guestfish(1)

📦

version 1.61.3 · 14 versions

💅 guestfish — the guest filesystem shell 🐠

okay so you found the guestfish(1) page, part of Virtualization Support, and bestie, you're in for a treat ✨

✨ NAME ✨

guestfish — the guest filesystem shell 🐚🫶

🌸 SYNOPSIS 🌸

guestfish [--options] [commands]

guestfish

guestfish [--ro|--rw] -a disk.img

guestfish [--ro|--rw] -a disk.img -m dev[:mountpoint]

guestfish -d libvirt-domain

guestfish [--ro|--rw] -a disk.img -i

guestfish -d libvirt-domain -i

🚨 WARNING 🚨

so real talk for a sec, bestie 💀 — running guestfish in write mode on live virtual machines, or at the same time as other disk editing tools, can be dangerous and can genuinely cause disk corruption. no cap. the VM has to be shut down before you use this command, and disk images must not be edited concurrently. periodt.

use the --ro (read-only) option to use guestfish safely if the disk image or virtual machine might be live 🫶. you may still see strange or inconsistent results if things are changing underneath you at the same time, but with this option you won't risk disk corruption. slay.

🦋 DESCRIPTION 🦋

Guestfish is a shell and command-line tool for examining and modifying virtual machine filesystems ✨. it uses libguestfs and exposes all of the functionality of the guestfs API — go check guestfs(3) iykyk.

so basically: Guestfish gives you structured access to the libguestfs API, whether that's from shell scripts, the command line, or interactively 💅. if you're trying to rescue a broken virtual machine image though, you should look at the virt-rescue(1) command instead — that's its whole vibe 🎀.

🔥 EXAMPLES 🔥

💖 As an interactive shell 💖

$ guestfish

Welcome to guestfish, the guest filesystem shell for
editing virtual machine filesystems.

Type: 'help' for a list of commands
      'man' to read the manual
      'quit' to quit the shell

><fs> add-ro disk.img
><fs> run
><fs> list-filesystems
/dev/sda1: ext4
/dev/vg_guest/lv_root: ext4
/dev/vg_guest/lv_swap: swap
><fs> mount /dev/vg_guest/lv_root /
><fs> cat /etc/fstab
# /etc/fstab
# Created by anaconda
[...]
><fs> exit

🌈 From shell scripts 🌈

Create a new /etc/motd file in a guest or disk image:

guestfish <<_EOF_
add disk.img
run
mount /dev/vg_guest/lv_root /
write /etc/motd "Welcome, new users"
_EOF_

List the LVM logical volumes in a disk image:

guestfish -a disk.img --ro <<_EOF_
run
lvs
_EOF_

List all the filesystems in a disk image:

guestfish -a disk.img --ro <<_EOF_
run
list-filesystems
_EOF_

⭐ On one command line ⭐

Update /etc/resolv.conf in a guest:

guestfish \
  add disk.img : run : mount /dev/vg_guest/lv_root / : \
  write /etc/resolv.conf "nameserver 1.2.3.4"

Edit /boot/grub/grub.conf interactively:

guestfish --rw --add disk.img \
  --mount /dev/vg_guest/lv_root \
  --mount /dev/sda1:/boot \
  edit /boot/grub/grub.conf

🎀 Mount disks automatically 🎀

Use the -i option to automatically mount the disks from a virtual machine 🫶:

guestfish --ro -a disk.img -i cat /etc/group

guestfish --ro -d libvirt-domain -i cat /etc/group

another way to edit /boot/grub/grub.conf interactively is:

guestfish --rw -a disk.img -i edit /boot/grub/grub.conf

🧚 As a script interpreter 🧚

Create a 100MB disk containing an ext2-formatted partition:

#!/usr/bin/guestfish -f
sparse test1.img 100M
run
part-disk /dev/sda mbr
mkfs ext2 /dev/sda1

💜 Start with a prepared disk 💜

Create a 1G disk called test1.img containing a single ext2-formatted partition:

guestfish -N fs

to list what's available, do:

guestfish -N help | less

🐟 Remote drives 🐟

access a remote disk using NBD:

guestfish -a nbd://example.com

👑 Remote control 👑

eval "`guestfish --listen`"
guestfish --remote add-ro disk.img
guestfish --remote run
guestfish --remote lvs

✨ OPTIONS ✨

okay bestie, this is the full options menu and it’s giving main character energy 💅 every flag is here, every value is here, nothing skipped. let’s go 🫶

--help — shows general help about options. that’s it, that’s the vibe ✨
-h, --cmd-help — lists all the guestfish commands you can use. like a little command directory, iconic 🎀
-h CMD, --cmd-help CMD — shows detailed help for one single command, CMD. very “tell me about this one specifically” energy 🔍
-a IMAGE, --add IMAGE — adds a block device or virtual machine image to the shell. the disk image format is auto-detected; to override that and force a particular format, use the --format=.. option. using this flag is mostly equivalent to using the add command, with readonly:true if the --ro flag was given, and with format:... if the --format=... flag was given 🦋
-a URI, --add URI — adds a remote disk. see “ADDING REMOTE STORAGE”. remote storage bestie, we love a long-distance relationship 🌈
--blocksize=512, --blocksize=4096, --blocksize — this parameter sets the sector size of the disk image. it affects all explicitly added subsequent disks after this parameter. using --blocksize with no argument switches the disk sector size to the default value, which is usually 512 bytes. see also guestfs_add_drive_opts in guestfs(3) 🧚
-c URI, --connect URI — when used together with the -d option, this specifies the libvirt URI to use. the default is to use the default libvirt connection 🔌
--csh — if you’re using the --listen option and a csh-like shell, use this option. see section “REMOTE CONTROL AND CSH” below 🐚
-d LIBVIRT-DOMAIN, --domain LIBVIRT-DOMAIN — adds disks from the named libvirt domain. if the --ro option is also used, then any libvirt domain can be used. however, in write mode, only libvirt domains which are shut down can be named here. domain UUIDs can be used instead of names. using this flag is mostly equivalent to using the add-domain command, with readonly:true if the --ro flag was given, and with format:... if the --format=... flag was given 👑
--echo-keys — when prompting for keys and passphrases, guestfish normally turns echoing off so you cannot see what you are typing. if you are not worried about Tempest attacks and there is no one else in the room, you can specify this flag to see what you are typing. bestie, only do this when the room is actually empty, okay? 🙈
-f FILE, --file FILE — reads commands from FILE. to write pure guestfish scripts, use:

#!/usr/bin/guestfish -f

script mode slay 💖

--format=raw|qcow2|.., --format — the default for the -a option is to auto-detect the format of the disk image. using this forces the disk format for -a options which follow on the command line. using --format with no argument switches back to auto-detection for subsequent -a options.

for example:

guestfish --format=raw -a disk.img

forces raw format (no auto-detection) for disk.img.

guestfish --format=raw -a disk.img --format -a another.img

forces raw format (no auto-detection) for disk.img and reverts to auto-detection for another.img.

if you have untrusted raw-format guest disk images, you should use this option to specify the disk format. this avoids a possible security problem with malicious guests (CVE-2010-3851). see also add. security check: do not skip this one 😭🔒

-i, --inspector — using virt-inspector(1) code, inspects the disks looking for an operating system and mounts filesystems as they would be mounted on the real virtual machine.

typical usage is either:

guestfish -d myguest -i

for an inactive libvirt domain called myguest, or:

guestfish --ro -d myguest -i

for active domains, readonly, or specify the block device directly:

guestfish --rw -a /dev/Guests/MyGuest -i

note that the command line syntax changed slightly over older versions of guestfish. you can still use the old syntax:

guestfish [--ro] -i disk.img
guestfish [--ro] -i libvirt-domain

using this flag is mostly equivalent to using the inspect-os command and then using other commands to mount the filesystems that were found. inspector mode is highkey iconic 🔍✨

--key SELECTOR — specifies a key for LUKS, to automatically open a LUKS device when using the inspection. here are the selector flavors, bestie:
- --key NAME:key:KEY_STRING, --key UUID:key:KEY_STRING, --key all:key:KEY_STRING — NAME is the libguestfs device name (eg. /dev/sda1). UUID is the device UUID. all means try the key against any encrypted device. use the specified KEY_STRING as passphrase. 🔑
- --key NAME:file:FILENAME, --key UUID:file:FILENAME, --key all:file:FILENAME — reads the passphrase from FILENAME. 📄
- --key NAME:clevis, --key UUID:clevis, --key all:clevis — attempts passphrase-less unlocking for the device with Clevis, over the network. please refer to “ENCRYPTED DISKS” in guestfs(3) for more information on network-bound disk encryption (NBDE). note that if any such option is present on the command line, QEMU user networking will be automatically enabled for the libguestfs appliance. network unlock energy 🌐
- --key NAME:error, --key UUID:error, --key all:error — any encrypted device matching will cause an error. --key all:error can be used to reject any disk image that contains an encrypted partition. strict mode activated 💀
--keys-from-stdin — reads key or passphrase parameters from stdin. the default is to try to read passphrases from the user by opening /dev/tty. if there are multiple encrypted devices, then you may need to supply multiple keys on stdin, one per line. multiple keys? multiple lines. we stay organized 💅
--listen — forks into the background and listens for remote commands. see section “REMOTE CONTROL GUESTFISH OVER A SOCKET” below. background mode, very mysterious of it 🕶️
-m dev[:mountpoint[:options[:fstype]]], --mount dev[:mountpoint[:options[:fstype]]] — mounts the named partition or logical volume on the given mountpoint. if the mountpoint is omitted, it defaults to /. you have to mount something on / before most commands will work. if any -m or --mount options are given, the guest is automatically launched. 🚀

if you don’t know what filesystems a disk image contains, you can either run guestfish without this option, then list the partitions, filesystems and LVs available (see list-partitions, list-filesystems and lvs commands), or you can use the virt-filesystems(1) program.

the third (and rarely used) part of the mount parameter is the list of mount options used to mount the underlying filesystem. if this is not given, then the mount options are either the empty string or ro (the latter if the --ro flag is used). by specifying the mount options, you override this default choice. probably the only time you would use this is to enable ACLs and/or extended attributes if the filesystem can support them:

-m /dev/sda1:/:acl,user_xattr

using this flag is equivalent to using the mount-options command.

the fourth part of the parameter is the filesystem driver to use, such as ext3 or ntfs. this is rarely needed, but can be useful if multiple drivers are valid for a filesystem (eg: ext2 and ext3), or if libguestfs misidentifies a filesystem. fstype customization, but make it rare 🎀

--network — enables QEMU user networking in the guest. networking era 🌐
-N [FILENAME=]TYPE, --new [FILENAME=]TYPE, -N help — prepares a fresh disk image formatted as TYPE. this is an alternative to the -a option: whereas -a adds an existing disk, -N creates a preformatted disk with a filesystem and adds it. see “PREPARED DISK IMAGES” below. fresh disk, fresh vibes ✨
-n, --no-sync — disables autosync. this is enabled by default. see the discussion of autosync in the guestfs(3) manpage. no-sync bestie, handle with care 🫶
--no-dest-paths — don’t tab-complete paths on the guest filesystem. it is useful to be able to hit the tab key to complete paths on the guest filesystem, but this causes extra “hidden” guestfs calls to be made, so this option is here to allow this feature to be disabled. hidden calls? not the vibe. disable if you must 🙈
--pipe-error — if writes fail to pipe commands (see “PIPES” below), then the command returns an error. the default (also for historical reasons) is to ignore such errors so that:

><fs> command_with_lots_of_output | head

doesn’t give an error. historical default behavior, keeping it chill 💀

--progress-bars — enables progress bars, even when guestfish is used non-interactively. progress bars are enabled by default when guestfish is used as an interactive shell. we love a little progress moment 📊✨
--no-progress-bars — disables progress bars. bye-bye little bars 👋
--remote, --remote=PID — sends remote commands to $GUESTFISH_PID or pid. see section “REMOTE CONTROL GUESTFISH OVER A SOCKET” below. remote control realness 📡
-r, --ro — this changes the -a, -d and -m options so that disks are added and mounts are done read-only. the option must always be used if the disk image or virtual machine might be running, and is generally recommended in cases where you don’t need write access to the disk. note that prepared disk images created with -N are not affected by this option. also commands like add are not affected — you have to specify the readonly:true option explicitly if you need it. see also “OPENING DISKS FOR READ AND WRITE” below. read-only is the safe bestie mode 🔒💖
--selinux — this option is provided for backwards compatibility and does nothing. it’s literally just there, being decorative 🎀
-v, --verbose — enables very verbose messages. this is particularly useful if you find a bug. detective mode: on 🔍
-V, --version — displays the guestfish / libguestfs version number and exits. version check slay 👑
-w, --rw — this changes the -a, -d and -m options so that disks are added and mounts are done read-write. see “OPENING DISKS FOR READ AND WRITE” below. read-write mode, use responsibly 🔥
-x — echoes each command before executing it. very “show your work” of it 📝✨

💅 COMMANDS ON COMMAND LINE

Okay so literally any leftover (non-option) arguments? Guestfish treats them as commands to run. Iconic.

Commands you wanna execute get separated by a colon (":"), and bestie, that colon has to be its own separate parameter. Like so:

guestfish cmd [args...] : cmd [args...] : cmd [args...] ...

If there aren't any extra arguments, you drop into a shell — interactive with a prompt if the input is a terminal, or a non-interactive shell otherwise.

In either command line mode or non-interactive shell, the first command that errors out makes the whole shell exit. In interactive mode (with a prompt), if a command fails you can just keep going and enter more commands. Slay.

Heads up 🫶: arguments of the commands count as guestfish options if they start with a dash ("-"). So you can always split the guestfish options from the rest of the commands (plus their args) with a double dash ("--"). Example:

guestfish -- disk_create overlay.qcow2 qcow2 -1 backingfile:image.img

🌸 USING `launch` (OR `run`)

Same energy as guestfs(3), bestie: first you configure your guest by adding disks, then you launch it, then you mount whatever disks you need, and finally you issue actions/commands. So the general order of the day is:

add or -a/--add
launch (aka run)
mount or -m/--mount
any other commands

"run" is a synonym for "launch". You must "launch" (or "run") your guest before mounting or doing any other commands. No skipping steps, iykyk.

The one exception: if any of the -i, -m, --mount, -N or --new options were given, then "run" happens automatically — simply because guestfish can't do the thing you asked for without it. Main character energy, honestly.

👑 OPENING DISKS FOR READ AND WRITE

The guestfish, guestmount(1) and virt-rescue(1) options --ro and --rw affect whether the other command line options -a, -c, -d, -i and -m open disk images read-only or for writing.

In libguestfs ≤ 1.10, guestfish, guestmount and virt-rescue defaulted to opening disk images supplied on the command line for write. To open a disk image read-only you had to do -a image --ro.

🚨 This matters, fr fr: if you accidentally open a live VM disk image as writable, you will cause irreversible disk corruption. Not cute. Do not do this.

In a future libguestfs we intend to flip the default the other way. Disk images will be opened read-only. You'll have to either specify guestfish --rw, guestmount --rw, virt-rescue --rw, or change the configuration file, to get write access for disk images specified by those other command line options.

This version of guestfish, guestmount and virt-rescue has a --rw option which does nothing (it's already the default). But it's highly recommended you use this option anyway to signal that you need write access — and to prep your scripts for the day when this option will be required for write access. Future-proofing, periodt.

Note 🎀: this does not affect commands like "add" and "mount", or any other libguestfs program apart from guestfish and guestmount.

