CLI reference
ply <command> --help is always current; this page is the map.
#Build & validate
ply build [DIR] [-o FILE] [--insecure-source]Resolve dependencies (writing ply.lock), produce a deterministic image
named <name>-<version>-<os>-<arch>.img.
ply check IMAGE [--against policy.toml]Validate an image; with --against, check it against a host runtime policy.
Pure function — wire it into CI.
#Run & observe
ply run IMAGE [--scale N] [-e K=V]… [--env-file F] [--link HOST:CONTAINER]Foreground, signals work, exit code propagates.
ply ps [--json]
ply stats [APP|APP.N] [--json] [--sample-ms MS]
ply exec APP[.N] CMD…#Lifecycle
ply deploy IMAGE [--timeout S] # rolling deploy, health-gated (see Deploys)
ply rm APP [--volumes] # volumes kept unless --volumes
ply gc # drop store entries nothing references#Images
ply rebase IMAGE --runtime [email protected] [-o FILE] # swap a runtime, no rebuild
ply bundle IMAGE -o FILE # flatten to fat mode
ply import docker://image:tag -o FILE # OCI bridge (fat mode)#Package authoring
ply craft new|shell|edit|changes|commit|ls|rmInteractive package authoring — shell in, install, commit the diff as an inert package. See Making packages.
#Host integration
ply systemd IMAGE # emit a unit file (supervision = systemd)
ply proxy [--backend caddy] # emit reverse-proxy config for all apps
ply lb APP [--format nginx] # emit one app's LB backend pool
ply setup # one-time host prep (idempotent, sudo)
ply sync # pre-fetch the host policy's packages#Fleet hygiene
ply audit # shared volumes, deprecated runtimes, risk surface
ply outdated # dependencies with newer versions available#Conventions
--jsoneverywhere it matters —ps,statsare stable interfaces for scripts.- Foreground by default — backgrounding is systemd's job, emitted for you.
- Destructive actions are explicit — data deletion never rides along
(
rmkeeps volumes;--volumesis the separate act). - Exit codes propagate —
ply runin CI behaves like running the binary.