delonix image

Usage: delonix image <COMMAND>

Commands:
  pull      Pull an image from a registry
  push      Publish a local image to an OCI registry
  remove    Remove a local image [alias: rm]
  describe  Human-readable detail of one or more images, `kubectl describe`-style
  history   Layers of an image (digest + size), from base to top
  ls        List local images
  sbom      The image's SBOM as an SPDX 2.3 document, not the table `scan --sbom` prints
  scan      SBOM + CVE scan of an image
  verify    Verify the cosign signature of a local image against a public key
  login     Authenticate to an OCI registry
  logout    Remove the stored credentials of a registry
  sign      Sign an image with cosign-compatible ECDSA-P256, publishing the signature next to it in the registry
  tag       Give another name/tag to a local image (copies nothing — it's just a new name for the same content)
  export    Export an OCI runtime bundle (rootfs + config.json) for `runc`/`crun`
  load      Load an image from an archive (the counterpart of `save`)
  save      Save an image to a portable archive (`docker save`'s counterpart)
  apply     Apply the `kind: Image` documents of a manifest
  prune     Remove unused images and the CAS blobs nobody references any more
  help      Print this message or the help of the given subcommand(s)

Options:
  -h, --help
          Print help (see a summary with '-h')

COMMAND MAP:
  Lifecycle    pull · remove · push
  Inspect      ls · describe · history · verify · scan · sbom
  Configure    tag · sign · login · logout
  Storage      export · save · load
  Declarative  apply
  Maintenance  prune

EXAMPLES:
  # fetch an image from a registry
  delonix image pull postgres:16

  # what is on disk, and how much of it
  delonix image ls

  # golden VM images live in a store of their own, next to the container ones
  delonix vm image ls

SEE ALSO:
  delonix build · delonix container run · delonix vm image · delonix image
  scan

  delonix › image

Usage: delonix image logout <REGISTRY>

Arguments:
  <REGISTRY>
          

Options:
  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # drop the stored credentials of a registry
  delonix image logout ghcr.io

SEE ALSO:
  delonix image login · delonix image push

  delonix › image › logout

Usage: delonix image login [OPTIONS] --username <USERNAME> <REGISTRY>

Arguments:
  <REGISTRY>
          Registry (e.g. `ghcr.io`, `docker.io`)

Options:
  -u, --username <USERNAME>
          

      --password-stdin
          Read the password/token from stdin (the only supported way)

  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # authenticate to a registry — the token comes from stdin, never from the
  # argv, where it would land in the shell history and in /proc
  printf '%s' "$GITHUB_TOKEN" | delonix image login ghcr.io -u angolardevops --password-stdin

  # the same for Docker Hub
  printf '%s' "$DOCKERHUB_TOKEN" | delonix image login docker.io -u myuser --password-stdin

SEE ALSO:
  delonix image logout · delonix image push · delonix image pull

  delonix › image › login

Usage: delonix image load --input <FILE>

Options:
  -i, --input <FILE>
          Archive to read (`.tar`; a `.tar.gz` must be gunzipped first)

  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # read back an archive written by `save`, `docker save` or `podman save`
  delonix image load -i postgres-16.tar

  # a gzipped archive has to be gunzipped first
  gunzip -c nginx.tar.gz > nginx.tar && delonix image load -i nginx.tar

SEE ALSO:
  delonix image save · delonix image ls · delonix image pull

  delonix › image › load

Usage: delonix image save --output <FILE> <IMAGE>

Arguments:
  <IMAGE>
          

Options:
  -o, --output <FILE>
          Destination file. Use `-o /dev/stdout` to pipe (e.g. into `gzip`)

  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # move an image to another machine with no registry in between
  delonix image save postgres:16 -o postgres-16.tar

  # pipe it straight into gzip instead of writing the plain archive
  delonix image save nginx -o /dev/stdout | gzip > nginx.tar.gz

SEE ALSO:
  delonix image load · delonix image push · delonix image export

  delonix › image › save

Usage: delonix image scan [OPTIONS] [IMAGE]

Arguments:
  [IMAGE]
          Image to scan (optional with `--update`)

Options:
      --sbom
          List the SBOM (installed packages) instead of scanning

      --fail-on <SEV>
          Fail (exit 1) if there are vulnerabilities >= this severity (low|medium|high|critical) — gate for CI

      --update
          Sync the CVE feed to the local database (used afterwards by each scan)

      --feed <URL|FICHEIRO>
          Feed source for `--update`: URL or file (or $DELONIX_ADVISORY_FEED)

  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # the CVEs of an image, read from the layers on disk — nothing is executed
  delonix image scan postgres:16

  # the installed packages (SBOM) instead of the findings
  delonix image scan --sbom nginx

  # a CI gate: exit 1 if anything high or worse is found
  delonix image scan --fail-on high ghcr.io/angolardevops/app:1.2.0

  # refresh the local feed first — a scan is only as fresh as the database
  # behind it
  delonix image scan --update

SEE ALSO:
  delonix image describe · delonix image pull · delonix image verify

  delonix › image › scan

Usage: delonix image verify <IMAGE> <PEM>

Arguments:
  <IMAGE>
          

  <PEM>
          Public key in PEM

Options:
  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # check the cosign signature of an image you already have against the
  # publisher's key
  delonix image verify ghcr.io/angolardevops/app:1.2.0 cosign.pub

