CLI Commands

Find the arcane-cli commands you’ll use most, grouped by task. First set your server URL and sign in (see CLI Configuration). Run arcane-cli <command> --help for all flags, or arcane-cli --help for the full command tree.

Sign in

Log in interactively with the device-code flow:

arcane-cli auth login

Check who you’re signed in as, or sign out:

arcane-cli auth me

arcane-cli auth logout

List every permission you hold in each environment and the bindings that grant them:

arcane-cli auth me --effective

For CI, use an API key or a federated credential instead. See Federated Credentials.

Environments

Commands cover every environment by default. Use --env for just one:

arcane-cli containers list --env 2

Changes without --env ask for confirmation before they run in all environments. See Work across environments.

List environments and check one is reachable:

arcane-cli environments list

arcane-cli environments test 2

Add an environment. The CLI prints its API key once, then the docker run and Compose commands to start the agent on the remote host:

arcane-cli environments create --name production

Containers

arcane-cli containers list

arcane-cli containers get my-container

arcane-cli containers restart my-container

List containers with a newer image available:

arcane-cli containers updates

Pull the newer image and recreate the container:

arcane-cli containers update my-container

Projects

arcane-cli projects list

arcane-cli projects up my-project

arcane-cli projects down my-project

Pull the latest images and restart:

arcane-cli projects redeploy my-project

Tip

projects up, projects redeploy, and projects pull print raw Docker output line by line, as docker compose would. They allow up to 30 minutes for large pulls and builds.

Remove a project and its resources:

arcane-cli projects destroy my-project

Warning

destroy removes the project’s files from disk by default. Pass --remove-files=false to keep them. Volumes are kept unless you add --remove-volumes.

Images and volumes

arcane-cli images list

arcane-cli images pull nginx:latest

Reclaim space:

arcane-cli images prune

arcane-cli volumes sizes

Find out what’s using a volume before you remove it:

arcane-cli volumes usage my-volume

GitOps

arcane-cli gitops list

arcane-cli gitops status my-sync

arcane-cli gitops sync my-sync

System

Free up space in every environment, or pass --env for one:

arcane-cli system prune

Check whether an Arcane upgrade is available, and apply it:

arcane-cli system upgrade --check

arcane-cli system upgrade

Turn a docker run command into Compose:

arcane-cli system convert "docker run -d -p 8080:80 nginx"

Vulnerabilities

Get a summary or the full findings list, scan an image now, or show one image’s findings:

arcane-cli images vulnerabilities summary

arcane-cli images vulnerabilities list

arcane-cli images vulnerabilities scan nginx:latest

arcane-cli images vulnerabilities image nginx:latest

Silence a CVE you’ve reviewed (and list or undo ignores with ignored / unignore):

arcane-cli images vulnerabilities ignore CVE-2026-1234

Users and access

Bind a role to a user, globally or in one environment:

arcane-cli admin bindings create --user <user-id> --role role_deployer --environment <env-id>

List bindings with --user, --role, or --environment filters, show a user’s effective access, or remove a binding:

arcane-cli admin bindings list --user <user-id>

arcane-cli admin bindings access <user-id>

arcane-cli admin bindings delete <binding-id>

Map an OIDC claim value to a role:

arcane-cli admin oidc create --claim docker-admins --role role_admin

Read and export the Event Log, including audit events if you hold audit:read. Filter with --search, --severity, and --type (exact types or categories, separated by commas):

arcane-cli admin events list --type authz.denied

arcane-cli admin events export --format csv -o events.csv

Custom roles live under admin roles (list, get, create, update, delete, permissions). See Roles & Permissions.

System backups

Manage Arcane system backups from the terminal:

arcane-cli admin backups list

arcane-cli admin backups create

arcane-cli admin backups restore <backup-id>

There are also subcommands for retention policies (policies), the recovery key (recovery), uploading a local backup to S3 (upload), and finding S3 restore points not in the database (discover).

Podman

These commands work on Podman environments; see Podman Overview for host requirements. Check what the host supports first:

arcane-cli podman status

Pods take the same flags as podman pod create:

arcane-cli podman pods list

arcane-cli podman pods create --name web -p 8080:80 --memory 512m

arcane-cli podman pods stop web --timeout 30

arcane-cli podman pods delete web --force

Install a Quadlet with any files it needs, then start its unit:

arcane-cli podman quadlets install web.kube --extra-file web.yaml

arcane-cli podman quadlets start web.kube

Play, tear down, or generate Kubernetes YAML:

arcane-cli podman kube play web.yaml --replace

arcane-cli podman kube down web.yaml

arcane-cli podman kube generate web --type deployment --service

Create or replace a secret. Without --file, the CLI prompts for the value, or reads one line from stdin:

arcane-cli podman secrets create db-password --file ./db-password.txt

arcane-cli podman secrets update db-password

Run Podman auto-update. --dry-run needs Podman 6.2 or later:

arcane-cli podman autoupdate --dry-run

Activities and webhooks

arcane-cli activities list

arcane-cli activities get <activity-id>

Manage webhooks, or fire one by its token:

arcane-cli webhooks list

arcane-cli webhooks trigger <token>

Updater

Inspect the automatic updater, trigger a run, and view history:

arcane-cli updater status

arcane-cli updater run

arcane-cli updater history

History shows one row per resource: resource, type, status, whether the update was applied, and start time. --limit (-n) sets how many entries return; the default is 50.

Update the CLI

arcane-cli self-update run

Switch between the stable and next release channels:

arcane-cli self-update channel next

To check release signatures before updating, turn on the signature verification preview.

Diagnose problems and set up your shell

Diagnose connectivity and configuration problems, install shell completion, or generate secrets and certificates for a new install:

arcane-cli doctor

arcane-cli completion zsh

arcane-cli generate secret

Scripting

Every command accepts --output json (or --json), so you can pair it with jq:

arcane-cli containers list --json | jq -r ".data[].name"

In JSON mode, stdout carries exactly one JSON document; status and progress go to stderr. List commands print the paginated response with data and pagination; others print only the resource or result. images pull, images build, and streaming projects commands print an array of progress frames when done.

Commands that remove or reset resources ask for confirmation. Add --yes to skip prompts in unattended scripts; on delete commands, --force also works.

Important

Without a terminal, or with --json, a prompt fails with confirmation required: re-run with --yes instead of waiting for input. Piping y into the command does not answer it.

--all (-a) returns every item, ignoring pagination. It can’t be combined with --limit or --start:

arcane-cli containers list --all --json

Note

--all means “ignore pagination”, not “include stopped containers”. containers list already returns containers in every state.

Renamed flags

Arcane 3.0 removed these old flag names, so scripts using them fail with unknown flag. They clashed with the global --env, --config, and --output flags, or were separate off switches.

Command	Old flag	New flag
containers create	--env	--env-var, -e
admin notifications settings set	--config	--provider-config
templates download	--output	--output-file, -o
environments create, environments update, registries create, registries update, templates registries update, admin federated create, admin federated update, admin backups policies update	--disabled	--enabled=false