cdnctl Reference

install — package managers

# macOS and Linux (Homebrew)
brew install mediatriple/tap/cdnctl

# Debian / Ubuntu (signed APT repository)
curl -fsSL https://cdn.com.tr/downloads/cdn-com-tr.gpg \
  | sudo gpg --dearmor -o /usr/share/keyrings/cdn-com-tr.gpg
echo "deb [signed-by=/usr/share/keyrings/cdn-com-tr.gpg] \
https://cdn.com.tr/downloads/deb stable main" \
  | sudo tee /etc/apt/sources.list.d/cdn-com-tr.list
sudo apt-get update && sudo apt-get install cdnctl

# RHEL / Fedora / Rocky (signed YUM repository)
sudo tee /etc/yum.repos.d/cdn-com-tr.repo >/dev/null <<'EOF'
[cdn-com-tr]
name=cdn.com.tr
baseurl=https://cdn.com.tr/downloads/rpm
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://cdn.com.tr/downloads/cdn-com-tr.gpg
EOF
sudo dnf install cdnctl

# Go toolchain
go install github.com/mediatriple/cdnctl@latest

Installed through a package manager, cdnctl upgrades with that package manager (brew upgrade cdnctl, apt-get install --only-upgrade cdnctl, dnf upgrade cdnctl) and cdnctl update deliberately steps aside, so it never overwrites a file dpkg, rpm or Homebrew owns.

install — script or direct download

curl -fsSL https://cdn.com.tr/downloads/cdnctl/install.sh | sh

# pin a specific version
CDNCTL_VERSION=0.17.2 curl -fsSL https://cdn.com.tr/downloads/cdnctl/install.sh | sh

Downloads the latest release for your platform, verifies it against the published checksums, and installs the binary.

Archives for linux (amd64/arm64), macOS (amd64/arm64) and Windows (amd64), each with a SHA256 checksums file, are published at /downloads/cdnctl/ and on the GitHub releases page. cdnctl is open source: github.com/mediatriple/cdnctl (MIT).

update

cdnctl update --check
cdnctl update --yes
cdnctl update --version <version> --yes

Self-updates the installed binary from the public release channel. The downloaded archive is verified against the published checksum file before the binary is replaced.

login

cdnctl login [--password-login] [--email <email>] [--password <password>] [--endpoint <url>]

Signs in and saves a token to ~/.cdnctl/config.json. By default a browser opens and your account approves this terminal, so no password is typed into the CLI; add --password-login to sign in with email and password instead (this is also what happens automatically when there is no terminal, e.g. CI). Use once per machine; the token is reused for subsequent commands.

configure

cdnctl configure [--endpoint <url>] [--token <token>]

Manually sets the endpoint or token without logging in. Useful for CI environments or token-based automation.

accounts list

cdnctl accounts list

Lists all CDN accounts accessible to the authenticated user (full JSON). The uuid field is used as --account in all other commands.

accounts ls

cdnctl accounts ls

A short, human-friendly version of the list — one line per account with just the uuid, domain, and type. Handy for finding the uuid to save as your default.

accounts use / current / clear

cdnctl accounts use <uuid>
cdnctl accounts current
cdnctl accounts clear

Save a default account once so you don't have to pass --account <uuid> on every command. After accounts use, account-scoped commands use the saved account automatically (they print (using saved account <uuid>) so you know which one); pass --account any time to override it. current shows it, clear forgets it.

Set your account once

cdnctl accounts use <uuid>

So the file commands below don't need --account every time. (Run cdnctl accounts ls to find your uuid.)

List files — files ls

cdnctl files ls                       # lists wp-content (uploads, plugins, themes, …)
cdnctl files ls --path uploads
cdnctl files ls --path uploads/2026

With no --path it lists the wp-content root.

Upload files — cp

cdnctl cp ./photo.jpg /uploads/photo.jpg
cdnctl cp ./backup.zip /uploads/backup.zip
cdnctl cp ./my-plugin.php /plugins/my-plugin/my-plugin.php

# upload a whole folder as one archive (structure is preserved):
cdnctl cp -r ./my-folder /uploads/my-folder

Add -r to upload a whole folder. It travels as one archive, not file by file, so even thousands of files take seconds; the folder structure is recreated under the destination, empty folders included, and every file is checked against its SHA-256 on the server before it is put in place. Existing files are not overwritten unless you add --force. You can also spell out the account inline as <uuid>:/uploads/photo.jpg instead of saving a default.

