---
url: /reference/cli.md
description: >-
  Every duploy CLI command, grouped by area, with global flags and context
  resolution.
---

# CLI

`duploy --help` and `duploy <command> --help` are always the most current
reference. This page groups the commands by what they act on.

## Global flags

| Flag | Env | Effect |
|---|---|---|
| `-o, --org <org>` | `DUPLOY_ORG` | Org slug, name or id |
| `-p, --project <project>` | `DUPLOY_PROJECT` | Project name or id |
| `--profile <name>` | `DUPLOY_PROFILE` | Credential profile |
| `--json` | | Raw API JSON on stdout |
| `-q, --quiet` | | Ids and status only |
| `--wide` | | Do not truncate tables |
| `-v, --verbose` | | More output |

Context comes from the flags, then the nearest `.duploy` file, then
`duploy use`. Credentials live in `~/.config/duploy/credentials.toml`.

## Account and context

| Command | Does |
|---|---|
| `login [--no-browser]` | Sign in through the browser |
| `logout` | Sign out and delete the profile |
| `whoami` | Who you are and your memberships |
| `use [org[/project]]` | Select the context; no argument shows it |
| `link <project>` / `unlink` | Bind this directory to a project |
| `orgs`, `projects` | List |
| `project ingress` | Slug, CNAME target and edge addresses for DNS |
| `tokens`, `token create <name> [--expires-days n]`, `token rm <id\|name>` | Access tokens |
| `audit [--limit n] [--before seq]` | Your security log |

## Config

| Command | Does |
|---|---|
| `config show` | Print the project's `duploy.toml` |
| `config edit [-f file\|-] [-m message] [-y]` | Edit with a diff and confirmation |
| `config sync` | Re-read the file from the repository |
| `config source --repo owner/name --branch b --path p` | Link the config to a repository; `--unlink` |

## Services, builds and deploys

| Command | Does |
|---|---|
| `services`, `service <s>` | List, details |
| `service stop\|start\|restart <s> [--instance id]` | Lifecycle |
| `service exec <s> [--instance id] -- <cmd>` | Run a command in an instance |
| `build [s]`, `builds`, `build cancel\|rm <id>` | Builds |
| `deploy [s]`, `deploys`, `deploy cancel <id>` | Deploys |
| `rollback <deploy-id> [-y]` | Redeploy a past image and config |
| `env <s>` | Variable names and kinds, never values |
| `secret set <s> K=V…` / `secret set <s> -` | Write secrets; `-` reads a `.env` from stdin |
| `secret rm <s> K…` | Remove secret values |

## Databases

| Command | Does |
|---|---|
| `dbs`, `db <d>` | List, details |
| `db creds <d>` | Credentials |
| `db connect <d> [-- args]` | `psql` / `mysql` / `redis-cli` through a tunnel |
| `db stop\|start\|restart <d>` | Lifecycle |
| `db upgrade-image <d>` | Move to the current platform image |
| `db backup <d>`, `db backups <d>`, `db backup rm <id>` | Backups |
| `db restore <d> --backup <id> \| --at <RFC3339> [--timeline n]` | Restore in place |
| `db timelines <d>` | Postgres timelines |
| `db import <d> <file> [-y]` | Replace the database with a dump |

## Cron, volumes and domains

| Command | Does |
|---|---|
| `run <s>`, `runs [--service s]`, `run cancel <id>` | Cron runs |
| `volumes` | Volumes, orphans included |
| `volume backup\|backups\|rm <name> [--service s]` | Volume operations |
| `volume restore <name> <backup-id> [-y]` | Restore in place |
| `domains`, `domain verify <host>` | Domains, TLS and ownership |

## Observing

| Command | Does |
|---|---|
| `logs <s> [-f] [--tail n] [--instance id]` | Container log |
| `logs --deploy\|--build\|--run\|--backup\|--restore <id>` | Job log |
| `logs --db <d>` | Database log |
| `metrics [s] [--db d] [--range 1h\|24h\|7d\|30d]` | CPU, memory, network |
| `usage` | Traffic this month and the last 24 hours |
| `events [--kind k]` | Live event stream |
| `until <event,…> [--service\|--db\|--deploy\|--build\|--sha\|--host] [--timeout]` | Wait for an event |

## Tunnels

| Command | Does |
|---|---|
| `tunnel db:<d> [-l 127.0.0.1:PORT]` | Local port to a database |
| `tunnel svc:<s>[:port] [-l 127.0.0.1:PORT]` | Local port to a service instance |

Tunnels run over the control plane; nothing in the project is exposed to the
internet. Idle tunnels close after an hour.

## Tools

| Command | Does |
|---|---|
| `version` | CLI and panel versions |
| `completions <fish\|zsh\|bash> [--install]` | Shell completion |