DevOps ToolBox

DevOps Cheatsheet

Copy-ready commands with editable placeholders — fill in the blanks and copy a command that’s ready to run, not a template. Search across every topic, and jump into our generators for the cron and systemd ones. Everything runs in your browser.

Git

Inspect

  • Status (short)git
    git status -sb
  • Pretty history graphgit
    git log --oneline --graph --decorate --all
  • History of one filegit
    git log --oneline --
    path = file to trace
  • Show what is stagedgit
    git diff --staged
  • Who changed each linegit
    git blame
  • Show a commitgit
    git show

Stage & commit

  • Stage everythinggit
    git add -A
  • Stage interactively (hunk by hunk)git
    git add -p
  • Commit with a messagegit
    git commit -m ""
    message = commit message
  • Amend the last commitdestructivegit
    git commit --amend

    Rewrites the last commit — avoid after pushing to a shared branch.

  • Add staged changes to last commit (keep message)destructivegit
    git commit --amend --no-edit

Branches

  • List branchesgit
    git branch -a
  • Create and switch to a branchgit
    git switch -c
  • Switch to an existing branchgit
    git switch
  • Delete a branch (safe)git
    git branch -d
  • Force-delete a branchdestructivegit
    git branch -D
  • Rename the current branchgit
    git branch -m

Sync with remote

  • Fetch all remotes (prune stale)git
    git fetch --all --prune
  • Pull with rebase (linear history)git
    git pull --rebase
  • Push and set upstreamgit
    git push -u origin
  • Force-push safely (after rebase)destructivegit
    git push --force-with-lease

    Refuses to overwrite work you have not seen — prefer over --force.

Stash

  • Stash changes (incl. untracked)git
    git stash -u
  • Re-apply the latest stashgit
    git stash pop
  • List stashesgit
    git stash list

Undo & rescue

  • Discard changes to a filedestructivegit
    git restore
  • Unstage a file (keep changes)git
    git restore --staged
  • Undo last commit, keep changes stagedgit
    git reset --soft HEAD~
    n = commits to undo
  • Discard all local changes to a refdestructivegit
    git reset --hard

    Throws away commits and working-tree changes — unrecoverable via normal means.

  • Revert a commit (safe, makes a new commit)git
    git revert
  • Find a "lost" commitgit
    git reflog

    Every HEAD move is here — recover work after a bad reset/rebase.

  • Delete untracked files & dirsdestructivegit
    git clean -fd

    Permanently removes untracked files. Dry-run first with -n.

Rebase & bisect

  • Interactive rebase (squash/reorder)destructivegit
    git rebase -i HEAD~

    Rewrites history — only on branches nobody else has pulled.

    n = commits back
  • Rebase current branch onto anotherdestructivegit
    git rebase
  • Apply a specific commit heregit
    git cherry-pick
  • Binary-search for a bad commitgit
    git bisect start
    bad = known-bad ref · good = known-good ref

Docker

Run & manage containers

  • Run a container (detached, published port)docker
    docker run -d --name -p :
    · host = host port · container = container port
  • Run an interactive shell, remove on exitdocker
    docker run --rm -it
  • Run with an env var and a volumedocker
    docker run -d -e = -v :
  • List running containersdocker
    docker ps
  • List all containers (incl. stopped)docker
    docker ps -a
  • Open a shell in a running containerdocker
    docker exec -it
  • Follow a container’s logsdocker
    docker logs -f
  • Stop a containerdocker
    docker stop
  • Force-remove a containerdestructivedocker
    docker rm -f
  • Get a container’s IP addressdocker
    docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}'
  • Live resource usagedocker
    docker stats
  • Copy a file out of a containerdocker
    docker cp :

Images

  • Build an image from the current dirdocker
    docker build -t .
  • List imagesdocker
    docker images
  • Pull an imagedocker
    docker pull
  • Tag an image for a registrydocker
    docker tag /
  • Push an imagedocker
    docker push
  • Remove an imagedestructivedocker
    docker rmi

Compose

  • Start the stack (detached)docker
    docker compose up -d
  • Stop and remove the stackdocker
    docker compose down
  • Stop the stack and delete its volumesdestructivedocker
    docker compose down -v

    Also removes named volumes — data is lost.

