5 guestfish - the libguestfs Filesystem Interactive SHell
9 guestfish [--options] [commands]
15 guestfish -a disk.img -m dev[:mountpoint]
17 guestfish -d libvirt-domain
19 guestfish -a disk.img -i
21 guestfish -d libvirt-domain -i
25 Using guestfish in read/write mode on live virtual machines can be
26 dangerous, potentially causing disk corruption. Use the I<--ro>
27 (read-only) option to use guestfish safely if the disk image or
28 virtual machine might be live.
32 Guestfish is a shell and command-line tool for examining and modifying
33 virtual machine filesystems. It uses libguestfs and exposes all of
34 the functionality of the guestfs API, see L<guestfs(3)>.
36 Guestfish gives you structured access to the libguestfs API, from
37 shell scripts or the command line or interactively. If you want to
38 rescue a broken virtual machine image, you should look at the
39 L<virt-rescue(1)> command.
43 =head2 As an interactive shell
47 Welcome to guestfish, the libguestfs filesystem interactive shell for
48 editing virtual machine filesystems.
50 Type: 'help' for a list of commands
51 'man' to read the manual
52 'quit' to quit the shell
56 ><fs> list-filesystems
58 /dev/vg_guest/lv_root: ext4
59 /dev/vg_guest/lv_swap: swap
60 ><fs> mount /dev/vg_guest/lv_root /
67 =head2 From shell scripts
69 Create a new C</etc/motd> file in a guest or disk image:
74 mount /dev/vg_guest/lv_root /
75 write /etc/motd "Welcome, new users"
78 List the LVM logical volumes in a disk image:
80 guestfish -a disk.img --ro <<_EOF_
85 List all the filesystems in a disk image:
87 guestfish -a disk.img --ro <<_EOF_
92 =head2 On one command line
94 Update C</etc/resolv.conf> in a guest:
97 add disk.img : run : mount /dev/vg_guest/lv_root / : \
98 write /etc/resolv.conf "nameserver 1.2.3.4"
100 Edit C</boot/grub/grub.conf> interactively:
102 guestfish --add disk.img \
103 --mount /dev/vg_guest/lv_root \
104 --mount /dev/sda1:/boot \
105 edit /boot/grub/grub.conf
107 =head2 Mount disks automatically
109 Use the I<-i> option to automatically mount the
110 disks from a virtual machine:
112 guestfish --ro -a disk.img -i cat /etc/group
114 guestfish --ro -d libvirt-domain -i cat /etc/group
116 Another way to edit C</boot/grub/grub.conf> interactively is:
118 guestfish -a disk.img -i edit /boot/grub/grub.conf
120 =head2 As a script interpreter
122 Create a 100MB disk containing an ext2-formatted partition:
124 #!/usr/bin/guestfish -f
125 sparse test1.img 100M
127 part-disk /dev/sda mbr
130 =head2 Start with a prepared disk
132 An alternate way to create a 100MB disk called C<test1.img> containing
133 a single ext2-formatted partition:
137 To list what is available do:
139 guestfish -N help | less
141 =head2 Remote control
143 eval `guestfish --listen`
144 guestfish --remote add-ro disk.img
145 guestfish --remote run
146 guestfish --remote lvs
154 Displays general help on options.
156 =item B<-h> | B<--cmd-help>
158 Lists all available guestfish commands.
160 =item B<-h cmd> | B<--cmd-help cmd>
162 Displays detailed help on a single command C<cmd>.
164 =item B<-a image> | B<--add image>
166 Add a block device or virtual machine image to the shell.
168 =item B<-c URI> | B<--connect URI>
170 When used in conjunction with the I<-d> option, this specifies
171 the libvirt URI to use. The default is to use the default libvirt
174 =item B<-d libvirt-domain> | B<--domain libvirt-domain>
176 Add disks from the named libvirt domain. If the I<--ro> option is
177 also used, then any libvirt domain can be used. However in write
178 mode, only libvirt domains which are shut down can be named here.
