Skip to main content

Command Line Interface

Usage:

$ knock [OPTIONS] COMMAND [ARGS]...

Options:

  • --help: Show this message and exit.

Commands:

  • reconcile: Reconcile all MirrorPolicy files under...
  • purge: Reap pending-deletion marks: purge tags...
  • attach: Ingest a scan report produced upstream and...
  • audit: Walk the registry and report images that...
  • gc: Garbage-collect superseded scan-result...
  • verify: Read knock's facts for a digest and gate...
  • version: Print the CLI version.
  • scan: Platform scan-pipeline commands (requires...

knock reconcile

Reconcile all MirrorPolicy files under DIRECTORY against their destinations.

Usage:

$ knock reconcile [OPTIONS] {directory}

Arguments:

  • directory: Directory of MirrorPolicy files (recursive). [required]

Options:

  • --dry-run: Plan only — no copies, no deletes.
  • -v, --verbose: Unfold per-operation detail in text output.
  • -j, --concurrency <int range>: Max parallel tag operations (overrides KNOCK_MAX_CONCURRENCY; 1 = sequential). [x>=1]
  • --shard-index <int range>: This shard's 0-based index (pass $JOB_COMPLETION_INDEX in an Indexed Job). [default: 0; x>=0]
  • --shard-count <int range>: Total shards N (1 = process all policies). [default: 1; x>=1]
  • --report-json: Emit the reconcile report as JSON to stdout (for piping to knock scan enqueue).
  • --help: Show this message and exit.

knock purge

Reap pending-deletion marks: purge tags not seen in prod within the idle window.

Usage:

$ knock purge [OPTIONS]

Options:

  • --registry <str>: Bound the walk to one registry from the roster.
  • --apply: Actually delete (default: dry-run, plan only).
  • --help: Show this message and exit.

knock attach

Ingest a scan report produced upstream and attach it as a stamped OCI referrer.

Usage:

$ knock attach [OPTIONS] {image_ref}

Arguments:

  • image_ref: Image reference (tag or digest) to stamp. [required]

Options:

  • --report <str>: Path to the upstream scan report, or '-' for stdin. [required]
  • --format <str>: Override report-format auto-detection (e.g. 'sarif').
  • --registry <str>: Roster entry to authenticate against (overrides ref host-matching).
  • --output <str>: Output format: 'text' (default) or 'json'. [default: text]
  • --fail-on <critical|high|medium|low|unknown>: Exit non-zero if the scan has a finding at or above this severity (CI gate).
  • --help: Show this message and exit.

knock audit

Walk the registry and report images that do NOT carry knock's provenance stamp.

Usage:

$ knock audit [OPTIONS]

Options:

  • --registry <str>: Bound the walk to one registry from the roster.
  • --fail-on-uncovered: Exit non-zero if any image lacks the stamp (CI gate).
  • --signed: Also probe each stamped image for a signed attestation referrer.
  • --fail-on-unsigned: Exit non-zero if any stamped image is unsigned (implies --signed).
  • --sbom: Also probe each stamped image for a package SBOM referrer.
  • --limit <int>: Stop after N images — bounded smoke-check / walk benchmark over a slice.
  • --help: Show this message and exit.

knock gc

Garbage-collect superseded scan-result referrers across the registry roster.

Usage:

$ knock gc [OPTIONS]

Options:

  • --registry <str>: Bound the walk to one registry from the roster.
  • --keep <int>: Newest scan referrers to retain per (tool, format). [default: 2]
  • --older-than-days <int>: Only collect referrers older than this many days. [default: 30]
  • --apply: Actually delete (default: dry-run, plan only).
  • --help: Show this message and exit.

knock verify

Read knock's facts for a digest and gate on them (exit 0 = pass, 1 = fail).

Usage:

$ knock verify [OPTIONS] {image_ref}

Arguments:

  • image_ref: Image reference (tag or digest) to verify. [required]

Options:

  • --require <str>: Comma-separated: scan-pass,stamp,sbom. [default: scan-pass]
  • --max-severity <critical|high|medium|low|unknown>: Fail at or above this scan severity. [default: high]
  • --max-age <str>: Scan freshness SLA (e.g. 7d, 12h, 30m). [default: 7d]
  • --registry <str>: Roster entry to authenticate against.
  • --output <str>: Output format: 'text' (default) or 'json'. [default: text]
  • --help: Show this message and exit.

knock version

Print the CLI version.

Usage:

$ knock version [OPTIONS]

Options:

  • --help: Show this message and exit.

knock scan

Platform scan-pipeline commands (requires pip install knock-oci[scan]).

Usage:

$ knock scan [OPTIONS] COMMAND [ARGS]...

Options:

  • --help: Show this message and exit.

Commands:

  • reserve: Reserve one placed digest from the queue...
  • attach: Read the reserved digest + the scanner's...
  • enqueue: Read a reconcile JSON report from stdin...
  • reaper: Claim idle entries and route...

knock scan reserve

Reserve one placed digest from the queue and write it to /shared for the scanner + attach steps. Exits 75 (EX_TEMPFAIL) when the queue is empty.

Usage:

$ knock scan reserve [OPTIONS]

Options:

  • --help: Show this message and exit.

knock scan attach

Read the reserved digest + the scanner's SARIF, attach the result, and ack. A missing/empty SARIF or a transient failure leaves the entry pending (the reaper retries); a permanent failure dead-letters it.

Usage:

$ knock scan attach [OPTIONS]

Options:

  • --help: Show this message and exit.

knock scan enqueue

Read a reconcile JSON report from stdin and enqueue the placed image refs.

Usage:

$ knock scan enqueue [OPTIONS]

Options:

  • --help: Show this message and exit.

knock scan reaper

Claim idle entries and route past-threshold ones to the dead stream.

Usage:

$ knock scan reaper [OPTIONS]

Options:

  • --min-idle-ms <int>: Idle threshold in ms. [default: 600000]
  • --max-deliveries <int>: Dead-letter threshold. [default: 3]
  • --help: Show this message and exit.