  # the gate to run before promoting a local build to production
  delonix image verify kaeso-odoo:18 keys/kaeso.pub

SEE ALSO:
  delonix image pull · delonix image scan · delonix image describe

  delonix › image › verify

Usage: delonix image history <IMAGE>

Arguments:
  <IMAGE>
          

Options:
  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # the layers from base to top, with the digest and size of each
  delonix image history postgres:16

  # where the size went, before deciding what to change in the Dockerfile
  delonix image history kaeso-odoo:18

SEE ALSO:
  delonix image describe · delonix build · delonix image ls

  delonix › image › history

Usage: delonix image tag <SOURCE> <TARGET>

Arguments:
  <SOURCE>
          

  <TARGET>
          

Options:
  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # a second name for the same content — nothing is copied
  delonix image tag postgres:16 db:stable

  # the shape a locally-built image needs before it can be pushed to your
  # registry
  delonix image tag kaeso-odoo:18 ghcr.io/angolardevops/kaeso-odoo:18

SEE ALSO:
  delonix image push · delonix image ls · delonix image remove

  delonix › image › tag

Usage: delonix image describe <NAMES>...

Arguments:
  <NAMES>...
          

Options:
  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # tags, digest, size, layers and the OCI config (entrypoint/cmd/env/workdir)
  # in one screen
  delonix image describe postgres:16

  # several at once, to compare what two images actually run
  delonix image describe alpine:3.19 redis:7-alpine

SEE ALSO:
  delonix image ls · delonix image history · delonix image scan

  delonix › image › describe

Usage: delonix image pull [OPTIONS] <IMAGE>

Arguments:
  <IMAGE>
          

Options:
      --verify <PEM>
          Verify the cosign signature with this public key (PEM) AFTER the pull, and fail if it does not match. Without this, a pull is not authenticated beyond the registry's own digest

  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # the common case — repository and tag
  delonix image pull postgres:16

  # a registry other than Docker Hub — write it out in the reference
  delonix image pull ghcr.io/angolardevops/kaeso-odoo:18

  # refuse the image unless it carries a cosign signature made by this key
  delonix image pull --verify cosign.pub ghcr.io/angolardevops/app:1.2.0

SEE ALSO:
  delonix image ls · delonix image scan · delonix image verify · delonix vm
  image pull

  delonix › image › pull

Usage: delonix image ls [OPTIONS]

Options:
  -o, --output <OUTPUT>
          Output format: `table` (default) or `json` (ADR-0005)
          
          [default: table]
          [possible values: table, json]

  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # what is on disk, newest first
  delonix image ls

  # as JSON, for a script to read instead of a table meant for eyes
  delonix image ls -o json

SEE ALSO:
  delonix image describe · delonix image history · delonix image remove

  delonix › image › ls

Usage: delonix image remove [OPTIONS] <IMAGE>

Arguments:
  <IMAGE>
          

Options:
  -f, --force
          Remove it even if a container still uses it

  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # remove an image nothing is using
  delonix image remove alpine:3.19

  # remove it even though a container still references it
  delonix image remove -f odoo:16

SEE ALSO:
  delonix image ls · delonix container rm · delonix system prune

  delonix › image › remove

Usage: delonix image export [OPTIONS] <IMAGE> <DIR>

Arguments:
  <IMAGE>
          

  <DIR>
          

Options:
      --rootless
          Emit a ROOTLESS bundle: add a user namespace and the current user's uid/gid mappings (container root -> your uid, then the delegated subuids), so `runc`/`crun` run it without root. Without it the bundle has no mappings and only runs as real root (`runc` refuses it rootless with "requires user namespaces"). The mappings are specific to THIS user, so the bundle is tied to this host's `/etc/subuid`

  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # an OCI runtime bundle (rootfs + config.json) that `runc` or `crun` runs
  # directly
  delonix image export alpine:latest /tmp/alpine-bundle

  # the directory you then hand to another OCI runtime — this is a bundle to
  # run, not an archive to ship
  delonix image export postgres:16 /tmp/pg-bundle

SEE ALSO:
  delonix image save · delonix image load · delonix container run

  delonix › image › export

Usage: delonix image push <NAME> [TARGET]

Arguments:
  <NAME>
          

  [TARGET]
          

Options:
  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # publish under the image's own reference
  delonix image push ghcr.io/angolardevops/app:1.2.0

  # publish a locally-named image under another reference, without tagging it
  # first
  delonix image push kaeso-odoo:18 ghcr.io/angolardevops/kaeso-odoo:18

SEE ALSO:
  delonix image login · delonix image tag · delonix vm image push

  delonix › image › push

Usage: delonix image apply [OPTIONS]

Options:
  -f, --file <FILE>
          

  -h, --help
          Print help (see a summary with '-h')

EXAMPLES:
  # apply only the `kind: Image` documents of `./delonix-manifest.yaml`,
  # ignoring the other Kinds
  delonix image apply

  # from a file of your own
  delonix image apply -f delonix-manifest.yaml

SEE ALSO:
  delonix stack apply · delonix stack plan · delonix image pull

  delonix › image › apply