180 =item B<-D> | B<--no-dest-paths>
182 Don't tab-complete paths on the guest filesystem. It is useful to be
183 able to hit the tab key to complete paths on the guest filesystem, but
184 this causes extra "hidden" guestfs calls to be made, so this option is
185 here to allow this feature to be disabled.
189 When prompting for keys and passphrases, guestfish normally turns
190 echoing off so you cannot see what you are typing. If you are not
191 worried about Tempest attacks and there is no one else in the room
192 you can specify this flag to see what you are typing.
194 =item B<-f file> | B<--file file>
196 Read commands from C<file>. To write pure guestfish
199 #!/usr/bin/guestfish -f
201 =item B<-i> | B<--inspector>
203 Using L<virt-inspector(1)> code, inspect the disks looking for
204 an operating system and mount filesystems as they would be
205 mounted on the real virtual machine.
207 Typical usage is either:
209 guestfish -d myguest -i
211 (for an inactive libvirt domain called I<myguest>), or:
213 guestfish --ro -d myguest -i
215 (for active domains, readonly), or specify the block device directly:
217 guestfish -a /dev/Guests/MyGuest -i
219 Note that the command line syntax changed slightly over older
220 versions of guestfish. You can still use the old syntax:
222 guestfish [--ro] -i disk.img
224 guestfish [--ro] -i libvirt-domain
226 =item B<--keys-from-stdin>
228 Read key or passphrase parameters from stdin. The default is
229 to try to read passphrases from the user by opening C</dev/tty>.
233 Fork into the background and listen for remote commands. See section
234 L</REMOTE CONTROL GUESTFISH OVER A SOCKET> below.
236 =item B<-m dev[:mountpoint]> | B<--mount dev[:mountpoint]>
238 Mount the named partition or logical volume on the given mountpoint.
240 If the mountpoint is omitted, it defaults to C</>.
242 You have to mount something on C</> before most commands will work.
244 If any I<-m> or I<--mount> options are given, the guest is
245 automatically launched.
247 If you don't know what filesystems a disk image contains, you
248 can either run guestfish without this option, then list the partitions
249 and LVs available (see L</list-partitions> and L</lvs> commands),
250 or you can use the L<virt-list-filesystems(1)> program.
252 =item B<-n> | B<--no-sync>
254 Disable autosync. This is enabled by default. See the discussion
255 of autosync in the L<guestfs(3)> manpage.
257 =item B<-N type> | B<--new type> | B<-N help>
259 Prepare a fresh disk image formatted as "type". This is an
260 alternative to the I<-a> option: whereas I<-a> adds an existing disk,
261 I<-N> creates a preformatted disk with a filesystem and adds it.
262 See L</PREPARED DISK IMAGES> below.
264 =item B<--progress-bars>
266 Enable progress bars, even when guestfish is used non-interactively.
268 Progress bars are enabled by default when guestfish is used as an
271 =item B<--no-progress-bars>
273 Disable progress bars.
275 =item B<--remote[=pid]>
277 Send remote commands to C<$GUESTFISH_PID> or C<pid>. See section
278 L</REMOTE CONTROL GUESTFISH OVER A SOCKET> below.
280 =item B<-r> | B<--ro>
282 This changes the I<-a> and I<-m> options so that disks are added and
283 mounts are done read-only (see L<guestfs(3)/guestfs_mount_ro>).
285 The option must always be used if the disk image or virtual machine
286 might be running, and is generally recommended in cases where you
287 don't need write access to the disk.
289 Note that prepared disk images created with I<-N> are not affected by
294 Enable SELinux support for the guest. See L<guestfs(3)/SELINUX>.
296 =item B<-v> | B<--verbose>
298 Enable very verbose messages. This is particularly useful if you find
301 =item B<-V> | B<--version>
303 Display the guestfish / libguestfs version number and exit.
307 Echo each command before executing it.
311 =head1 COMMANDS ON COMMAND LINE
313 Any additional (non-option) arguments are treated as commands to
316 Commands to execute should be separated by a colon (C<:>), where the
317 colon is a separate parameter. Thus:
319 guestfish cmd [args...] : cmd [args...] : cmd [args...] ...
321 If there are no additional arguments, then we enter a shell, either an
322 interactive shell with a prompt (if the input is a terminal) or a
323 non-interactive shell.