🦋 QUOTING

You can quote ordinary parameters with either single or double quotes. Example time:

add "file with a space.img"

rm '/file name'

rm '/"'

A few commands need a list of strings passed to them. For those, use a whitespace-separated list, enclosed in quotes. Strings containing whitespace that need to be passed through must be enclosed in single quotes. A literal single quote has to be escaped with a backslash. Lowkey fiddly but we ball.

vgcreate VG "/dev/sda1 /dev/sdb1"
command "/bin/echo 'foo      bar'"
command "/bin/echo \'foo\'"

✨ ESCAPE SEQUENCES IN DOUBLE QUOTED ARGUMENTS

In double-quoted arguments (only), use backslash to insert special characters:

"\a" — Alert (bell) character.
"\b" — Backspace character.
"\f" — Form feed character.
"\n" — Newline character.
"\r" — Carriage return character.
"\t" — Horizontal tab character.
"\v" — Vertical tab character.
"\"" — A literal double quote character.
"\ooo" — A character with octal value ooo. There must be precisely 3 octal digits (unlike C). Yes, exactly 3, no vibes-based guessing.
"\xhh" — A character with hex value hh. There must be precisely 2 hex digits.

🙈 In the current implementation, "\000" and "\x00" cannot be used in strings.

"\\" — A literal backslash character.

🎀 OPTIONAL ARGUMENTS

Some commands take optional arguments. In this documentation they show up as "[argname:..]". You use them like this:

add filename

add filename readonly:true

add filename format:qcow2 readonly:false

Each optional argument can appear at most once. And all the optional arguments have to come after the required ones. Order matters, bestie 💅.

🌈 NUMBERS

This section applies to every command that can take integers as parameters. Buckle up.

⭐ SIZE SUFFIX

When a command takes a parameter measured in bytes, you can use one of these suffixes to say kilobytes, megabytes and bigger:

k or K or KiB — the size in kilobytes (multiplied by 1024).
KB — the size in SI 1000 byte units.
M or MiB — the size in megabytes (multiplied by 1048576).
MB — the size in SI 1000000 byte units.
G or GiB — the size in gigabytes (multiplied by 2**30).
GB — the size in SI 10**9 byte units.
T or TiB — the size in terabytes (multiplied by 2**40).
TB — the size in SI 10**12 byte units.
P or PiB — the size in petabytes (multiplied by 2**50).
PB — the size in SI 10**15 byte units.
E or EiB — the size in exabytes (multiplied by 2**60).
EB — the size in SI 10**18 byte units.
Z or ZiB — the size in zettabytes (multiplied by 2**70).
ZB — the size in SI 10**21 byte units.
Y or YiB — the size in yottabytes (multiplied by 2**80).
YB — the size in SI 10**24 byte units.

For example:

truncate-size /file 1G

would truncate the file to 1 gigabyte. Chef's kiss.

⚠️ Careful though, because a few commands take sizes in kilobytes or megabytes already (eg. the parameter to "memsize" is specified in megabytes already). Adding a suffix will probably not do what you expect. Read the room (and the docs).

🧚 OCTAL AND HEXADECIMAL NUMBERS

For specifying the radix (base), use the C convention: 0 to prefix an octal number, or "0x" to prefix a hexadecimal number. Like:

 1234      decimal number 1234
 02322     octal number, equivalent to decimal 1234
 0x4d2     hexadecimal number, equivalent to decimal 1234

When you're using the "chmod" command, you almost always want to specify an octal number for the mode — and you must prefix it with 0 (unlike the Unix chmod(1) program):

chmod 0777 /public  # OK
chmod 777 /public   # WRONG! This is mode 777 decimal = 01411 octal.

💀 Yeah. That second one is a trap. The first one ate.

Commands that return numbers usually print them in decimal, but some commands print numbers in other radices (eg. "umask" prints the mode in octal, preceded by 0).

🍓 WILDCARDS AND GLOBBING

Neither guestfish nor the underlying guestfs API performs wildcard expansion (globbing) by default. So for example this will not do what you expect:

rm-rf /home/*

Assuming you don't have a directory literally called /home/*, the command above will return an error. 😭

To actually perform wildcard expansion, use the "glob" command.

glob rm-rf /home/*

That runs "rm-rf" on each path that matches (ie. potentially running the command many times), which is equivalent to:

rm-rf /home/jim
rm-rf /home/joe
rm-rf /home/mary

"glob" only works on simple guest paths, not on device names. Noted 📝.

If you've got several parameters, each containing a wildcard, then glob will perform a Cartesian product. Math queen behavior.

💜 COMMENTS

Any line starting with a # character is treated as a comment and ignored. The # can optionally have whitespace before it, but it can't have a command before it. For example:

# this is a comment
        # this is a comment
foo # NOT a comment

Blank lines are also ignored. So chill, add your little notes ✨.

🔥 RUNNING COMMANDS LOCALLY

Any line that starts with a ! character gets treated as a command sent to the local shell (/bin/sh or whatever system(3) uses). For example:

!mkdir local
tgz-out /remote local/remote-data.tar.gz

...will create a directory "local" on the host, and then export the contents of /remote on the mounted filesystem to local/remote-data.tar.gz. (See "tgz-out".)

To change the local directory, use the "lcd" command. "!cd" will have no effect, because of the way subprocesses work in Unix. Sad but true 🙈.

🫶 LOCAL COMMANDS WITH INLINE EXECUTION

If a line starts with <! then the shell command is executed (same as for !), but afterwards any output (stdout) of that shell command is parsed and executed as guestfish commands.

So you can use a shell script to construct arbitrary guestfish commands, which then get parsed by guestfish. Literally building commands with commands, iconic.

For example, it's tedious to create a sequence of files (eg. /foo.1 through /foo.100) using guestfish commands alone. But it's simple if we use a shell script to create the guestfish commands for us:

<! for n in `seq 1 100`; do echo write /foo.$n $n; done

or with names like /foo.001:

<! for n in `seq 1 100`; do printf "write /foo.%03d %d\n" $n $n; done

💡 Pro tip: when using guestfish interactively it can be helpful to just run the shell script first (ie. remove the initial "<" character so it's just an ordinary ! local command), see what guestfish commands it would run, and when you're happy with those, prepend the "<" character to run the guestfish commands for real. Test first, slay later.

🌟 PIPES

Use "command <space> | command" to pipe the output of the first command (a guestfish command) into the second command (any host command). For example:

cat /etc/passwd | awk -F: '$3 == 0 { print }'

(where "cat" is the guestfish cat command, but "awk" is the host awk program). The above command would list all accounts in the guest filesystem which have UID 0 — ie. root accounts including backdoors 👀. Other examples:

hexdump /bin/ls | head
list-devices | tail -1
tgz-out / - | tar ztf -

The space before the pipe symbol is required; any space after the pipe symbol is optional. Everything after the pipe symbol is just passed straight to the host shell, so it can contain redirections, globs and anything else that makes sense on the host side.

To use a literal argument that begins with a pipe symbol, you have to quote it, eg:

echo "|"

🎀 HOME DIRECTORIES

If a parameter starts with the character "~" then the tilde may be expanded as a home directory path (either "~" for the current user's home directory, or "~user" for another user).

🌸 Note that home directory expansion happens for users known on the host, not in the guest filesystem. Different world, bestie.

To use a literal argument that begins with a tilde, you have to quote it, eg:

echo "~"

🔐 ENCRYPTED DISKS 🔐

okay so bestie, listen — libguestfs does have some support for Linux guests that are encrypted with the Linux Unified Key Setup (LUKS) standard. Is that a mood? Yes. And that standard covers nearly all whole disk encryption systems used by modern Linux guests, plus Windows BitLocker. We love range. 💅

First step, babes: identify those encrypted block devices and partitions using vfs-type:

><fs> vfs-type /dev/sda2
crypto_LUKS

or:

><fs> vfs-type /dev/sda2
BitLocker

Then you open those devices with cryptsetup-open. This literally creates a device-mapper device called /dev/mapper/name.

><fs> cryptsetup-open /dev/sda2 name
Enter key or passphrase ("key"): <enter the passphrase>

For Linux guests you also have to tell LVM to scan for volume groups on the newly created mapper device — it's giving teamwork:

vgscan
vg-activate-all true

Now the filesystems or logical volumes can be mounted in the usual way. slay. ✨

Before you close an encrypted device though, you must unmount any logical volumes on it and deactivate the volume groups by calling vg-activate false VG on each one. Then (and only then!) you can close the mapper device:

vg-activate false /dev/VG
cryptsetup-close /dev/mapper/name

🪟 WINDOWS PATHS 🪟

If a path is prefixed with win: then you can use Windows-style drive letters and paths (with some limitations, because of course). These three commands are equivalent, no cap:

file /WINDOWS/system32/config/system.LOG

file win:\windows\system32\config\system.log

file WIN:C:\Windows\SYSTEM32\CONFIG\SYSTEM.LOG

The parameter gets rewritten "behind the scenes" — the way that works is it looks up the position where the drive is mounted, prepends that to the path, changes all backslash characters to forward slash, then resolves the result using case-sensitive-path. So for example if the E: drive was mounted on /e then the parameter might be rewritten like this:

win:e:\foo\bar => /e/FOO/bar

Big caveat bestie: this only works in argument positions that expect a path. 💀

📤 UPLOADING AND DOWNLOADING FILES 📥

For commands like upload, download, tar-in, tar-out and others which upload from or download to a local file, there's a special filename - that means "from stdin" or "to stdout". Obsessed with the simplicity tbh. For example:

upload - /foo

reads stdin and creates from that a file /foo in the disk image, and:

tar-out /etc - | tar tf -

writes the tarball to stdout and then pipes that into the external tar command (see "PIPES" — the girlies covered that already).

When you use - to read from stdin, the input is read up to the end of stdin. You can also use a special "heredoc"-like syntax to read up to some arbitrary end marker:

upload -<<END /foo
input line 1
input line 2
input line 3
END

Any string of characters can be used instead of END — get creative, it's your world 🌈. But the end marker must appear on a line of its own, without any preceding or following characters (not even spaces). Not one single space. She's strict. 😤

Heads up: the -<< syntax only applies to parameters used to upload local files (so-called "FileIn" parameters in the generator).

💥 EXIT ON ERROR BEHAVIOUR 💥

By default, guestfish will ignore any errors when in interactive mode (ie. taking commands from a human over a tty) — she's forgiving like that 🫶 — and will exit on the first error in non-interactive mode (scripts, commands given on the command line). She's not forgiving like that.

But here's the trick: if you prefix a command with a - character, then that command will not cause guestfish to exit, even if that (one) command returns an error. Just that one. Don't push it. 💅

📡 REMOTE CONTROL GUESTFISH OVER A SOCKET 📡

Guestfish can be remote-controlled over a socket. This is useful particularly in shell scripts where you want to make several different changes to a filesystem, but you don't want the overhead of starting up a guestfish process each time. Efficiency icon behavior, honestly. 🔥

Start a guestfish server process using:

eval "`guestfish --listen`"

and then send it commands by doing:

guestfish --remote cmd [...]

To cause the server to exit, send it the exit command:

guestfish --remote exit

Note that the server will normally exit if there is an error in a command. You can change this in the usual way. See section "EXIT ON ERROR BEHAVIOUR". ✨

👯 CONTROLLING MULTIPLE GUESTFISH PROCESSES 👯

The eval statement sets the environment variable $GUESTFISH_PID, which is how the --remote option knows where to send the commands. You can have several guestfish listener processes running using:

eval "`guestfish --listen`"
pid1=$GUESTFISH_PID
eval "`guestfish --listen`"
pid2=$GUESTFISH_PID
...
guestfish --remote=$pid1 cmd
guestfish --remote=$pid2 cmd

Look at her go, running a whole little friend group of processes. 🎀

🐚 REMOTE CONTROL AND CSH 🐚

When using csh-like shells (csh, tcsh etc) you have to add the --csh option:

eval "`guestfish --listen --csh`"

Otherwise the vibes are off and it simply won't work. 🙈

🔍 REMOTE CONTROL DETAILS 🔍

Remote control happens over a Unix domain socket called /tmp/.guestfish-$UID/socket-$PID, where $UID is the effective user ID of the process, and $PID is the process ID of the server. Cute little address. 🏠

Guestfish client and server versions must match exactly. No mixing, no matching-ish, exactly. Periodt.

Older versions of guestfish were vulnerable to CVE-2013-4419 (see "CVE-2013-4419" in guestfs(3)). This is fixed in the current version — so like, update bestie. 😭

🛡️ USING REMOTE CONTROL ROBUSTLY FROM SHELL SCRIPTS 🛡️

From Bash, you can use the following code which creates a guestfish instance, correctly quotes the command line, handles failure to start, and cleans up guestfish when the script exits. We stan a well-behaved script:

#!/bin/bash -

set -e

guestfish[0]="guestfish"
guestfish[1]="--listen"
guestfish[2]="--ro"
guestfish[3]="-a"
guestfish[4]="disk.img"

GUESTFISH_PID=
eval $("${guestfish[@]}")
if [ -z "$GUESTFISH_PID" ]; then
    echo "error: guestfish didn't start up, see error messages above"
    exit 1
fi

cleanup_guestfish ()
{
    guestfish --remote -- exit >/dev/null 2>&1 ||:
}
trap cleanup_guestfish EXIT ERR

guestfish --remote -- run

# ...

🚫 REMOTE CONTROL DOES NOT WORK WITH -a ETC. OPTIONS 🚫

Options such as -a, --add, -N, --new etc don’t interact properly with remote support. They are processed locally, and not sent through to the remote guestfish. In particular this won't do what you expect:

guestfish --remote --add disk.img

Don’t use these options. Use the equivalent commands instead, eg:

guestfish --remote add-drive disk.img

or:

guestfish --remote
><fs> add disk.img

💀 REMOTE CONTROL RUN COMMAND HANGING 💀

Using the run (or launch) command remotely in a command substitution context hangs, ie. don't do (note the backquotes):

a=`guestfish --remote run`

Like, she will just sit there. Forever. Since the run command produces no output on stdout, this is not useful anyway. For further information see https://bugzilla.redhat.com/show_bug.cgi?id=592910.

💾 PREPARED DISK IMAGES 💾

Okay so picture this: you need a disk image, like, right now, and you do NOT want to type out fifteen commands to partition and format it. Enter the -N [filename=]type or --new [filename=]type parameter — it picks from a whole set of preformatted disk images that guestfish can just... make for you 🎀. It's genuinely a lifesaver for testing, no cap. It's used instead of the -a option, and just like -a it can show up multiple times (and yes, you can mix it with -a too, go off).

The new disk is called test1.img for the first -N, test2.img for the second and so on. Heads up though: existing files in the current directory are overwritten 😭. If you want a different filename, specify filename= before the type (examples below, bestie).

The type basically describes how the disk should be sized, partitioned, how filesystem(s) should be created, and how content should be added. Optionally the type can be followed by extra parameters, separated by : (colon) characters. Like, -N fs creates a default 1G, sparsely-allocated disk, containing a single partition, with the partition formatted as ext2. And -N fs:ext4:2G is the same vibe, but for an ext4 filesystem on a 2GB disk instead. Slay.

Note that the prepared filesystem is not mounted. You would usually have to use the mount /dev/sda1 / command or add the -m /dev/sda1 option. Don't forget, or you'll be staring at your screen like 👁️👄👁️.

If any -N or --new options are given, the libguestfs appliance is automatically launched. Convenient.

✨ EXAMPLES ✨

Create a 1G disk with an ext4-formatted partition, called test1.img in the current directory:

guestfish -N fs:ext4

Create a 32MB disk with a VFAT-formatted partition, and mount it:

guestfish -N fs:vfat:32M -m /dev/sda1

Create a blank 200MB disk:

guestfish -N disk:200M

Create a blank 200MB disk called blankdisk.img (instead of test1.img):

guestfish -N blankdisk.img=disk:200M

🧚 `-N disk` — create a blank disk 🧚

guestfish -N [filename=]disk[:size]

Create a blank disk, size 1G (by default).

