delonix image

Usage: dlx image [OPTIONS] <COMMAND>

Commands:
  dash       Dashboard (KPIs + table) of images — interactive TUI, or `--once` snapshot
  pull       Pull an image from a registry. With `--vm`, no argument = the OFFICIAL Delonix golden VM image
  ls-remote  (only with `--vm`) List the tags available in a remote OCI repository — with no argument, the OFFICIAL Delonix golden image repo
  ls         List local images
  describe   Human-readable detail of one or more images, `kubectl describe`-style (tags/digest/size/layers + the OCI config: entrypoint/cmd/env/workdir). With `--vm`, describes golden VM images
  tag        Give another name/tag to a local image (copies nothing — it's just a new name for the same content)
  history    Layers of an image (digest + size), from base to top
  verify     Verify the cosign signature of a local image against a public key
  scan       SBOM + CVE scan of an image (reads the layers from the CAS, without running anything). Pulls the image if missing. See `--sbom`, `--fail-on`, `--update`
  rm         Remove a local image
  export     Export an OCI runtime bundle (rootfs + config.json) for `runc`/`crun`
  save       Save an image to a portable archive (`docker save`'s counterpart) — the way to move an image to another machine with no registry. The archive is an OCI layout WITH the legacy `manifest.json`, so `delonix image load`, `docker load`, `podman load` and `ctr images import` all read it
  load       Load an image from an archive produced by `delonix image save`, `docker save` or `podman save` (the counterpart of `save`)
  apply      Apply the `kind: Image` documents of a manifest (`pull` idempotent by reference; `build` rebuilds and replaces the tag on each apply)
  login      Authenticate to an OCI registry (stores the credentials in `<root>/auth.json`, docker/podman format). The password ALWAYS comes from stdin — never from an argument (it would end up in the shell history and in /proc)
  logout     Remove the stored credentials of a registry
  vm         Golden VM images (`<root>/vm-images/`): ls/pull/push/build. Equivalent to `image --vm <cmd>` (old form, kept)
  push       Publish a local image to an OCI registry. Without `target`, publishes under the image's own reference. With `--vm`, `target` is required
  init       (only with `--vm`) Build the golden VM image (Ubuntu + kubeadm/kubelet/ kubectl + `delonix-cri`). Scaffold a `VMfile` (and a cloud-init) for building your own image
  build      
  help       Print this message or the help of the given subcommand(s)

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --vm            Operate on VM images (`<root>/vm-images/`) instead of container images — enables the `push`/`build` subcommands
  -h, --help          Print help

Usage: dlx image init [OPTIONS] [NAME]

Arguments:
  [NAME]  Name to use in the scaffold (image tag, hostname, account) [default: myimage]

Options:
  -d, --dir <DIR>     Where to write it (default: the current directory)
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --force         Overwrite an existing `VMfile`
  -h, --help          Print help

Usage: dlx image vm [OPTIONS] <COMMAND>

Commands:
  ls         List the local VM images
  describe   Human-readable detail of one or more VM images, `kubectl describe`-style
  pull       Fetch a VM image from an OCI registry (single-blob artifact) — with no argument, the OFFICIAL Delonix image
  ls-remote  List the tags available in a remote OCI repository — with no argument, the OFFICIAL Delonix golden image repo (discover which k8s versions are published before `pull`/`--k8s-version`)
  push       Publish a local VM image to an OCI registry
  init       Build the golden VM image (Ubuntu + kubeadm/kubelet/kubectl + `delonix-cri`). Scaffold a `VMfile` (and a cloud-init) for building your own image
  build      
  help       Print this message or the help of the given subcommand(s)

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Usage: dlx image logout [OPTIONS] <REGISTRY>

Arguments:
  <REGISTRY>  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Usage: dlx image login [OPTIONS] --username <USERNAME> <REGISTRY>

Arguments:
  <REGISTRY>  Registry (e.g. `ghcr.io`, `docker.io`)

Options:
      --l18n <en|pt>         Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -u, --username <USERNAME>  
      --password-stdin       Read the password/token from stdin (the only supported way)
  -h, --help                 Print help

Usage: dlx image load [OPTIONS] --input <FILE>

Options:
  -i, --input <FILE>  Archive to read (`.tar`; a `.tar.gz` must be gunzipped first)
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Usage: dlx image save [OPTIONS] --output <FILE> <IMAGE>

Arguments:
  <IMAGE>  

Options:
      --l18n <en|pt>   Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -o, --output <FILE>  Destination file. Use `-o /dev/stdout` to pipe (e.g. into `gzip`)
  -h, --help           Print help

