CLI reference
Every shellz command on servers and in container images.
The shellz binary is installed at /usr/local/bin/shellz. Server commands need root. On Rocky, Alma, RHEL and Fedora, call it by its full path with sudo, because sudo's secure_path doesn't include /usr/local/bin.
On servers
shellz status
sudo /usr/local/bin/shellz status [--json]Shows the enrollment, org key, policy, recorder state, active sessions, upload backlog, container recording state and recent alerts. --json prints the same as JSON, for monitoring.
shellz update
sudo /usr/local/bin/shellz update [--check]Installs the latest signed release now, instead of waiting for the automatic check. --check only reports whether an update is available. See Updates and removal.
shellz uninstall
sudo /usr/local/bin/shellz uninstallRemoves shellz and restores the server, but only after an owner or admin has approved removal of this server. Otherwise it's refused and reported. See Removing shellz.
shellz decrypt
shellz decrypt (--org-key FILE | --data-key KEY) [--host-key KEY] [--out DIR] [--session ID] <dir>Verifies and decrypts recordings offline. It reads every .seg segment file under <dir> (any layout), checks the hash chain of each session, decrypts it, and writes <sessionId>.cast (asciicast v2) and <sessionId>.txt to --out (default: the current directory). Nothing is sent over the network.
| Flag | Meaning |
|---|---|
--org-key FILE | The org's X25519 private key: base64url, PKCS#8 PEM, or JSON ({"keyId", "x25519Private"}, or a list of them) |
--data-key KEY | A single session's data key (base64url) |
--host-key KEY | The server's Ed25519 public key (base64url). With it, segment signatures are checked too. |
--out DIR | Where to write the output |
--session ID | Only this session |
shellz decrypt runs on Linux and doesn't need the server to be enrolled.
shellz version
shellz version [--short]Prints the version. --short prints only the version number.
Internal commands
shellz enroll <token> is run by the installer. shellz recorder is run by systemd. shellz shell starts a recorded shell. You don't need to run these yourself.
In container images
shellz run
ENTRYPOINT ["/usr/local/bin/shellz", "run", "--"]
CMD ["<your command>", "<args>"]Runs your command with session recording, normally as PID 1. It enrolls the container in its fleet using the fleet token, records shells opened by exec, forwards signals to your command, and exits with its exit code. See Container image and Container settings.
shellz image-install
RUN ["/usr/local/bin/shellz", "image-install"]Puts the recording shim in front of the image's shells (/bin/sh, bash, ash, dash, zsh, fish), keeping the real shells next to them. It's safe to run more than once. --undo restores the original shells. The container installer get.shellz.dev/container runs it for you.
Installers
| Script | Use |
|---|---|
curl -fsSL https://get.shellz.dev | sudo sh -s -- <join token> | Install on a server |
curl -fsSL https://get.shellz.dev/container | sh | Add shellz to a container image, in a RUN step |
Both verify the release signature with the shellz release key built into the script, and the SHA-256 checksum, before installing anything.