard (KPIs + table + problems) of the containers — interactive TUI, or `--once` for a text snapshot
`container init`	Initialize a project with a Delonixfile + manifest — files ALREADY FILLED IN (images included), ready to use without editing anything
`container run`	Run a container from an image (pulls it if missing)
`container ps`	List containers [alias: ls]
`container start`	(Re)start stopped/crashed containers, reusing the persistent rootfs (writes made inside the container survive, like in docker) and the same network/ports/volumes as the original `run`. Always detached
`container stop`	Stop one or more containers (SIGTERM, then SIGKILL)
`container kill`	Send a signal to one or more containers (default SIGKILL) — unlike `stop`, does not wait or force a `Stopped` status: the real outcome (e.g. `Crashed` for a `KILL`) is picked up on the next observation
`container wait`	Block until one or more containers exit, then print their exit code (one per line, in the order given)
`container restart`	Stop then start one or more containers (reuses the persistent rootfs and the original run configuration, like `start`)
`container rename`	Give a container a new name
`container port`	Published ports of a container (`hostPort/proto -> containerPort`)
`container rm`	Remove one or more containers
`container pause`	Suspend a container's processes (cgroup v2 freezer) — the state stays in memory, unlike `stop`. Resume with `unpause`
`container unpause`	Resume a container suspended with `pause`
`container commit`	Create an image from a container's CURRENT rootfs state (whatever was written inside becomes a new layer)
`container ssh`	Interactive shell inside a container (shortcut for `exec -t`): with no command, it tries `bash` and falls back to `sh`, which exists in any image
`container healthcheck`	Run the image's `HEALTHCHECK` inside the container. Exits with 1 if `unhealthy` — usable in a script/CI
`container top`	Processes running inside a container (read from `cgroup.procs`)
`container diff`	Files changed relative to the image: `A` = created/changed, `D` = deleted
`container cp`	Copy files between the host and a container. Exactly one side is `container:/path` (e.g. `delonix container cp web:/etc/nginx.conf .`)
`container exec`	Execute a command inside a running container
`container inspect`	Show the full spec of one or more containers (Store JSON)
`container describe`	Human-readable detail of one or more containers, `kubectl describe`-style (for humans; use `inspect` for script-consumable JSON)
`container update`	Reconfigure a RUNNING container without stopping it — ports, volumes, networks, and bandwidth cap
`container stats`	Resource usage (CPU/memory/PIDs) of the running containers — one sample and exits (no stream). With no IDs, shows all running ones
`container logs`	Show the logs (detached containers)
`container attach`	Re-attach to a running container's output stream (same log file `logs -f` reads). Unlike `docker attach`, this is OUTPUT-ONLY: a detached container's stdin has nowhere to go (this engine keeps no live conduit to it once started, unlike a persistent per-container shim) — `-i`/`--stdin` is refused with a clear error instead of silently doing nothing
`container apply`	Apply the `kind: Container` documents of a manifest (idempotent by name — an existing container with that name is neither recreated nor checked for spec drift, see `cmd::manifest`)

`delonix workload`

Comando	O que faz
`workload ls`	List all workloads — containers AND VMs — in one table (or `-o json`)
`workload describe`	Describe a workload by name (routed to the owning backend, kubectl-style)
`workload stop`	Stop a workload by name (routed to the owning backend)
`workload rm`	Remove a workload by name

`delonix pod`

Comando	O que faz
`pod create`	Create a pod (N containers sharing a netns) from a manifest (`kind: Pod`)
`pod ls`	List the pods (derived from container labels)
`pod describe`	Details of one or more pods (containers + the shared IP), `kubectl` style
`pod rm`	Remove a pod: stop/remove ALL its containers + the shared netns
`pod logs`	Logs of a pod's container (defaults to the first member)