325 In either command line mode or non-interactive shell, the first
326 command that gives an error causes the whole shell to exit. In
327 interactive mode (with a prompt) if a command fails, you can continue
330 =head1 USING launch (OR run)
332 As with L<guestfs(3)>, you must first configure your guest by adding
333 disks, then launch it, then mount any disks you need, and finally
334 issue actions/commands. So the general order of the day is:
356 C<run> is a synonym for C<launch>. You must C<launch> (or C<run>)
357 your guest before mounting or performing any other commands.
359 The only exception is that if any of the I<-i>, I<-m>, I<--mount>,
360 I<-N> or I<--new> options were given then C<run> is done
361 automatically, simply because guestfish can't perform the action you
362 asked for without doing this.
366 You can quote ordinary parameters using either single or double
369 add "file with a space.img"
375 A few commands require a list of strings to be passed. For these, use
376 a whitespace-separated list, enclosed in quotes. Strings containing whitespace
377 to be passed through must be enclosed in single quotes. A literal single quote
378 must be escaped with a backslash.
380 vgcreate VG "/dev/sda1 /dev/sdb1"
381 command "/bin/echo 'foo bar'"
382 command "/bin/echo \'foo\'"
386 This section applies to all commands which can take integers
391 When the command takes a parameter measured in bytes, you can use one
392 of the following suffixes to specify kilobytes, megabytes and larger
397 =item B<k> or B<K> or B<KiB>
399 The size in kilobytes (multiplied by 1024).
403 The size in SI 1000 byte units.
407 The size in megabytes (multiplied by 1048576).
411 The size in SI 1000000 byte units.
415 The size in gigabytes (multiplied by 2**30).
419 The size in SI 10**9 byte units.
423 The size in terabytes (multiplied by 2**40).
427 The size in SI 10**12 byte units.
431 The size in petabytes (multiplied by 2**50).
435 The size in SI 10**15 byte units.
439 The size in exabytes (multiplied by 2**60).
443 The size in SI 10**18 byte units.
447 The size in zettabytes (multiplied by 2**70).
451 The size in SI 10**21 byte units.
455 The size in yottabytes (multiplied by 2**80).
459 The size in SI 10**24 byte units.
465 truncate-size /file 1G
467 would truncate the file to 1 gigabyte.
469 Be careful because a few commands take sizes in kilobytes or megabytes
470 (eg. the parameter to L</memsize> is specified in megabytes already).
471 Adding a suffix will probably not do what you expect.
473 =head2 OCTAL AND HEXADECIMAL NUMBERS
475 For specifying the radix (base) use the C convention: C<0> to prefix
476 an octal number or C<0x> to prefix a hexadecimal number. For example:
478 1234 decimal number 1234
479 02322 octal number, equivalent to decimal 1234
480 0x4d2 hexadecimal number, equivalent to decimal 1234
482 When using the C<chmod> command, you almost always want to specify an
483 octal number for the mode, and you must prefix it with C<0> (unlike
484 the Unix L<chmod(1)> program):
486 chmod 0777 /public # OK
487 chmod 777 /public # WRONG! This is mode 777 decimal = 01411 octal.
489 Commands that return numbers usually print them in decimal, but
490 some commands print numbers in other radices (eg. C<umask> prints
491 the mode in octal, preceeded by C<0>).
493 =head1 WILDCARDS AND GLOBBING
495 Neither guestfish nor the underlying guestfs API performs
496 wildcard expansion (globbing) by default. So for example the
497 following will not do what you expect:
501 Assuming you don't have a directory called literally C</home/*>
502 then the above command will return an error.
504 To perform wildcard expansion, use the C<glob> command.
508 runs C<rm-rf> on each path that matches (ie. potentially running
509 the command many times), equivalent to:
515 C<glob> only works on simple guest paths and not on device names.
517 If you have several parameters, each containing a wildcard, then glob
518 will perform a Cartesian product.