The default size can be changed by supplying an optional parameter.

The optional parameters are:

size — default 1G — the size of the disk image

🧚 `-N part` — create a partitioned disk 🧚

guestfish -N [filename=]part[:size[:partition]]

Create a disk with a single partition. By default the size of the disk is 1G (the available space in the partition will be a tiny bit smaller) and the partition table will be MBR (old DOS-style).

These defaults can be changed by supplying optional parameters.

The optional parameters are:

size — default 1G — the size of the disk image
partition — default mbr — partition table type

🧚 `-N fs` — create a filesystem 🧚

guestfish -N [filename=]fs[:filesystem[:size[:partition]]]

Create a disk with a single partition, with the partition containing an empty filesystem. This defaults to creating a 1G disk (the available space in the filesystem will be a tiny bit smaller) with an MBR (old DOS-style) partition table and an ext2 filesystem.

These defaults can be changed by supplying optional parameters.

The optional parameters are:

filesystem — default ext2 — the type of filesystem to use
size — default 1G — the size of the disk image
partition — default mbr — partition table type

🧚 `-N lv` — create a disk with logical volume 🧚

guestfish -N [filename=]lv[:name[:size[:partition]]]

Create a disk with a single partition, set up the partition as an LVM2 physical volume, and place a volume group and logical volume on there. This defaults to creating a 1G disk with the VG and LV called /dev/VG/LV. You can change the name of the VG and LV by supplying an alternate name as the first optional parameter.

Note this does not create a filesystem. Use lvfs to do that, iykyk.

The optional parameters are:

name — default /dev/VG/LV — the name of the VG and LV to use
size — default 1G — the size of the disk image
partition — default mbr — partition table type

🧚 `-N lvfs` — create a disk with logical volume and filesystem 🧚

guestfish -N [filename=]lvfs[:name[:filesystem[:size[:partition]]]]

Create a disk with a single partition, set up the partition as an LVM2 physical volume, and place a volume group and logical volume on there. Then format the LV with a filesystem. This defaults to creating a 1G disk with the VG and LV called /dev/VG/LV, with an ext2 filesystem.

The optional parameters are:

name — default /dev/VG/LV — the name of the VG and LV to use
filesystem — default ext2 — the type of filesystem to use
size — default 1G — the size of the disk image
partition — default mbr — partition table type

🧚 `-N bootroot` — create a boot and root filesystem 🧚

guestfish -N [filename=]bootroot[:bootfs[:rootfs[:size[:bootsize[:partition]]]]]

Create a disk with two partitions, for boot and root filesystem. Format the two filesystems independently. There are several optional parameters which control the exact layout and filesystem types.

The optional parameters are:

bootfs — default ext2 — the type of filesystem to use for boot
rootfs — default ext2 — the type of filesystem to use for root
size — default 1G — the size of the disk image
bootsize — default 128M — the size of the boot filesystem
partition — default mbr — partition table type

🧚 `-N bootrootlv` — create a boot and root filesystem using LVM 🧚

guestfish -N [filename=]bootrootlv[:name[:bootfs[:rootfs[:size[:bootsize[:partition]]]]]]

This is the same as bootroot but the root filesystem (only) is placed on a logical volume, named by default /dev/VG/LV. There are several optional parameters which control the exact layout.

The optional parameters are:

name — default /dev/VG/LV — the name of the VG and LV for root
bootfs — default ext2 — the type of filesystem to use for boot
rootfs — default ext2 — the type of filesystem to use for root
size — default 1G — the size of the disk image
bootsize — default 128M — the size of the boot filesystem
partition — default mbr — partition table type

🌐 ADDING REMOTE STORAGE 🌐

For API-level documentation on this topic, see guestfs_add_drive_opts in guestfs(3) and REMOTE STORAGE in guestfs(3). (Yes, both of those, go read them 💜.)

On the command line, you can use the -a option to add network block devices using a URI-style format, for example:

guestfish -a nbd://example.com

URIs cannot be used with the add command. Sorry bestie, that's just the rules.

The equivalent command using the API directly is:

><fs> add /disk.img protocol:nbd server:tcp:example.com

The possible -a URI formats are described below.

🦋 `-a disk.img` / `-a file:///path/to/disk.img` 🦋

Add the local disk image (or device) called disk.img.

🦋 `-a nbd://example.com[:port]`, `-a nbd://example.com[:port]/exportname`, `-a nbd://?socket=/socket`, `-a nbd:///exportname?socket=/socket` 🦋

Add a disk located on Network Block Device (nbd) storage.

The exportname part of the URI specifies an NBD export name, but is usually left empty.

The optional ?socket parameter can be used to specify a Unix domain socket that we talk to the NBD server over. Note that you cannot mix server name (ie. TCP/IP) and socket path. Pick a lane 💅.

The equivalent API command would be (no export name):

><fs> add "" protocol:nbd server:[tcp:example.com|unix:/socket]

🦋 `-a rbd:///pool/disk`, `-a rbd://example.com[:port]/pool/disk` 🦋

Add a disk image located on a Ceph (RBD/librbd) storage volume.

Although libguestfs and Ceph supports multiple servers, only a single server can be specified when using this URI syntax.

The equivalent API command would be:

><fs> add pool/disk protocol:rbd server:tcp:example.com:port

Note that the URIs follow the syntax of RFC 3986: in particular, there are restrictions on the allowed characters for the various components of the URI. Characters such as :, @, and / must be percent-encoded:

$ guestfish -a rbd://user:pass%40word@example.com[:port]/pool/disk

In this case, the password is pass@word. Sneaky little %40 doing all the work there 🔥.

📊 PROGRESS BARS 📊

Some (not all) long-running commands send progress notification messages as they are running. Guestfish turns these messages into progress bars. Cute, right?

When a command that supports progress bars takes longer than two seconds to run, and if progress bars are enabled, then you will see one appearing below the command:

><fs> copy-size /large-file /another-file 2048M
/ 10% [#####-----------------------------------------] 00:30

The spinner on the left hand side moves round once for every progress notification received from the backend. This is a (reasonably) golden assurance that the command is "doing something" even if the progress bar is not moving, because the command is able to send the progress notifications. Honestly kind of iconic. When the bar reaches 100% and the command finishes, the spinner disappears. 🫶

Progress bars are enabled by default when guestfish is used interactively. You can enable them even for non-interactive modes using --progress-bars, and you can disable them completely using --no-progress-bars. Your terminal, your rules ✨.

💬 PROMPT 💬

Okay so the prompt is customizable, bestie. You can change or add colours to the default prompt (the ><fs> one) by setting the GUESTFISH_PS1 environment variable. Then there’s a second string, GUESTFISH_OUTPUT, which is printed after the command has been entered and before the output — it’s giving you colour control for the output. A third string, GUESTFISH_INIT, is printed before the welcome message, so you can control the colour of that message. And a fourth string, GUESTFISH_RESTORE, is printed before guestfish exits. Fully themed terminal era, no cap. 💅

A simple prompt can be set by setting GUESTFISH_PS1 to an alternate string:

$ GUESTFISH_PS1='(type a command) '
$ export GUESTFISH_PS1
$ guestfish
[...]
(type a command) ▂

You can also use special escape sequences, as described below:

\\ — a literal backslash character.
\[, \] — (these should only be used in GUESTFISH_PS1.) Place non-printing characters (eg. terminal control codes for colours) between \[...\]. What this does is tell the readline(3) library that it should treat this subsequence as zero-width, so that command-line redisplay, editing etc works. Iconic little readline hack, honestly.
\a — a bell character.
\e — an ASCII ESC (escape) character.
\n — a newline.
\r — a carriage return.
\NNN — the ASCII character whose code is the octal value NNN.
\xNN — the ASCII character whose code is the hex value NN.

✨ EXAMPLES OF PROMPTS ✨

Note that these examples require a terminal that supports ANSI escape codes. Your terminal needs the range, bestie. 🌈

A bold black version of the ordinary prompt.

GUESTFISH_PS1='\[\e[1;30m\]><fs>\[\e[0;30m\] '

Blue welcome text, green prompt, red commands, black command output.

GUESTFISH_PS1='\[\e[1;32m\]><fs>\[\e[0;31m\] '
GUESTFISH_OUTPUT='\e[0m'
GUESTFISH_RESTORE="$GUESTFISH_OUTPUT"
GUESTFISH_INIT='\e[1;34m'

🪟 WINDOWS 8 🪟

🪟 Heads up, bestie: Windows 8 “fast startup” can prevent guestfish from mounting NTFS partitions. See WINDOWS HIBERNATION AND WINDOWS 8 FAST STARTUP in guestfs(3).

🌸 GUESTFISH COMMANDS 🌸

The commands in this section are guestfish convenience commands — in other words, they are not part of the guestfs(3) API. They’re the little quality-of-life extras. 🫶

help

help
help cmd
help -l|--list

Without any parameter, this provides general help.

With a cmd parameter, this displays detailed help for that command.

With -l or --list, this lists all commands.

exit / quit

This exits guestfish. You can also use the ^D key — that’s Ctrl+D for the keyboard girlies. 💅

alloc / allocate

alloc filename size

This creates an empty (zeroed) file of the given size, and then adds it so it can be further examined.

For more advanced image creation, see disk-create.

Size can be specified using standard suffixes, eg. 1M.

To create a sparse file, use sparse instead. To create a prepared disk image, see PREPARED DISK IMAGES.

copy-in

copy-in local [local ...] /remotedir

copy-in copies local files or directories recursively into the disk image, placing them in the directory called /remotedir (which must exist). This guestfish meta-command turns into a sequence of tar-in and other commands as necessary.

Multiple local files and directories can be specified, but the last parameter must always be a remote directory. Wildcards cannot be used.

copy-out

copy-out remote [remote ...] localdir

copy-out copies remote files or directories recursively out of the disk image, placing them on the host disk in a local directory called localdir (which must exist). This guestfish meta-command turns into a sequence of download, tar-out and other commands as necessary.

Multiple remote files and directories can be specified, but the last parameter must always be a local directory. To download to the current directory, use . as in:

copy-out /home .

Wildcards cannot be used in the ordinary command, but you can use them with the help of glob like this:

glob copy-out /home/* .

delete-event

delete-event name

Delete the event handler which was previously registered as name. If multiple event handlers were registered with the same name, they are all deleted.

See also the guestfish commands event and list-events.

display

display filename

Use display (a graphical display program) to display an image file. It downloads the file, and runs display on it.

To use an alternative program, set the GUESTFISH_DISPLAY_IMAGE environment variable. For example to use the GNOME display program:

export GUESTFISH_DISPLAY_IMAGE=eog

echo

echo [params ...]

This echos the parameters to the terminal.

edit / vi / emacs

edit filename

This is used to edit a file. It downloads the file, edits it locally using your editor, then uploads the result.

The editor is $EDITOR. However if you use the alternate commands vi or emacs you will get those corresponding editors.

event

event name eventset "shell script ..."

Register a shell script fragment which is executed when an event is raised. See guestfs_set_event_callback in guestfs(3) for a discussion of the event API in libguestfs.

The name parameter is a name that you give to this event handler. It can be any string (even the empty string) and is simply there so you can delete the handler using the guestfish delete-event command.

The eventset parameter is a comma-separated list of one or more events, for example close or close,trace. The special value * means all events.

The third and final parameter is the shell script fragment (or any external command) that is executed when any of the events in the eventset occurs. It is executed using $SHELL -c, or if $SHELL is not set then /bin/sh -c.

The shell script fragment receives callback parameters as arguments $1, $2 etc. The actual event that was called is available in the environment variable $EVENT.

event "" close "echo closed"
event messages appliance,library,trace "echo $@"
event "" progress "echo progress: $3/$4"
event "" * "echo $EVENT $@"

See also the guestfish commands delete-event and list-events.

glob

glob command args...

Expand wildcards in any paths in the args list, and run command repeatedly on each matching path.

See WILDCARDS AND GLOBBING.

hexedit

hexedit <filename|device>
hexedit <filename|device> <max>
hexedit <filename|device> <start> <max>

Use hexedit (a hex editor) to edit all or part of a binary file or block device.

This command works by downloading potentially the whole file or device, editing it locally, then uploading it. If the file or device is large, you have to specify which part you wish to edit by using max and/or start max parameters. start and max are specified in bytes, with the usual modifiers allowed such as 1M (1 megabyte).

For example to edit the first few sectors of a disk you might do:

hexedit /dev/sda 1M

which would allow you to edit anywhere within the first megabyte of the disk.

To edit the superblock of an ext2 filesystem on /dev/sda1, do:

hexedit /dev/sda1 0x400 0x400

(assuming the superblock is in the standard location).

This command requires the external hexedit(1) program. You can specify another program to use by setting the HEXEDITOR environment variable.

lcd

lcd directory

Change the local directory, ie. the current directory of guestfish itself.

Note that !cd won’t do what you might expect.

list-events

list-events

List the event handlers registered using the guestfish event command.

man / manual

man

Opens the manual page for guestfish.

more / less

more filename

less filename

This is used to view a file.

The default viewer is $PAGER. However if you use the alternate command less you will get the less command specifically.

not

not command [args...]

This runs an existing guestfish command and negates the exit code, so if the command fails, then not command succeeds.

Note this doesn’t reverse the sense of commands which return booleans. (eg. not exists /foo doesn’t do what you think).

For example not cat /foo will check that the file does not exist.

reopen

reopen

Close and reopen the libguestfs handle. It is not necessary to use this normally, because the handle is closed properly when guestfish exits. However this is occasionally useful for testing.

setenv

setenv VAR value

Set the environment variable VAR to the string value.

To print the value of an environment variable use a shell command such as:

!echo $VAR

sparse

sparse filename size

This creates an empty sparse file of the given size, and then adds it so it can be further examined.

In all respects it works the same as the alloc command, except that the image file is allocated sparsely, which means that disk blocks are not assigned to the file until they are needed. Sparse disk files only use space when written to, but they are slower and there is a danger you could run out of real disk space during a write operation. ⚠️ Not me warning you about real disk space — I’m literally warning you about real disk space.

For more advanced image creation, see disk-create.

Size can be specified using standard suffixes, eg. 1M.

See also the guestfish scratch command.

supported

supported

This command returns a list of the optional groups known to the daemon, and indicates which ones are supported by this build of the libguestfs appliance.

See also AVAILABILITY in guestfs(3).

time

time command args...

Run the command as usual, but print the elapsed time afterwards. This can be useful for benchmarking operations.

unsetenv

unsetenv VAR

Remove VAR from the environment.

🧚 COMMANDS 🧚

acl-delete-def-file

acl-delete-def-file dir

This function deletes the default POSIX Access Control List (ACL) attached to directory dir.

This command depends on the feature acl. See also feature-available.

acl-get-file

acl-get-file path acltype

This function returns the POSIX Access Control List (ACL) attached to path. The ACL is returned in “long text form” (see acl(5)).

The acltype parameter may be:

access — Return the ordinary (access) ACL for any file, directory or other filesystem object.
default — Return the default ACL. Normally this only makes sense if path is a directory.

This command depends on the feature acl. See also feature-available.

acl-set-file

acl-set-file path acltype acl

This function sets the POSIX Access Control List (ACL) attached to path.

The acltype parameter may be:

access — Set the ordinary (access) ACL for any file, directory or other filesystem object.
"default" — sets the default ACL. Ngl this only really makes sense if path is a directory 💅

The acl parameter is the new ACL, and it can be in either "long text form" or "short text form" (peep acl(5) for the deets). Heads up: the new ACL completely replaces any ACL that was already on the file — no merging, no blending, it's giving full reset 🫶. The ACL has to contain the full Unix permissions, like u::rwx,g::rx,o::rx.

