Command line
cdnctl Reference
Complete reference for cdnctl (v0.8.x). All commands output JSON. Authentication token is stored in ~/.cdnctl/config.json or read from the CDNCTL_TOKEN and CDNCTL_ENDPOINT environment variables.
delete or revoke requires an explicit --yes flag. Without it the command exits with an error and makes no changes.
Install & Update
cdnctl ships as a static binary for Linux, macOS, and Windows (amd64/arm64). It requires no PHP, Python, Node.js, or kubectl.
install
curl -fsSL https://cdn.com.tr/downloads/cdnctl/install.sh | sh
# pin a specific version
CDNCTL_VERSION=0.5.0 curl -fsSL https://cdn.com.tr/downloads/cdnctl/install.sh | sh
Downloads the latest release for your platform, verifies it against the published checksums, and installs the binary.
update
cdnctl update --check
cdnctl update --yes
cdnctl update --version <version> --yes
Self-updates the installed binary from the public release channel. The downloaded archive is verified against the published checksum file before the binary is replaced.
| Flag | Description | |
|---|---|---|
| --check | optional | Only report whether a newer version exists; change nothing |
| --yes | optional | Apply the update without prompting |
| --version | optional | Update (or downgrade) to a specific version instead of latest |
| --bin-dir | optional | Install directory when the current binary path is not writable. Default fallback: $HOME/.local/bin. Env: CDNCTL_BIN_DIR |
Authentication & Configuration
login
cdnctl login --email <email> --password <password> [--endpoint <url>]
Authenticates and saves a token to ~/.cdnctl/config.json. Use once per machine; token is reused for subsequent commands.
| Flag | Description | |
|---|---|---|
| required | Account email address | |
| --password | required | Account password |
| --endpoint | optional | API base URL. Defaults to https://cdn.com.tr |
configure
cdnctl configure [--endpoint <url>] [--token <token>]
Manually sets the endpoint or token without logging in. Useful for CI environments or token-based automation.
| Flag | Description | |
|---|---|---|
| --endpoint | optional | API base URL |
| --token | optional | Bearer token. Alternatively set CDNCTL_TOKEN env var |
CDNCTL_TOKEN and CDNCTL_ENDPOINT override the config file and are useful for CI pipelines where writing to disk is not ideal.
Accounts
accounts list
cdnctl accounts list
Lists all CDN accounts accessible to the authenticated user. The uuid field from this output is used as --account in all other commands.
Container Apps
container apps list
cdnctl container apps list --account <uuid>
Lists all container apps under the account.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
container apps create
cdnctl container apps create \
--account <uuid> \
--name <name> \
--image <registry/image> \
[--tag <tag>] \
[--port <port>] \
[--healthcheck <path>] \
[--healthcheck-type http|tcp|none] \
[--metrics-port <port>] \
[--metrics-path <path>] \
[--replicas <n>] \
[--plan <code>] \
[--domain <domain>] \
[--env-json '{"KEY":"value"}'] \
[--secrets-json '{"SECRET":"value"}'] \
[--registry-credential <uuid>] \
[--persistent-mount-path <path>] \
[--persistent-storage-gb <n>]
Creates a new container app record and first revision. Does not deploy — run deploy after create.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --name | required | App name (slug-safe) |
| --image | required | Container image path, e.g. registry.example.com/acme/api |
| --tag | optional | Image tag. Default: empty string |
| --port | optional | Container port the app listens on. Default: 8080 |
| --healthcheck | optional | HTTP health check path. Default: /health |
| --healthcheck-type | optional | Health check type: http, tcp, or none |
| --metrics-port | optional | Port that exposes Prometheus metrics |
| --metrics-path | optional | Path that exposes Prometheus metrics, e.g. /metrics |
| --replicas | optional | Number of replicas. Default: 1 |
| --plan | optional | Resource plan code. Default: starter |
| --domain | optional | Custom domain to attach |
| --env-json | optional | JSON object of environment variables. Values are visible in GET responses. |
| --secrets-json | optional | JSON object of secrets. Values are encrypted and never returned after create. |
| --registry-credential | optional | UUID of a registry credential for private images |
| --persistent-mount-path | optional | Mount path for persistent volume, e.g. /app/data |
| --persistent-storage-gb | optional | Persistent volume size in GB |
--secrets-json are stored encrypted and are not returned in any GET response. Save them before running this command.
