Skip to content
Onebox

CLI commands

Generated from the binary, so it cannot describe a flag the CLI does not have. ob <command> --help is the same text.

Which command changes nothing

Section titled “Which command changes nothing”

Many commands change nothing — status, logs, audit, schema, version and canonical all just report. These five are the ones that get confused with each other, because each one answers “would this deploy work?” from a different place.

CommandReadsContacts the server
ob validatethe project fileno
ob previewthe runtime it would generateno
ob doctorthis runner, its local SSH agent, and the environment’s policyno
ob preflightthe server’s readiness to accept a deployyes
ob planthe project, the server, and writes a plan artifactyes

ob plan is the only one of the five that writes a file, and it writes it locally.

ob

Section titled “ob”
onebox (ob) — plan-before-apply production operations for one application on one server.


You describe what the application is in ob.yml (or ob.yaml); Onebox generates
the Compose runtime, the names, the routing and the supporting services.
Agentless over SSH, health-gated, journaled and fenced.


Usage:
  ob [flags]
  ob [command]


Available Commands:
  abort       revert an interrupted deploy to the previous release (migration-gated)
  approve     record a local human confirmation for one exact executable plan
  audit       who deployed what, when, from which SHA — incl. failed runs
  bootstrap   first contact: host setup, registry login, and supporting/data services
  canonical   print the canonical form Onebox understood, with where each value came from
  completion  Generate the autocompletion script for the specified shell
  deploy      show the plan, confirm, and release with health-gated zero downtime
  destroy     tear the app down (typed confirmation; volumes kept unless --volumes)
  doctor      check local runner provenance and deployment safety capabilities
  eject       write the generated runtime into the repository and hand it over for good
  exec        run a command inside a workload or service container
  help        Help about any command
  init        scaffold ob.yml from the compose file + rollability doctor
  job         plan and run a sealed one-shot manual job
  logs        compose logs from the current release
  plan        refresh → rendered diff + pinned images + command list → plan artifact
  preflight   ask the server whether this project could be deployed (changes nothing)
  preview     render the runtime the declarative contract generates (no target, no changes)
  proxy       manage the host-scoped proxy (proxy.managed: true)
  resume      continue an interrupted deploy from the journal (fences the old runner)
  rollback    re-release the previous release dir (pinned local image)
  schema      print the JSON Schema for the project file, for editors
  secrets     SOPS-encrypted secrets
  service     manage supporting and data services
  status      recorded versus actual state per workload and service
  validate    validate schema, workloads, and rollability — no side effects
  version     print version and build provenance


Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
  -h, --help            help for ob
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command
      --version         version for ob


Use "ob [command] --help" for more information about a command.

ob abort

Section titled “ob abort”
Revert an interrupted deploy to the release that was serving before it.


Gated on what the interrupted deploy already did: a migration whose effect
cannot be reversed by re-activating a directory refuses, because reverting
the containers would leave them running against data they do not match.


Usage:
  ob abort [flags]


Flags:
      --break-lock             break a stale operation lock after inspecting its holder
      --break-migration-gate   abort past a closed migration gate (you assert schema compatibility)
  -h, --help                   help for abort


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob approve

Section titled “ob approve”
Record a short-lived local confirmation bound to one exact plan and, when supplied, one exact backup report.


Prompts for confirmation, because approving is a human act: a routine plan
asks yes or no, and one that touches data asks for the release identifier to
be typed back. There is no flag to skip it. The artifact is tamper-evident but
is not an authenticated identity-provider signature. Contacts nothing.


Usage:
  ob approve [flags]


Flags:
      --backup-report string   backup report to bind into this local confirmation
  -h, --help                   help for approve
  -o, --out string             local confirmation artifact path (default "ob-approval.json")
      --plan string            executable plan artifact to approve


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob audit

Section titled “ob audit”
Who did what, when, and from which revision — including runs whose terminal
is long gone.


Reads the append-only journals on the host. One row per invocation, so a
rollback appears as its own event rather than hiding inside the release it
restored.


Usage:
  ob audit [flags]


Flags:
  -n, --count int   journals to show (default 10)
  -h, --help        help for audit


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob bootstrap

Section titled “ob bootstrap”
Prepare a host: install what the deploy needs, create the layout, log in to
registries, start the proxy, and start supporting services.


Run once per host before the first deploy. It is safe to run again — each
step converges rather than repeats. Application images, source and environment
payloads are not required or staged; `ob deploy` binds and releases them.


Usage:
  ob bootstrap [flags]


Flags:
      --break-lock   break a stale bootstrap lock after inspecting its holder
  -h, --help         help for bootstrap


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob canonical

Section titled “ob canonical”
Print the project as Onebox normalised it for an environment: shorthand
expanded, defaults filled, overrides applied.


