Command Line Interface
Usage:
$ knock [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
reconcile: Reconcile all MirrorPolicy files under...purge: Reap pending-deletion marks: purge tags...attach: Ingest a scan report produced upstream and...audit: Walk the registry and report images that...gc: Garbage-collect superseded scan-result...verify: Read knock's facts for a digest and gate...version: Print the CLI version.scan: Platform scan-pipeline commands (requires...
knock reconcile
Reconcile all MirrorPolicy files under DIRECTORY against their destinations.
Usage:
$ knock reconcile [OPTIONS] {directory}
Arguments:
directory: Directory of MirrorPolicy files (recursive). [required]
Options:
--dry-run: Plan only — no copies, no deletes.-v, --verbose: Unfold per-operation detail in text output.-j, --concurrency <int range>: Max parallel tag operations (overrides KNOCK_MAX_CONCURRENCY; 1 = sequential). [x>=1]--shard-index <int range>: This shard's 0-based index (pass $JOB_COMPLETION_INDEX in an Indexed Job). [default: 0; x>=0]--shard-count <int range>: Total shards N (1 = process all policies). [default: 1; x>=1]--report-json: Emit the reconcile report as JSON to stdout (for piping toknock scan enqueue).--help: Show this message and exit.
knock purge
Reap pending-deletion marks: purge tags not seen in prod within the idle window.
Usage:
$ knock purge [OPTIONS]
Options:
--registry <str>: Bound the walk to one registry from the roster.--apply: Actually delete (default: dry-run, plan only).--help: Show this message and exit.
knock attach
Ingest a scan report produced upstream and attach it as a stamped OCI referrer.
Usage:
$ knock attach [OPTIONS] {image_ref}
Arguments:
image_ref: Image reference (tag or digest) to stamp. [required]
Options:
--report <str>: Path to the upstream scan report, or '-' for stdin. [required]--format <str>: Override report-format auto-detection (e.g. 'sarif').--registry <str>: Roster entry to authenticate against (overrides ref host-matching).--output <str>: Output format: 'text' (default) or 'json'. [default: text]--fail-on <critical|high|medium|low|unknown>: Exit non-zero if the scan has a finding at or above this severity (CI gate).--help: Show this message and exit.
knock audit
Walk the registry and report images that do NOT carry knock's provenance stamp.
Usage:
$ knock audit [OPTIONS]
Options:
--registry <str>: Bound the walk to one registry from the roster.--fail-on-uncovered: Exit non-zero if any image lacks the stamp (CI gate).--signed: Also probe each stamped image for a signed attestation referrer.--fail-on-unsigned: Exit non-zero if any stamped image is unsigned (implies --signed).--sbom: Also probe each stamped image for a package SBOM referrer.--limit <int>: Stop after N images — bounded smoke-check / walk benchmark over a slice.--help: Show this message and exit.
knock gc
Garbage-collect superseded scan-result referrers across the registry roster.
Usage:
$ knock gc [OPTIONS]
Options:
--registry <str>: Bound the walk to one registry from the roster.--keep <int>: Newest scan referrers to retain per (tool, format). [default: 2]--older-than-days <int>: Only collect referrers older than this many days. [default: 30]--apply: Actually delete (default: dry-run, plan only).--help: Show this message and exit.
knock verify
Read knock's facts for a digest and gate on them (exit 0 = pass, 1 = fail).
Usage:
$ knock verify [OPTIONS] {image_ref}
Arguments:
image_ref: Image reference (tag or digest) to verify. [required]
Options:
--require <str>: Comma-separated: scan-pass,stamp,sbom. [default: scan-pass]--max-severity <critical|high|medium|low|unknown>: Fail at or above this scan severity. [default: high]--max-age <str>: Scan freshness SLA (e.g. 7d, 12h, 30m). [default: 7d]--registry <str>: Roster entry to authenticate against.--output <str>: Output format: 'text' (default) or 'json'. [default: text]--help: Show this message and exit.
knock version
Print the CLI version.
Usage:
$ knock version [OPTIONS]
Options:
--help: Show this message and exit.
knock scan
Platform scan-pipeline commands (requires pip install knock-oci[scan]).
Usage:
$ knock scan [OPTIONS] COMMAND [ARGS]...
Options:
--help: Show this message and exit.
Commands:
reserve: Reserve one placed digest from the queue...attach: Read the reserved digest + the scanner's...enqueue: Read a reconcile JSON report from stdin...reaper: Claim idle entries and route...
knock scan reserve
Reserve one placed digest from the queue and write it to /shared for the scanner + attach steps. Exits 75 (EX_TEMPFAIL) when the queue is empty.
Usage:
$ knock scan reserve [OPTIONS]
Options:
--help: Show this message and exit.
knock scan attach
Read the reserved digest + the scanner's SARIF, attach the result, and ack. A missing/empty SARIF or a transient failure leaves the entry pending (the reaper retries); a permanent failure dead-letters it.
Usage:
$ knock scan attach [OPTIONS]
Options:
--help: Show this message and exit.
knock scan enqueue
Read a reconcile JSON report from stdin and enqueue the placed image refs.
Usage:
$ knock scan enqueue [OPTIONS]
Options:
--help: Show this message and exit.
knock scan reaper
Claim idle entries and route past-threshold ones to the dead stream.
Usage:
$ knock scan reaper [OPTIONS]
Options:
--min-idle-ms <int>: Idle threshold in ms. [default: 600000]--max-deliveries <int>: Dead-letter threshold. [default: 3]--help: Show this message and exit.