container apps update
cdnctl container apps update \
--account <uuid> \
--app <uuid> \
[--image <registry/image>] \
[--tag <tag>] \
[--port <port>] \
[--replicas <n>] \
[--healthcheck <path>] \
[--healthcheck-type http|tcp|none] \
[--metrics-port <port>] \
[--metrics-path <path>] \
[--domain <domain>] \
[--env-json '{"KEY":"value"}'] \
[--secrets-json '{"SECRET":"value"}'] \
[--registry-credential <uuid>] \
[--persistent-mount-path <path>]
Updates app settings. Only the flags you pass are changed. Run deploy after update to publish the new revision.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --image | optional | New image path |
| --tag | optional | New image tag |
| --port | optional | Container port |
| --replicas | optional | Number of replicas |
| --healthcheck | optional | Health check path |
| --healthcheck-type | optional | Health check type: http, tcp, or none |
| --metrics-port | optional | Port that exposes Prometheus metrics |
| --metrics-path | optional | Path that exposes Prometheus metrics |
| --domain | optional | Domain to attach. Pass empty string to remove. |
| --env-json | optional | Replaces all env vars with this JSON object |
| --secrets-json | optional | Replaces all secrets with this JSON object. Values are never returned. |
| --registry-credential | optional | Registry credential UUID. Pass empty string to remove. |
| --persistent-mount-path | optional | Persistent mount path. Pass empty string to disable. |
container apps deploy
cdnctl container apps deploy --account <uuid> --app <uuid>
Publishes the current configuration as a new revision. Use wait afterwards to block until the deployment reaches a target status.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
container apps expose
cdnctl container apps expose --account <uuid> --app <uuid>
Mints a permanent, immutable <uid>.cdn.com.tr subdomain for the app. The subdomain never changes even if a custom domain is updated.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
container apps restart
cdnctl container apps restart --account <uuid> --app <uuid>
Performs a rolling restart of all running replicas without creating a new revision.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
container apps scale
cdnctl container apps scale --account <uuid> --app <uuid> --replicas <n>
Changes the replica count immediately without creating a new revision. Pass 0 to scale the app to zero.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --replicas | required | Target replica count (use 0 to suspend the app) |
container apps show
cdnctl container apps show --account <uuid> --app <uuid>
Returns full app configuration including the list of revisions. Use the revision UUIDs from this output with rollback.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
container apps rollback
cdnctl container apps rollback --account <uuid> --app <uuid> --revision <revision_uuid>
Re-deploys a previous revision. Use show to list available revision UUIDs.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --revision | required | Revision UUID to roll back to (from show) |
container apps operations
cdnctl container apps operations --account <uuid> --app <uuid>
Lists all platform operations recorded for the app, such as deploys, restarts, and scale events.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
container apps status
cdnctl container apps status --account <uuid> --app <uuid>
Returns the current runtime status and last operation result of the app.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
container apps wait
cdnctl container apps wait \
--account <uuid> \
--app <uuid> \
--status <target> \
[--timeout <seconds>] \
[--interval <seconds>]
Polls app status until it reaches --status or the timeout expires. Exits 0 on success, 1 on failure or timeout. On failure, includes diagnose output automatically.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --status | required | Target status string, e.g. running |
| --timeout | optional | Max seconds to wait. Default: 300 |
| --interval | optional | Poll interval in seconds. Default: 5 |
container apps logs
cdnctl container apps logs --account <uuid> --app <uuid> [--tail <n>]
Returns recent container log lines.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --tail | optional | Number of log lines to return. Default: 100 |
container apps diagnose
cdnctl container apps diagnose --account <uuid> --app <uuid> [--tail <n>]
Returns a combined status and log snapshot. Used automatically by wait on failure. Run this first when an app is stuck or failing.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --tail | optional | Number of log lines to include. Default: 120 |
container apps delete
cdnctl container apps delete --account <uuid> --app <uuid> --yes
Permanently deletes the app and all its revisions. This operation is irreversible.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --yes | required | Explicit confirmation required for destructive operations |
Container Preflight
Run preflight before creating apps to verify that the account has all platform prerequisites satisfied (quotas, network policies, registry access, etc.).
