CLI Reference

container create

Create a new container from a base image.

volt container create --name <name> --image <image> [flags]

Flag	Description
--name	Container name (required, alphanumeric + ._-, max 64 chars)
--image	Base image name (required)
--env KEY=VAL	Set environment variables (repeatable)
--memory	Memory limit (e.g., 512M, 2G)
--cpus	CPU quota (e.g., 0.5, 2)

# Create a Debian container
sudo volt container create --name web --image debian-minimal

# Create with resource limits
sudo volt container create --name api --image debian-minimal \
  --memory 512M --cpus 1 --env NODE_ENV=production

container start / stop / restart

Control container lifecycle via systemd.

volt container start <name>
volt container stop <name>
volt container restart <name>

sudo volt container start web
sudo volt container stop web
sudo volt container restart web

container exec

Execute a command inside a running container using nsenter.

volt container exec <name> -- <command> [args...]

# Run a command
sudo volt container exec web -- nginx -t

# Interactive shell
sudo volt container exec web -- /bin/bash

container shell

Open an interactive shell in a container (auto-detects bash/sh).

volt container shell <name>

container attach

Attach to a container's primary process using nsenter.

volt container attach <name>

container list

List all containers with their status.

volt container list [-o json|yaml]

sudo volt container list
sudo volt container list -o json

container inspect

Show detailed information about a container — rootfs, unit status, OS info.

volt container inspect <name>

container logs

View container logs via journald.

volt container logs <name> [-f] [-n <lines>] [--since <time>]

Flag	Description
-f, --follow	Follow log output (stream)
-n, --tail	Number of recent lines to show
--since	Show logs since timestamp (e.g., 1h ago)

container kill

Send a signal to a container via machinectl kill.

volt container kill <name> [--signal <SIG>]

sudo volt container kill web --signal SIGTERM

container cp

Copy files between host and container.

volt container cp <src> <dst>

# Copy from container to host
sudo volt container cp web:/etc/nginx/nginx.conf ./nginx.conf

# Copy from host to container
sudo volt container cp ./app.conf web:/etc/app/

container rename

Rename a container. Stops the container, moves rootfs, rewrites the unit file, and restarts.

volt container rename <old-name> <new-name>

container update

Update cgroup resource limits on a running container via systemctl set-property.

volt container update <name> --memory <limit> --cpus <quota>

sudo volt container update web --memory 1G --cpus 2

container export

Export a container's rootfs as a tarball.

volt container export <name> [--output <file>]

container delete

Delete a container — stops it, removes the systemd unit, and removes the rootfs.

volt container delete <name>

vm create

Create a new virtual machine with a config and systemd unit.

volt vm create <name> [flags]

sudo volt vm create dev-box --memory 2G --cpus 2 --disk 20G

vm list

List all VMs with their configuration and status.

volt vm list [-o json|yaml]

vm start / stop

Start or stop a VM via systemd.

volt vm start <name>
volt vm stop <name>

vm ssh

Resolve a VM's IP address and SSH into it.

volt vm ssh <name>

vm attach

Attach storage to a VM via symlink-based mounting.

volt vm attach <name> <storage-path>

vm exec

Execute a command inside a VM namespace using nsenter.

volt vm exec <name> -- <command> [args...]

vm destroy

Destroy a VM — stops it, removes the systemd unit, and deletes the VM directory.

volt vm destroy <name>

workload list

List all workloads with type, status, and resource usage. Supports JSON/YAML output.

volt workload list [-o json|yaml]

workload status / inspect

Detailed status with resource metrics, or rich inspection with CAS refs and backend details.

volt workload status <name>
volt workload inspect <name>

workload start / stop / restart

Auto-dispatches to the correct backend (container, VM, or service).

volt workload start <name>
volt workload stop <name>
volt workload restart <name>

workload freeze / thaw

Suspend and resume workloads. Containers use the cgroup freezer; VMs use SIGSTOP/SIGCONT.

volt workload freeze <name>
volt workload thaw <name>

service create

Generate a systemd unit file for a new service.

volt service create <name> --exec <command> [flags]