If you're specifying individual users or groups, then the mask field is also required (like m::rwx), followed by the u:ID:... and/or g:ID:... field(s). So a full ACL string could look like this:

 u::rwx,g::rwx,o::rwx,m::rwx,u:500:rwx,g:500:rwx
 \ Unix permissions / \mask/ \      ACL        /

You should use numeric UIDs and GIDs, bestie — no cap. If you want to map usernames and groupnames to the correct numeric ID in the context of the guest, use the Augeas functions (see aug-init ✨).

This command depends on the feature acl. See also feature-available.

🌸 `add-cdrom`

add-cdrom filename

This function adds a virtual CD-ROM disk image to the guest. Iconic, honestly.

The image gets added as a read-only drive, so this function is equivalent to add-drive-ro.

⚠️ This function is deprecated, bestie. In new code, use the add-drive-ro call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. So like… read the room 💀

🦋 `add-domain` / `domain`

add-domain dom [libvirturi:..] [readonly:true|false] [iface:..] [live:true|false] [allowuuid:true|false] [readonlydisk:..] [cachemode:..] [discard:..] [copyonread:true|false]

This function adds the disk(s) attached to the named libvirt domain dom. It works by connecting to libvirt, requesting the domain and domain XML from libvirt, parsing it for disks, and calling add-drive-opts on each one. It's giving personal assistant energy, fr fr 🎀

The number of disks added is returned. This operation is atomic: if an error is returned, then no disks are added. All or nothing, periodt.

This function does some minimal checks to make sure the libvirt domain is not running (unless readonly is true). In a future version we will try to acquire the libvirt lock on each disk 👑

Disks must be accessible locally. This often means that adding disks from a remote libvirt connection (see https://libvirt.org/remote.html) will fail unless those disks are accessible via the same device path locally too. Lowkey annoying but that's the vibe.

The optional libvirturi parameter sets the libvirt URI (see https://libvirt.org/uri.html). If this is not set then we connect to the default libvirt URI (or one set through an environment variable — see the libvirt documentation for full details).

The optional live flag is ignored in libguestfs ≥ 1.48. It's just, like, not invited to the party anymore 🙈

If the allowuuid flag is true (default is false) then a UUID may be passed instead of the domain name. The dom string is treated as a UUID first and looked up, and if that lookup fails then we treat dom as a name as usual. Try UUID first, fall back to name — main character problem-solving ✨

The optional readonlydisk parameter controls what we do for disks which are marked <readonly/> in the libvirt XML. Possible values are:

readonlydisk = "error"
- If readonly is false: the whole call is aborted with an error if any disk with the <readonly/> flag is found. Like, immediate exit, no discussion 😭
- If readonly is true: disks with the <readonly/> flag are added read-only.
readonlydisk = "read"
- If readonly is false: disks with the <readonly/> flag are added read-only. Other disks are added read/write.
- If readonly is true: disks with the <readonly/> flag are added read-only.
readonlydisk = "write" (this is the default)
- If readonly is false: disks with the <readonly/> flag are added read/write.
- If readonly is true: disks with the <readonly/> flag are added read-only.
readonlydisk = "ignore"
- If readonly is true or false: disks with the <readonly/> flag are skipped. Not invited. Blocked. 💅

If present, the value of logical_block_size attribute of <blockio/> tag in libvirt XML will be passed as blocksize parameter to add-drive-opts.

The other optional parameters are passed directly through to add-drive-opts.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

🔥 `add-drive` / `add` / `add-drive-opts`

add-drive filename [readonly:true|false] [format:..] [iface:..] [name:..] [label:..] [protocol:..] [server:..] [username:..] [secret:..] [cachemode:..] [discard:..] [copyonread:true|false] [blocksize:N]

This function adds a disk image called filename to the handle. filename may be a regular host file or a host device. Obsessed with the flexibility tbh 🫶

When this function is called before launch (which is the usual case) then the first time you call this function, the disk appears in the API as /dev/sda, the second time as /dev/sdb, and so on. Counting up like a little roster ✨

You don't necessarily need to be root when using libguestfs. However you obviously do need sufficient permissions to access the filename for whatever operations you want to perform (ie. read access if you just want to read the image, or write access if you want to modify the image). Common sense check, bestie 💜

This call checks that filename exists.

filename may be the special string /dev/null. See NULL DISKS in guestfs(3).

The optional arguments are:

readonly — if true then the image is treated as read-only. Writes are still allowed, but they are stored in a temporary snapshot overlay which is discarded at the end. The disk that you add is not modified. Genuinely such a slay safety feature.
format — this forces the image format. If you omit this (or use add-drive or add-drive-ro) then the format is automatically detected. Possible formats include raw and qcow2.

🚨 Automatic detection of the format opens you up to a potential security hole when dealing with untrusted raw-format images. See CVE-2010-3851 and RHBZ#642934. Specifying the format closes this security hole. Like, please just specify it, i'm begging 😭

iface — this rarely-used option lets you emulate the behaviour of the deprecated add-drive-with-if call (q.v.)
name — this field used to be passed as a hint for guest inspection, but it is no longer used. Rip to a real one 💀
label — give the disk a label. The label should be a unique, short string using only ASCII characters [a-zA-Z]. As well as its usual name in the API (such as /dev/sda), the drive will also be named /dev/disk/guestfs/label.

See DISK LABELS in guestfs(3).

protocol — the optional protocol argument can be used to select an alternate source protocol.

See also: REMOTE STORAGE in guestfs(3).

protocol = "file" — filename is interpreted as a local file or device. This is the default if the optional protocol parameter is omitted.
protocol = "nbd" — connect to the Network Block Device server. The server parameter must also be supplied — see below.

See also: NETWORK BLOCK DEVICE in guestfs(3).

protocol = "rbd" — connect to the Ceph (librbd/RBD) server. The server parameter must also be supplied — see below. The username parameter may be supplied. See below. The secret parameter may be supplied. See below.

`add-drive-ro` / `add-ro`

add-drive-ro filename

This function is literally the equivalent of calling "add-drive-opts" with the optional parameter "GUESTFS_ADD_DRIVE_OPTS_READONLY" set to 1, so the disk is added read-only, with the format being detected automatically. Set it and forget it, it's giving safety 💅

`add-drive-ro-with-if`

add-drive-ro-with-if filename iface

This is the same as "add-drive-ro" but it lets you specify the QEMU interface emulation to use at run time. Heads up though: both the direct and the libvirt backends ignore iface.

This function is deprecated. In new code, use the "add-drive" call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. So like... they're still here, but they're not thriving, yk?

`add-drive-scratch` / `scratch`

add-drive-scratch size [name:..] [label:..] [blocksize:N]

This command adds a temporary scratch drive to the handle. The "size" parameter is the virtual size (in bytes). The scratch drive is blank initially — meaning all reads return zeroes until you start writing to it ✨ The drive is deleted when the handle is closed. Poof, gone, no evidence.

The optional arguments "name", "label" and "blocksize" are passed through to "add-drive-opts".

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

`add-drive-with-if`

add-drive-with-if filename iface

This is the same as "add-drive" but it allows you to specify the QEMU interface emulation to use at run time. Both the direct and the libvirt backends ignore iface.

This function is deprecated. In new code, use the "add-drive" call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

`aug-clear`

aug-clear augpath

Set the value associated with "path" to "NULL". This is the same as the augtool(1) "clear" command. Clean slate energy 🧚

`aug-close`

aug-close

Close the current Augeas handle and free up any resources used by it. After calling this, you have to call "aug-init" again before you can use any other Augeas functions. It's giving "you can't sit with us until you re-init" 😭

`aug-defnode`

aug-defnode name expr val

Defines a variable "name" whose value is the result of evaluating "expr".

If "expr" evaluates to an empty nodeset, a node is created, equivalent to calling "aug-set" "expr", "val". "name" will be the nodeset containing that single node.

On success this returns a pair containing the number of nodes in the nodeset, and a boolean flag if a node was created. Two-for-one, iconic.

`aug-defvar`

aug-defvar name expr

Defines an Augeas variable "name" whose value is the result of evaluating "expr". If "expr" is NULL, then "name" is undefined.

On success this returns the number of nodes in "expr", or 0 if "expr" evaluates to something which is not a nodeset. Lowkey a vibe check on whether you gave it a nodeset at all.

`aug-get`

aug-get augpath

Look up the value associated with "path". If "path" matches exactly one node, the "value" is returned. Exactly one, bestie, we don't do ambiguity here 💅

`aug-init`

aug-init root flags

Create a new Augeas handle for editing configuration files. If there was any previous Augeas handle associated with this guestfs session, then it is closed. New handle, who dis.

You must call this before using any other "aug-*" commands. No exceptions, periodt.

"root" is the filesystem root. "root" must not be NULL — use / instead.

The flags are the same as the flags defined in <augeas.h>, the logical or of the following integers:

"AUG_SAVE_BACKUP" = 1 — Keep the original file with a .augsave extension.
"AUG_SAVE_NEWFILE" = 2 — Save changes into a file with extension .augnew, and do not overwrite original. Overrides "AUG_SAVE_BACKUP".
"AUG_TYPE_CHECK" = 4 — Typecheck lenses. This option is only useful when debugging Augeas lenses. Use of this option may require additional memory for the libguestfs appliance. You may need to set the "LIBGUESTFS_MEMSIZE" environment variable or call "set-memsize".
"AUG_NO_STDINC" = 8 — Do not use standard load path for modules.
"AUG_SAVE_NOOP" = 16 — Make save a no-op, just record what would have been changed.
"AUG_NO_LOAD" = 32 — Do not load the tree in "aug-init".

To close the handle, you can call "aug-close".

To find out more about Augeas, see http://augeas.net/. Slay, go read up 🔥

`aug-insert`

aug-insert augpath label true|false

Create a new sibling "label" for "path", inserting it into the tree before or after "path" (depending on the boolean flag "before").

"path" must match exactly one existing node in the tree, and "label" must be a label, i.e. not contain /, "*" or end with a bracketed index [N]. Them's the rules 🎀

`aug-label`

aug-label augpath

The label (name of the last element) of the Augeas path expression "augpath" is returned. "augpath" must match exactly one node, else this function returns an error. No match, no label, sorry bestie.

`aug-load`

aug-load

Load files into the tree.

See "aug_load" in the Augeas documentation for the full gory details. Gory is right 😭

`aug-ls`

aug-ls augpath

This is just a shortcut for listing "aug-match" "path/*" and sorting the resulting nodes into alphabetical order. Cute, tidy, alphabetised, obsessed.

`aug-match`

aug-match augpath

Returns a list of paths which match the path expression "path". The returned paths are sufficiently qualified so that they match exactly one node in the current tree. Fully-qualified paths only, we're not doing vague around here ✨

`aug-mv`

aug-mv src dest

Move the node "src" to "dest". "src" must match exactly one node. "dest" is overwritten if it exists. Yes, overwritten — say goodbye to whatever was chilling there before 💀

`aug-rm`

aug-rm augpath

Remove "path" and all of its children. It's giving "delete the whole bloodline".

On success this returns the number of entries which were removed.

`aug-save`

aug-save

This writes all pending changes to disk. The flags which were passed to "aug-init" affect exactly how files are saved. So like, remember what you set earlier, it still matters.

`aug-set`

aug-set augpath val

Set the value associated with "augpath" to "val".

In the Augeas API, it is possible to clear a node by setting the value to NULL. Due to an oversight in the libguestfs API you cannot do that with this call. Instead you must use the "aug-clear" call. Yeah, we know, a little awkward, but that's the lore 🙈

`aug-setm`

aug-setm base sub val

Change multiple Augeas nodes in a single operation. "base" is an expression matching multiple nodes. "sub" is a path expression relative to "base". All nodes matching "base" are found, and then for each node, "sub" is changed to "val". "sub" may also be "NULL" in which case the "base" nodes are modified. Bulk edit but make it fashion.

This returns the number of nodes modified.

`aug-transform`

aug-transform lens file [remove:true|false]

Add an Augeas transformation for the specified "lens" so it can handle "file".

If "remove" is true ("false" by default), then the transformation is removed. Toggle behaviour, we love a two-way street 🦋

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

`available`

available 'groups ...'

This command is used to check the availability of some groups of functionality in the appliance, which not all builds of the libguestfs appliance will be able to provide. Basically: is this feature even in the building or not.

The libguestfs groups, and the functions that those groups correspond to, are listed in "AVAILABILITY" in guestfs(3). You can also fetch this list at runtime by calling "available-all-groups".

The argument "groups" is a list of group names, e.g. ["inotify", "augeas"] would check for the availability of the Linux inotify functions and Augeas (configuration file editing) functions.

The command returns no error if all requested groups are available.

It fails with an error if one or more of the requested groups is unavailable in the appliance.

If an unknown group name is included in the list of groups then an error is always returned. No sneaky typos slipping through 💀

Notes:

"feature-available" is the same as this call, but with a slightly simpler to use API: that call returns a boolean true/false instead of throwing an error.
You must call "launch" before calling this function. The reason is because we don't know what groups are supported by the appliance/daemon until it is running and can be queried.
If a group of functions is available, this does not necessarily mean that they will work. You still have to check for errors when calling individual API functions even if they are available.
It is usually the job of distro packagers to build complete functionality into the libguestfs appliance. Upstream libguestfs, if built from source with all requirements satisfied, will support everything.
This call was added in version 1.0.80. In previous versions of libguestfs all you could do would be to speculatively execute a command to find out if the daemon implemented it. See also "version".

`available-all-groups`

available-all-groups

This command returns a list of all optional groups that this daemon knows about. Note this returns both supported and unsupported groups. To find out which ones the daemon can actually support you have to call "available" / "feature-available" on each member of the returned list. It's a two-step, bestie, don't skip leg day.

See also "available", "feature-available" and "AVAILABILITY" in guestfs(3).

`base64-in`

base64-in (base64file|-) filename

This command uploads base64-encoded data from "base64file" to filename.

Use "-" instead of a filename to read/write from stdin/stdout. The dash is the moment, honestly 🎀

`base64-out`

base64-out filename (base64file|-)

This command downloads the contents of filename, writing it out to local file "base64file" encoded as base64.

Use "-" instead of a filename to read/write from stdin/stdout.

`blkdiscard`

blkdiscard device

This discards all blocks on the block device "device", giving the free space back to the host. Marie Kondo but for blocks ✨

This operation requires support in libguestfs, the host filesystem, qemu and the host kernel. If this support isn't present it may give an error or even appear to run but do nothing. You must also set the "discard" attribute on the underlying drive (see "add-drive-opts").

⚠️ Real talk: "appear to run but do nothing" is the scariest sentence on this whole page. Check your support first, bestie.

This command depends on the feature "blkdiscard". See also "feature-available".

`blkdiscardzeroes`

blkdiscardzeroes device

This call returns true if blocks on "device" that have been discarded by a call to "blkdiscard" are returned as blocks of zero bytes when read the next time.

If it returns false, then it may be that discarded blocks are read as stale or random data. Which is... a lot 🙈 So yeah, worth checking before you trust those zeroes.

🧚 Feature check, finishing the previous command: this one depends on the feature blkdiscardzeroes. See also feature-available.

`blkid`

blkid device

Returns block device attributes for device. Usually these fields show up in the returned hash, and other fields may also be present — no cap, it can surprise you.

UUID — the uuid of this device.
LABEL — the label of this device.
VERSION — the version of blkid command.
TYPE — the filesystem type or RAID of this device.
USAGE — the usage of this device, for example filesystem or raid.