container preflight
cdnctl container preflight --account <uuid>
Checks that the account is ready to run container workloads and returns a list of any issues found.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
Registry Credentials
Registry credentials are account-scoped and can be reused across apps. The password is stored encrypted and is never returned after create.
container registry-credentials list
cdnctl container registry-credentials list --account <uuid>
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
container registry-credentials create
cdnctl container registry-credentials create \
--account <uuid> \
--name <name> \
--password <token> \
[--registry-url <url>] \
[--username <user>]
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --name | required | Friendly name for this credential |
| --password | required | Registry password or access token |
| --registry-url | optional | Registry URL. Default: https://index.docker.io/v1/ |
| --username | optional | Registry username |
container registry-credentials delete
cdnctl container registry-credentials delete \
--account <uuid> \
--credential <credential_uuid> \
--yes
Permanently removes a registry credential. Any apps that reference this credential will fail to pull images on the next deploy.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --credential | required | Credential UUID from registry-credentials list |
| --yes | required | Explicit confirmation required for destructive operations |
Managed Add-ons
Add-ons are created and connected to the app automatically. Credentials are injected as environment variables — no manual host, port, or password entry needed. Run deploy after enabling or disabling an add-on.
container addons list
cdnctl container addons list --account <uuid> --app <uuid>
Lists all add-ons currently attached to the app.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
container addons enable-database
cdnctl container addons enable-database \
--account <uuid> \
--app <uuid> \
[--plan <code>] \
[--env-prefix <prefix>] \
[--storage-mb <n>] \
[--url-scheme <scheme>]
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --plan | optional | Resource plan code. Default: starter |
| --env-prefix | optional | Env var prefix for injected credentials. Default: DB |
| --storage-mb | optional | Storage size in MB |
| --url-scheme | optional | Database URL scheme for the DATABASE_URL var, e.g. mysql+pymysql. Default: mysql |
container addons disable-database
cdnctl container addons disable-database --account <uuid> --app <uuid>
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
container addons enable-redis
cdnctl container addons enable-redis \
--account <uuid> \
--app <uuid> \
[--plan <code>] \
[--env-prefix <prefix>]
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --plan | optional | Resource plan code. Default: starter |
| --env-prefix | optional | Env var prefix. Default: REDIS |
container addons disable-redis
cdnctl container addons disable-redis --account <uuid> --app <uuid>
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
container addons enable-postgres
cdnctl container addons enable-postgres \
--account <uuid> \
--app <uuid> \
[--plan <code>] \
[--env-prefix <prefix>] \
[--storage-mb <n>]
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --plan | optional | Resource plan code. Default: starter |
| --env-prefix | optional | Env var prefix for injected credentials. Default: DATABASE |
| --storage-mb | optional | Storage size in MB. Default: 10240 |
container addons disable-postgres
cdnctl container addons disable-postgres \
--account <uuid> \
--app <uuid> \
[--delete-data --confirmation <app_name>]
Disables the Postgres add-on. By default data is retained. Pass --delete-data together with --confirmation to permanently destroy all data.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --delete-data | optional | Permanently destroy all Postgres data |
| --confirmation | optional | App name to confirm data deletion when --delete-data is set |
container addons enable-nats
cdnctl container addons enable-nats \
--account <uuid> \
--app <uuid> \
[--plan <code>] \
[--env-prefix <prefix>] \
[--storage-mb <n>]
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --plan | optional | Resource plan code. Default: starter |
| --env-prefix | optional | Env var prefix for injected credentials. Default: NATS |
| --storage-mb | optional | JetStream storage size in MB. Default: 5120 |
container addons disable-nats
cdnctl container addons disable-nats \
--account <uuid> \
--app <uuid> \
[--delete-data]
Disables the NATS add-on. Pass --delete-data to permanently destroy all JetStream data.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --delete-data | optional | Permanently destroy all NATS JetStream data |
Compose Import
Import an existing docker-compose.yml as managed container apps. Services with a prebuilt image become apps; Redis, MySQL/MariaDB, Postgres, and NATS services are converted into managed add-ons attached to the apps that depend on them. Always run preview first — it shows the resulting plan, warnings, unsupported services, and whether the import fits your app quota, without creating anything.