Download files — cp

cdnctl cp :/uploads/photo.jpg ./                      # into the current folder
cdnctl cp :/plugins/my-plugin/my-plugin.php ./backup.php
cdnctl cp <account_uuid>:/uploads/photo.jpg ./          # a specific account

# download a whole folder recursively (its contents land in ./backup):
cdnctl cp -r :/uploads/2026 ./backup

# the same single-file download as an explicit sub-command:
cdnctl files get --path /uploads/photo.jpg --out ./photo.jpg

Put the remote path first, with a colon in front of it — the same order scp uses. : alone means your default account; write <account_uuid>:path for another one. The file lands in the folder you name (or at the file name you give). With -r a remote folder comes down as one archive into the local folder; -r with an empty path (<account_uuid>:) brings the whole storage. Every download is checked against its size and SHA-256 before anything is written; an existing local file is replaced only with --force. A single file (without -r) can be up to 10 MB.

Keep a folder in sync — sync

# upload what changed in ./my-theme (rsync-style, one direction):
cdnctl sync ./my-theme :/themes/my-theme

# download what changed on the server:
cdnctl sync :/uploads ./uploads-backup

# mirror, deleting what the source no longer has — look at the plan first:
cdnctl sync --delete --dry-run ./my-theme :/themes/my-theme
cdnctl sync --delete --exclude '*.log' ./my-theme :/themes/my-theme

# compare by SHA-256 instead of size and modification time:
cdnctl sync -c :/uploads ./uploads-backup

Works like rsync, in one direction: SOURCE and DESTINATION, exactly one of them remote. Only what differs is moved — by size and modification time, or by SHA-256 with -c — and modification times are kept, so a second run moves nothing. --delete also removes what the source no longer has (never the folder itself or excluded names, and nothing at all if anything in the run failed); --dry-run prints the plan (+ new, ~ changed, - deleted, ! skipped) without changing anything; --exclude leaves names out (*.log, /cache/). A trailing slash makes no difference: the contents of SOURCE always go into DESTINATION. Symbolic links are reported and left alone.

Create a folder — files mkdir

cdnctl files mkdir --path /uploads/2026/07

Delete a file — files rm

cdnctl files rm --path /uploads/photo.jpg --yes

Requires --yes. Only files can be deleted (directories are refused).

container apps list

cdnctl container apps list --account <uuid>

Lists all container apps under the account.

container apps create

cdnctl container apps create \
  --account <uuid> \
  --name <name> \
  --image <registry/image> \
  [--tag <tag>] \
  [--port <port>] \
  [--healthcheck <path>] \
  [--healthcheck-type http|tcp|none] \
  [--metrics-port <port>] \
  [--metrics-path <path>] \
  [--replicas <n>] \
  [--plan <code>] \
  [--domain <domain>] \
  [--env-json '{"KEY":"value"}'] \
  [--secrets-json '{"SECRET":"value"}'] \
  [--registry-credential <uuid>] \
  [--persistent-mount-path <path>] \
  [--persistent-storage-gb <n>]

Creates a new container app record and first revision. Does not deploy — run deploy after create.

container apps update

cdnctl container apps update \
  --account <uuid> \
  --app <uuid> \
  [--image <registry/image>] \
  [--tag <tag>] \
  [--port <port>] \
  [--replicas <n>] \
  [--healthcheck <path>] \
  [--healthcheck-type http|tcp|none] \
  [--metrics-port <port>] \
  [--metrics-path <path>] \
  [--domain <domain>] \
  [--env-json '{"KEY":"value"}'] \
  [--secrets-json '{"SECRET":"value"}'] \
  [--registry-credential <uuid>] \
  [--persistent-mount-path <path>]

Updates app settings. Only the flags you pass are changed. Run deploy after update to publish the new revision.

container apps deploy

cdnctl container apps deploy --account <uuid> --app <uuid>

Publishes the current configuration as a new revision. Use wait afterwards to block until the deployment reaches a target status.

container apps expose

cdnctl container apps expose --account <uuid> --app <uuid>

Mints a permanent, immutable <uid>.cdn.com.tr subdomain for the app. The subdomain never changes even if a custom domain is updated.

container apps restart

cdnctl container apps restart --account <uuid> --app <uuid>

Performs a rolling restart of all running replicas without creating a new revision.

container apps scale

cdnctl container apps scale --account <uuid> --app <uuid> --replicas <n>

Changes the replica count immediately without creating a new revision. Pass 0 to scale the app to zero.

container apps show

cdnctl container apps show --account <uuid> --app <uuid>

Returns full app configuration including the list of revisions. Use the revision UUIDs from this output with rollback.

container apps rollback

cdnctl container apps rollback --account <uuid> --app <uuid> --revision <revision_uuid>

Re-deploys a previous revision. Use show to list available revision UUIDs.

container apps operations

cdnctl container apps operations --account <uuid> --app <uuid>

Lists all platform operations recorded for the app, such as deploys, restarts, and scale events.

