Command reference

Captured 2026-08-03 from a live node running software build crt-20260201-0179, which exposes 43 commands. The 34 read-only commands permitted by the capture policy have current output; the other nine are explicitly skipped because they mutate state, read a privileged marker, or perform disk writes.

The Tier column is not advisory. It selects the endpoint a command must be sent to, and sending a command to the wrong one returns command not supported — which reads as though the command does not exist. See the debug API before using this table.

Command	Category	Tier	Transport	Example argument
chronyc-sources	Network	ExecUser	exec-user	none
crictl-images	System	ExecUser	exec-user	none
crictl-inspect	System	ExecUser	exec-user	container-id
crictl-logs	System	ExecUser	exec-user	container-id
crictl-ps	System	ExecUser	exec-user	none
crictl-ps-a	System	ExecUser	exec-user	none
curl-host	Network	ExecUser	exec-user	-v cloud.f5.com
curl-vega	Network	ExecUser	exec-user	-v cloud.f5.com
diagnosis	System	ExecUser	global GET	none
dig	Network	ExecUser	exec-user	@192.168.0.2 http://volterra.azurecr.io
docker-images	System	ExecUser	exec-user	none
docker-inspect	System	ExecUser	exec-user	container-id OR name
docker-logs	System	ExecUser	exec-user	container-id OR name
docker-ps	System	ExecUser	exec-user	none
docker-ps-a	System	ExecUser	exec-user	none
dropstats	Network	ExecUser	exec-user	none
dropstats-non-zero	Network	ExecUser	exec-user	none
flow-l	Network	ExecUser	exec-user	none
flow-l-match	Network	ExecUser	exec-user	100.127.192.10:53
health	System	ExecUser	global GET	none
ip	Network	ExecUser	exec-user	help OR addr
ip-link-set	Network	Exec	exec	(<device>||<group>) (up||down)
ip-link-show	Network	ExecUser	exec-user	none
ipsec-status	Network	ExecUser	exec-user	none
ipsec-statusall	Network	ExecUser	exec-user	none
journalctl	System	ExecUser	exec-user	-u vpm -n 200
netstat	Network	ExecUser	exec-user	none
nh	Network	ExecUser	exec-user	--help OR --list
rt	Network	ExecUser	exec-user	--help OR --dump $vrf-id OR --get $ipv4 --vrf $vrf-id
show-ip-bgp	Network	ExecUser	exec-user	none
show-ip-bgp-neighbors	Network	ExecUser	exec-user	none
show-ip-bgp-neighbors-advertised-route	Network	ExecUser	exec-user	none
show-ip-bgp-summary	Network	ExecUser	exec-user	none
vif	Network	ExecUser	exec-user	--list

One command here changes the node

ip-link-set is Exec tier and takes an interface up or down. It is documented for completeness, has no captured output, and is never executed by the capture harness.

Maintenance commands on this build

Nine commands need treatment beyond their catalog name and tier:

Command	Category	Tier
collect-database-stats	System	ExecUser
iptables-lv	Network	ExecUser
marker-exists-NetworkManager	System	Exec
marker-exists-crio	System	Exec
marker-exists-kubelet	System	Exec
systemctl-restart-NetworkManager	System	Exec
systemctl-restart-crio	System	Exec
systemctl-restart-kubelet	System	Exec
systemctl-start-crio-prune	System	Exec

These commands are present on the current deployment. iptables-lv is captured as read-only. collect-database-stats is skipped because prior evidence shows that it runs a random-write benchmark. The seven Exec commands are never executed by the capture harness; four restart or prune services under a live data plane and three read privileged markers.

See current maintenance commands for the command-by-command safety classification and the dated evidence.

Detecting the surface moving

Because the surface changes with the software build, the catalog records the build it came from, and scripts/capture-sitecli.sh --check reports a build change separately from added or removed commands.