Cloud Providers gate
204 allow
211 ask
4 block
The largest gate. Cloud-provider CLIs and container orchestration. AWS uses an action_prefix pattern (every describe-* / list-* / get-* is allow; create-* / delete-* / put-* ask). kubectl, terraform, docker, podman, helm, and pulumi each have their own subcommand maps.
Showing all 419 rules.
Blocked
rules/cloud.toml#block 4 patternsaws iam delete-user
Block
Blocked:
aws iam delete-user removes an IAM identity. Detach policies and rotate access keys via individual commands instead.aws organizations delete
Block
Blocked:
aws organizations delete-* removes organization-level entities (accounts, OUs, policies). Effects span the whole org and are hard to reverse.kubectl delete namespace kube-system
Block
Refusing to delete the
kube-system namespace. It hosts core cluster services; deleting it breaks the cluster.kubectl delete ns kube-system
Block
Refusing to delete the
kube-system namespace. It hosts core cluster services; deleting it breaks the cluster.Allowed · inspection
rules/cloud.toml#allow 204 patternsaws --version
Allow
Prints the AWS CLI version. Read-only.
aws help
Allow
Shows AWS CLI help text. Read-only.
aws s3 ls
Allow
Lists S3 buckets or objects under a prefix. Read-only.
aws sts get-caller-identity
Allow
Reports the IAM identity of the current credentials (account, ARN, user ID). Read-only.
aws sts get-session-token
Allow
Returns temporary session credentials for the current identity. Read-only call; the returned token grants the same access until it expires.
aws configure list
Allow
Shows the resolved CLI configuration (profile, region, credential source). Read-only; values are masked.
aws describe-*
Allow
AWS describe-* operation: reads the configuration or state of a resource. Read-only.
aws list-*
Allow
AWS list-* operation: enumerates resources in the account/region. Read-only.
aws get-*
Allow
AWS get-* operation: fetches an attribute, object, or value. Read-only.
aws head-*
Allow
AWS head-* operation: fetches metadata only (e.g. S3 object headers) without the body. Read-only.
aws query-*
Allow
AWS query operation: reads items from a table or index (e.g. DynamoDB query). Read-only.
aws scan-*
Allow
AWS scan operation: reads across a whole table or index (e.g. DynamoDB scan). Read-only; can consume significant read capacity on large tables.
aws filter-*
Allow
AWS filter-* operation: reads a filtered view of events or records (e.g. CloudWatch Logs filter). Read-only.
az --version
Allow
Prints the Azure CLI version and component versions. Read-only.
az --help
Allow
Shows Azure CLI help text. Read-only.
az -h
Allow
Shows Azure CLI help text. Read-only.
docker ps
Allow
Docker ps: lists running (or with
-a, all) containers. Read-only.docker images
Allow
Docker images: lists local images. Read-only.
docker inspect
Allow
Docker inspect: prints the low-level config of a container, image, or other object. Read-only.
docker logs
Allow
Docker logs: prints or streams a container's stdout/stderr. Read-only.
docker stats
Allow
Docker stats: shows live CPU/memory/IO usage per container. Read-only.
docker top
Allow
Docker top: lists the processes running inside a container. Read-only.
docker port
Allow
Docker port: shows the published port mappings for a container. Read-only.
docker version
Allow
Docker version: prints client and daemon versions. Read-only.
docker info
Allow
Docker info: prints daemon-wide configuration and resource counts. Read-only.
docker history
Allow
Docker history: shows the layer history of an image. Read-only.
docker -v
Allow
Prints the Docker version. Read-only.
docker --version
Allow
Prints the Docker version. Read-only.
docker -h
Allow
Shows Docker help text. Read-only.
docker --help
Allow
Shows Docker help text. Read-only.
docker network ls
Allow
Docker network ls: lists Docker networks. Read-only.
docker network list
Allow
Docker network list: lists Docker networks. Read-only.
docker network inspect
Allow
Docker network inspect: prints a network's config and attached containers. Read-only.
docker volume ls
Allow
Docker volume ls: lists Docker volumes. Read-only.
docker volume list
Allow
Docker volume list: lists Docker volumes. Read-only.
docker volume inspect
Allow
Docker volume inspect: prints a volume's config and mountpoint. Read-only.
docker system df
Allow
Docker system df: reports disk usage by images, containers, volumes, and cache. Read-only.
docker system info
Allow
Docker system info: prints daemon-wide configuration and resource counts. Read-only.
docker buildx ls
Allow
Docker buildx ls: lists builder instances and their nodes. Read-only.
docker buildx inspect
Allow
Docker buildx inspect: prints a builder's config and status. Read-only.
docker buildx version
Allow
Prints the buildx plugin version. Read-only.
docker scout quickview
Allow
Docker Scout quickview: prints a vulnerability summary for an image. Read-only.
docker scout cves
Allow
Docker Scout cves: lists known CVEs in an image. Read-only.
docker scout recommendations
Allow
Docker Scout recommendations: suggests base-image and dependency updates for an image. Read-only.
docker scout compare
Allow
Docker Scout compare: diffs the vulnerability profile of two images. Read-only.
docker context ls
Allow
Docker context ls: lists Docker contexts and marks the active one. Read-only.
docker context list
Allow
Docker context list: lists Docker contexts and marks the active one. Read-only.
docker context show
Allow
Docker context show: prints the name of the active context. Read-only.
docker context inspect
Allow
Docker context inspect: prints a context's endpoint config. Read-only.
docker manifest inspect
Allow
Docker manifest inspect: prints a manifest list or image manifest from a registry. Read-only.
docker image ls
Allow
Docker image ls: lists local images. Read-only.
docker image list
Allow
Docker image list: lists local images. Read-only.
docker image inspect
Allow
Docker image inspect: prints an image's low-level config. Read-only.