`blockdev-flushbufs`

blockdev-flushbufs device

Tells the kernel to flush internal buffers associated with device. Under the hood this uses the blockdev(8) command. 💅

`blockdev-getbsz`

blockdev-getbsz device

Returns the block size of a device.

😭 Note: this is different from both size in blocks and filesystem block size. Also this setting is not really used by anything. You should probably not use it for anything. Filesystems have their own idea about what block size to choose.

This uses the blockdev(8) command.

`blockdev-getro`

blockdev-getro device

Returns a boolean indicating if the block device is read-only (true if read-only, false if not).

This uses the blockdev(8) command. 🫶

`blockdev-getsize64`

blockdev-getsize64 device

Returns the size of the device in bytes. See also blockdev-getsz.

This uses the blockdev(8) command.

`blockdev-getss`

blockdev-getss device

Returns the size of sectors on a block device. Usually 512, but it can be larger for modern devices.

💀 Note, this is not the size in sectors — use blockdev-getsz for that.

This uses the blockdev(8) command.

`blockdev-getsz`

blockdev-getsz device

Returns the size of the device in units of 512-byte sectors (even if the sectorsize isn't 512 bytes … weird).

See also blockdev-getss for the real sector size of the device, and blockdev-getsize64 for the more useful size in bytes.

This uses the blockdev(8) command.

`blockdev-rereadpt`

blockdev-rereadpt device

Rereads the partition table on device.

This uses the blockdev(8) command.

`blockdev-setbsz`

blockdev-setbsz device blocksize

🚨 This call does nothing and has never done anything because of a bug in blockdev. Do not use it.

If you need to set the filesystem block size, use the blocksize option of mkfs.

💅 Deprecation station: this function is deprecated. There is no replacement. Consult the API documentation in guestfs(3) for further information. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

`blockdev-setra`

blockdev-setra device sectors

Sets readahead (in 512-byte sectors) for the device.

This uses the blockdev(8) command.

`blockdev-setro`

blockdev-setro device

Sets the block device named device to read-only.

This uses the blockdev(8) command.

`blockdev-setrw`

blockdev-setrw device

Sets the block device named device to read-write.

This uses the blockdev(8) command. ✨

`btrfs-balance-cancel`

btrfs-balance-cancel path

Cancels a running balance on a btrfs filesystem.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-balance-pause`

btrfs-balance-pause path

Pauses a running balance on a btrfs filesystem.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-balance-resume`

btrfs-balance-resume path

Resumes a paused balance on a btrfs filesystem.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-balance-status`

btrfs-balance-status path

Shows the status of a running or paused balance on a btrfs filesystem.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-device-add`

btrfs-device-add 'devices ...' fs

Adds the list of device(s) in devices to the btrfs filesystem mounted at fs. If devices is an empty list, this does nothing.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-device-delete`

btrfs-device-delete 'devices ...' fs

Removes the devices from the btrfs filesystem mounted at fs. If devices is an empty list, this does nothing.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-filesystem-balance` / `btrfs-balance`

btrfs-filesystem-balance fs

Balances the chunks in the btrfs filesystem mounted at fs across the underlying devices.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-filesystem-defragment`

btrfs-filesystem-defragment path [flush:true|false] [compress:..]

Defragments a file or directory on a btrfs filesystem. compress is one of zlib or lzo.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-filesystem-resize`

btrfs-filesystem-resize mountpoint [size:N]

This command resizes a btrfs filesystem.

🎀 Note that unlike other resize calls, the filesystem has to be mounted and the parameter is the mountpoint not the device (this is a requirement of btrfs itself).

The optional parameters are:

size — the new size (in bytes) of the filesystem. If omitted, the filesystem is resized to the maximum size.

`btrfs-filesystem-show`

btrfs-filesystem-show device

Shows all the devices where the filesystems in device is spanned over.

If not all the devices for the filesystems are present, then this function fails and the errno is set to ENODEV.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-filesystem-sync`

btrfs-filesystem-sync fs

Forces sync on the btrfs filesystem mounted at fs.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-fsck`

btrfs-fsck device [superblock:N] [repair:true|false]

Used to check a btrfs filesystem; device is the device file where the filesystem is stored.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

💀 Deprecation station: this function is deprecated. In new code, use the btrfs-scrub-full call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-image`

btrfs-image 'source ...' image [compresslevel:N]

This is used to create an image of a btrfs filesystem. All data will be zeroed, but metadata and the like is preserved.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-qgroup-assign`

btrfs-qgroup-assign src dst path

Adds qgroup src to parent qgroup dst. This command can group several qgroups into a parent qgroup to share common limit.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-qgroup-create`

btrfs-qgroup-create qgroupid subvolume

Creates a quota group (qgroup) for subvolume at subvolume.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-qgroup-destroy`

btrfs-qgroup-destroy qgroupid subvolume

Destroys a quota group.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-qgroup-limit`

btrfs-qgroup-limit subvolume size

Limits the size of the subvolume with path subvolume.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-qgroup-remove`

btrfs-qgroup-remove src dst path

Removes qgroup src from the parent qgroup dst.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-qgroup-show`

btrfs-qgroup-show path

Shows all subvolume quota groups in a btrfs filesystem, including their usages.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-quota-enable`

btrfs-quota-enable fs true|false

Enables or disables subvolume quota support for filesystem which contains path.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-quota-rescan`

btrfs-quota-rescan fs

Trashes all qgroup numbers and scans the metadata again with the current config.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-replace`

btrfs-replace srcdev targetdev mntpoint

Replaces a device of a btrfs filesystem. On a live filesystem, it duplicates the data to the target device which is currently stored on the source device. After completion of the operation, the source device is wiped out and removed from the filesystem.

The targetdev needs to be same size or larger than the srcdev. Devices which are currently mounted are never allowed to be used as the targetdev.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-rescue-chunk-recover`

btrfs-rescue-chunk-recover device

Recovers the chunk tree of btrfs filesystem by scanning the devices one by one.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-rescue-super-recover`

btrfs-rescue-super-recover device

Recovers bad superblocks from good copies.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-scrub-cancel`

btrfs-scrub-cancel path

Cancels a running scrub on a btrfs filesystem.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-scrub-full`

btrfs-scrub-full path [readonly:true|false]

Runs a full scrub on a btrfs filesystem and waits for it to finish. If the filesystem has errors this will return an error.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-scrub-resume`

btrfs-scrub-resume path

Resumes a previously canceled or interrupted scrub on a btrfs filesystem.

🌸 btrfs feature check: this command depends on the feature btrfs. See also feature-available.

`btrfs-scrub-start`

btrfs-scrub-start path

Reads all the data and metadata on the filesystem, and uses checksums and the duplicate copies from RAID storage to identify and repair any corrupt data.

btrfs-scrub-status 🧼

btrfs-scrub-status path

Okay so this one shows you the status of a scrub that's either currently running or already finished on a btrfs filesystem. That's it, that's the vibe.

This command depends on the feature btrfs. See also feature-available.

btrfs-set-seeding 🌱

btrfs-set-seeding device true|false

Turns the seeding feature on or off for a device that's holding a btrfs filesystem. You pass true or false, no in-between, bestie.

This command depends on the feature btrfs. See also feature-available.

btrfs-subvolume-create / btrfs-subvolume-create-opts 🎀

btrfs-subvolume-create dest [qgroupid:..]

Makes a brand new btrfs subvolume. The dest argument is literally the destination directory plus the name of the subvolume, written like /path/to/dest/name. The optional qgroupid parameter is the qgroup that your shiny new subvolume gets added to. Slay.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

This command depends on the feature btrfs. See also feature-available.

btrfs-subvolume-delete 🗑️

btrfs-subvolume-delete subvolume

Deletes the named btrfs subvolume or snapshot. Poof, gone, no cap.

This command depends on the feature btrfs. See also feature-available.

btrfs-subvolume-get-default ⭐

btrfs-subvolume-get-default fs

Gets the default subvolume or snapshot of a filesystem mounted at mountpoint.

This command depends on the feature btrfs. See also feature-available.

btrfs-subvolume-list 📋

btrfs-subvolume-list fs

Lists all the btrfs snapshots and subvolumes of the btrfs filesystem that's mounted at fs. Iconic little inventory moment.

This command depends on the feature btrfs. See also feature-available.

btrfs-subvolume-set-default 👑

btrfs-subvolume-set-default id fs

Sets which subvolume of the btrfs filesystem fs gets mounted by default. Wanna know your options first? Peep btrfs-subvolume-list for a list of subvolumes.

This command depends on the feature btrfs. See also feature-available.

btrfs-subvolume-show 🔍

btrfs-subvolume-show subvolume

Returns the detailed deets on the subvolume. Very "tell me everything" energy.

This command depends on the feature btrfs. See also feature-available.

btrfs-subvolume-snapshot / btrfs-subvolume-snapshot-opts 📸

btrfs-subvolume-snapshot source dest [ro:true|false] [qgroupid:..]

Creates a snapshot of the btrfs subvolume source. The dest argument is the destination directory plus the name of the snapshot, written like /path/to/dest/name. By default the newly created snapshot is writable — but if the optional ro parameter is true, you get a readonly snapshot instead. The optional qgroupid parameter is the qgroup that the newly created snapshot gets added to. Cute.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

This command depends on the feature btrfs. See also feature-available.

btrfstune-enable-extended-inode-refs 🧬

btrfstune-enable-extended-inode-refs device

This will enable extended inode refs. Do with that what you will.

This command depends on the feature btrfs. See also feature-available.

btrfstune-enable-skinny-metadata-extent-refs 🪶

btrfstune-enable-skinny-metadata-extent-refs device

This enables skinny metadata extent refs. Skinny legend behavior, honestly.

This command depends on the feature btrfs. See also feature-available.

btrfstune-seeding 🌾

btrfstune-seeding device true|false

Enables seeding of a btrfs device. Heads up: this forces the fs readonly so you can use it to build other filesystems. That's the whole point, bestie.

This command depends on the feature btrfs. See also feature-available.

c-pointer 🫵

c-pointer

In non-C language bindings, this lets you grab the underlying C pointer to the handle (ie. h *). Why even? So other libraries can interwork with libguestfs. Extremely "behind the scenes" of it all.

canonical-device-name 🪞

canonical-device-name device

This utility function is a real one when you're displaying device names to the user. It takes a bunch of irregular device names and hands them back in a consistent format:

/dev/hdX
/dev/vdX

These come back as /dev/sdX. Note this works for device names and partition names. It's approximately the reverse of the algorithm described in BLOCK DEVICE NAMING in guestfs(3).

/dev/mapper/VG-LV
/dev/dm-N

Converted to /dev/VG/LV form using lvm-canonical-lv-name.

Any other strings are returned unmodified. No notes.

cap-get-file 🎩

cap-get-file path

Returns the Linux capabilities attached to path. The capabilities set comes back in text form (see cap_to_text(3)).

And if there are no capabilities attached to the file? You get an empty string. Nothing, nada.

This command depends on the feature linuxcaps. See also feature-available.

cap-set-file 🪄

cap-set-file path cap

Sets the Linux capabilities attached to path. The capabilities set cap should be passed in text form (see cap_from_text(3)).

This command depends on the feature linuxcaps. See also feature-available.

case-sensitive-path 🔠

case-sensitive-path path

Okay this one's lowkey important. It resolves case-insensitive paths on a filesystem that's actually case sensitive. The classic use case: you've read paths out of Windows configuration files or the Windows Registry, and now you need the true path. This is your girl.

Here's the little quirk it handles — the Linux ntfs-3g filesystem driver (and probably others too) exports a filesystem to Linux as case-sensitive, even though the underlying filesystem is case-insensitive.

One consequence of that? Special directories like C:\windows might show up as /WINDOWS or /windows (or honestly whatever), depending on the precise details of how they were created. In Windows itself this wouldn't be a problem at all. Bug or feature? You decide. See the relevant entry in the ntfs-3g FAQ: https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-FAQ

case-sensitive-path attempts to resolve the true case of each element in the path. It returns a resolved path if either the full path or its parent directory exists. If the parent directory exists but the full path doesn't, the case of the parent directory gets correctly resolved, and the remainder is appended unmodified. For example, if the file /Windows/System32/netkvm.sys exists:

"case-sensitive-path" ("/windows/system32/netkvm.sys")
    "Windows/System32/netkvm.sys"

"case-sensitive-path" ("/windows/system32/NoSuchFile")
    "Windows/System32/NoSuchFile"

"case-sensitive-path" ("/windows/system33/netkvm.sys")
    ERROR

Note: because of the above behaviour, case-sensitive-path cannot be used to check for the existence of a file. Not a file-exists checker, bestie, don't try it.

Note: this function does not handle drive names, backslashes etc.

cat 🐱

cat path

Returns the contents of the file named path.

Fair warning though — because in C this function returns a char *, there's literally no way to tell a "\0" character in a file apart from end of string. So if you're dealing with binary files, use the read-file or download functions instead. Not me making the rules, that's just how it is.

checksum 🔐

checksum csumtype path

Computes the MD5, SHAx or CRC checksum of the file named path. The type of checksum is decided by the csumtype parameter, which has to be one of these:

crc — computes the cyclic redundancy check (CRC) specified by POSIX for the cksum command.
gost, gost12 — computes the checksum using the GOST R34.11-94 or GOST R34.11-2012 message digest.
md5 — computes the MD5 hash (using the md5sum(1) program).
sha1 — computes the SHA1 hash (using the sha1sum(1) program).
sha224 — computes the SHA224 hash (using the sha224sum(1) program).
sha256 — computes the SHA256 hash (using the sha256sum(1) program).
sha384 — computes the SHA384 hash (using the sha384sum(1) program).
sha512 — computes the SHA512 hash (using the sha512sum(1) program).

The checksum comes back as a printable string.

Wanna checksum a device instead? That's checksum-device. Wanna checksum lots of files at once? That's checksums-out.

checksum-device 💾

checksum-device csumtype device

Computes the MD5, SHAx or CRC checksum of the contents of the device named device. For the types of checksums supported, go look at the checksum command — same menu, different target.

checksums-out 🧾

checksums-out csumtype directory (sumsfile|-)

This one computes the checksums of all the regular files in directory and then emits a list of those checksums to the local output file sumsfile.

What's it for? Verifying the integrity of a virtual machine. But — and listen up — to be properly secure you should pay attention to the output of the checksum command (it uses the ones from GNU coreutils). In particular, when the filename isn't printable, coreutils uses a special backslash syntax. For more info, see the GNU coreutils info file.

Use - instead of a filename to read/write from stdin/stdout.

chmod 🔧

chmod mode path

Changes the mode (permissions) of path to mode. Only numeric modes are supported — no rwxr-xr-x cosplay here.

Note: when you use this command from guestfish, mode by default would be decimal — unless you prefix it with 0 to get octal. So write 0700, not 700. Please. For the love of everything.

The mode that actually gets set is affected by the umask. Sneaky but true.

chown 👤

chown owner group path

Changes the file owner to owner and the group to group.

Only numeric uid and gid are supported. Want to use names? You'll have to locate and parse the password file yourself. Honestly Augeas support makes this relatively easy, so it's giving "doable side quest" rather than "impossible".

clear-backend-setting 🧹

clear-backend-setting name

If there's a backend setting string matching name or beginning with name=, then that string gets removed from the backend settings. Clean sweep.

This call returns the number of strings that got removed (which may be 0, 1, or greater than 1). So yes, it can clear more than one. Overachiever.

See BACKEND in guestfs(3), BACKEND SETTINGS in guestfs(3).

clevis-luks-unlock 🔓✨

clevis-luks-unlock device mapname

This opens a block device that's been encrypted according to the Linux Unified Key Setup (LUKS) standard, using network-bound disk encryption (NBDE). Fancy.

device is the encrypted block device.