522 Any line which starts with a I<#> character is treated as a comment
523 and ignored. The I<#> can optionally be preceeded by whitespace,
524 but B<not> by a command. For example:
530 Blank lines are also ignored.
532 =head1 RUNNING COMMANDS LOCALLY
534 Any line which starts with a I<!> character is treated as a command
535 sent to the local shell (C</bin/sh> or whatever L<system(3)> uses).
539 tgz-out /remote local/remote-data.tar.gz
541 will create a directory C<local> on the host, and then export
542 the contents of C</remote> on the mounted filesystem to
543 C<local/remote-data.tar.gz>. (See C<tgz-out>).
545 To change the local directory, use the C<lcd> command. C<!cd> will
546 have no effect, due to the way that subprocesses work in Unix.
550 Use C<command E<lt>spaceE<gt> | command> to pipe the output of the
551 first command (a guestfish command) to the second command (any host
552 command). For example:
554 cat /etc/passwd | awk -F: '$3 == 0 { print }'
556 (where C<cat> is the guestfish cat command, but C<awk> is the host awk
557 program). The above command would list all accounts in the guest
558 filesystem which have UID 0, ie. root accounts including backdoors.
561 hexdump /bin/ls | head
562 list-devices | tail -1
563 tgz-out / - | tar ztf -
565 The space before the pipe symbol is required, any space after the pipe
566 symbol is optional. Everything after the pipe symbol is just passed
567 straight to the host shell, so it can contain redirections, globs and
568 anything else that makes sense on the host side.
570 To use a literal argument which begins with a pipe symbol, you have
575 =head1 HOME DIRECTORIES
577 If a parameter starts with the character C<~> then the tilde may be
578 expanded as a home directory path (either C<~> for the current user's
579 home directory, or C<~user> for another user).
581 Note that home directory expansion happens for users known I<on the
582 host>, not in the guest filesystem.
584 To use a literal argument which begins with a tilde, you have to quote
589 =head1 ENCRYPTED DISKS
591 Libguestfs has some support for Linux guests encrypted according to
592 the Linux Unified Key Setup (LUKS) standard, which includes nearly all
593 whole disk encryption systems used by modern Linux guests. Currently
594 only LVM-on-LUKS is supported.
596 Identify encrypted block devices and partitions using L</vfs-type>:
598 ><fs> vfs-type /dev/sda2
601 Then open those devices using L</luks-open>. This creates a
602 device-mapper device called C</dev/mapper/luksdev>.
604 ><fs> luks-open /dev/sda2 luksdev
605 Enter key or passphrase ("key"): <enter the passphrase>
607 Finally you have to tell LVM to scan for volume groups on
608 the newly created mapper device:
613 The logical volume(s) can now be mounted in the usual way.
615 Before closing a LUKS device you must unmount any logical volumes on
616 it and deactivate the volume groups by calling C<vg-activate false VG>
617 on each one. Then you can close the mapper device:
619 vg-activate false /dev/VG
620 luks-close /dev/mapper/luksdev
624 If a path is prefixed with C<win:> then you can use Windows-style
625 paths (with some limitations). The following commands are equivalent:
627 file /WINDOWS/system32/config/system.LOG
629 file win:/windows/system32/config/system.log
631 file win:\windows\system32\config\system.log
633 file WIN:C:\Windows\SYSTEM32\conFIG\SYSTEM.LOG
635 This syntax implicitly calls C<case-sensitive-path> (q.v.) so it also
636 handles case insensitivity like Windows would. This only works in
637 argument positions that expect a path.
639 =head1 UPLOADING AND DOWNLOADING FILES
641 For commands such as C<upload>, C<download>, C<tar-in>, C<tar-out> and
642 others which upload from or download to a local file, you can use the
643 special filename C<-> to mean "from stdin" or "to stdout". For example:
647 reads stdin and creates from that a file C</foo> in the disk image,
650 tar-out /etc - | tar tf -
652 writes the tarball to stdout and then pipes that into the external
653 "tar" command (see L</PIPES>).
655 When using C<-> to read from stdin, the input is read up to the end of
656 stdin. You can also use a special "heredoc"-like syntax to read up to
657 some arbitrary end marker:
665 Any string of characters can be used instead of C<END>. The end
666 marker must appear on a line of its own, without any preceeding or
667 following characters (not even spaces).