docker image history
Allow
Docker image history: shows the layer history of an image. Read-only.
docker container ls
Allow
Docker container ls: lists running (or with
-a, all) containers. Read-only.docker container list
Allow
Docker container list: lists running (or with
-a, all) containers. Read-only.docker container inspect
Allow
Docker container inspect: prints a container's low-level config. Read-only.
docker container logs
Allow
Docker container logs: prints or streams a container's stdout/stderr. Read-only.
docker container top
Allow
Docker container top: lists the processes running inside a container. Read-only.
docker container stats
Allow
Docker container stats: shows live CPU/memory/IO usage per container. Read-only.
docker compose ps
Allow
Compose ps: lists the containers for the current compose project. Read-only.
docker compose logs
Allow
Compose logs: prints or streams logs from the project's service containers. Read-only.
docker compose config
Allow
Compose config: renders the fully-resolved compose file to stdout. Read-only.
docker compose images
Allow
Compose images: lists the images used by the project's services. Read-only.
docker compose ls
Allow
Compose ls: lists running compose projects. Read-only.
docker compose version
Allow
Prints the Compose plugin version. Read-only.
docker compose top
Allow
Compose top: lists the processes running in the project's service containers. Read-only.
docker-compose ps
Allow
Compose ps: lists the containers for the current compose project. Read-only.
docker-compose logs
Allow
Compose logs: prints or streams logs from the project's service containers. Read-only.
docker-compose config
Allow
Compose config: renders the fully-resolved compose file to stdout. Read-only.
docker-compose images
Allow
Compose images: lists the images used by the project's services. Read-only.
docker-compose ls
Allow
Compose ls: lists running compose projects. Read-only.
docker-compose version
Allow
Prints the Compose version. Read-only.
docker-compose -h
Allow
Shows Compose help text. Read-only.
docker-compose --help
Allow
Shows Compose help text. Read-only.
gcloud config list
Allow
Shows the active gcloud configuration (account, project, region/zone). Read-only.
gcloud config get-value
Allow
Prints a single gcloud config value (e.g.
project, account). Read-only.gcloud auth list
Allow
Lists credentialed accounts and marks the active one. Read-only.
gcloud auth describe
Allow
Shows details of a credentialed account (token status, scopes). Read-only.
gcloud projects list
Allow
Lists GCP projects the active account can see. Read-only.
gcloud projects describe
Allow
Shows metadata for a project (number, state, labels). Read-only.
gcloud compute instances list
Allow
Lists Compute Engine VMs in the project. Read-only.
gcloud compute instances describe
Allow
Shows the configuration and status of a VM. Read-only.
gcloud compute zones list
Allow
Lists available Compute Engine zones. Read-only.
gcloud compute regions list
Allow
Lists available Compute Engine regions and quotas. Read-only.
gcloud compute machine-types list
Allow
Lists available machine types per zone. Read-only.
gcloud container clusters list
Allow
Lists GKE clusters in the project. Read-only.
gcloud container clusters describe
Allow
Shows the configuration and status of a GKE cluster. Read-only.
gcloud storage ls
Allow
Lists Cloud Storage buckets or objects under a prefix. Read-only.
gcloud storage cat
Allow
Streams the contents of a Cloud Storage object to stdout. Read-only.
gcloud functions list
Allow
Lists Cloud Functions in the project. Read-only.
gcloud functions describe
Allow
Shows the configuration and status of a Cloud Function. Read-only.
gcloud functions logs
Allow
Reads execution logs for a Cloud Function. Read-only.
gcloud run services list
Allow
Lists Cloud Run services in the project. Read-only.
gcloud run services describe
Allow
Shows the configuration, revisions, and traffic split of a Cloud Run service. Read-only.
gcloud sql instances list
Allow
Lists Cloud SQL instances in the project. Read-only.
gcloud sql instances describe
Allow
Shows the configuration and status of a Cloud SQL instance. Read-only.
gcloud logging read
Allow
Reads log entries from Cloud Logging. Read-only.
gcloud iam list
Allow
Lists IAM resources (roles, service accounts, etc.) in the project. Read-only.
gcloud iam describe
Allow
Shows details of an IAM resource (role, service account). Read-only.
gcloud secrets list
Allow
Lists secrets in Secret Manager (names only, not payloads). Read-only.
gcloud secrets describe
Allow
Shows metadata for a secret (replication, labels). Does not reveal the payload. Read-only.
gcloud secrets versions
Allow
Lists or describes versions of a secret (state, create time). Read-only; does not print payloads.
gcloud --version
Allow
Prints the gcloud CLI version. Read-only.
gcloud help
Allow
Shows gcloud help text. Read-only.
gcloud info
Allow
Shows gcloud environment diagnostics (SDK paths, active config, account). Read-only.
helm list
Allow
Helm list: lists releases in the current namespace (or all with
-A). Read-only.helm ls
Allow
Helm ls: lists releases in the current namespace (or all with
-A). Read-only.helm get
Allow
Helm get: prints details of an installed release (values, manifest, notes, hooks). Read-only.
helm show
Allow
Helm show: prints chart metadata, values, or README from a chart. Read-only.
helm search
Allow
Helm search: searches repositories or the Artifact Hub for charts. Read-only.
helm repo list
Allow
Helm repo list: lists configured chart repositories. Read-only.
helm repo update
Allow
Helm repo update: refreshes the local index for all repos. Read-only on clusters; updates local cache files.
helm status
Allow
Helm status: prints the status of a named release. Read-only.
helm history
Allow
Helm history: lists the revision history of a release. Read-only.
helm version
Allow
Prints the Helm client version. Read-only.
helm -h
Allow
Shows Helm help text. Read-only.
helm --help
Allow
Shows Helm help text. Read-only.