`delonix image`

Comando	O que faz
`image dash`	Dashboard (KPIs + table) of images — interactive TUI, or `--once` snapshot
`image pull`	Pull an image from a registry. With `--vm`, no argument = the OFFICIAL Delonix golden VM image
`image ls-remote`	(only with `--vm`) List the tags available in a remote OCI repository — with no argument, the OFFICIAL Delonix golden image repo
`image ls`	List local images
`image describe`	Human-readable detail of one or more images, `kubectl describe`-style (tags/digest/size/layers + the OCI config: entrypoint/cmd/env/workdir). With `--vm`, describes golden VM images
`image tag`	Give another name/tag to a local image (copies nothing — it's just a new name for the same content)
`image history`	Layers of an image (digest + size), from base to top
`image verify`	Verify the cosign signature of a local image against a public key
`image scan`	SBOM + CVE scan of an image (reads the layers from the CAS, without running anything). Pulls the image if missing. See `--sbom`, `--fail-on`, `--update`
`image rm`	Remove a local image
`image export`	Export an OCI runtime bundle (rootfs + config.json) for `runc`/`crun`
`image save`	Save an image to a portable archive (`docker save`'s counterpart) — the way to move an image to another machine with no registry. The archive is an OCI layout WITH the legacy `manifest.json`, so `delonix image load`, `docker load`, `podman load` and `ctr images import` all read it
`image load`	Load an image from an archive produced by `delonix image save`, `docker save` or `podman save` (the counterpart of `save`)
`image apply`	Apply the `kind: Image` documents of a manifest (`pull` idempotent by reference; `build` rebuilds and replaces the tag on each apply)
`image login`	Authenticate to an OCI registry (stores the credentials in `<root>/auth.json`, docker/podman format). The password ALWAYS comes from stdin — never from an argument (it would end up in the shell history and in /proc)
`image logout`	Remove the stored credentials of a registry
`image vm`	Golden VM images (`<root>/vm-images/`): ls/pull/push/build. Equivalent to `image --vm <cmd>` (old form, kept)
`image push`	Publish a local image to an OCI registry. Without `target`, publishes under the image's own reference. With `--vm`, `target` is required
`image init`	(only with `--vm`) Build the golden VM image (Ubuntu + kubeadm/kubelet/ kubectl + `delonix-cri`). Scaffold a `VMfile` (and a cloud-init) for building your own image
`image build`

`delonix build`

Constrói uma imagem a partir de um Dockerfile ou Delonixfile.

`delonix vm`

Comando	O que faz
`vm dash`	Dashboard (KPIs + table) of the VMs — interactive TUI, or `--once` snapshot
`vm init`	Bootstrap a project with a VM manifest — files ALREADY FILLED IN (images included), ready to use without editing anything
`vm create`	Create (or auto-recover) a VM
`vm build`	Build a qcow2 VM image from a `VMfile`
`vm pull`	Pull a golden VM image from an OCI registry — with no argument, the OFFICIAL Delonix image (ready for `vm create`/`cluster kubeadm`)
`vm ls-remote`	List the tags available in a remote OCI repository — with no argument, the OFFICIAL Delonix golden image repo (discover which k8s versions are published before `pull`)
`vm push`	Push a local golden VM image to an OCI registry (`vm push <name> <target>`)
`vm ls`	List the VMs
`vm console`	Attach to the VM's serial console (interactive terminal) — works with no IP (boot logs, login). Escape: Ctrl-]
`vm vnc`	Print the VNC address of a graphical VM (created with `--vnc`, libvirt)
`vm status`	Current state (reconciles liveness/IP with the backend)
`vm reach`
`vm bridge`	EXPERIMENTAL (root): give a libvirt VM DIRECT IP reachability to a container SDN network (veth from the host into the holder netns + routes). Defaults to a DRY-RUN; add `--apply` (as root) to establish it
`vm unbridge`	Tear down a `vm bridge` (dry-run without `--apply`)
`vm describe`	Human-readable detail of one or more VMs, `kubectl describe` style (for humans; use `status` for the usual compact view). Includes the LIVE state — `delonix_vm::status` reconciles liveness/IP with the backend
`vm stop`	Stop the VM (preserves disk/record)
`vm start`	Start an existing, stopped VM — idempotent (already running = no-op). Reboots with the base disk/vcpus/memory/network/backend recorded at its last `create`/`start`, reusing the same overlay (disk state preserved). Does NOT restore anything that only ever existed as a `vm create` flag (custom kernel/seed/volumes/static IP/VNC/advanced libvirt knobs) — a VM using those needs the original `vm create` invocation instead (also idempotent/auto-heal)
`vm restart`	Stop (if running) then start — always a real reboot, unlike `start`. Same recovered-fields limits as `start`
`vm rm`	Remove the VM (stops + deletes overlay/state)
`vm snapshot`	Take a named snapshot (libvirt: a running VM's snapshot is a system checkpoint — memory + disk; `restore` reverts to it). Not yet supported on the cloud-hypervisor backend
`vm restore`	Revert the VM to a named snapshot
`vm snapshots`	List the VM's snapshots
`vm apply`	Apply the `kind: Vm` documents of a manifest (`delonix_vm::create` is already idempotent by name — creates or auto-recovers)