669 Note that the C<-E<lt>E<lt>> syntax only applies to parameters used to
670 upload local files (so-called "FileIn" parameters in the generator).
672 =head1 EXIT ON ERROR BEHAVIOUR
674 By default, guestfish will ignore any errors when in interactive mode
675 (ie. taking commands from a human over a tty), and will exit on the
676 first error in non-interactive mode (scripts, commands given on the
679 If you prefix a command with a I<-> character, then that command will
680 not cause guestfish to exit, even if that (one) command returns an
683 =head1 REMOTE CONTROL GUESTFISH OVER A SOCKET
685 Guestfish can be remote-controlled over a socket. This is useful
686 particularly in shell scripts where you want to make several different
687 changes to a filesystem, but you don't want the overhead of starting
688 up a guestfish process each time.
690 Start a guestfish server process using:
692 eval `guestfish --listen`
694 and then send it commands by doing:
696 guestfish --remote cmd [...]
698 To cause the server to exit, send it the exit command:
700 guestfish --remote exit
702 Note that the server will normally exit if there is an error in a
703 command. You can change this in the usual way. See section
704 L</EXIT ON ERROR BEHAVIOUR>.
706 =head2 CONTROLLING MULTIPLE GUESTFISH PROCESSES
708 The C<eval> statement sets the environment variable C<$GUESTFISH_PID>,
709 which is how the I<--remote> option knows where to send the commands.
710 You can have several guestfish listener processes running using:
712 eval `guestfish --listen`
714 eval `guestfish --listen`
717 guestfish --remote=$pid1 cmd
718 guestfish --remote=$pid2 cmd
720 =head2 REMOTE CONTROL DETAILS
722 Remote control happens over a Unix domain socket called
723 C</tmp/.guestfish-$UID/socket-$PID>, where C<$UID> is the effective
724 user ID of the process, and C<$PID> is the process ID of the server.
726 Guestfish client and server versions must match exactly.
728 =head1 PREPARED DISK IMAGES
730 Use the I<-N type> or I<--new type> parameter to select one of a set
731 of preformatted disk images that guestfish can make for you to save
732 typing. This is particularly useful for testing purposes. This
733 option is used instead of the I<-a> option, and like I<-a> can appear
734 multiple times (and can be mixed with I<-a>).
736 The new disk is called C<test1.img> for the first I<-N>, C<test2.img>
737 for the second and so on. Existing files in the current directory are
740 The type briefly describes how the disk should be sized, partitioned,
741 how filesystem(s) should be created, and how content should be added.
742 Optionally the type can be followed by extra parameters, separated by
743 C<:> (colon) characters. For example, I<-N fs> creates a default
744 100MB, sparsely-allocated disk, containing a single partition, with
745 the partition formatted as ext2. I<-N fs:ext4:1G> is the same, but
746 for an ext4 filesystem on a 1GB disk instead.
748 To list the available types and any extra parameters they take, run:
750 guestfish -N help | less
752 Note that the prepared filesystem is not mounted. You would usually
753 have to use the C<mount /dev/sda1 /> command or add the
754 I<-m /dev/sda1> option.
756 If any I<-N> or I<--new> options are given, the guest is automatically
761 Create a 100MB disk with an ext4-formatted partition:
765 Create a 32MB disk with a VFAT-formatted partition, and mount it:
767 guestfish -N fs:vfat:32M -m /dev/sda1
769 Create a blank 200MB disk:
771 guestfish -N disk:200M
775 Some (not all) long-running commands send progress notification
776 messages as they are running. Guestfish turns these messages into
779 When a command that supports progress bars takes longer than two
780 seconds to run, and if progress bars are enabled, then you will see
781 one appearing below the command:
783 ><fs> copy-size /large-file /another-file 2048M
784 / 10% [#####-----------------------------------------] 00:30
786 The spinner on the left hand side moves round once for every progress
787 notification received from the backend. This is a (reasonably) golden
788 assurance that the command is "doing something" even if the progress
789 bar is not moving, because the command is able to send the progress
790 notifications. When the bar reaches 100% and the command finishes,
791 the spinner disappears.