helm template
Allow
Helm template: renders chart templates to stdout locally. Read-only; does not contact the cluster.
helm lint
Allow
Helm lint: checks a chart for issues and best-practice violations. Read-only.
helm verify
Allow
Helm verify: checks that a packaged chart's provenance signature is valid. Read-only.
kubectl get
Allow
kubectl get: lists or prints resources in the current context/namespace. Read-only.
kubectl describe
Allow
kubectl describe: prints detailed state and recent events for a resource. Read-only.
kubectl logs
Allow
kubectl logs: streams or prints container logs from a pod. Read-only.
kubectl top
Allow
kubectl top: shows CPU/memory usage for nodes or pods via the metrics API. Read-only.
kubectl explain
Allow
kubectl explain: prints the schema/field docs for a resource kind. Read-only.
kubectl api-resources
Allow
kubectl api-resources: lists the resource types the cluster serves. Read-only.
kubectl api-versions
Allow
kubectl api-versions: lists the API group/versions the cluster serves. Read-only.
kubectl cluster-info
Allow
kubectl cluster-info: prints the control plane and core service endpoints. Read-only.
kubectl version
Allow
kubectl version: prints client and server versions. Read-only.
kubectl -h
Allow
Shows kubectl help text. Read-only.
kubectl --help
Allow
Shows kubectl help text. Read-only.
kubectl config view
Allow
kubectl config view: prints the merged kubeconfig. Read-only; secret values are redacted unless
--raw is passed.kubectl config get-contexts
Allow
kubectl config get-contexts: lists contexts and marks the current one. Read-only.
kubectl config current-context
Allow
kubectl config current-context: prints the name of the active context. Read-only.
kubectl config get-clusters
Allow
kubectl config get-clusters: lists cluster entries in the kubeconfig. Read-only.
kubectl auth can-i
Allow
kubectl auth can-i: checks whether the current user may perform an action. Read-only.
kubectl auth whoami
Allow
kubectl auth whoami: prints the identity attributes the API server sees for the current user. Read-only.
kubectl diff
Allow
kubectl diff: shows what
apply would change by comparing the manifest against live state. Read-only.kubectl kustomize
Allow
kubectl kustomize: renders a kustomization to stdout. Read-only; does not contact the cluster.
kubectl wait
Allow
kubectl wait: blocks until a resource reaches a condition. Polls state; does not modify resources.
podman ps
Allow
Podman ps: lists running (or with
-a, all) containers. Read-only.podman images
Allow
Podman images: lists local images. Read-only.
podman inspect
Allow
Podman inspect: prints the low-level config of a container or image. Read-only.
podman logs
Allow
Podman logs: prints or streams a container's stdout/stderr. Read-only.
podman stats
Allow
Podman stats: shows live CPU/memory/IO usage per container. Read-only.
podman top
Allow
Podman top: lists the processes running inside a container. Read-only.
podman port
Allow
Podman port: shows the published port mappings for a container. Read-only.
podman version
Allow
Podman version: prints client and (where applicable) service versions. Read-only.
podman info
Allow
Podman info: prints host and storage configuration. Read-only.
podman history
Allow
Podman history: shows the layer history of an image. Read-only.
podman search
Allow
Podman search: queries configured registries for matching images. Read-only.
podman healthcheck
Allow
Podman healthcheck: runs or reports a container's configured health check. Reports status; does not modify the container.
podman -v
Allow
Prints the Podman version. Read-only.
podman --version
Allow
Prints the Podman version. Read-only.
podman -h
Allow
Shows Podman help text. Read-only.
podman --help
Allow
Shows Podman help text. Read-only.
podman network ls
Allow
Podman network ls: lists Podman networks. Read-only.
podman network list
Allow
Podman network list: lists Podman networks. Read-only.
podman network inspect
Allow
Podman network inspect: prints a network's config and attached containers. Read-only.
podman volume ls
Allow
Podman volume ls: lists Podman volumes. Read-only.
podman volume list
Allow
Podman volume list: lists Podman volumes. Read-only.
podman volume inspect
Allow
Podman volume inspect: prints a volume's config and mountpoint. Read-only.
podman system df
Allow
Podman system df: reports disk usage by images, containers, and volumes. Read-only.
podman system info
Allow
Podman system info: prints host and storage configuration. Read-only.
podman machine info
Allow
Podman machine info: prints info about the Podman machine VM environment. Read-only.
podman machine inspect
Allow
Podman machine inspect: prints a Podman machine VM's config. Read-only.
podman machine list
Allow
Podman machine list: lists Podman machine VMs and their state. Read-only.
podman pod ps
Allow
Podman pod ps: lists pods and their state. Read-only.
podman pod list
Allow
Podman pod list: lists pods and their state. Read-only.
podman pod inspect
Allow
Podman pod inspect: prints a pod's config and member containers. Read-only.
podman pod logs
Allow
Podman pod logs: prints or streams logs from a pod's containers. Read-only.
podman pod top
Allow
Podman pod top: lists the processes running across a pod's containers. Read-only.
podman pod stats
Allow
Podman pod stats: shows live resource usage for a pod's containers. Read-only.
podman secret ls
Allow
Podman secret ls: lists secret names and metadata (not values). Read-only.
podman secret list
Allow
Podman secret list: lists secret names and metadata (not values). Read-only.
podman secret inspect
Allow
Podman secret inspect: prints a secret's metadata. Does not reveal the value. Read-only.
pulumi preview
Allow
Pulumi preview: computes and prints the planned changes for the selected stack without applying them. Read-only.
pulumi whoami
Allow
Pulumi whoami: prints the currently logged-in Pulumi identity and backend. Read-only.
pulumi version
Allow
Prints the Pulumi CLI version. Read-only.