`delonix volumes`

Comando	O que faz
`volumes create`	Create a named volume
`volumes ls`	List the volumes
`volumes inspect`	Details of a volume (includes real on-disk usage)
`volumes describe`	Readable detail of one or more volumes, `kubectl describe` style (for humans; use `inspect` for the usual compact view)
`volumes rm`	Remove a volume. Refuses while a container or a `kind: ShareVolume` still references it (use `--force` to remove it anyway)
`volumes apply`	Apply the `kind: Volume` documents from a manifest (idempotent by name)
`volumes snapshot`	Point-in-time snapshots of a volume (tar.gz under the volume; safe in rootless)

`delonix network`

Comando	O que faz
`network dash`	Dashboard (KPIs + table) of the networks — interactive TUI, or `--once` snapshot
`network ls`	List the networks
`network node`	WireGuard identity of THIS node, for the encrypted VXLAN overlay between nodes (`network create --driver overlay`). The private key stays 0600 in `<root>/wg/node.key`; the public one is what you hand out to the peers
`network create`	Create a network
`network inspect`	Detail of a network
`network describe`	Readable detail of one or more networks, `kubectl describe` style (for humans; use `inspect` for the usual compact view)
`network rm`	Remove a network
`network apply`	Apply the `kind: Network` documents of a manifest (idempotent by name)

`delonix stack`

Comando	O que faz
`stack init`	Initializes a COMPLETE project: Delonixfile + manifest + cluster + README — files ALREADY FILLED IN (images included), ready to use without editing anything
`stack apply`	Applies all the manifest Kinds (Network → Volume → Image → Vm → Container)
`stack ls`	Stack detail in `kubectl describe` style: each resource DECLARED in the manifest and whether or not it is present on the machine
`stack describe`
`stack validate`	Validates the manifest WITHOUT touching anything (dry-run): resolves the cross-references (`Container.network`/`.volumes`, `Vm.network`, `Ingress/Egress. target`) against what the manifest declares PLUS what already exists in the stores. Exits with an error if any reference is left unresolved — it is the safety net against an `apply` that would only fail halfway through (fail-fast, no rollback)

`delonix compose`

Comando	O que faz
`compose up`	Creates/starts every service — build, then network, then volume, then containers in `depends_on` order (gated on the declared condition)
`compose down`	Removes every container this project's `up` created (and, with `-v`, its named volumes). Networks/volumes marked `external: true` are NEVER removed
`compose ps`	Containers of this project (derived from labels)
`compose logs`	Logs of one service (default: every service, one after another)
`compose config`	Validates and prints the resolved project, without creating anything (`docker compose config` equivalent)