The appliance will connect to the Tang servers noted in the tree of Clevis pins bound to a keyslot of the LUKS header. That Clevis pin tree may comprise sss (redundancy) pins as internal nodes (optionally), and tang pins as leaves. Heads up: tpm2 pins are not supported. The appliance unlocks the encrypted block device by combining responses from the Tang servers with metadata from the LUKS header — and there's no key parameter at all, so don't go looking for one.

This command will fail if networking has not been enabled for the appliance. Refer to set-network. Networking is the whole vibe here, bestie.

The command creates a new block device called /dev/mapper/mapname. Reads and writes to this block device get decrypted from and encrypted to the underlying device, respectively. When you're done with it, close the decrypted block device with cryptsetup-close. 💅

mapname cannot be control — that name is reserved by device-mapper, so don't even try it, bestie, it's not your name to take.

If this block device contains LVM volume groups, then calling lvm-scan with the activate parameter true will make them visible. ✨

Use list-dm-devices to list all device mapper devices. iykyk.

This command depends on the feature clevisluks. See also feature-available.

`command`

command 'arguments ...'

This call runs a command from the guest filesystem. The filesystem must be mounted, and it must contain a compatible operating system (ie. something Linux, with the same or compatible processor architecture). No cap, it has to actually match.

The single parameter is an argv-style list of arguments. The first element is the name of the program to run. Subsequent elements are parameters. The list must be non-empty (ie. must contain a program name). Note that the command runs directly, and is not invoked via the shell (see sh) — so no sneaky shell tricks, she's not about that life. 🙈

The return value is anything printed to stdout by the command. 📤

If the command returns a non-zero exit status, then this function returns an error message. The error message string is the content of stderr from the command.

The $PATH environment variable will contain at least /usr/bin and /bin. If you require a program from another location, you should provide the full path in the first parameter. Fr fr, spell it all out.

Shared libraries and data files required by the program must be available on filesystems which are mounted in the correct places. It is the caller's responsibility to ensure all filesystems that are needed are mounted at the right locations. That's on you, not her. 💅

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See PROTOCOL LIMITS in guestfs(3). ⚠️

`command-lines`

command-lines 'arguments ...'

This is the same as command, but splits the result into a list of lines. Cute, right? ✨

`command-out`

command-out 'arguments ...' (output|-)

This is the same as command, but streams the output back, handling the case where the output from the command is larger than the protocol limit. Big output energy. 🔥

`compress-device-out`

compress-device-out ctype device (zdevice|-) [level:N]

This command compresses device and writes it out to the local file zdevice. 🗜️

The ctype and optional level parameters have the same meaning as in compress-out.

Use - instead of a filename to read/write from stdin/stdout.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

`compress-out`

compress-out ctype file (zfile|-) [level:N]

This command compresses file and writes it out to the local file zfile.

The compression program used is controlled by the ctype parameter. Currently this includes: compress, gzip, bzip2, xz or lzop. Some compression types may not be supported by particular builds of libguestfs, in which case you will get an error containing the substring not supported. 💀 rude but okay.

The optional level parameter controls compression level. The meaning and default for this parameter depends on the compression program being used.

Use - instead of a filename to read/write from stdin/stdout.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

`config`

config hvparam hvvalue

This can be used to add arbitrary hypervisor parameters of the form -param value. Actually it's not quite arbitrary — we prevent you from setting some parameters which would interfere with parameters that we use. She's got boundaries. 🚧

The first character of hvparam string must be a - (dash). Periodt.

hvvalue can be NULL.

`copy-attributes`

copy-attributes src dest [all:true|false] [mode:true|false] [xattributes:true|false] [ownership:true|false]

Copy the attributes of a path (which can be a file or a directory) to another path. Glow-up transfer, honestly. ✨

By default no attribute is copied, so make sure to specify any (or all to copy everything). Don't come crying to me if nothing transferred, bestie. 😭

The optional arguments specify which attributes can be copied:

mode — copy part of the file mode from source to destination. Only the UNIX permissions and the sticky/setuid/setgid bits can be copied. 👑
xattributes — copy the Linux extended attributes (xattrs) from source to destination. This flag does nothing if the linuxxattrs feature is not available (see feature-available).
ownership — copy the owner uid and the group gid of source to destination.
all — copy all the attributes from source to destination. Enabling it enables all the other flags, if they are not specified already. main character flag, fr.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

`copy-device-to-device`

copy-device-to-device src dest [srcoffset:N] [destoffset:N] [size:N] [sparse:true|false] [append:true|false]

The four calls copy-device-to-device, copy-device-to-file, copy-file-to-device, and copy-file-to-file let you copy from a source (device|file) to a destination (device|file). The whole squad. 🫶

Partial copies can be made since you can specify optionally the source offset, destination offset and size to copy. These values are all specified in bytes. If not given, the offsets both default to zero, and the size defaults to copying as much as possible until we hit the end of the source.

The source and destination may be the same object. However overlapping regions may not be copied correctly. ⚠️ lowkey a trap, be careful.

If the destination is a file, it is created if required. If the destination file is not large enough, it is extended.

If the destination is a file and the append flag is not set, then the destination file is truncated. If the append flag is set, then the copy appends to the destination file. The append flag currently cannot be set for devices. 🚫

If the sparse flag is true then the call avoids writing blocks that contain only zeroes, which can help in some situations where the backing disk is thin-provisioned. Note that unless the target is already zeroed, using this option will result in incorrect copying. 💀 yeah, read that again.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

`copy-device-to-file`

copy-device-to-file src dest [srcoffset:N] [destoffset:N] [size:N] [sparse:true|false] [append:true|false]

See copy-device-to-device for a general overview of this call.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

`copy-file-to-device`

copy-file-to-device src dest [srcoffset:N] [destoffset:N] [size:N] [sparse:true|false] [append:true|false]

See copy-device-to-device for a general overview of this call.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

`copy-file-to-file`

copy-file-to-file src dest [srcoffset:N] [destoffset:N] [size:N] [sparse:true|false] [append:true|false]

See copy-device-to-device for a general overview of this call.

🚨 This is not the function you want for copying files. This is for copying blocks within existing files. See cp, cp-a and mv for general file copying and moving functions. please don't use this for your vacation photos, i'm begging 🙈

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

`copy-size`

copy-size src dest size

This command copies exactly size bytes from one source device or file src to another destination device or file dest.

Note this will fail if the source is too short or if the destination is not large enough. 😭

⚠️ This function is deprecated. In new code, use the copy-device-to-device call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. She's still here, she's just not thriving. 💅

`cp`

cp src dest

This copies a file from src to dest where dest is either a destination filename or destination directory. simple as that, slay. ✨

`cp-a`

cp-a src dest

This copies a file or directory from src to dest recursively using the cp -a command.

`cp-r`

cp-r src dest

This copies a file or directory from src to dest recursively using the cp -rP command.

Most users should use cp-a instead. This command is useful when you don't want to preserve permissions, because the target filesystem does not support it (primarily when writing to DOS FAT filesystems). 🎀

`cpio-out`

cpio-out directory (cpiofile|-) [format:..]

This command packs the contents of directory and downloads it to local file cpiofile. 📦

The optional format parameter can be used to select the format. Only the following formats are currently permitted:

newc — New (SVR4) portable format. This format happens to be compatible with the cpio-like format used by the Linux kernel for initramfs. This is the default format. 👑
crc — New (SVR4) portable format with a checksum. ✅

Use - instead of a filename to read/write from stdin/stdout.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

`cryptsetup-close`

cryptsetup-close device

This closes an encrypted device that was created earlier by cryptsetup-open. The device parameter must be the name of the mapping device (ie. /dev/mapper/mapname) and not the name of the underlying block device. read it again bestie, this one trips everyone up. 🙈

This command depends on the feature luks. See also feature-available.

`cryptsetup-open`

cryptsetup-open device mapname [readonly:true|false] [crypttype:..] [cipher:..]

This command opens a block device which has been encrypted according to the Linux Unified Key Setup (LUKS) standard, Windows BitLocker, or some other types. spicy 🔥

device is the encrypted block device or partition.

The caller must supply one of the keys associated with the encrypted block device, in the key parameter. 🔑

This creates a new block device called /dev/mapper/mapname. Reads and writes to this block device are decrypted from and encrypted to the underlying device respectively.

mapname cannot be control because that name is reserved by device-mapper. 🚫

If the optional crypttype parameter is not present then libguestfs tries to guess the correct type (for example LUKS or BitLocker). However you can override this by specifying one of the following types:

luks — a Linux LUKS device. 🐧
bitlk — a Windows BitLocker device. 🪟

The optional readonly flag, if set to true, creates a read-only mapping.

The optional cipher parameter allows specifying which cipher to use. 🔐 and yes, that's the tea 🫖

If this block device has LVM volume groups chillin' on it, then calling lvm-scan with the activate parameter set to true makes them visible. 💅

Use list-dm-devices to get the full list of device mapper devices.

This command has one or more key or passphrase parameters, and guestfish will prompt you for each one separately. 🎀

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

This command depends on the feature luks. See also feature-available.

dd

dd src dest

Copies from one source device or file src over to a destination device or file dest. Normally you'd use this to copy to or from a device or partition — like, duplicating a filesystem, that vibe. 🦋

If the destination is a device it has to be as big or bigger than the source file or device, otherwise the copy just fails, no cap. And bestie, this command cannot do partial copies — for that see copy-device-to-device.

⚠️ This function is deprecated. In new code, use the copy-device-to-device call instead.

Deprecated functions don't get removed from the API, but the fact that they're deprecated means there are problems with using them correctly. So like… be aware. 💀

device-index

device-index device

Takes a device name (eg. /dev/sdb) and returns that device's index in the list of devices. ✨

Index numbers start at 0. The named device has to actually exist — like, say, as a string you got back from list-devices.

See also list-devices, part-to-dev, device-name.

device-name

device-name index

Does the opposite: takes a device index and hands you back the device name. Index 0 returns the string /dev/sda, iconic. 👑

The drive index must have been added to the handle first, obviously.

See also list-devices, part-to-dev, device-index.

df

df

Runs the df(1) command to report disk space used. 🍓

This one is mostly for interactive sessions — please don't try to parse the output string, it's not built for that. Use statvfs from your programs instead.

df-h

df-h

Runs the df -h command to report disk space used, but in human-readable format. 🌸

Same vibe check as above: mostly useful for interactive sessions, and it's not intended for you to parse that output string. Use statvfs from programs, periodt.

disk-create

disk-create filename format size [backingfile:..] [backingformat:..] [preallocation:..] [compat:..] [clustersize:N]

Creates a blank disk image called filename (that's a host file, bestie) with format format — usually raw or qcow2. The size is size bytes. 💖

If you use the optional backingfile parameter, then a snapshot gets created on top of the backing file. In that case size must be passed as -1. The snapshot's size ends up the same as the backing file's size, which gets discovered automatically. You're encouraged to also pass backingformat to describe the format of backingfile, okurrr. ✨

If filename refers to a block device, then the device gets formatted, and size is ignored since block devices have their own intrinsic size.

The other optional parameters are:

preallocation — if format is raw, this can be either off (or sparse) or full, to create a sparse or fully allocated file respectively. The default is off. If format is qcow2, then this can be off (or sparse), metadata or full. Preallocating metadata can be faster when you're doing lots of writes, but it uses more space. The default is off.
compat — qcow2 only: pass the string 1.1 to use the advanced qcow2 format supported by qemu ≥ 1.1.
clustersize — qcow2 only: changes the qcow2 cluster size. The default is 65536 (bytes) and this setting can be any power of two between 512 and 2097152.

🫶 Heads up: this call does not add the new disk to the handle. You may need to call add-drive-opts separately.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

disk-format

disk-format filename

Detects and returns the format of the disk image called filename. filename can also be a host device, etc. If the format can't be detected, then unknown is returned. 🙈

⚠️ Note that detecting the disk format can be insecure under some circumstances. See "CVE-2010-3851" in guestfs(3).

See also: "DISK IMAGE FORMATS" in guestfs(3)

disk-has-backing-file

disk-has-backing-file filename

Detects and returns whether the disk image filename has a backing file. Yes/no energy. 🦋

⚠️ Note that detecting disk features can be insecure under some circumstances. See "CVE-2010-3851" in guestfs(3).

disk-virtual-size

disk-virtual-size filename

Detects and returns the virtual size, in bytes, of the disk image called filename. 💅

⚠️ Note that detecting disk features can be insecure under some circumstances. See "CVE-2010-3851" in guestfs(3).

dmesg

dmesg

Returns the kernel messages (the dmesg(1) output) from the guest kernel. Sometimes this is useful for extended debugging of problems, iykyk. 🔍

Another way to get the same info: enable verbose messages with set-verbose, or set the environment variable LIBGUESTFS_DEBUG=1 before running the program.

download

download remotefilename (filename|-)

Downloads the file remotefilename and saves it as filename on your local machine. 💖

filename can also be a named pipe.

download-blocks

download-blocks device start stop (filename|-) [unallocated:true|false]

Downloads the data units from start address start to stop from the disk partition (eg. /dev/sda1) and saves them as filename on your local machine. 🌈

The use of this API on sparse disk image formats such as QCOW, may result in large zero-filled files downloaded on the host. 😭

The size of a data unit varies across filesystem implementations — on NTFS filesystems data units are referred to as clusters, while on ExtX ones they're called fragments.

If the optional unallocated flag is true (default is false), only the unallocated blocks get extracted. This is useful for detecting hidden data, or retrieving deleted files whose data units haven't been overwritten yet. 🕵️‍♀️

Use - instead of a filename to read/write from stdin/stdout.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

This command depends on the feature sleuthkit. See also feature-available.

download-inode

download-inode device inode (filename|-)

Downloads a file given its inode from the disk partition (eg. /dev/sda1) and saves it as filename on your local machine. 🎀

You don't need to mount the disk to run this command.

The command is capable of downloading deleted or inaccessible files — main character energy, honestly. 👑

Use - instead of a filename to read/write from stdin/stdout.

This command depends on the feature sleuthkit. See also feature-available.

download-offset

download-offset remotefilename (filename|-) offset size

Downloads the file remotefilename and saves it as filename on your local machine. 💜

remotefilename is read for size bytes starting at offset — and that region must be within the file or device, no stretching.

Note that there's no limit on how much data you can download with this call, unlike with pread, and this call always reads the full amount unless an error occurs. Slay.

drop-caches

drop-caches whattodrop

Instructs the guest kernel to drop its page cache, and/or dentries and inode caches. The parameter whattodrop tells the kernel exactly what to drop — see https://linux-mm.org/Drop_Caches 🧚

Setting whattodrop to 3 should drop everything. ✨

This automatically calls sync(2) before the operation, so that the maximum guest memory gets freed.

du

du path

Runs the du -s command to estimate file space usage for path. 🍓

path can be a file or a directory. If path is a directory then the estimate includes the contents of the directory and all subdirectories, recursively — the whole tree.

The result is the estimated size in kilobytes (ie. units of 1024 bytes).

e2fsck

e2fsck device [correct:true|false] [forceall:true|false] [forceno:true|false]

Runs the ext2/ext3 filesystem checker on device. It can take these optional arguments: 💅

correct — automatically repair the file system. This option causes e2fsck to automatically fix any filesystem problems that can be safely fixed without human intervention. This option may not be specified at the same time as the forceall or forceno options.
forceall — assume an answer of ‘yes’ to all questions; allows e2fsck to be used non-interactively. This option may not be specified at the same time as the correct or forceno options.
forceno — open the filesystem readonly and assume an answer of ‘no’ to all questions; allows e2fsck to be used non-interactively. This option may not be specified at the same time as the correct or forceall options.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

e2fsck-f

e2fsck-f device

Runs e2fsck -p -f device — that's the ext2/ext3 filesystem checker on device, noninteractively (-p), even if the filesystem looks clean (-f). 🤔

⚠️ This function is deprecated. In new code, use the e2fsck call instead.