pulumi -h
Allow
Shows Pulumi help text. Read-only.
pulumi --help
Allow
Shows Pulumi help text. Read-only.
pulumi stack ls
Allow
Pulumi stack ls: lists stacks for the current project and marks the active one. Read-only.
pulumi stack list
Allow
Pulumi stack list: lists stacks for the current project and marks the active one. Read-only.
pulumi stack output
Allow
Pulumi stack output: prints the selected stack's outputs. Read-only; may expose sensitive outputs with
--show-secrets.pulumi stack history
Allow
Pulumi stack history: lists past updates for the selected stack. Read-only.
pulumi stack export
Allow
Pulumi stack export: writes the selected stack's state deployment to stdout. Read-only; exposes full state including secrets.
pulumi config get
Allow
Pulumi config get: prints a single config value for the selected stack. Read-only;
--secret values are decrypted to stdout.terraform plan
Allow
Terraform plan: computes and prints the diff between config and state without changing infrastructure. Read-only.
terraform show
Allow
Terraform show: prints the current state or a saved plan in human-readable form. Read-only.
terraform output
Allow
Terraform output: prints the values of root module outputs from state. Read-only; may expose sensitive output values.
terraform validate
Allow
Terraform validate: checks config for syntax and internal consistency. Read-only; does not touch state or providers' APIs.
terraform version
Allow
Prints the Terraform and provider versions. Read-only.
terraform providers
Allow
Terraform providers: lists the providers required by the configuration. Read-only.
terraform graph
Allow
Terraform graph: emits the dependency graph in DOT format. Read-only.
terraform -version
Allow
Prints the Terraform version. Read-only.
terraform --version
Allow
Prints the Terraform version. Read-only.
terraform -help
Allow
Shows Terraform help text. Read-only.
terraform --help
Allow
Shows Terraform help text. Read-only.
terraform state list
Allow
Terraform state list: lists the resource addresses tracked in state. Read-only.
terraform state show
Allow
Terraform state show: prints the attributes of one resource from state. Read-only; may expose sensitive values.
terraform workspace list
Allow
Terraform workspace list: lists workspaces and marks the active one. Read-only.
terraform workspace show
Allow
Terraform workspace show: prints the name of the active workspace. Read-only.
terraform fmt -check
Allow
Terraform fmt -check: reports whether
.tf files match canonical style without rewriting them. Read-only.Asks first · mutations
rules/cloud.toml#ask 211 patternsaws create-*
Ask
AWS create operation: provisions a new resource in the account. Verify region, profile, and resource type; provisioning may incur cost.
aws delete-*
Ask
AWS delete operation. Verify region, profile, and resource ID before approving; most deletions cannot be reversed.
aws put-*
Ask
AWS put operation: writes or overwrites a resource (object, item, policy, parameter). Existing values are replaced; previous content may be lost.
aws update-*
Ask
AWS update operation: changes the configuration of an existing resource. Effect is immediate; review the diff first.
aws modify-*
Ask
AWS modify operation: changes attributes of a running resource (instance type, security group, parameter). May restart or interrupt the resource.
aws remove-*
Ask
AWS remove operation: removes attached items (tags, permissions, members). Effect is immediate.
aws run-*
Ask
AWS run operation: launches resources such as EC2 instances or task definitions. Billing starts when they reach running state.
aws start-*
Ask
AWS start operation: starts a stopped resource (instance, DB, pipeline). Billing typically resumes once running.
aws stop-*
Ask
AWS stop operation: halts a running resource. Connected clients drop; storage bills usually continue.
aws terminate-*
Ask
AWS terminate operation: permanently destroys the resource (instance, workflow execution). Attached ephemeral storage is lost.
aws reboot-*
Ask
AWS reboot operation: restarts a running resource (instance, cache cluster, DB). Causes downtime during the reboot window.
aws attach-*
Ask
AWS attach operation: connects one resource to another (volume to instance, policy to role, gateway to VPC). Live traffic/state may shift.
aws detach-*
Ask
AWS detach operation: disconnects an attached resource (volume, policy, network interface). The detached side loses that access.
aws associate-*
Ask
AWS associate operation: links resources (route table to subnet, address to instance, IAM identity to provider). May reroute live traffic.
aws disassociate-*
Ask
AWS disassociate operation: unlinks resources (address from instance, route table from subnet). May break in-flight traffic.
aws enable-*
Ask
AWS enable operation: turns on a feature or service (logging, MFA, region, security control). Effect is immediate.
aws disable-*
Ask
AWS disable operation: turns off a feature or service (logging, MFA, security control). Coverage drops immediately.
aws register-*
Ask
AWS register operation: registers a target with a service (task definition, target with load balancer, domain). Becomes live to that service.
aws deregister-*
Ask
AWS deregister operation: removes a registered target (from load balancer, task definition). The target stops receiving traffic.
aws invoke-*
Ask
AWS invoke operation: executes a function or state machine (Lambda, Step Functions). Side effects run in the cloud and may incur cost.
aws publish-*
Ask
AWS publish operation: publishes a message, version, or layer (SNS, Lambda version, layer version). Subscribers/consumers see it immediately.
aws send-*
Ask
AWS send operation: dispatches a message or signal (SQS, SES, command to instance). Delivery is real-time and may cost per message.
aws tag-*
Ask
AWS tag operation: adds tags to a resource. Tags can drive billing allocation and IAM conditions; pick keys/values intentionally.
aws untag-*
Ask
AWS untag operation: removes tags from a resource. Tag-based IAM policies and cost allocation depending on those tags will stop applying.
docker buildx build
Ask
Docker buildx build: builds an image (optionally multi-arch). Pulls base images and may push if
--push is set.docker buildx create
Ask
Docker buildx create: creates a new builder instance (may spin up a container or remote driver). Subsequent builds use it.