Flag	Description
--exec	Command to run (ExecStart)
--env KEY=VAL	Environment variables (repeatable)
--user	Run as user
--workdir	Working directory
--type	Unit type: simple, oneshot, forking, notify

sudo volt service create myapi --exec "/usr/bin/node /app/server.js" \
  --user www-data --env PORT=3000 --env NODE_ENV=production

service start / stop / restart / reload

volt service start <name>
volt service stop <name>
volt service restart <name>
volt service reload <name>

service enable / disable

Enable or disable a service for automatic start on boot.

volt service enable <name> [--now]
volt service disable <name> [--now]

service status / inspect / logs

volt service status <name>
volt service inspect <name>
volt service logs <name> [-f] [-n <lines>] [--since <time>]

service template

Generate a service from a template: simple, oneshot, forking, notify, socket.

volt service template <type> <name>

service edit / cat / show / deps / mask / unmask / delete

volt service edit <name>       # Edit with $EDITOR or inline override
volt service cat <name>        # Show unit file contents
volt service show <name>       # systemctl show (all properties)
volt service deps <name>       # Show dependency tree
volt service mask <name>       # Prevent service from starting
volt service unmask <name>     # Reverse mask
volt service delete <name>     # Stop, disable, remove unit

compose up / down

up creates volumes, networks (bridges), generates systemd units, creates a target, and starts services. down tears everything down.

volt compose up [-f <file>] [-d]
volt compose down [-f <file>]

sudo volt compose up -f volt-compose.yaml
sudo volt compose down

compose start / stop / restart

Control the entire stack via a systemd target.

volt compose start [-f <file>]
volt compose stop [-f <file>]
volt compose restart [-f <file>]

compose ps / logs / top / events

volt compose ps          # Service status
volt compose logs [-f]   # Combined logs
volt compose top         # CPU/MEM/PID per service
volt compose events      # Event stream

compose exec

Execute a command in a running compose service.

volt compose exec <service> -- <command>

compose config

Validate and display the parsed compose YAML.

volt compose config [-f <file>]

net create / list / inspect / delete

Manage bridge networks.

volt net create <name> [--subnet <cidr>]
volt net list
volt net inspect <name>
volt net delete <name>

sudo volt net create appnet --subnet 10.100.0.0/24
sudo volt net list

net connect / disconnect

Connect or disconnect a container from a network.

volt net connect <network> <container>
volt net disconnect <network> <container>

net status

Comprehensive network overview — bridges, IPs, routes, and listening ports.

volt net status

net firewall list / add / delete / flush

Manage nftables firewall rules with metadata tracking.

volt net firewall list
volt net firewall add --port <port> --protocol <tcp|udp> [--source <cidr>]
volt net firewall delete --port <port>
volt net firewall flush

# Allow HTTP/HTTPS
sudo volt net firewall add --port 80 --protocol tcp
sudo volt net firewall add --port 443 --protocol tcp

# Allow SSH from specific subnet only
sudo volt net firewall add --port 22 --protocol tcp --source 10.0.0.0/8

net policy create / list / delete / test

Higher-level workload-to-workload network policies.

volt net policy create --from <workload> --to <workload> --allow <port>
volt net policy list
volt net policy delete <id>
volt net policy test --from <workload> --to <workload>

net bridge / dns / port / vlan

volt net bridge create <name>   # Direct bridge management
volt net bridge list
volt net bridge delete <name>
volt net dns list              # resolvectl status
volt net port list             # Listening ports (ss -tlnp)
volt net vlan list             # VLAN interfaces

volume create

volt volume create --name <name> [--size <size>]

Without --size: creates a directory volume. With --size: creates a file-backed ext4 volume with loop mount.

sudo volt volume create --name appdata
sudo volt volume create --name dbdata --size 5G

volume list / inspect

volt volume list
volt volume inspect <name>

volume attach / detach

Bind-mount a volume into a container's rootfs.

volt volume attach <volume> <container> <mount-path>
volt volume detach <volume> <container>

volume resize

Resize a file-backed volume (uses truncate + resize2fs).

volt volume resize <name> <new-size>

volume snapshot / backup / delete

volt volume snapshot <name>    # cp -a based snapshot
volt volume backup <name>      # tar.gz export
volt volume delete <name>      # Unmount + remove

image pull

Pull a base image using debootstrap with known distro mappings.