793 Progress bars are enabled by default when guestfish is used
794 interactively. You can enable them even for non-interactive modes
795 using I<--progress-bars>, and you can disable them completely using
796 I<--no-progress-bars>.
798 =head1 GUESTFISH COMMANDS
800 The commands in this section are guestfish convenience commands, in
801 other words, they are not part of the L<guestfs(3)> API.
808 Without any parameter, this lists all commands. With a C<cmd>
809 parameter, this displays detailed help for a command.
813 This exits guestfish. You can also use C<^D> key.
823 guestfish returns 0 if the commands completed without error, or
824 1 if there was an error.
826 =head1 ENVIRONMENT VARIABLES
832 The C<edit> command uses C<$EDITOR> as the editor. If not
837 Used with the I<--remote> option to specify the remote guestfish
838 process to control. See section
839 L</REMOTE CONTROL GUESTFISH OVER A SOCKET>.
843 The L</hexedit> command uses C<$HEXEDITOR> as the external hex
844 editor. If not specified, the external L<hexedit(1)> program
849 If compiled with GNU readline support, various files in the
850 home directory can be used. See L</FILES>.
852 =item LIBGUESTFS_APPEND
854 Pass additional options to the guest kernel.
856 =item LIBGUESTFS_DEBUG
858 Set C<LIBGUESTFS_DEBUG=1> to enable verbose messages. This has the
859 same effect as using the B<-v> option.
861 =item LIBGUESTFS_MEMSIZE
863 Set the memory allocated to the qemu process, in megabytes. For
866 LIBGUESTFS_MEMSIZE=700
868 =item LIBGUESTFS_PATH
870 Set the path that guestfish uses to search for kernel and initrd.img.
871 See the discussion of paths in L<guestfs(3)>.
873 =item LIBGUESTFS_QEMU
875 Set the default qemu binary that libguestfs uses. If not set, then
876 the qemu which was found at compile time by the configure script is
879 =item LIBGUESTFS_TRACE
881 Set C<LIBGUESTFS_TRACE=1> to enable command traces.
885 The C<more> command uses C<$PAGER> as the pager. If not
886 set, it uses C<more>.
890 Location of temporary directory, defaults to C</tmp>.
892 If libguestfs was compiled to use the supermin appliance then the
893 real appliance is cached in this directory, shared between all
894 handles belonging to the same EUID. You can use C<$TMPDIR> to
895 configure another directory to use in case C</tmp> is not large
904 =item $HOME/.guestfish
906 If compiled with GNU readline support, then the command history
907 is saved in this file.
913 If compiled with GNU readline support, then these files can be used to
914 configure readline. For further information, please see
915 L<readline(3)/INITIALIZATION FILE>.
917 To write rules which only apply to guestfish, use:
923 Variables that you can set in inputrc that change the behaviour
924 of guestfish in useful ways include:
928 =item completion-ignore-case (default: on)
930 By default, guestfish will ignore case when tab-completing
931 paths on the disk. Use:
933 set completion-ignore-case off
935 to make guestfish case sensitive.
941 =item test2.img (etc)
943 When using the C<-N> or C<--new> option, the prepared disk or
944 filesystem will be created in the file C<test1.img> in the current
945 directory. The second use of C<-N> will use C<test2.img> and so on.
946 Any existing file with the same name will be overwritten.
953 L<http://libguestfs.org/>,
957 L<virt-list-filesystems(1)>,
958 L<virt-list-partitions(1)>,
969 Richard W.M. Jones (C<rjones at redhat dot com>)
973 Copyright (C) 2009-2010 Red Hat Inc.
974 L<http://libguestfs.org/>
976 This program is free software; you can redistribute it and/or modify
977 it under the terms of the GNU General Public License as published by
978 the Free Software Foundation; either version 2 of the License, or
979 (at your option) any later version.
981 This program is distributed in the hope that it will be useful,
982 but WITHOUT ANY WARRANTY; without even the implied warranty of
983 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
984 GNU General Public License for more details.
986 You should have received a copy of the GNU General Public License
987 along with this program; if not, write to the Free Software
988 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.