Values you did not write are marked with their origin, because the difference
between a value someone chose and one that appeared by default is what a
person checking a production configuration needs to see.


Usage:
  ob canonical [flags]


Flags:
  -h, --help           help for canonical
      --origins-only   list every value's origin instead of the document


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob deploy

Section titled “ob deploy”
Release: run pre-release jobs, replace workloads behind their health checks,
verify, and move the current symlink.


This is the only way an application reaches a host. It takes the deploy lock,
fences any older runner, journals every phase, drains connections before
stopping a container, and can roll back. Without --plan it plans inline and
asks for confirmation; with --plan it applies exactly what was reviewed.


If it is interrupted, `ob resume` finishes it and `ob abort` reverts it.


Usage:
  ob deploy [flags]


Flags:
      --approval string                    apply a plan-bound local confirmation artifact
      --backup-report string               apply the backup report bound into the local confirmation
      --break-lock                         break a stale deploy lock after inspecting its holder
  -h, --help                               help for deploy
      --image stringArray                  resolved image as workload=reference, for build-sourced workloads (repeatable)
      --no-rollback                        verify failures halt; never auto-rollback
      --override-migration-backup string   audited break-glass reason for proceeding without a required backup report (requires --approval)
      --plan string                        apply a saved plan artifact (binds config + host state; local confirmation is separate)
      --redeploy                           deploy even when nothing changed (fresh roll of identical content)
  -y, --yes                                skip the confirmation prompt


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob destroy

Section titled “ob destroy”
Tear the application down: every container it owns, its scheduled timers, and
its state directory.


Requires the application name typed back. Volumes are kept unless --volumes,
and when they are kept the service credentials are kept with them — a volume
whose credential is gone cannot be opened by a new one. The host proxy survives
unless --proxy is supplied.


Usage:
  ob destroy [flags]


Flags:
  -h, --help      help for destroy
      --proxy     also remove this host's managed proxy
      --volumes   also remove named volumes (DATA LOSS)


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob doctor

Section titled “ob doctor”
Check this runner and the safety capabilities of the environment it targets.


Reports the runner's provenance and whether it satisfies the environment's
minimum version and plan schema, and names every workload and service holding
durable data that has no backup — Onebox does not take backups, and silence
there would read as approval. In structured output, automation should gate on
the report status: data.status for pass or warn, and error.details.status for
a failing diagnosis.


Usage:
  ob doctor [flags]


Flags:
  -h, --help   help for doctor


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob eject

Section titled “ob eject”
Write the runtime Onebox generates into your repository as ordinary Compose,
and repoint the affected workloads at it.


This is one way. Onebox will not regenerate or reconcile those services
afterwards. The written file carries none of the identity or routing keys
Onebox adds, so it is a file you own rather than one it half-owns, and your
project file keeps its comments and ordering.


Usage:
  ob eject [flags]


Flags:
  -h, --help                help for eject
      --image stringArray   resolved image as workload=reference (repeatable)
  -o, --out string          repository path to write the runtime to (default: a free name beside the project)
      --overwrite           replace an existing file at the destination


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob exec

Section titled “ob exec”
Run a command inside a running container.


Names a workload or a supporting service. This is an escape hatch: it does not
claim convergence, rollback, idempotence, or output redaction. Onebox journals
the reason, target, target kind, operator, outcome, and command digest — never
the command bytes or passthrough output.


Arguments are passed as a literal vector, so a shell metacharacter is not
interpreted: write `ob exec --reason 'inspect queue' web -- sh -c 'a && b'`
rather than passing the pipeline as one word. Reasons are durable metadata; do
not put credentials or other sensitive values in them.


Usage:
  ob exec <workload|service> -- <command...> [flags]


Flags:
  -h, --help            help for exec
      --reason string   single-line operational justification (max 256 bytes; journaled)


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob init

Section titled “ob init”
Scaffold `ob.yml` from the Compose file already in this repository.


A starting point, not permission to deploy: read what it inferred about
roles, persistence, health and job data effects before planning. Writes only
in this repository and contacts nothing.


Usage:
  ob init [flags]


Flags:
  -h, --help   help for init


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob job

Section titled “ob job”
Plan and run one declared `when: manual` job against the current serving release.


The job remains in the release runtime but never runs during deploy. Saved plans
bind its release, runtime digest, immutable image and data effect so agents can
obtain a separate approval before execution.


Usage:
  ob job [flags]
  ob job [command]


Available Commands:
  plan        seal a current-release-bound one-shot job plan
  run         run one manual job from an inline or saved sealed plan


Flags:
  -h, --help   help for job


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command


Use "ob job [command] --help" for more information about a command.

ob job plan

Section titled “ob job plan”
Observe the current serving release and write a short-lived executable job plan.