Deprecated functions don't get removed from the API, but the fact that they're deprecated means there are problems with using them correctly. 💀

echo-daemon

echo-daemon 'words ...'

Concatenates the list of words you pass it with single spaces in between, and returns the resulting string. ✨

You can use this command to test the connection through to the daemon. 🫶

egrep

egrep regex path

Calls the external egrep(1) program and returns the matching lines. 🔍

Because of the message protocol, there's a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

⚠️ This function is deprecated. In new code, use the grep call instead.

Deprecated functions don't get removed from the API, but the fact that they're deprecated means there are problems with using them correctly.

egrepi

egrepi regex path

Calls the external egrep -i program and returns the matching lines. 🌸

Because of the message protocol, there's a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

⚠️ This function is deprecated. In new code, use the grep call instead.

Deprecated functions are never gonna get yeeted from the API — they're staying — but the fact that they're deprecated is the universe telling you there are actual problems with using them correctly. Read the room bestie. 💅

✨ equal

equal file1 file2

Compares file1 and file2 and hands you back true if their contents are exactly the same, or false if they're not. That's it, that's the whole vibe check. 🎀

It does the actual comparing with the external cmp(1) program, no cap.

✨ exists

exists path

Returns "true" if and only if there's a file, a directory (or literally anything) hanging out under the name path. Like, it exists or it doesn't, that's the tea. 🫶

✨ extlinux

extlinux directory

Installs the SYSLINUX bootloader onto the device that's mounted at directory. And here's the iconic part: unlike syslinux, which needs a FAT filesystem, this one is lowkey flexible — it works on an ext2/3/4 or btrfs filesystem. Slay. 🔥

The directory parameter can be either a mountpoint, or a directory inside the mountpoint. Either one's fine.

You also have to:

mark the partition as "active" with part-set-bootable, annnnd
install a Master Boot Record (eg. using pwrite-device) on the first sector of the whole disk.

The SYSLINUX package ships with some suitable Master Boot Records, so you're covered. Peep the extlinux(1) man page for the full deets.

Want extra config? Drop a file called extlinux.conf on the filesystem under directory and SYSLINUX will pick it up. For what goes inside that file, again, see extlinux(1).

✨ f2fs-expand

f2fs-expand device

Expands a f2fs filesystem so it matches the size of the underlying device. Glow-up for your filesystem, basically. ✨

This command depends on the feature "f2fs". See also feature-available.

✨ fallocate

fallocate path len

Preallocates a file (containing zero bytes, bestie) named path, of size len bytes. If that file already exists, it gets overwritten, no hesitation. 💀

Do not confuse this with the guestfish-specific alloc command — that one allocates a file on the host and attaches it as a device. Totally different beast.

This function is deprecated. In new code, use the fallocate64 call instead.

And yeah — deprecated functions won't be removed from the API, but being deprecated means there are genuine problems with using them correctly. Consider yourself warned. 🙈

✨ fallocate64

fallocate64 path len

Preallocates a file (containing zero bytes) named path, of size len bytes. If the file already exists already — yep — overwritten.

Heads up though: this call actually allocates disk blocks for the file. If you want a sparse file instead, use truncate-size. Different tools, different vibes. 🦋

The deprecated fallocate call does the same thing, but owing to an oversight it only allowed 30-bit lengths to be specified — which effectively capped the max size of files created through it at 1GB. Oops. 😭

Also, don't confuse this with the guestfish-specific alloc and sparse commands, which create a file on the host and attach it as a device.

✨ feature-available

feature-available 'groups ...'

Same as available, except this one returns a simple true/false boolean result instead of throwing an exception when a feature isn't found. Much chiller. 🎀 For the rest of the documentation, see available.

✨ fgrep

fgrep pattern path

Calls the external fgrep(1) program and gives you back the matching lines. 🔍

Because of the message protocol, there's a transfer limit of somewhere between 2MB and 4MB. See PROTOCOL LIMITS in guestfs(3).

This function is deprecated. In new code, use the grep call instead.

Deprecated functions won't be removed from the API, but the deprecation is a whole signal that there are problems with correct use. You've been told. 💅

✨ fgrepi

fgrepi pattern path

Calls the external fgrep -i program and returns the matching lines. Case-insensitive queen. 👑

Same deal on limits: because of the message protocol, there's a transfer limit of somewhere between 2MB and 4MB. See PROTOCOL LIMITS in guestfs(3).

This function is deprecated. In new code, use the grep call instead.

Deprecated functions stay in the API forever, but again — deprecated means there are problems with using them correctly.

✨ file

file path

This one uses the standard file(1) command to figure out the type or contents of the file. Classic. 🎀

It'll also transparently look inside various types of compressed file — like, it peeks under the layers, iconic behaviour honestly.

The filename is not prepended to the output (same as the file command's -b option).

The output depends on the output of the underlying file(1) command, and it can change in future in ways beyond our control. In other words: the output is not guaranteed by the ABI. Don't build your whole life on it, fr fr.

See also: file(1), vfs-type, lstat, is-file, is-blockdev (etc), is-zero. 🦋

✨ file-architecture

file-architecture filename

Detects the architecture of the binary filename and returns it — if it's known. Detective mode, main character energy. 🔍

Currently defined architectures are:

"aarch64" — 64 bit ARM.
"arm" — 32 bit ARM.
"i386" — this string is returned for all 32 bit i386, i486, i586, i686 binaries, irrespective of the precise processor requirements of the binary.
"ia64" — Intel Itanium.
"ppc" — 32 bit Power PC.
"ppc64" — 64 bit Power PC (big endian).
"ppc64le" — 64 bit Power PC (little endian).
"loongarch64" — 64 bit LoongArch64 (little endian).
"riscv32", "riscv64", "riscv128" — RISC-V 32-, 64- or 128-bit variants.
"s390" — 31 bit IBM S/390.
"s390x" — 64 bit IBM S/390.
"sparc" — 32 bit SPARC.
"sparc64" — 64 bit SPARC V9 and above.
"x86_64" — 64 bit x86-64.

Libguestfs may return other architecture strings in future, so like… stay tuned. 🌈

The function works on at least the following types of files:

many types of Un*x and Linux binary
many types of Un*x and Linux shared library
Windows Win32 and Win64 binaries
Windows Win32 and Win64 DLLs — Win32 binaries and DLLs return "i386"; Win64 binaries and DLLs return "x86_64".
Linux kernel modules
Linux new-style initrd images
some non-x86 Linux vmlinuz kernels

What it can't do currently (the flop era 😭):

static libraries (libfoo.a)
Linux old-style initrd as compressed ext2 filesystem (RHEL 3)
x86 Linux vmlinuz kernels — x86 vmlinuz images (bzImage format) consist of a mix of 16-, 32- and compressed code, and are horribly hard to unpack. If you wanna find the architecture of a kernel, use the architecture of the associated initrd or kernel module(s) instead. Work smarter, not harder. 💅

✨ filesize

filesize file

Returns the size of file in bytes. Simple, clean, to the point. ✨

Want other stats about a file? Use stat, lstat, is-dir, is-file etc. Want the size of block devices? Use blockdev-getsize64. Right tool for the right job, bestie.

✨ filesystem-available

filesystem-available filesystem

Checks whether libguestfs supports the named filesystem. The argument filesystem is a filesystem name, such as "ext3".

You must call launch before using this command. No launch, no service. 🫶

This is mainly useful as a negative test. Because — plot twist — if this returns true, it does not mean that a particular filesystem can actually be created or mounted. Filesystems can fail for other reasons, such as it being a later version of the filesystem, or having incompatible features, or lacking the right mkfs.<fs> tool. So true is like… neighbour, not a guarantee. 😭

See also available, feature-available, AVAILABILITY in guestfs(3).

✨ filesystem-walk

filesystem-walk device

Walks through the internal structures of a disk partition (eg. /dev/sda1) in order to return a list of all the files and directories stored within. Spelunking era. 🔦

You do not need to mount the disk partition to run this command.

All entries in the filesystem are returned. This function can list deleted or unaccessible files. The entries are not sorted — so no, don't expect alphabetical order, it's giving chaos. 💀

The tsk_dirent structure contains the following fields:

"tsk_inode" — filesystem reference number of the node. It might be 0 if the node has been deleted.
"tsk_type" — basic file type information. See below for a detailed list of values.
"tsk_size" — file size in bytes. It might be -1 if the node has been deleted.
"tsk_name" — the file path relative to its directory.
"tsk_flags" — bitfield containing extra information regarding the entry. It contains the logical OR of the following values:
- 0x0001 — if set to 1, the file is allocated and visible within the filesystem. Otherwise, the file has been deleted. Under certain circumstances, the function download_inode can be used to recover deleted files. 🕵️
- 0x0002 — filesystems such as NTFS and Ext2 or greater separate the file name from the metadata structure. The bit is set to 1 when the file name is in an unallocated state and the metadata structure is in an allocated one. This generally implies the metadata has been reallocated to a new file. Therefore, information such as file type, file size, timestamps, number of links and symlink target might not correspond with the ones of the original deleted entry.
- 0x0004 — the bit is set to 1 when the file is compressed using filesystem native compression support (NTFS). The API is not able to detect application level compression.
"tsk_atime_sec", "tsk_atime_nsec", "tsk_mtime_sec", "tsk_mtime_nsec", "tsk_ctime_sec", "tsk_ctime_nsec", "tsk_crtime_sec", "tsk_crtime_nsec" — respectively, access, modification, last status change and creation time in Unix format in seconds and nanoseconds.
"tsk_nlink" — number of file names pointing to this entry.
"tsk_link" — if the entry is a symbolic link, this field will contain the path to the target file.

The "tsk_type" field will contain one of the following characters:

'b' Block special
'c' Char special
'd' Directory
'f' FIFO (named pipe)
'l' Symbolic link
'r' Regular file
's' Socket
'h' Shadow inode (Solaris)
'w' Whiteout inode (BSD)
'u' Unknown file type

This command depends on the feature "libtsk". See also feature-available.

✨ fill

fill c len path

Creates a brand new file called path. The initial content of the file is len octets of c, where c must be a number in the range [0..255]. Fill it up, bestie. 🍓

If you wanna fill a file with zero bytes (sparsely), it is much more efficient to use truncate-size instead. And if you want a file with a pattern of repeating bytes, use fill-pattern. Right tool, right moment, periodt.

✨ fill-dir

fill-dir dir nr

This one is useful for testing filesystems: it creates nr empty files in the directory dir, with names 00000000 through nr-1 — ie. each file name is 8 digits long, padded with zeroes. Obsessively tidy. 🎀✨

🧚 `fill-pattern`

fill-pattern pattern len path

Okay so this one is literally fill's glittery sibling ✨ — except instead of one byte it makes a brand new file of length len stuffed with the repeating pattern of bytes in pattern. And yes, the pattern gets truncated if necessary so the file length is exactly len bytes — precision queen behavior 💅.

🔍 `find`

find directory

Bestie, this lists out all the files and directories, recursively, starting at directory. It's essentially equivalent to running the shell command find directory -print, except some post-processing happens on the output (more on that below 👇).

It returns a list of strings with no prefix at all. So if your directory structure looked like this:

/tmp/a
/tmp/b
/tmp/c/d

then the list you get back from find /tmp would be 4 elements:

a
b
c
c/d

If directory is not a directory, this command returns an error 😭. Also good to know: the returned list is sorted. Periodt.

🫶 `find0`

find0 directory (files|-)

Same energy as find, but it drops the resulting list into an external file called files instead.

It works the same way as find with these exceptions:

The resulting list is written to an external file 📄
Items (filenames) in the result are separated by "\0" characters — see find(1) option -print0
The result list is not sorted (chaotic, love that for us 💀)

Use - instead of a filename to read/write from stdin/stdout.

💜 `find-inode`

find-inode device inode

Searches all the entries associated with the given inode on device 🔎.

For each entry, a tsk_dirent structure is returned — peek filesystem_walk for more info on those tsk_dirent structures.

This command depends on the feature libtsk — see also feature-available.

🎀 `findfs-label`

findfs-label label

Searches the filesystems and returns the one that has the given label 💖. If no such filesystem can be found, you get an error, sorry bestie.

Wanna find the label of a filesystem instead? Use vfs-label.

🌸 `findfs-partlabel`

findfs-partlabel label

Searches the partitions and returns the one carrying the given label 🏷️. No such partition? Error, no cap.

To find the label of a partition, use blkid (PART_ENTRY_NAME).

🦋 `findfs-partuuid`

findfs-partuuid uuid

Searches the partitions and returns the one with the given partition uuid ⭐. If no such partition can be found, error time 🙈.

To find the UUID of a partition, use blkid (PART_ENTRY_UUID).

🌈 `findfs-uuid`

findfs-uuid uuid

Searches the filesystems and returns the one with the given uuid 💫. No such filesystem → error.

To find the UUID of a filesystem, use vfs-uuid.

💅 `fsck`

fsck fstype device

This runs the filesystem checker (fsck) on device, which should have filesystem type fstype 🩺.

The returned integer is the status — check fsck(8) for the full list of status codes from fsck.

Notes, and these matter:

Multiple status codes can be summed together ➕
A non-zero return code can mean "success" — for example if errors have been corrected on the filesystem. Yes really, don't panic 😭
Checking or repairing NTFS volumes is not supported (by linux-ntfs) 💀

This command is entirely equivalent to running fsck -a -t fstype device.

🧹 `fstrim`

fstrim mountpoint [offset:N] [length:N] [minimumfreeextent:N]

Trims the free space in the filesystem mounted on mountpoint ✨. The filesystem must be mounted read-write.

The filesystem contents are not affected — but any free space in the filesystem gets "trimmed", i.e. given back to the host device. That makes disk images more sparse, allows unused space in qcow2 files to be reused, etc. Iconic efficiency behavior 👑

This operation requires support in libguestfs, the mounted filesystem, the host filesystem, qemu and the host kernel. If that support isn't present, it may give an error or even appear to run but do nothing 🙃 — rude, I know.

In the case where the kernel vfs driver does not support trimming, this call will fail with errno set to ENOTSUP. Currently this happens when trying to trim FAT filesystems.

See also zero-free-space — slightly different operation that turns free space in the filesystem into zeroes. It's totally valid to call fstrim either instead of, or after calling zero-free-space 🫶.

This command has one or more optional arguments — see OPTIONAL ARGUMENTS.

This command depends on the feature fstrim — see also feature-available.

⭐ `get-append`

get-append

Returns the additional kernel options that are added to the libguestfs appliance kernel command line 🚀.

If it's NULL, then no options are added.

💀 `get-attach-method`

get-attach-method

Returns the current backend.

See set-backend and BACKEND in guestfs(3).

This function is deprecated. In new code, use the get-backend call instead. Deprecated functions will not be removed from the API, but the fact that they're deprecated indicates there are problems with correct use of these functions — so like, don't 🙈.

🍓 `get-autosync`

get-autosync

Gets the autosync flag 💫. That's it, that's the whole vibe.

🌟 `get-backend`

get-backend

Returns the current backend.

This handle property was previously called the "attach method".

See set-backend and BACKEND in guestfs(3).

🔥 `get-backend-setting`

get-backend-setting name

Finds a backend setting string that's either name or begins with name=. If it's name, this returns the string 1 ✨. If it's name=, it returns the part after the equals sign (which may be an empty string).

If no such setting is found, this function throws an error 😭. The errno (see last-errno) will be ESRCH in that case.