  • Follow logs for a servicedocker
    docker compose logs -f
  • List compose servicesdocker
    docker compose ps
  • Run a command in a servicedocker
    docker compose exec
    Convert env vars →
  • Rebuild service imagesdocker
    docker compose build --no-cache

Cleanup

  • Show disk usagedocker
    docker system df
  • Remove dangling datadestructivedocker
    docker system prune

    Removes stopped containers, unused networks, and dangling images.

  • Aggressively reclaim everything unuseddestructivedocker
    docker system prune -a --volumes

    Also removes all unused images AND volumes — can delete a lot. Be sure.

kubectl

Contexts & namespaces

  • List contextskubectl
    kubectl config get-contexts
  • Switch context (cluster)kubectl
    kubectl config use-context
  • Set the default namespacekubectl
    kubectl config set-context --current --namespace=
  • List namespaceskubectl
    kubectl get namespaces

Inspect resources

  • List pods in a namespacekubectl
    kubectl get pods -n
  • List pods across all namespaceskubectl
    kubectl get pods --all-namespaces
  • List pods with node/IP (wide)kubectl
    kubectl get pods -o wide
  • Dump a resource as YAMLkubectl
    kubectl get -o yaml
  • Describe a resource (events, state)kubectl
    kubectl describe
  • Recent events, newest lastkubectl
    kubectl get events --sort-by=.lastTimestamp
  • Pod CPU/memory usagekubectl
    kubectl top pods -n

Logs & exec

  • Follow a pod’s logskubectl
    kubectl logs -f
  • Logs of one container in a podkubectl
    kubectl logs -c
  • Logs from the previous (crashed) containerkubectl
    kubectl logs --previous
  • Open a shell in a podkubectl
    kubectl exec -it --
  • Port-forward to a pod/servicekubectl
    kubectl port-forward :

Apply & manage

  • Apply a manifestkubectl
    kubectl apply -f
  • Delete a resourcedestructivekubectl
    kubectl delete
  • Scale a deploymentkubectl
    kubectl scale deployment --replicas=
  • Create a ConfigMap from a .env filekubectl
    kubectl create configmap --from-env-file=
    Build ConfigMap/Secret →
  • Create a Secret from literalskubectl
    kubectl create secret generic --from-literal==
    Build ConfigMap/Secret →

Rollouts

  • Watch a rolloutkubectl
    kubectl rollout status deployment/
  • Restart a deployment (rolling)kubectl
    kubectl rollout restart deployment/
  • Roll back to the previous revisiondestructivekubectl
    kubectl rollout undo deployment/

curl

Basics

  • GET a URLcurl
    curl
  • Follow redirectscurl
    curl -L
  • Silent (no progress), still show errorscurl
    curl -sS
  • Download to a named filecurl
    curl -o
  • Download keeping the remote filenamecurl
    curl -OL

Methods & data

  • POST JSONcurl
    curl -X POST -H "Content-Type: application/json" -d ''
  • PUT with datacurl
    curl -X PUT -d ''
  • DELETE a resourcecurl
    curl -X DELETE
  • POST a form / upload a filecurl
    curl -F =@
  • POST url-encoded fieldscurl
    curl -d =

Headers & auth

  • Send a custom headercurl
    curl -H ": "
  • Bearer token authcurl
    curl -H "Authorization: Bearer "
  • Basic authcurl
    curl -u :

Debug & inspect

  • Headers only (HEAD request)curl
    curl -I
  • Verbose (see request + TLS handshake)curl
    curl -v
  • Print status code and total timecurl
    curl -s -o /dev/null -w '%{http_code} %{time_total}s\n'
  • Skip TLS certificate verificationdestructivecurl
    curl -k

    Disables cert checking — for local/self-signed only, never in production.

  • Override DNS for a hostcurl
    curl --resolve ::

tar

Create

  • Create a .tar.gz archivetar
    tar -czf .tar.gz
  • Create an uncompressed .tartar
    tar -cf .tar
  • Create a .tar.xz (smaller, slower)tar
    tar -cJf .tar.xz
  • Create, excluding a patterntar
    tar --exclude= -czf .tar.gz

Extract

  • Extract a .tar.gz heretar
    tar -xzf .tar.gz
  • Extract any tar (auto-detect compression)tar
    tar -xf
  • Extract into a specific directorytar
    tar -xzf .tar.gz -C
  • Extract a single file/dirtar
    tar -xzf .tar.gz

List & inspect

  • List archive contentstar
    tar -tzf .tar.gz
  • List with sizes and permissionstar
    tar -tvzf .tar.gz