The plan binds the exact runtime digest, digest-pinned image, job data effect,
target and expiry. It reads the target and writes only the local plan artifact.


Usage:
  ob job plan <id> [flags]


Flags:
      --backup-report-out string   write a plan-bound backup report template when migration protection is required
  -h, --help                       help for plan
  -o, --out string                 job plan artifact path (default "ob-job-plan.json")


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob job run

Section titled “ob job run”
Run one manual job through the canonical lock, fence, local-confirmation and journal boundary.


Humans may pass an id and confirm interactively. Automation should supply a
saved --plan and its separately created local-confirmation artifact through
--approval; migration plans may also require the exact plan-bound --backup-report.


Usage:
  ob job run [id] [flags]


Flags:
      --approval string                    apply a plan-bound local confirmation artifact
      --backup-report string               apply the backup report bound into the local confirmation
      --break-lock                         break a stale operation lock after inspecting its holder
  -h, --help                               help for run
      --override-migration-backup string   audited break-glass reason (requires --approval)
      --plan string                        apply a saved job plan artifact


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob logs

Section titled “ob logs”
Stream logs from one workload or Onebox-run supporting service. Reads only.


Log bytes are operator-controlled and may contain secrets; Onebox does not claim
to redact passthrough output.


Usage:
  ob logs <workload|service> [flags]


Flags:
  -f, --follow     stream
  -h, --help       help for logs
      --tail int   lines per service (default 100)


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob plan

Section titled “ob plan”
Read the target's current state, render the runtime, pin every image to a
digest, and write a plan artifact.


Reads the target but changes nothing there. The plan binds the configuration,
the rendered runtime, the host state and the pinned images, and expires after
15 minutes — so a tag that moves afterwards cannot change what is deployed.
Approve it with `ob approve --plan`, apply it with `ob deploy --plan`.


Usage:
  ob plan [flags]


Flags:
      --backup-report-out string   write a plan-bound backup report template when migration protection is required
  -h, --help                       help for plan
      --image stringArray          resolved image as workload=reference, for build-sourced workloads (repeatable)
  -o, --out string                 plan artifact path (default "ob-plan.json")


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob preflight

Section titled “ob preflight”
Render the project locally, then ask the server what would stand in the way:
a missing container runtime, a base path this account cannot write, a derived
name already held by something Onebox does not own, a missing ingress network.


Every problem is reported at once rather than the first one, and nothing is
created, renamed or removed.


Usage:
  ob preflight [flags]


Flags:
  -h, --help   help for preflight


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob preview

Section titled “ob preview”
Load an onebox.run/v1 project, resolve the environment's overrides, and print
the Compose runtime Onebox would generate, with its content digest.


Nothing is contacted and nothing is written. Environment values are redacted:
a preview must never put a secret on a terminal.


Usage:
  ob preview [flags]


Flags:
      --digest-only         print the content digest and nothing else
  -h, --help                help for preview
      --image stringArray   resolved image for a build-sourced workload, as workload=reference (repeatable)
      --raw                 do not redact environment values
      --release string      release identity to stamp (default "preview")


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob proxy

Section titled “ob proxy”
Manage the host-scoped proxy owned by this host's sole Onebox application.


The proxy outlives application releases and holds the public ports and
certificates. A different application identity is refused before mutation.


Usage:
  ob proxy [flags]
  ob proxy [command]


Available Commands:
  apply       converge the host proxy — diff shown; unchanged config never touches the container (ACME-safe)


Flags:
  -h, --help   help for proxy


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command


Use "ob proxy [command] --help" for more information about a command.

ob proxy apply

Section titled “ob proxy apply”
Reconfigure the host proxy from the sole owning application's routes.


Taken under the host lock because the proxy belongs to the box rather than to
a release. Cross-application route merging is not supported.


Usage:
  ob proxy apply [flags]


Flags:
      --break-lock   break a stale host lock after inspecting its holder
  -h, --help         help for apply


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob resume

Section titled “ob resume”
Continue a deploy that was interrupted, from the journal.


Fences the runner that stopped so it cannot wake up and act on stale state,
then carries on from the last completed phase. Use when the interruption was
the runner's — a lost connection, a killed process — rather than the
release's.


Usage:
  ob resume [flags]


Flags:
  -h, --help   help for resume


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob rollback

Section titled “ob rollback”
Re-activate the previous release from the directory still on the host.


Nothing is pulled and nothing is rebuilt: the previous release's images are
already there, which is what makes this fast and available when a registry is
not. Refused when there is no previous release, or when its snapshot is
unavailable or unusable. Supporting services are not rolled back, so a
migration a job already applied stays applied — moving the symlink does
not undo it.