`delonix cluster`

Comando	O que faz
`cluster init`	Initialize a project with the cluster manifests (kind/vm/ssh) — files ALREADY FILLED IN (images included), ready to use without editing anything
`cluster create`	Create a local Kubernetes cluster without a manifest and without Docker (native kind mode): starts the `kindest/node` nodes in the Delonix engine itself and bootstraps them with `kubeadm`. No flags = 1 control-plane ready to use
`cluster ls`	List the clusters and the state of their nodes [alias: list]
`cluster delete`	Remove a kind-mode cluster (stops and deletes the nodes + kubeconfig)
`cluster load`	Load local images into a kind-mode cluster's nodes, without a registry (the equivalent of `kind load docker-image`): packs each image from the local store and imports it into every running node's containerd
`cluster kube`	Generate a Kubernetes manifest from a container/pod already running locally (`kube generate`) — the "ran it locally, now give me the YAML for k8s" path (equivalent to `podman generate kube`)
`cluster apply`	Apply the `kind: Cluster` document(s) of a manifest
`cluster kubeadm`	Provision VMs (golden VM image) + `kubeadm` bootstrap — from zero to a working cluster, without writing a manifest by hand

`delonix secret`

Comando	O que faz
`secret create`	Create/replace a secret from literals and/or a `.env` file
`secret ls`	List the secrets (name + number of keys; values NEVER shown)
`secret inspect`	Show the keys of a secret (values redacted, unless `--reveal`)
`secret set`	Set/update keys in a secret (creates it if it does not exist)
`secret unset`	Remove a key from a secret (or the whole secret with `--all`)
`secret rm`	Remove a secret
`secret rotate-key`	Rotate the host master key: re-encrypt ALL secrets with a new key. The values are preserved
`secret apply`	Apply the `kind: Secret` documents from a manifest (declarative — creates the secret without needing `secret create` on the CLI)

`delonix storage`

Comando	O que faz
`storage dash`	Storage/volumes dashboard (KPIs + table) — TUI, or `--once` snapshot
`storage create`	Create (and mount) a network storage
`storage ls`	List the network storages (volumes with a network driver)
`storage inspect`	Details of a storage
`storage rm`	Remove (and unmount) a storage. The DATA stays on the NAS — only the local mount is torn down, like docker
`storage apply`	Apply the `kind: Storage` documents from a manifest

`delonix sharevolume`

Comando	O que faz
`sharevolume apply`	Apply the `kind: ShareVolume` documents of a manifest (idempotent)
`sharevolume ls`	List share volumes (parent storage, quota, live usage)
`sharevolume describe`	Human-readable detail of one share volume
`sharevolume rm`	Un-register a share volume. The underlying data (a subdirectory of the parent Storage) is PRESERVED unless `--purge-data` is passed

`delonix net ingress`

Comando	O que faz
`net ingress allow`	Allow inbound traffic to a container: `[proto/]port` from an optional CIDR
`net ingress deny`	Deny inbound traffic to a container (same shape as `allow`)
`net ingress policy`	Set the default inbound policy when no rule matches
`net ingress publish`	Publish a host port to the container (DNAT through the ingress)
`net ingress unpublish`	Remove a published host port
`net ingress ls`	Show the inbound firewall (policy + rules) and published ports
`net ingress rm`	Remove inbound rule(s) matching `[proto/]port` (all protos if none given)
`net ingress clear`	Remove all inbound rules (keeps published ports)

`delonix net egress`

Comando	O que faz
`net egress allow`	Allow outbound traffic from a container: `[proto/]port` to an optional CIDR
`net egress deny`	Deny outbound traffic from a container (same shape as `allow`)
`net egress policy`	Set the default outbound policy when no rule matches
`net egress net`	Govern a whole network's egress to the Internet
`net egress host`	Allow a network's egress to a HOSTNAME (and `*.hostname`), learnt live from DNS answers — the FQDN allowlist nft/CIDR can't express. Repeatable
`net egress ls`	Show the outbound firewall (policy + rules)
`net egress rm`	Remove outbound rule(s) matching `[proto/]port` (all protos if none given)
`net egress show`	Show a NETWORK's egress policy: CIDR allowlist, FQDN hosts, and the IPs currently learnt from DNS for those hosts
`net egress clear`	Remove all outbound rules