container compose preview
cdnctl container compose preview --account <uuid> --file docker-compose.yml
Parses the compose file server-side and returns the import plan: apps to be created, add-on mappings, environment/secret key classification, warnings, unsupported services, and an entitlement check. Creates nothing. Secret values are never echoed back — only key names.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --file | required | Path to the compose file (max 256 KB) |
container compose apply
cdnctl container compose apply --account <uuid> --file docker-compose.yml --yes
Applies the import: creates the apps in dependency order and enables the mapped add-ons. All-or-nothing — if any app name conflicts with an existing app, or any service is unsupported (e.g. uses build:), nothing is created. Deploy each created app afterwards with container apps deploy.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --file | required | Path to the compose file (max 256 KB) |
| --yes | required | Confirms resource creation |
build: (push a prebuilt image instead), command/entrypoint overrides (bake into the image), env_file, file-based compose secrets, and more than one persistent mount per service. Host-side port numbers are ignored — public exposure uses the platform's domain and apps expose flow.
Imports
Imports must complete before deployment opens public routing. Use apps status or apps wait to track readiness after an import finishes.
container imports list
cdnctl container imports list --account <uuid> --app <uuid>
Lists all imports and their current status for the app.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
container imports database
cdnctl container imports database \
--account <uuid> \
--app <uuid> \
--file <path/to/dump.sql.gz>
Uploads and queues a gzip-compressed SQL dump for import into the managed database.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --file | required | Local path to .sql.gz file |
container imports files
cdnctl container imports files \
--account <uuid> \
--app <uuid> \
--file <path/to/archive.tar.gz> \
[--target-path <path>]
Uploads and extracts a tar.gz archive into the persistent volume.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --file | required | Local path to .tar.gz archive |
| --target-path | optional | Destination path inside the container. Default: /app/data |
container imports cancel
cdnctl container imports cancel \
--account <uuid> \
--app <uuid> \
--import <import_uuid>
Cancels a queued or in-progress import. Has no effect if the import has already completed.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --import | required | Import UUID from imports list |
Scheduled Jobs
Jobs are HTTP calls made on a cron schedule to an endpoint inside the app. Create them disabled, verify with run, then enable.