Usage:
  ob rollback [flags]


Flags:
  -h, --help   help for rollback


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob schema

Section titled “ob schema”
Write the JSON Schema for the `onebox.run/v1` project file.


Reference it from the first line of a project so an editor can offer
completion, hover documentation and inline errors:


  # yaml-language-server: $schema=https://raw.githubusercontent.com/labstack/onebox/main/docs/onebox.run-v1.schema.json


Or keep a copy in the repository with --out, which is what an editor
needs when the machine is offline.


Usage:
  ob schema [flags]


Flags:
  -h, --help         help for schema
  -o, --out string   write to this path instead of standard output


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob secrets

Section titled “ob secrets”
SOPS-encrypted secrets for this project.


`list` names every value-free declaration and its stable entry ID. `edit`
decrypts the selected source to a temporary file, opens an editor, and re-encrypts.
`push` renders the decrypted values into the current release on the host
and restarts what reads them. Plaintext never enters the project file, the
generated runtime, or any plan.


Usage:
  ob secrets [flags]
  ob secrets [command]


Available Commands:
  edit        open one encrypted source in $EDITOR via sops
  list        list value-free secret declarations and stable entry IDs
  push        re-render secrets into the live release and restart workloads if changed


Flags:
  -h, --help   help for secrets


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command


Use "ob secrets [command] --help" for more information about a command.

ob secrets edit

Section titled “ob secrets edit”
Decrypt the secrets file, open it in $EDITOR, and re-encrypt on save.


Plaintext exists only in a temporary file for the life of the editor. It
never enters the project file, the generated runtime, or any plan.


Usage:
  ob secrets edit [entry-id] [flags]


Flags:
  -h, --help   help for edit


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob secrets list

Section titled “ob secrets list”
List the encrypted secret declarations active in the selected environment.


The result contains stable entry IDs, source paths, scopes, output paths, and
affected workloads, but never decrypted values. Pass an ID to `ob secrets edit`
when more than one editable source exists.


Usage:
  ob secrets list [flags]


Flags:
  -h, --help   help for list


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob secrets push

Section titled “ob secrets push”
Render the complete decrypted secret graph into the current release on the host and
replace every workload that reads the declared secret graph when any value changes.


The payload is uploaded and compared on the host even for a no-op; unchanged values do
not replace or restart workloads. Refused when secret declarations differ from the
deployed release, or when that release predates opaque secret generations. In either
case, deploy first.


Usage:
  ob secrets push [flags]


Flags:
  -h, --help   help for push


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob service

Section titled “ob service”
Manage the supporting services this project declares.


They run in their own Compose projects, so no deploy and no rollback can
stop them or remove their volumes. `apply` converges them to what the
project declares; a major version change a driver cannot perform in place
is refused rather than attempted.


Usage:
  ob service [flags]
  ob service [command]


Available Commands:
  apply       planned service convergence — diff shown, destructive mounts refused without --allow-destructive-mounts


Flags:
  -h, --help   help for service


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command


Use "ob service [command] --help" for more information about a command.

ob service apply

Section titled “ob service apply”
Converge the supporting services to what the project declares.


Each runs in its own Compose project, so this never touches a release and a
release never touches it. A change a driver can apply in place is applied; a
major version change it cannot — a data directory the new version could not
open — is refused with what to do instead, rather than replacing the
container and leaving the data intact and unreachable.


Usage:
  ob service apply [flags]


Flags:
      --allow-destructive-mounts   permit only the mount detachments named in the service plan
      --break-lock                 break a stale operation lock after inspecting its holder
  -h, --help                       help for apply


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob status

Section titled “ob status”
Compare what the host records against what it is actually running, per
workload and service.


Reads only. Reports the recorded release, each container's release label and
health, replica shortfalls, the proxy, and any incomplete deploy. Exits
non-zero on divergence so a script can branch on it.


Usage:
  ob status [flags]


Flags:
  -h, --help   help for status


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob validate

Section titled “ob validate”
Load the project, expand shorthand, apply defaults and the environment's
overrides, and check every rule the contract states.


Contacts nothing and writes nothing. Build metadata is valid before CI supplies
a release image; plan and deploy require that image via `--image`. A failure
names the field, the line and the constraint; `ob canonical` shows what was
understood.


Usage:
  ob validate [flags]


Flags:
  -h, --help   help for validate


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command

ob version

Section titled “ob version”
Print the version and build provenance of this binary.


Environment policy can require a released runner, so a commit-derived or
dirty build is reported as such rather than as a version.


Usage:
  ob version [flags]


Flags:
  -h, --help   help for version


Global Flags:
  -c, --config string   path to the project YAML file (default "ob.yml")
  -e, --env string      environment name (default "production")
      --output string   output mode for supported commands: human|json|ndjson (see the CLI reference) (default "human")
  -v, --verbose         print every remote command