Variants

  • Create a .tar.bz2tar
    tar -cjf .tar.bz2
  • Create and print each file addedtar
    tar -czvf .tar.gz

SSH & SCP

Connect

  • Connect to a hostssh
    ssh @
  • Connect on a non-default portssh
    ssh @ -p
  • Connect with a specific keyssh
    ssh -i @
  • Run a single command remotelyssh
    ssh @ ''

Keys

  • Generate an ed25519 key pairssh
    ssh-keygen -t ed25519 -C ""
  • Install your public key on a hostssh
    ssh-copy-id @
  • Add a key to the agentssh
    ssh-add

Tunnels (port-forwarding)

  • Local forward (reach a remote service locally)ssh
    ssh -L :: @
  • Background tunnel (no shell)ssh
    ssh -fN -L :localhost: @
  • Remote forward (expose a local service)ssh
    ssh -R :localhost: @
  • Dynamic SOCKS proxyssh
    ssh -D -fN @

Copy files

  • Copy a local file to a hostssh
    scp @:
  • Copy a remote file downssh
    scp @:
  • Copy a directory recursivelyssh
    scp -r @:
  • Sync a directory over SSH (fast, resumable)ssh
    rsync -avz -e ssh @:

Config

  • ~/.ssh/config host aliasssh
    # ~/.ssh/config Host HostName User Port IdentityFile

    Then just `ssh <alias>`. Put this in ~/.ssh/config.

systemd (systemctl & journalctl)

Service control

  • Show a unit’s statussystemctl
    systemctl status
    unit = service/unit name
  • Start a service nowsystemctl
    sudo systemctl start
  • Stop a service nowsystemctl
    sudo systemctl stop
  • Restart a servicesystemctl
    sudo systemctl restart
  • Reload config without dropping connectionssystemctl
    sudo systemctl reload

Enable at boot

  • Enable and start immediatelysystemctl
    sudo systemctl enable --now
  • Disable and stop immediatelysystemctl
    sudo systemctl disable --now
  • Is a unit enabled at boot?systemctl
    systemctl is-enabled
  • Mask a unit (prevent it starting at all)destructivesystemctl
    sudo systemctl mask

Inspect units

  • List running unitssystemctl
    systemctl list-units --type=service --state=running
  • List failed unitssystemctl
    systemctl --failed
  • Show a unit filesystemctl
    systemctl cat
  • Override a unit (drop-in)systemctl
    sudo systemctl edit
  • Reload systemd after editing unit filessystemctl
    sudo systemctl daemon-reload

Timers

Logs (journalctl)

  • Follow a unit’s logs livesystemctl
    journalctl -u -f
  • A unit’s logs since a timesystemctl
    journalctl -u --since ""
    · since = e.g. "2024-01-01" or "10 min ago"
  • Logs from the current bootsystemctl
    journalctl -b
  • Kernel messages (like dmesg)systemctl
    journalctl -k
  • Only errors and worsesystemctl
    journalctl -p err -b
  • Trim the journal to a sizesystemctl
    sudo journalctl --vacuum-size=
    size = e.g. 200M, 1G

Cron

Manage your crontab

  • List the current crontabcron
    crontab -l
  • Edit the crontabcron
    crontab -e
  • List another user’s crontabcron
    sudo crontab -l -u
  • Remove the crontabdestructivecron
    crontab -r

    Deletes the whole crontab with no confirmation. Back it up first with crontab -l.

  • Install a crontab from a filecron
    crontab

The five fields

  • Field ordercron
    # min hour day-of-month month day-of-week command command

    minute hour day-of-month month day-of-week — then the command.

    Build interactively →
  • Operators: * , - /cron
    */15 9-17 * * 1-5

    * = every · , = list (1,15) · - = range (9-17) · / = step (*/15). This one: every 15 min, 9am–5pm, Mon–Fri.

    Build interactively →

Common schedules

Macros & special

  • @daily (midnight)cron
    @daily
  • @hourlycron
    @hourly
  • @reboot (run once at startup)cron
    @reboot

    Runs when cron starts after boot. In systemd, this maps to OnBootSec=.

    Convert to a systemd timer →
  • Pin a time zone with CRON_TZcron
    CRON_TZ= 0 9 * * 1-5

    Cron uses the machine’s local clock; CRON_TZ makes a job fire at a specific zone’s time across DST.

    zone = IANA zoneConvert time zone →