docker buildx rm
Ask
Docker buildx rm: removes a builder instance and its cache. In-progress builds against it fail.
docker buildx use
Ask
Docker buildx use: sets the active builder. Subsequent
docker buildx build calls use the selected builder.docker buildx stop
Ask
Docker buildx stop: stops a running builder instance. In-progress builds on it are interrupted.
docker buildx prune
Ask
Docker buildx prune: deletes unused build cache. Frees disk; next builds are slower until cache rewarms.
docker scout enroll
Ask
Docker Scout enroll: opts the organization into Docker Scout vulnerability scanning. Image data is uploaded to Docker's service.
docker context create
Ask
Docker context create: registers a new daemon endpoint in the Docker config. Subsequent commands can target it.
docker context rm
Ask
Docker context rm: removes a context from the Docker config. If it was active, the default context becomes active.
docker context use
Ask
Docker context use: switches the active daemon endpoint. Subsequent docker commands target the new daemon (potentially remote).
docker manifest create
Ask
Docker manifest create: builds a local multi-arch manifest list referencing existing image digests. Not yet pushed to a registry.
docker manifest push
Ask
Docker manifest push: publishes the manifest list to the registry. Consumers of that tag will pull the new manifest immediately.
docker manifest annotate
Ask
Docker manifest annotate: edits a local manifest list (os/arch/variant). Push is a separate step.
docker image rm
Ask
Docker image rm: removes a local image (and its layers if unreferenced). Containers using that image still run.
docker image prune
Ask
Docker image prune: deletes dangling (or with
-a, all unused) local images. Reclaims disk; can be expensive to repull.docker image tag
Ask
Docker image tag: creates a new ref pointing at an existing image. Local-only until pushed.
docker image push
Ask
Docker image push: uploads the image (and layers) to the registry under the given ref. Overwrites the tag for everyone consuming it.
docker image pull
Ask
Docker image pull: downloads an image from a registry. Network/disk usage; verify the ref is the intended source.
docker container rm
Ask
Docker container rm: removes a stopped container (with
-f, also force-kills a running one). Anonymous volumes are removed only with -v.docker container start
Ask
Docker container start: starts an existing stopped container. Bound ports and volumes from the original
run reapply.docker container stop
Ask
Docker container stop: sends SIGTERM then SIGKILL after the grace period. In-flight requests to the container drop.
docker container kill
Ask
Docker container kill: sends a signal (SIGKILL by default) directly. No graceful shutdown; in-flight work is lost.
docker container prune
Ask
Docker container prune: deletes all stopped containers. Their writable layers and anonymous state are gone.
docker compose up
Ask
Compose up: starts the services in the current compose file. Builds/pulls images as needed; with
-d runs detached.docker compose down
Ask
Compose down: stops and removes containers, networks, and (with
-v) volumes for the project. Persistent state in named volumes survives unless -v is set.docker compose start
Ask
Compose start: starts already-created service containers. Does not create or rebuild.
docker compose stop
Ask
Compose stop: stops running service containers but leaves them in place. In-flight requests drop.
docker compose restart
Ask
Compose restart: restarts service containers without recreating them. Brief downtime per service.
docker compose build
Ask
Compose build: builds (or rebuilds) the services' images per the compose file. Local-only until pushed.
docker compose pull
Ask
Compose pull: pulls the service images from their registries. Disk/network usage.
docker compose push
Ask
Compose push: pushes the service images to their registries. Overwrites the tags for anyone consuming them.
docker compose exec
Ask
Compose exec: runs a command inside a running service container. Side effects (writes, signals) happen in that live container.
docker compose run
Ask
Compose run: spins up a one-off service container with the given command. Leaves a stopped container behind unless
--rm is set.docker compose rm
Ask
Compose rm: removes stopped service containers (with
-s it also stops them first). Anonymous volumes go with -v.docker compose create
Ask
Compose create: creates service containers without starting them. Useful before a separate
start.docker compose kill
Ask
Compose kill: sends SIGKILL to running service containers. No graceful shutdown.
docker compose pause
Ask
Compose pause: freezes all processes in the service containers via cgroups. Connections hang until unpaused.
docker compose unpause
Ask
Compose unpause: resumes previously-paused service containers.
docker run
Ask
Docker run: creates and starts a new container from an image. Honours
-v mounts, port publishes, and --privileged; verify those before approving.docker exec
Ask
Docker exec: runs a command inside an already-running container. Side effects happen in that live container.
docker build
Ask
Docker build: builds an image from a Dockerfile. Pulls base images; local-only until pushed.
docker push
Ask
Docker push: uploads an image to the registry under the given ref. Overwrites the tag for everyone consuming it.
docker pull
Ask
Docker pull: downloads an image from a registry. Network/disk usage; verify the ref.
docker rm
Ask
Docker rm: removes a stopped container (with
-f, also force-kills a running one). Anonymous volumes go with -v.docker rmi
Ask
Docker rmi: removes a local image. Containers using it still run; layers go when no ref remains.
docker kill
Ask
Docker kill: sends a signal (SIGKILL by default) directly to the container PID 1. No graceful shutdown.
docker stop
Ask
Docker stop: sends SIGTERM then SIGKILL after the grace period. In-flight requests drop.
docker start
Ask
Docker start: starts an existing stopped container. Original
run config (ports, mounts) reapplies.docker restart
Ask
Docker restart: stops and starts the container. Brief downtime; existing config reapplies.
docker pause
Ask
Docker pause: freezes all processes in the container via cgroups. Connections hang until unpaused.
docker unpause
Ask
Docker unpause: resumes a previously-paused container.
docker tag
Ask
Docker tag: creates a new ref pointing at an existing image. Local-only until pushed.