`delonix net httproute`

Comando	O que faz
`net httproute ls`	State of the proxy + active routes (from the config in effect)
`net httproute apply`	Apply the HTTPRoutes of a manifest (brings up/reloads the proxy)
`net httproute rm`	Stop the proxy and unpublish the ports (teardown)

`delonix net tunnel`

Comando	O que faz
`net tunnel apply`	Apply the `kind: Tunnel` documents of a manifest (idempotent)
`net tunnel expose`	One-shot expose of a local port, no manifest needed
`net tunnel ls`	List tunnels (state + public URL)
`net tunnel describe`	Human-readable detail of one tunnel
`net tunnel rm`	Stop and remove a tunnel

`delonix net flow`

Tráfego por-container ao vivo — datapath eBPF (degrada para contadores veth).

`delonix net boot`

Comando	O que faz
`net boot enable`	Install + enable systemd units for the RUNNING containers, so they come back up when the host boots. Rootless uses user units + linger
`net boot disable`	Disable + remove the generated boot units
`net boot status`	Show boot-persistence status (installed units + mode)

`delonix system`

Comando	O que faz
`system events`	Engine events (create/start/die/remove/…), from oldest to most recent. With no daemon, the log is a shared append-only file — each command appends its own line (see `delonix_runtime_core::events`)
`system info`	Engine state: rootless?, cgroup delegation, network infra, counts
`system setup`	Diagnose — and, with `--delegate`, fix — cgroup delegation, the prerequisite for `--memory`/`--cpus`/`--pids-limit` to mean anything
`system df`	Disk usage by area (images, containers, volumes, VM images)
`system virt`	Host virtualization: hypervisor, KVM, virtio — and what there is to tune
`system prune`	Reclaim space: remove stopped containers, unused images, CAS blobs nobody references, empty cgroups and — the biggest space saver — orphan container directories (from nodes/containers that died abruptly without `rm`, with no registry entry)
`system monitor`	Active network connections per container (via conntrack): who comes in, who goes out, and between containers. Refreshes continuously (see `--no-stream`)
`system thermal`	Thermal governor: lowers Delonix's CPU budget when the CPU heats up and restores it when it cools down. Runs continuously (see `--once`)

`delonix dash`

Dashboard de resumo/KPIs (TUI estilo htop) — RAM/rede/disco, uptime por-container, JSON e Prometheus.

`delonix serve docker-api`

Fatia da API Docker Engine, num socket unix — ciclo de vida completo de um container, não só leitura.

`delonix cluster kube`

Comando	O que faz
`cluster kube generate`	Generates a `kind: Pod` from a container (or from every member of a pod) and prints it to stdout

`delonix net netns`

Comando	O que faz
`net netns up`	Bring the ingress infra up (idempotent): holder netns + delonix0 + single slirp
`net netns status`	Show the ingress infra status (holder/slirp pids, bridge, refcount)
`net netns down`	Force tear-down of the ingress infra (kills slirp + holder, frees the netns)
`net netns attach`	Attach a netns to delonix0 via veth (the holder is the netns/veth factory)
`net netns detach`	Detach (and destroy) a previously attached netns
`net netns exec`	Run a command inside an attached netns (exercises the runtime join path)
`net netns publish`	Publish a port through the ingress (add_hostfwd + DNAT) to a container
`net netns unpublish`	Unpublish a host port from the ingress
`net netns firewall`	Apply (or clear) a container's parameterizable firewall AT THE INGRESS

`delonix completion`

Autocompletion dinâmico para bash, zsh, fish, elvish e powershell.

`delonix serve cri`

Serve o endpoint CRI (runtime.v1) num socket unix.

Global

--l18n en|pt — idioma da saída (EN por omissão; pt para pt_AO). $DELONIX_ROOT — raiz do estado. delonix completion <shell> — autocompletion.