# The douklar CLI

> Plan and run syncs, manage config and verify ECR mappings from a terminal.

The command line tool is `douklar-cli`, reached as `douklar`. It runs the
same sync engine on your machine, against local config files.

## Install

From the app checkout:

```bash
./install.sh cli
douklar --help
```

The installer adds the `douklar-cli` command. When no `douklar` is on `PATH`
yet, it also links the app launcher `scripts/douklar`, so you get `douklar`
as well. `./install.sh cli --no-deps` skips dependency downloads for offline
machines.

`douklar install`, `douklar update` and `douklar companion` belong to the app
launcher. Every other `douklar` command runs `douklar-cli` with the same
arguments.

ECR moves also need the AWS CLI and exactly ORAS v1.3.4 on `PATH`.
`douklar doctor` checks the local prerequisites.

## Commands

```text
douklar status
douklar doctor [--aws] [--profile P] [--strict]
douklar config init|show|validate|generate|fmt|export
douklar mapping list|add|remove
douklar check run
douklar sync plan|run
```

Global options work before the command and on every command: `-v`,
`-q`, `--debug`, `--no-input`, `--color auto|always|never` and
`--progress auto|live|final|off`. Data commands take `--json` and print one
JSON document on stdout.

Exit codes: `0` success, `1` the operation ran and failed, `2` usage or
validation error before any work, `130` interrupted.

## Plan, then run

```bash
douklar sync plan --service ecr --service s3 --app my-app
douklar sync run --service ecr --service s3 --app my-app
```

`sync plan` shows what `sync run` would do and writes nothing. Both read the
workspace `sync.yaml` unless you pass `--config PATH`.

| Option | Effect |
|---|---|
| `--service ecr\|s3\|codecommit\|dynamodb\|all` | Limit to this service (repeatable) |
| `--app <name>` | Limit to this mapping name (repeatable) |
| `--json` | One JSON document on stdout |
| `--dynamodb-ttl-policy preserve_all\|exclude_expired_at_cutoff` | `run`: required when the selection contains DynamoDB |
| `--codecommit-push-mode mirror\|incremental` | `run`: CodeCommit push mode (default `mirror`) |
| `--codecommit-overwrite` | `run`: allow reconciling a non-empty CodeCommit destination |
| `--ecr-update-latest` | `run`: also move the destination's ECR `latest` tag |
| `--s3-transport worker_relay\|server_side` | `run`: S3 path (default `worker_relay`) |
| `--s3-keep-tags` | `run`: copy each object's tags |
| `--s3-kms-key-arn <ARN>` | `run`: encrypt written objects with this key (full ARN) |

Without a terminal, a non-empty CodeCommit destination is skipped and
reported failed unless `--codecommit-overwrite` is given.

## Verify ECR mappings

```bash
douklar check run --exit-code
```

`check run` verifies the ECR repository pairs in the workspace `sync.yaml`
with the console's verdict engine. It reads only. With `--exit-code` it exits
`1` unless every mapping is `in_sync`, which suits CI.

## Bundles for the console

`douklar config export` writes a bundle folder for the console's
**Settings > Imports**. Bundles carry `producer.tool = "douklar-cli"`; the app
imports no other producer.

Source: https://douklar.app/docs/douklar/cli (Douklar docs, last checked 2026-10-23)