docker commit
Ask
Docker commit: creates a new image from a container's writable layer. Image is not reproducible from a Dockerfile.
docker cp
Ask
Docker cp: copies files between the local FS and a container. Overwrites destination paths.
docker login
Ask
Docker login: writes registry credentials to
~/.docker/config.json (or the configured credential helper). Anyone with read access to the file gets those credentials.docker logout
Ask
Docker logout: removes registry credentials from the Docker config. Subsequent pulls/pushes to that registry need to re-auth.
docker network create
Ask
Docker network create: creates a user-defined network. Containers can be attached and discover each other by name.
docker network rm
Ask
Docker network rm: removes a network. Fails if containers are still attached; otherwise their inter-container DNS breaks.
docker network connect
Ask
Docker network connect: attaches a running container to an additional network. Gives it new addresses and DNS visibility.
docker network disconnect
Ask
Docker network disconnect: detaches a container from a network. Existing connections on that network drop.
docker volume create
Ask
Docker volume create: creates a named volume managed by the engine. Persists across container recreates.
docker volume rm
Ask
Docker volume rm: removes a named volume and its data. Fails if a container still references it; otherwise the data is gone.
docker system prune
Ask
Docker system prune: deletes stopped containers, unused networks, dangling images, and build cache (with
-a --volumes also more). Reclaims disk; can be expensive to rebuild.docker-compose up
Ask
Compose up: starts the services in the current compose file. Builds/pulls images as needed; with
-d runs detached.docker-compose down
Ask
Compose down: stops and removes containers, networks, and (with
-v) volumes for the project. Named-volume data survives unless -v is set.docker-compose start
Ask
Compose start: starts already-created service containers. Does not create or rebuild.
docker-compose stop
Ask
Compose stop: stops running service containers but leaves them in place. In-flight requests drop.
docker-compose restart
Ask
Compose restart: restarts service containers without recreating them. Brief downtime per service.
docker-compose pause
Ask
Compose pause: freezes all processes in the service containers via cgroups. Connections hang until unpaused.
docker-compose unpause
Ask
Compose unpause: resumes previously-paused service containers.
docker-compose build
Ask
Compose build: builds (or rebuilds) the services' images per the compose file. Local-only until pushed.
docker-compose push
Ask
Compose push: pushes the service images to their registries. Overwrites the tags for consumers.
docker-compose pull
Ask
Compose pull: pulls the service images from their registries. Disk/network usage.
docker-compose rm
Ask
Compose rm: removes stopped service containers (with
-s it also stops them first). Anonymous volumes go with -v.docker-compose kill
Ask
Compose kill: sends SIGKILL to running service containers. No graceful shutdown.
docker-compose exec
Ask
Compose exec: runs a command inside a running service container. Side effects happen in that live container.
docker-compose run
Ask
Compose run: spins up a one-off service container with the given command. Leaves a stopped container behind unless
--rm is set.docker-compose create
Ask
Compose create: creates service containers without starting them. Useful before a separate
start.gcloud container clusters get-credentials
Ask
Fetches GKE cluster credentials and writes a context entry to
~/.kube/config. Subsequent kubectl commands target that cluster.gcloud compute instances create
Ask
GCE create: provisions a new VM in the project. Billing starts when it boots; verify zone, machine type, and network.
gcloud compute instances delete
Ask
GCE compute delete: terminates the VM. Persistent disks may or may not be deleted depending on flags.
gcloud compute instances start
Ask
GCE start: boots a stopped VM. Compute billing resumes once the instance is running.
gcloud compute instances stop
Ask
GCE stop: shuts the VM down. Connections drop; persistent disks still bill while stopped.
gcloud compute instances reset
Ask
GCE reset: hard-reboots the VM without a clean shutdown. In-memory state and unflushed disk writes are lost.
gcloud container clusters create
Ask
GKE create: provisions a new Kubernetes cluster. Control plane and node pools begin billing immediately.
gcloud container clusters delete
Ask
GKE delete: tears down the cluster including all workloads. Cannot be reversed.
gcloud container clusters resize
Ask
GKE resize: changes node pool size. Scaling down evicts pods from removed nodes; scaling up adds nodes that begin billing.
gcloud container clusters upgrade
Ask
GKE upgrade: upgrades the control plane or node pool version. Workloads get rescheduled during node rollouts; cannot be downgraded mid-flight.
gcloud storage cp
Ask
GCS copy: writes objects into a bucket. May overwrite existing objects at the same key.
gcloud storage mv
Ask
GCS move: copies then deletes the source. Failure mid-operation can leave partial state at the destination.
gcloud storage rm
Ask
GCS delete: removes objects from a bucket. Recursive (
-r) on a prefix deletes every matching object; recovery requires object versioning.gcloud functions deploy
Ask
Cloud Functions deploy: uploads source and publishes a new revision. Traffic shifts to the new version once deployment succeeds.
gcloud functions delete
Ask
Cloud Functions delete: removes the function. Triggers stop firing immediately; callers get errors until recreated.
gcloud run deploy
Ask
Cloud Run deploy: builds/pulls the image and rolls out a new revision. Traffic shifts to it per the service's traffic policy.
gcloud run services delete
Ask
Cloud Run delete: removes the service. Live traffic returns 404 until redeploy.
gcloud sql instances create
Ask
Cloud SQL create: provisions a managed database instance. Billing starts at create time; tier and storage choices are sticky.
gcloud sql instances delete
Ask
Cloud SQL delete: removes the database instance and its data. Restore requires a prior backup; otherwise data is gone.
gcloud sql instances patch
Ask
Cloud SQL patch: changes instance settings (tier, flags, maintenance, network). Some changes restart the instance.
gcloud secrets create
Ask
Secret Manager create: creates a new secret container. Initial payload value (if provided) lands in Cloud audit logs at IAM read.