volt image pull <distro>

sudo volt image pull debian-minimal
sudo volt image pull ubuntu-22.04

image build

Build a custom image from a YAML specification (debootstrap + packages + run commands).

volt image build -f <spec.yaml> --name <name>

image list / inspect / tag

volt image list
volt image inspect <name>     # Size, file count, OS info
volt image tag <name> <tag>   # Symlink-based tagging

image import / export / delete

volt image import <tarball> --name <name>
volt image export <name> [--output <file>]
volt image delete <name>

cas status

Show CAS statistics — object count, total size, ref count, disk usage.

volt cas status

cas info

Display details about a specific CAS object including content type detection.

volt cas info <hash>

cas build

Convert a directory into CAS with deduplication and a manifest.

volt cas build <directory> [--ref <name>]

cas verify

Verify SHA256 integrity of all CAS objects.

volt cas verify

cas gc

Garbage collect unreferenced objects with reference-counting.

volt cas gc [--dry-run]

volt bundle create <output.vbundle> --ref <cas-ref>
volt bundle inspect <file.vbundle>
volt bundle verify <file.vbundle>
volt bundle import <file.vbundle>
volt bundle export <ref> --output <file.vbundle>
volt bundle list

security profile list / show

Discover and display Landlock and seccomp profiles.

volt security profile list
volt security profile show <profile-name>

security audit

Comprehensive security audit — checks kernel config, LSM modules, sysctl hardening, filesystem permissions, and more.

volt security audit

Checks 13+ sysctl values, Landlock/seccomp/LSM support, and filesystem hardening.

# List all workloads
sudo volt ps

# Control from ps
sudo volt ps start <name>
sudo volt ps stop <name>
sudo volt ps kill <name>
sudo volt ps restart <name>
sudo volt ps inspect <name>

Auto-detects workload type and dispatches to the correct backend.

volt logs <name> [-f] [-n <lines>] [--since <time>] [--priority <level>] [-o json]

volt top [--sort cpu|mem|pids]

volt events [--type <type>] [-f]

task create

Create a timer + service pair for scheduled execution.

volt task create <name> --exec <command> --schedule <calendar>

sudo volt task create backup --exec "/usr/local/bin/backup.sh" \
  --schedule "daily"

sudo volt task create cleanup --exec "volt cas gc" \
  --schedule "*-*-* 03:00:00"

task list / run / status / enable / disable / logs / edit / delete

volt task list                # List all timers
volt task run <name>          # Run immediately
volt task status <name>       # Check timer status
volt task enable <name>       # Enable timer
volt task disable <name>      # Disable timer
volt task logs <name>         # View task output
volt task edit <name>         # Edit timer/service
volt task delete <name>       # Remove timer + service

volt desktop create <name> --profile <type>
volt desktop list
volt desktop connect <name>

volt cluster create <name> --nodes <count>
volt cluster status
volt cluster drain <node>
volt cluster remove <node>

volt daemon start
volt daemon stop
volt daemon restart
volt daemon status
volt daemon reload
volt daemon config

system info / health

volt system info              # Platform info and status
volt system health            # Check systemd, daemon, bridges, dirs, runtime

system backup / restore

Backup creates a tar.gz of /etc/volt + state metadata. Restore extracts it.

volt system backup [--output <file>]
volt system restore <backup-file>

system harden

Apply kernel hardening via sysctl parameters from 90-armored-hardening.conf.

volt system harden

system mode

Set the operation mode: production, development, or standalone.

volt system mode production
volt system mode development

system register / license / deactivate / reset

volt system register <license-key>   # Register with license
volt system license                   # Show registration status
volt system deactivate                # Remove license + keypair
volt system reset --confirm           # Full destructive reset

volt config show                    # Display full config
volt config get <key>               # Get a specific value
volt config set <key> <value>       # Set a value (supports nested keys)
volt config edit                    # Open in $EDITOR
volt config validate                # Validate config syntax
volt config reset                   # Reset to defaults

volt tune <profile>

# Apply web server tuning
sudo volt tune web-server

# Apply database tuning
sudo volt tune database