container apps status

cdnctl container apps status --account <uuid> --app <uuid>

Returns the current runtime status and last operation result of the app.

container apps wait

cdnctl container apps wait \
  --account <uuid> \
  --app <uuid> \
  --status <target> \
  [--timeout <seconds>] \
  [--interval <seconds>]

Polls app status until it reaches --status or the timeout expires. Exits 0 on success, 1 on failure or timeout. On failure, includes diagnose output automatically.

container apps logs

cdnctl container apps logs --account <uuid> --app <uuid> [--tail <n>]

Returns recent container log lines.

container apps diagnose

cdnctl container apps diagnose --account <uuid> --app <uuid> [--tail <n>]

Returns a combined status and log snapshot. Used automatically by wait on failure. Run this first when an app is stuck or failing.

container apps delete

cdnctl container apps delete --account <uuid> --app <uuid> --yes

Permanently deletes the app and all its revisions. This operation is irreversible.

container preflight

cdnctl container preflight --account <uuid>

Checks that the account is ready to run container workloads and returns a list of any issues found.

container registry-credentials list

cdnctl container registry-credentials list --account <uuid>

container registry-credentials create

cdnctl container registry-credentials create \
  --account <uuid> \
  --name <name> \
  --password <token> \
  [--registry-url <url>] \
  [--username <user>]

container registry-credentials delete

cdnctl container registry-credentials delete \
  --account <uuid> \
  --credential <credential_uuid> \
  --yes

Permanently removes a registry credential. Any apps that reference this credential will fail to pull images on the next deploy.

container addons list

cdnctl container addons list --account <uuid> --app <uuid>

Lists all add-ons currently attached to the app.

container addons enable-database

cdnctl container addons enable-database \
  --account <uuid> \
  --app <uuid> \
  [--plan <code>] \
  [--env-prefix <prefix>] \
  [--storage-mb <n>] \
  [--url-scheme <scheme>]

container addons disable-database

cdnctl container addons disable-database --account <uuid> --app <uuid>

container addons enable-redis

cdnctl container addons enable-redis \
  --account <uuid> \
  --app <uuid> \
  [--plan <code>] \
  [--env-prefix <prefix>]

container addons disable-redis

cdnctl container addons disable-redis --account <uuid> --app <uuid>

container addons enable-postgres

cdnctl container addons enable-postgres \
  --account <uuid> \
  --app <uuid> \
  [--plan <code>] \
  [--env-prefix <prefix>] \
  [--storage-mb <n>]

container addons disable-postgres

cdnctl container addons disable-postgres \
  --account <uuid> \
  --app <uuid> \
  [--delete-data --confirmation <app_name>]

Disables the Postgres add-on. By default data is retained. Pass --delete-data together with --confirmation to permanently destroy all data.

container addons enable-nats

cdnctl container addons enable-nats \
  --account <uuid> \
  --app <uuid> \
  [--plan <code>] \
  [--env-prefix <prefix>] \
  [--storage-mb <n>]

container addons disable-nats

cdnctl container addons disable-nats \
  --account <uuid> \
  --app <uuid> \
  [--delete-data]

Disables the NATS add-on. Pass --delete-data to permanently destroy all JetStream data.

container compose preview

cdnctl container compose preview --account <uuid> --file docker-compose.yml

Parses the compose file server-side and returns the import plan: apps to be created, add-on mappings, environment/secret key classification, warnings, unsupported services, and an entitlement check. Creates nothing. Secret values are never echoed back — only key names.

container compose apply

cdnctl container compose apply --account <uuid> --file docker-compose.yml --yes

Applies the import: creates the apps in dependency order and enables the mapped add-ons. All-or-nothing — if any app name conflicts with an existing app, or any service is unsupported (e.g. uses build:), nothing is created. Deploy each created app afterwards with container apps deploy.

container imports list

cdnctl container imports list --account <uuid> --app <uuid>

Lists all imports and their current status for the app.

container imports database

cdnctl container imports database \
  --account <uuid> \
  --app <uuid> \
  --file <path/to/dump.sql.gz>

Uploads and queues a gzip-compressed SQL dump for import into the managed database.

container imports files

cdnctl container imports files \
  --account <uuid> \
  --app <uuid> \
  --file <path/to/archive.tar.gz> \
  [--target-path <path>]

Uploads and extracts a tar.gz archive into the persistent volume.

container imports cancel

cdnctl container imports cancel \
  --account <uuid> \
  --app <uuid> \
  --import <import_uuid>

Cancels a queued or in-progress import. Has no effect if the import has already completed.