gcloud secrets delete
Ask
Secret Manager delete: removes the secret and all its versions. Consumers that read it will start failing immediately.
gcloud projects create
Ask
GCP project create: provisions a new project under your org/billing. Project IDs are globally unique and cannot be reused.
gcloud projects delete
Ask
GCP project delete: schedules the project for deletion (30-day grace). All resources go offline immediately.
helm repo add
Ask
Helm repo add: registers a chart repository in the local Helm config. Subsequent installs can pull charts from it.
helm repo remove
Ask
Helm repo remove: removes a chart repository from the local Helm config. Existing releases keep running.
helm install
Ask
Helm install: deploys a chart as a new release into the current kube context/namespace. Creates the resources defined in the chart.
helm upgrade
Ask
Helm upgrade: applies a new chart version or values to an existing release. Workloads may roll; use
--atomic to auto-rollback on failure.helm uninstall
Ask
Helm uninstall: removes a release and all its Kubernetes resources from the cluster. Persistent volumes may be retained per chart settings.
helm rollback
Ask
Helm rollback: rolls a release back to a previous revision. Workloads roll to match the earlier manifests.
helm delete
Ask
Helm delete: removes a release (alias for uninstall in Helm 3). The release's Kubernetes resources are deleted.
helm push
Ask
Helm push: uploads a packaged chart to an OCI registry. Overwrites the chart version for consumers of that ref.
helm package
Ask
Helm package: bundles a chart directory into a
.tgz. Local-only until pushed.kubectl debug
Ask
kubectl debug: attaches an ephemeral debug container to a running pod or node. The debug container runs with the target's namespace and may have elevated access.
kubectl apply
Ask
kubectl apply: creates or updates resources from a manifest in the current context/namespace. Drift between cluster and file is reconciled toward the file.
kubectl create
Ask
kubectl create: imperatively creates a resource in the current context/namespace. Fails if the resource already exists.
kubectl delete
Ask
kubectl delete: removes the resource from the cluster. Verify namespace/context; many resources cascade-delete dependents.
kubectl edit
Ask
kubectl edit: opens the live resource in $EDITOR and applies on save. Changes go straight to the cluster; no diff review.
kubectl patch
Ask
kubectl patch: applies a strategic/JSON/merge patch to a live resource. Effect is immediate; rolling updates can trigger pod restarts.
kubectl replace
Ask
kubectl replace: replaces a live resource entirely with the manifest. Fields absent from the file are dropped;
--force deletes and recreates.kubectl scale
Ask
kubectl scale: changes the replica count on a Deployment/StatefulSet/ReplicaSet. Scaling to 0 stops the workload.
kubectl rollout
Ask
kubectl rollout: triggers, pauses, resumes, undoes, or restarts a Deployment/DaemonSet/StatefulSet rollout. Pods get replaced per the strategy.
kubectl expose
Ask
kubectl expose: creates a Service in front of a workload. With type=LoadBalancer it provisions a cloud LB; type=NodePort opens a node port.
kubectl run
Ask
kubectl run: creates a pod in the current namespace from an image. Useful for one-off shells/jobs; leaves a pod behind unless
--rm is set.kubectl exec
Ask
kubectl exec: runs a command inside a running container. Side effects (writes, signals) happen in the live pod.
kubectl cp
Ask
kubectl cp: copies files between local FS and a pod via
tar in the container. Requires tar in the container image.kubectl port-forward
Ask
kubectl port-forward: tunnels a local port to a pod/service. Anyone on the local host can reach the forwarded target while running.
kubectl label
Ask
kubectl label: adds, updates, or removes labels on a resource. Labels drive selectors (Services, NetworkPolicies, scheduling); changes can shift routing.
kubectl annotate
Ask
kubectl annotate: adds, updates, or removes annotations on a resource. Annotations can configure controllers (ingress, autoscaler, sidecars).
kubectl taint
Ask
kubectl taint: adds a taint to a node so non-tolerating pods avoid it. With
NoExecute, existing non-tolerating pods are evicted.kubectl drain
Ask
kubectl drain: cordons the node and evicts its pods to other nodes. Confirm replicas/replacements exist before approving.
kubectl cordon
Ask
kubectl cordon: marks a node unschedulable. Existing pods stay; new pods land elsewhere.
kubectl uncordon
Ask
kubectl uncordon: marks a node schedulable again. The scheduler resumes placing new pods on it.
kubectl config set-context
Ask
kubectl config set-context: writes a context entry to
~/.kube/config. Sets cluster, user, and default namespace for that context.kubectl config use-context
Ask
kubectl config use-context: switches the current context in
~/.kube/config. Subsequent kubectl commands target the new cluster/namespace.kubectl config set-cluster
Ask
kubectl config set-cluster: writes a cluster entry (server URL, CA data) to
~/.kube/config. Misconfigured CA bypasses TLS verification.kubectl config set-credentials
Ask
kubectl config set-credentials: writes auth data (token, cert, exec plugin) to
~/.kube/config. Anyone with read access to the file gets those credentials.kubectl config delete-context
Ask
kubectl config delete-context: removes a context from
~/.kube/config. The cluster and user entries it referenced are left intact.kubectl config delete-cluster
Ask
kubectl config delete-cluster: removes a cluster entry from
~/.kube/config. Contexts that referenced it stop working.podman run
Ask
Podman run: creates and starts a new container from an image. Honours
-v mounts and port publishes; verify those before approving.podman exec
Ask
Podman exec: runs a command inside an already-running container. Side effects happen in that live container.
podman build
Ask
Podman build: builds an image from a Containerfile/Dockerfile. Pulls base images; local-only until pushed.
podman push
Ask
Podman push: uploads an image to the registry under the given ref. Overwrites the tag for consumers.