container jobs list
cdnctl container jobs list --account <uuid> --app <uuid>
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
container jobs create
cdnctl container jobs create \
--account <uuid> \
--app <uuid> \
--name <name> \
--schedule "<cron expression>" \
--path </endpoint/path> \
[--method <POST|GET>] \
[--secret-header-name <header>] \
[--secret-source <ENV_VAR>] \
[--enabled]
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --name | required | Job name |
| --schedule | required | Cron expression, e.g. */30 * * * * |
| --path | required | HTTP path to call, e.g. /jobs/run |
| --method | optional | HTTP method. Default: POST |
| --secret-header-name | optional | Header name to send the token in, e.g. X-Token |
| --secret-source | optional | Name of the app secret or env var whose value is sent as the header value |
| --enabled | optional | Create the job enabled. Omit to create disabled (recommended for first-time setup) |
container jobs run
cdnctl container jobs run \
--account <uuid> \
--app <uuid> \
--job <job_uuid> \
[--wait] \
[--timeout <seconds>] \
[--interval <seconds>]
Triggers an immediate one-off run of the job. Use --wait to block until the run completes or fails.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --job | required | Job UUID from jobs list |
| --wait | optional | Block until the run completes |
| --timeout | optional | Max seconds to wait when --wait is set. Default: 180 |
| --interval | optional | Poll interval in seconds. Default: 5 |
container jobs delete
cdnctl container jobs delete \
--account <uuid> \
--app <uuid> \
--job <job_uuid> \
--yes
Permanently removes the scheduled job.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --job | required | Job UUID from jobs list |
| --yes | required | Explicit confirmation required for destructive operations |
Object Storage
Use cdnctl for the control plane: creating buckets, access keys, and bindings. For reading and writing objects use any S3-compatible client pointed at https://s3.cdn.com.tr. See the Object Storage with AWS CLI guide.
object-storage buckets list
cdnctl object-storage buckets list --account <uuid>
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
object-storage buckets create
cdnctl object-storage buckets create \
--account <uuid> \
--name <bucket-name> \
[--visibility private|public]
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --name | required | Bucket name (globally unique within the platform) |
| --visibility | optional | private or public. Default: private |
object-storage buckets usage
cdnctl object-storage buckets usage --account <uuid> --bucket <bucket_uuid>
Returns current storage usage statistics for the bucket.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --bucket | required | Bucket UUID from buckets list |
object-storage buckets delete
cdnctl object-storage buckets delete --account <uuid> --bucket <bucket_uuid> --yes
Permanently deletes the bucket and all objects inside it. This operation is irreversible.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --bucket | required | Bucket UUID from buckets list |
| --yes | required | Explicit confirmation required for destructive operations |
object-storage access-keys create
cdnctl object-storage access-keys create \
--account <uuid> \
[--bucket <uuid>] \
[--name <name>]
Creates an S3-compatible access key. The secret_key field in the response is shown once and never returned again. Copy it before closing the terminal.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --bucket | optional | Bucket UUID to scope the key to |
| --name | optional | Friendly name for the key |
object-storage access-keys rotate
cdnctl object-storage access-keys rotate --account <uuid> --key <key_uuid>
Generates a new secret for the access key while keeping the same key UUID and bucket scope. The new secret_key is returned once and never again. Update any clients before rotating in production.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --key | required | Access key UUID from access-keys create |
object-storage access-keys revoke
cdnctl object-storage access-keys revoke --account <uuid> --key <key_uuid> --yes
Permanently revokes and deletes the access key. Any clients still using this key will receive authentication errors immediately.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --key | required | Access key UUID to revoke |
| --yes | required | Explicit confirmation required for destructive operations |
object-storage bindings create
cdnctl object-storage bindings create \
--account <uuid> \
--app <uuid> \
--bucket <uuid> \
[--access-key <uuid>] \
[--env-prefix <prefix>]
Binds a bucket to an app. S3 credentials and endpoint are injected as environment variables on the next deploy.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --bucket | required | Bucket UUID |
| --access-key | optional | Access key UUID to use for the binding |
| --env-prefix | optional | Env var prefix. Default: S3 |
object-storage bindings delete
cdnctl object-storage bindings delete \
--account <uuid> \
--app <uuid> \
--binding <binding_uuid> \
--yes
Removes the bucket binding from the app. The bucket and access key are not affected; only the environment variable injection is removed on the next deploy.
| Flag | Description | |
|---|---|---|
| --account | required | Account UUID |
| --app | required | App UUID |
| --binding | required | Binding UUID from bindings list or app show response |
| --yes | required | Explicit confirmation required for destructive operations |