Usage: dlx image scan [OPTIONS] [IMAGE]

Arguments:
  [IMAGE]  Image to scan (optional with `--update`)

Options:
      --l18n <en|pt>         Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --sbom                 List the SBOM (installed packages) instead of scanning
      --fail-on <SEV>        Fail (exit 1) if there are vulnerabilities >= this severity (low|medium|high|critical) — gate for CI
      --update               Sync the CVE feed to the local database (used afterwards by each scan)
      --feed <URL|FICHEIRO>  Feed source for `--update`: URL or file (or $DELONIX_ADVISORY_FEED)
  -h, --help                 Print help

Usage: dlx image verify [OPTIONS] <IMAGE> <PEM>

Arguments:
  <IMAGE>  
  <PEM>    Public key in PEM

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Usage: dlx image history [OPTIONS] <IMAGE>

Arguments:
  <IMAGE>  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Usage: dlx image tag [OPTIONS] <SOURCE> <TARGET>

Arguments:
  <SOURCE>  
  <TARGET>  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Usage: dlx image describe [OPTIONS] <NAMES>...

Arguments:
  <NAMES>...  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Usage: dlx image ls-remote [OPTIONS] [SOURCE]

Arguments:
  [SOURCE]  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --no-k8s        With no argument, list the official NO-Kubernetes golden's repo instead of the Kubernetes one
  -h, --help          Print help

Usage: dlx image dash [OPTIONS]

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --once          
      --json          
  -h, --help          Print help

Usage: dlx image pull [OPTIONS] [IMAGE]

Arguments:
  [IMAGE]  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
      --verify <PEM>  Verify the cosign signature with this public key (PEM) AFTER the pull, and fail if it does not match. Without this, a pull is not authenticated beyond the registry's own digest
      --no-k8s        (only with `--vm`) With no argument, pull the official NO-Kubernetes golden instead of the Kubernetes one
  -h, --help          Print help

Usage: dlx image ls [OPTIONS]

Options:
      --l18n <en|pt>     Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -o, --output <OUTPUT>  Output format: `table` (default) or `json` (ADR-0005). Works for both `image ls` and `image --vm ls` [default: table] [possible values: table, json]
  -h, --help             Print help

Usage: dlx image rm [OPTIONS] <IMAGE>

Arguments:
  <IMAGE>  

Options:
  -f, --force         Remove it even if a container still uses it
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Usage: dlx image export [OPTIONS] <IMAGE> <DIR>

Arguments:
  <IMAGE>  
  <DIR>    

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Usage: dlx image push [OPTIONS] <NAME> [TARGET]

Arguments:
  <NAME>    
  [TARGET]  

Options:
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help

Usage: dlx image build [OPTIONS] --tag <TAG> [CONTEXT]

Arguments:
  [CONTEXT]  Build context — the directory `COPY` reads from [default: .]

Options:
      --l18n <en|pt>
          Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -t, --tag <TAG>
          
  -f, --file <FILE>
          Build from a `VMfile` instead of the built-in golden recipe
      --distro <DISTRO>
          [default: ubuntu] [possible values: ubuntu, debian, rocky]
      --ubuntu-release <UBUNTU_RELEASE>
          [default: 26.04]
      --debian-release <DEBIAN_RELEASE>
          [default: bookworm]
      --rocky-release <ROCKY_RELEASE>
          [default: 9]
      --k8s-version <K8S_VERSION>
          
      --extra-package <EXTRA_PACKAGES>
          
      --extra-run <EXTRA_RUN>
          
      --cri-bin <CRI_BIN>
          
      --no-compress
          Do not compress the final qcow2 (larger, but with no decompression cost on backing-file reads at runtime)
      --network
          Give the guest network access during `RUN` — VMfile builds only. The golden recipe already decides this with `--offline`
      --offline
          Fetch the k8s .deb packages on the HOST (verified) and install them with `dpkg` — the appliance runs without network. No DHCP/DNS needed in the guest
      --no-k8s
          Build a golden image with NO Kubernetes — just `delonix` itself
      --delonix-bin <DELONIX_BIN>
          
  -h, --help
          Print help

Usage: dlx image apply [OPTIONS]

Options:
  -f, --file <FILE>   
      --l18n <en|pt>  Output language: `en` (default) or `pt` (Portuguese, pt_AO). Also settable via `$DELONIX_L18N`. Global — works before any subcommand
  -h, --help          Print help