container jobs list

cdnctl container jobs list --account <uuid> --app <uuid>

container jobs create

cdnctl container jobs create \
  --account <uuid> \
  --app <uuid> \
  --name <name> \
  --schedule "<cron expression>" \
  --path </endpoint/path> \
  [--method <POST|GET>] \
  [--secret-header-name <header>] \
  [--secret-source <ENV_VAR>] \
  [--enabled]

container jobs run

cdnctl container jobs run \
  --account <uuid> \
  --app <uuid> \
  --job <job_uuid> \
  [--wait] \
  [--timeout <seconds>] \
  [--interval <seconds>]

Triggers an immediate one-off run of the job. Use --wait to block until the run completes or fails.

container jobs delete

cdnctl container jobs delete \
  --account <uuid> \
  --app <uuid> \
  --job <job_uuid> \
  --yes

Permanently removes the scheduled job.

object-storage buckets list

cdnctl object-storage buckets list --account <uuid>

object-storage buckets create

cdnctl object-storage buckets create \
  --account <uuid> \
  --name <bucket-name> \
  [--visibility private|public]

object-storage buckets usage

cdnctl object-storage buckets usage --account <uuid> --bucket <bucket_uuid>

Returns current storage usage statistics for the bucket.

object-storage buckets delete

cdnctl object-storage buckets delete --account <uuid> --bucket <bucket_uuid> --yes

Permanently deletes the bucket and all objects inside it. This operation is irreversible.

object-storage access-keys create

cdnctl object-storage access-keys create \
  --account <uuid> \
  [--bucket <uuid>] \
  [--name <name>]

Creates an S3-compatible access key. The secret_key field in the response is shown once and never returned again. Copy it before closing the terminal.

object-storage access-keys rotate

cdnctl object-storage access-keys rotate --account <uuid> --key <key_uuid>

Generates a new secret for the access key while keeping the same key UUID and bucket scope. The new secret_key is returned once and never again. Update any clients before rotating in production.

object-storage access-keys revoke

cdnctl object-storage access-keys revoke --account <uuid> --key <key_uuid> --yes

Permanently revokes and deletes the access key. Any clients still using this key will receive authentication errors immediately.

object-storage bindings create

cdnctl object-storage bindings create \
  --account <uuid> \
  --app <uuid> \
  --bucket <uuid> \
  [--access-key <uuid>] \
  [--env-prefix <prefix>]

Binds a bucket to an app. S3 credentials and endpoint are injected as environment variables on the next deploy.

object-storage bindings delete

cdnctl object-storage bindings delete \
  --account <uuid> \
  --app <uuid> \
  --binding <binding_uuid> \
  --yes

Removes the bucket binding from the app. The bucket and access key are not affected; only the environment variable injection is removed on the next deploy.

purge

cdnctl purge --account <uuid> --path /sitemap.xml [--path /other] [--type exact|prefix|variants] [--save]
cdnctl purge --account <uuid> --paths "/a,/b,/c" [--type prefix]

purge all

cdnctl purge all --account <uuid> --yes
cdnctl purge all status --account <uuid>

Empties the account's entire edge cache; the next requests go to your origin. purge all status shows whether the last full purge has finished on every edge.

waf logs

cdnctl waf logs [--account <uuid>] [--range 1h|1d|7d|30d] [--format table|json]

What the WAF matched in the window: rules, countries, client IPs and response codes — the same numbers as the panel's WAF page.

waf show

cdnctl waf show <ref> [--account <uuid>] [--format table|json]

One blocked request in detail. <ref> is the Reference ID on the block page your visitor saw (32 characters), or at least its first 12 characters as the panel table shows them. Searches the last 30 days of this account's sites and prints the request, every rule it matched with the matched data, and a verdict — for example whether an upload was blocked only because it was larger than the part of the body the WAF inspects. Exits with status 1 when nothing matches.

logs status / logs list

cdnctl logs status [--account <uuid>]
cdnctl logs list [--account <uuid>] [--day YYYY-MM-DD] [--format table|json]

logs status shows whether delivery is on, whether IPs are masked and how many days files are kept. logs list lists one UTC day's files — one per edge per five minutes.

logs pull

cdnctl logs pull [--account <uuid>] [--day YYYY-MM-DD] [--out <dir>]

Downloads every file of a UTC day into a folder. Running it again fetches only new files; the same folder is the cache logs grep uses.

logs grep

cdnctl logs grep --from "2026-09-25 14:00" --to "2026-09-25 15:00" \
  --status 5xx --path /api/ --format table
cdnctl logs grep --from 14:00 --ip 203.0.113.0/24 --count

Searches a time window on your own computer: downloads only the five-minute files that overlap the window (skipping any already in the cache), then filters every line. Filters combine; without a filter every line in the window is printed. Output is the raw JSON lines, ready for jq.