podman pull
Ask
Podman pull: downloads an image from a registry. Network/disk usage; verify the ref.
podman rm
Ask
Podman rm: removes a stopped container (with
-f, also force-kills a running one). Anonymous volumes go with -v.podman rmi
Ask
Podman rmi: removes a local image. Containers using it still run; layers go when no ref remains.
podman kill
Ask
Podman kill: sends a signal (SIGKILL by default) to the container PID 1. No graceful shutdown.
podman stop
Ask
Podman stop: sends SIGTERM then SIGKILL after the grace period. In-flight requests drop.
podman start
Ask
Podman start: starts an existing stopped container. Original
run config (ports, mounts) reapplies.podman restart
Ask
Podman restart: stops and starts the container. Brief downtime; existing config reapplies.
podman pause
Ask
Podman pause: freezes all processes in the container via cgroups. Connections hang until unpaused.
podman unpause
Ask
Podman unpause: resumes a previously-paused container.
podman tag
Ask
Podman tag: creates a new ref pointing at an existing image. Local-only until pushed.
podman commit
Ask
Podman commit: creates a new image from a container's writable layer. Image is not reproducible from a Containerfile.
podman cp
Ask
Podman cp: copies files between the local FS and a container. Overwrites destination paths.
podman login
Ask
Podman login: writes registry credentials to the auth store. Anyone with read access to the file gets those credentials.
podman logout
Ask
Podman logout: removes registry credentials from the auth store. Subsequent pulls/pushes need to re-auth.
podman create
Ask
Podman create: creates a container without starting it. Useful before a separate
start.podman pod
Ask
Podman pod: pod-level operation (create/start/stop/rm). Affects all containers in the pod at once.
podman generate
Ask
Podman generate: emits Kubernetes/systemd config from existing containers or pods to stdout (or a file). May write to disk depending on flags.
podman play
Ask
Podman play: creates pods and containers from a Kubernetes YAML manifest. Pulls images and starts workloads locally.
pulumi up
Ask
Pulumi up: applies the current program to the selected stack, creating/updating/deleting cloud resources. Run
pulumi preview first.pulumi destroy
Ask
Pulumi destroy: tears down every resource tracked by the selected stack. Cannot be undone without recreating from code.
pulumi refresh
Ask
Pulumi refresh: reconciles state with the real cloud, updating the state file to match what is actually deployed.
pulumi import
Ask
Pulumi import: brings an existing cloud resource under Pulumi management and emits code for it. Verify the resource address matches the program.
pulumi cancel
Ask
Pulumi cancel: forcibly cancels an in-progress update on the stack. Partial state on the cloud side may not match the state file.
pulumi new
Ask
Pulumi new: scaffolds a new project (and stack) in the current directory. Writes program files and
Pulumi.yaml.pulumi stack init
Ask
Pulumi stack init: creates a new stack under the current project. The stack starts empty until
pulumi up runs.pulumi stack rm
Ask
Pulumi stack rm: removes the stack's state and config. Use
--force only after pulumi destroy; otherwise cloud resources are orphaned.pulumi stack select
Ask
Pulumi stack select: switches the active stack. Subsequent
up/destroy/config commands target the selected stack.pulumi config set
Ask
Pulumi config set: writes a config value (optionally encrypted with
--secret) into the stack's config file.pulumi config rm
Ask
Pulumi config rm: removes a config key from the stack. Programs that read it will fall back to defaults or error.
terraform test
Ask
Terraform test: runs
.tftest.hcl cases. With command = apply (default), test cases create real infrastructure for the duration of the run.terraform console
Ask
Terraform console: interactive REPL against the current state. Evaluates expressions only, but reads state from the configured backend.
terraform force-unlock
Ask
Terraform force-unlock removes a stuck state lock. Confirm no other apply is in progress; concurrent applies corrupt state.
terraform apply
Ask
Terraform apply: applies planned changes to real infrastructure. Run
terraform plan first and review the diff.terraform destroy
Ask
Terraform destroy: tears down resources tracked by this state. Use
-target to scope; cannot be undone.terraform import
Ask
Terraform import: brings an existing real resource under terraform management. Verify the address matches your config.
terraform taint
Ask
Terraform taint: marks a resource for replacement on the next apply. The next
apply will destroy and recreate it.terraform untaint
Ask
Terraform untaint: clears the tainted mark from a resource so the next apply does not replace it.
terraform init
Ask
Terraform init: downloads providers/modules and configures the backend. Writes
.terraform/ and .terraform.lock.hcl.terraform fmt
Ask
Terraform fmt: rewrites
.tf files in place to canonical style. Use -check to verify without modifying.terraform state mv
Ask
Terraform state mv: renames or reparents resources in state. Validate addresses; mistakes leave resources orphaned.
terraform state rm
Ask
Terraform state rm: drops a resource from state without destroying it in the cloud. The resource becomes unmanaged.
terraform state push
Ask
Terraform state push: overwrites remote state with local. Take a backup of remote state first.
terraform state pull
Ask
Terraform state pull: downloads the current remote state to stdout. Read-only on remote state, but exposes sensitive values.
terraform workspace new
Ask
Terraform workspace new: creates a new workspace with its own state file. Subsequent commands run against it until switched.
terraform workspace delete
Ask
Terraform workspace delete: removes the workspace and its state file. State cannot be recovered after deletion.
terraform workspace select
Ask
Terraform workspace select: switches the active workspace. Subsequent plan/apply runs target the selected workspace's state.
Custom handlers do the heavy lifting. check_gcloud handles 3-word patterns (gcloud compute instances create). check_docker handles docker compose with flags between the subcommand. The action-prefix machinery for AWS is declarative in TOML but enforced in Rust at parse time.