# CLI reference

URL: https://shellz.dev/docs/reference/cli

> Every shellz command on servers and in container images.

The `shellz` binary is installed at `/usr/local/bin/shellz`. Server commands need root. On Rocky, Alma, RHEL and Fedora, call it by its full path with `sudo`, because sudo's `secure_path` doesn't include `/usr/local/bin`.

## On servers

### shellz status

```bash
sudo /usr/local/bin/shellz status [--json]
```

Shows the enrollment, org key, policy, recorder state, active sessions, upload backlog, container recording state and recent alerts. `--json` prints the same as JSON, for monitoring.

### shellz update

```bash
sudo /usr/local/bin/shellz update [--check]
```

Installs the latest signed release now, instead of waiting for the automatic check. `--check` only reports whether an update is available. See [Updates and removal](https://shellz.dev/docs/guides/updates-and-removal.md).

### shellz uninstall

```bash
sudo /usr/local/bin/shellz uninstall
```

Removes shellz and restores the server, but only after an owner or admin has approved removal of this server. Otherwise it's refused and reported. See [Removing shellz](https://shellz.dev/docs/guides/updates-and-removal.md#removing-shellz).

### shellz decrypt

```bash
shellz decrypt (--org-key FILE | --data-key KEY) [--host-key KEY] [--out DIR] [--session ID] <dir>
```

Verifies and decrypts recordings offline. It reads every `.seg` segment file under `<dir>` (any layout), checks the hash chain of each session, decrypts it, and writes `<sessionId>.cast` (asciicast v2) and `<sessionId>.txt` to `--out` (default: the current directory). Nothing is sent over the network.

| Flag | Meaning |
|---|---|
| `--org-key FILE` | The org's X25519 private key: base64url, PKCS#8 PEM, or JSON (`{"keyId", "x25519Private"}`, or a list of them) |
| `--data-key KEY` | A single session's data key (base64url) |
| `--host-key KEY` | The server's Ed25519 public key (base64url). With it, segment signatures are checked too. |
| `--out DIR` | Where to write the output |
| `--session ID` | Only this session |

`shellz decrypt` runs on Linux and doesn't need the server to be enrolled.

### shellz version

```bash
shellz version [--short]
```

Prints the version. `--short` prints only the version number.

### Internal commands

`shellz enroll <token>` is run by the installer. `shellz recorder` is run by systemd. `shellz shell` starts a recorded shell. You don't need to run these yourself.

## In container images

### shellz run

```dockerfile
ENTRYPOINT ["/usr/local/bin/shellz", "run", "--"]
CMD ["<your command>", "<args>"]
```

Runs your command with session recording, normally as PID 1. It enrolls the container in its fleet using the fleet token, records shells opened by exec, forwards signals to your command, and exits with its exit code. See [Container image](https://shellz.dev/docs/install/container-image.md) and [Container settings](https://shellz.dev/docs/reference/container-settings.md).

### shellz image-install

```dockerfile
RUN ["/usr/local/bin/shellz", "image-install"]
```

Puts the recording shim in front of the image's shells (`/bin/sh`, `bash`, `ash`, `dash`, `zsh`, `fish`), keeping the real shells next to them. It's safe to run more than once. `--undo` restores the original shells. The container installer `get.shellz.dev/container` runs it for you.

## Installers

| Script | Use |
|---|---|
| `curl -fsSL https://get.shellz.dev \| sudo sh -s -- <join token>` | Install on a server |
| `curl -fsSL https://get.shellz.dev/container \| sh` | Add shellz to a container image, in a `RUN` step |

Both verify the release signature with the shellz release key built into the script, and the SHA-256 checksum, before installing anything.