See BACKEND in guestfs(3) and BACKEND SETTINGS in guestfs(3).

🎀 `get-backend-settings`

get-backend-settings

Returns the current backend settings — like, all of them 💖.

This call returns all backend settings strings. Wanna find just one single setting? See get-backend-setting.

See BACKEND in guestfs(3) and BACKEND SETTINGS in guestfs(3).

🌸 `get-cachedir`

get-cachedir

Gets the directory used by the handle to store the appliance cache 📁.

🦋 `get-direct`

get-direct

Returns the direct appliance mode flag.

This function is deprecated. In new code, use the internal-get-console-socket call instead. Deprecated functions will not be removed from the API, but the fact that they're deprecated indicates there are problems with correct use of these functions.

🧚 `get-e2attrs`

get-e2attrs file

This returns the file attributes associated with file ✨.

The attributes are a set of bits associated with each inode which affect the behaviour of the file. They're returned as a string of letters (described below). The string may be empty, which indicates that no file attributes are set for this file.

These attributes are only present when the file lives on an ext2/3/4 filesystem. Using this call on other filesystem types will result in an error 💀.

The characters (file attributes) in the returned string are currently:

'A' — when the file is accessed, its atime is not modified.
'a' — the file is append-only.
'c' — the file is compressed on-disk.
'D' — (Directories only.) Changes to this directory are written synchronously to disk.
'd' — the file is not a candidate for backup (see dump(8)).
'E' — the file has compression errors.
'e' — the file is using extents.
'h' — the file is storing its blocks in units of the filesystem blocksize instead of sectors.
'I' — (Directories only.) The directory is using hashed trees.
'i' — the file is immutable. It cannot be modified, deleted or renamed. No link can be created to this file 🔒.
'j' — the file is data-journaled.
's' — when the file is deleted, all its blocks will be zeroed.
'S' — changes to this file are written synchronously to disk.
'T' — (Directories only.) This is a hint to the block allocator that subdirectories contained in this directory should be spread across blocks. If not present, the block allocator will try to group subdirectories together.
't' — for a file, this disables tail-merging. (Not used by upstream implementations of ext2.)
'u' — when the file is deleted, its blocks will be saved, allowing the file to be undeleted.
'X' — the raw contents of the compressed file may be accessed.
'Z' — the compressed file is dirty.

More file attributes may be added to this list later 👀. Not all file attributes may be set for all kinds of files. For the detailed tea, consult the chattr(1) man page.

💜 `get-e2generation`

get-e2generation file

This returns the ext2 file generation of file. The generation (which used to be called the "version") is a number associated with an inode. This is most commonly used by NFS servers 🌐.

The generation is only present when the file is located on an ext2/3/4 filesystem. Using this call on other filesystem types will result in an error.

See set-e2generation.

🎀 `get-e2label`

get-e2label device

This returns the ext2/3/4 filesystem label of the filesystem on device 🏷️.

This function is deprecated. In new code, use the vfs-label call instead. Deprecated functions will not be removed from the API, but the fact that they're deprecated indicates that there are problems with correct use of these functions.

🌈 `get-e2uuid`

get-e2uuid device

This returns the ext2/3/4 filesystem UUID of the filesystem on device ⭐.

This function is deprecated. In new code, use the vfs-uuid call instead. Deprecated functions will not be removed from the API, but the fact that they're deprecated indicates that there are problems with correct use of these functions.

💅 `get-hv`

get-hv

Returns the current hypervisor binary 🖥️.

If it wasn't set already, then this will return the default qemu binary name.

Heads up: for some backends this may return an error if called before launch, since it may not be possible to get the default hypervisor before the appliance is launched 😭.

🍓 `get-identifier`

get-identifier

Gets the handle identifier. See set-identifier ✨.

🔐 `get-libvirt-requested-credential-challenge`

get-libvirt-requested-credential-challenge index

Gets the challenge (provided by libvirt) for the index'th requested credential. If libvirt did not provide a challenge, this returns the empty string "" 🫶.

See LIBVIRT AUTHENTICATION in guestfs(3) for documentation and example code.

🔑 `get-libvirt-requested-credential-defresult`

get-libvirt-requested-credential-defresult index

Gets the default result (provided by libvirt) for the index'th requested credential. If libvirt did not provide a default result, this returns the empty string "" ✨.

💅 `get-libvirt-requested-credential-prompt`

get-libvirt-requested-credential-prompt index

okay so bestie, this one grabs the prompt that libvirt hands over for the index'th requested credential. If libvirt didn't feel like giving a prompt, you just get the empty string "" back — no vibes, no drama.

Head to "LIBVIRT AUTHENTICATION" in guestfs(3) for the actual docs and example code, iykyk.

🔐 `get-libvirt-requested-credentials`

get-libvirt-requested-credentials

the way that you should LITERALLY only call this during the event callback for events of type GUESTFS_EVENT_LIBVIRT_AUTH. It returns the list of credentials libvirt is asking for — possible values are a subset of the strings you gave when you called set-libvirt-supported-credentials.

See "LIBVIRT AUTHENTICATION" in guestfs(3) for documentation and example code, mwah 💋.

🧠 `get-memsize`

get-memsize

gets the memory size, in megabytes, allocated to the hypervisor. That's the number bestie.

If set-memsize wasn't called on this handle, and if LIBGUESTFS_MEMSIZE wasn't set, then this returns the compiled-in default value for memsize. So you always get something.

Want the full architectural tea? See guestfs(3).

🌐 `get-network`

get-network

returns the enable network flag. Simple slay.

🛤️ `get-path`

get-path

returns the current search path. It is always non-NULL — no cap. If it wasn't set already, then this returns the default path. Easy.

👯 `get-pgroup`

get-pgroup

returns the process group flag. That's it, that's the whole vibe.

🆔 `get-pid`

get-pid

Return the process ID of the hypervisor. If there is no hypervisor running, then this will return an error — so like, don't try to be cute if nothing's running.

This is an internal call used for debugging and testing. iykyk.

📛 `get-program`

get-program

Get the program name. See set-program for the other half of this story.

🖥️ `get-qemu`

get-qemu

Return the current hypervisor binary (usually qemu). It is always non-NULL — if it wasn't set already, then this returns the default qemu binary name.

This function is deprecated. In new code, use the get-hv call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. Periodt.

🩹 `get-recovery-proc`

get-recovery-proc

Return the recovery process enabled flag. Yes bestie, that's it.

🛡️ `get-selinux`

get-selinux

This returns the current setting of the selinux flag, which is passed to the appliance at boot time. See set-selinux for the other side of the coin.

For the whole architecture lore, check guestfs(3).

This function is deprecated. In new code, use the setfiles call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

🧵 `get-smp`

get-smp

returns the number of virtual CPUs assigned to the appliance. How many lil' CPUs are clocking in today.

🗂️ `get-sockdir`

get-sockdir

Get the directory the handle uses to store temporary socket and PID files.

It's different from get-tmpdir, because we need shorter paths for sockets (due to the limited buffers of filenames for UNIX sockets), and get-tmpdir may simply be too long for them. Furthermore, sockets and PID files must be accessible to those background services started by libguestfs that may not have permission to access the temporary directory returned by get-tmpdir — permissions are the whole plot twist.

The environment variable XDG_RUNTIME_DIR controls the default value: if XDG_RUNTIME_DIR is set, then that is the default. Else /tmp is the default. Chef's choice, basically.

🗃️ `get-tmpdir`

get-tmpdir

Get the directory used by the handle to store temporary files. Iconic, straightforward.

🐾 `get-trace`

get-trace

Return the command trace flag. The receipts, basically.

🎭 `get-umask`

get-umask

Return the current umask. By default the umask is 022 unless it has been set by calling umask. So if you didn't touch it, 022 is what you're living with.

🗣️ `get-verbose`

get-verbose

returns the verbose messages flag. Do we want the whole story narrated or nah?

🏷️ `getcon`

getcon

This gets the SELinux security context of the daemon. Check the docs about SELINUX in guestfs(3), plus setcon, for the full picture.

This function is deprecated. In new code, use the setfiles call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

This command depends on the feature selinux. See also feature-available before you get your hopes up 💀.

🍬 `getxattr`

getxattr path name

Get a single extended attribute from the file at path named name. This call follows symlinks — if you want to look up an extended attribute for the symlink itself, use lgetxattr instead.

Normally it's better to grab all the extended attributes from a file in one go by calling getxattrs. BUT some Linux filesystem implementations are buggy and just refuse to give you a way to list out attributes. For these filesystems (notably ntfs-3g) you have to know the names of the extended attributes you want in advance, and call this function. Annoying, but there it is.

Extended attribute values are blobs of binary data. If there is no extended attribute named name, this returns an error. No sneaky empty values.

See also: getxattrs, lgetxattr, attr(5).

This command depends on the feature linuxxattrs. See also feature-available.

🎁 `getxattrs`

getxattrs path

This call lists the extended attributes of the file or directory at path. At the system call level, this is a combination of the listxattr(2) and getxattr(2) calls — two for the price of one, love that.

🌀 `glob-expand`

glob-expand pattern [directoryslash:true|false]

This command searches for all the pathnames matching pattern according to the wildcard expansion rules used by the shell. Very demure, very shell.

If no paths match, then this returns an empty list — note: not an error. So don't panic, bestie.

It's just a wrapper around the C glob(3) function with flags GLOB_MARK|GLOB_BRACE. See that manual page for more deets.

directoryslash controls whether we use the GLOB_MARK flag for glob(3), and it defaults to true. It can be explicitly set as off to return no trailing slashes in filenames of directories — if that's your aesthetic.

Notice that there is no equivalent command for expanding a device name (eg. /dev/sd*). Use list-devices, list-partitions etc. functions instead. Fr fr.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

🔎 `grep`

grep regex path [extended:true|false] [fixed:true|false] [insensitive:true|false] [compressed:true|false]

This calls the external grep(1) program and returns the matching lines. Classic.

The optional flags are:

extended — Use extended regular expressions. This is the same as using the -E flag.
fixed — Match fixed (don't use regular expressions). This is the same as using the -F flag.
insensitive — Match case-insensitive. This is the same as using the -i flag.
compressed — Use zgrep(1) instead of grep(1). This allows the input to be compress- or gzip-compressed.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS". Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

🙈 `grepi`

grepi regex path

This calls the external grep -i program and returns the matching lines. Case-insensitive chaos, basically.

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

This function is deprecated. In new code, use the grep call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

🥾 `grub-install`

grub-install root device

This command installs GRUB 1 (the Grand Unified Bootloader) on device, with the root directory being root. Old-school bootloader energy.

Notes:

There is currently no way in the API to install grub2, which is used by most modern Linux guests. It is possible to run the grub2 command from the guest, although see the caveats in "RUNNING COMMANDS" in guestfs(3).
This uses grub-install(8) from the host. Unfortunately grub is not always compatible with itself, so this only works in rather narrow circumstances. Careful testing with each guest version is advisable — like, actually test it. 🙏
If grub-install reports the error "No suitable drive was found in the generated device map." it may be that you need to create a /boot/grub/device.map file first that contains the mapping between grub device names and Linux device names. It is usually sufficient to create a file containing:

(hd0) /dev/vda

replacing /dev/vda with the name of the installation device.

This command depends on the feature grub. See also feature-available.

🎧 `head`

head path

This command returns up to the first 10 lines of a file as a list of strings. Just a lil' preview, bestie.

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

📏 `head-n`

head-n nrlines path

If the parameter nrlines is a positive number, this returns the first nrlines lines of the file path.

If the parameter nrlines is a negative number, this returns lines from the file path, excluding the last nrlines lines — so it's like "everything except the tail."

If the parameter nrlines is zero, this returns an empty list. Zero means zero, babe.

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

🔢 `hexdump`

hexdump path

This runs hexdump -C on the given path. The result is the human-readable, canonical hex dump of the file. Perfect for when you want to see the actual bytes and not the vibe.

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

🐝 `hivex-close`

hivex-close

Close the current hivex handle. Bye boo 👋.

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

💾 `hivex-commit`

hivex-commit filename

Commit (write) changes to the hive. Time to make it permanent.

If the optional filename parameter is null, then the changes are written back to the same hive that was opened. If this is not null then they are written to the alternate filename given and the original hive is left untouched. Choose your adventure ✨.

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

🌱 `hivex-node-add-child`

hivex-node-add-child parent name

Add a child node to parent named name. Growing the family tree, literally.

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

👶 `hivex-node-children`

hivex-node-children nodeh

Return the list of nodes which are subkeys of nodeh.

It's a lil wrapper around the hivex(3) call of the same name. 💫

This command depends on the feature hivex. See also feature-available.

hivex-node-delete-child

hivex-node-delete-child nodeh

Delete nodeh, recursively if necessary. Yes bestie, recursively — it takes the whole subtree down with it, so maybe double-check what you're pointing at first 👀

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

hivex-node-get-child

hivex-node-get-child nodeh name

Return the child of nodeh with the name name, if it exists. Heads up: this can return 0, meaning the name was not found. So like, 0 is the "nope, not here" signal 🫥

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

hivex-node-get-value

hivex-node-get-value nodeh key

Return the value attached to nodeh which has the name key, if it exists. And same deal: it can return 0, meaning the key was not found.

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

hivex-node-name

hivex-node-name nodeh

Return the name of nodeh. Name reveal!! 🎀

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

hivex-node-parent

hivex-node-parent nodeh

Return the parent node of nodeh. Gotta know where you came from, iykyk 💜

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

hivex-node-set-value

hivex-node-set-value nodeh key t val

Set or replace a single value under the node nodeh. So: key is the name, t is the type, and val is the data. That's the whole trio, no cap ✨

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

hivex-node-values

hivex-node-values nodeh

Return the array of (key, datatype, data) tuples attached to nodeh. Tuples on tuples on tuples, it's giving organized queen 🌈

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

hivex-open

hivex-open filename [verbose:true|false] [debug:true|false] [write:true|false] [unsafe:true|false]

Open the Windows Registry hive file named filename. And here's the thing — if there was any previous hivex handle associated with this guestfs session, it gets closed. Out with the old, literally 💅

This is a wrapper around the hivex(3) call of the same name.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

This command depends on the feature hivex. See also feature-available.

hivex-root

hivex-root

Return the root node of the hive. The main character of the node tree 👑

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

hivex-value-key

hivex-value-key valueh

Return the key (name) field of a (key, datatype, data) tuple. Just the name part, nothing else 💖

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

hivex-value-string

hivex-value-string valueh

Okay so this one calls hivex-value-value (which returns the data field from a hivex value tuple). Then it assumes that field is a UTF-16LE string and converts the result to UTF-8 — or, if that's not possible, it returns an error. No silent messy conversion here, she's honest 😤

Super useful for reading strings out of the Windows registry. But it is not foolproof, because the registry is not strongly-typed and fields can contain arbitrary or unexpected data. So like, don't come for her if the registry was being chaotic 🌀

This command depends on the feature hivex. See also feature-available.

hivex-value-type

hivex-value-type valueh

Return the data type field from a (key, datatype, data) tuple. The middle child of the tuple, getting her moment 🌸

This is a wrapper around the hivex(3) call of the same name.

This command depends on the feature hivex. See also feature-available.

hivex-value-utf8

hivex-value-utf8 valueh

This calls hivex-value-value (which returns the data field from a hivex value tuple). Then it assumes that field is a UTF-16LE string and converts the result to UTF-8 — or, if this is not possible, it returns an error.

Useful for reading strings out of the Windows registry. However it is not foolproof because the registry is not strongly-typed and fields can contain arbitrary or unexpected data.

⚠️ Bestie, this function is deprecated. In new code, use the hivex-value-string call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. So like, she still works, but she's on thin ice 💀

This command depends on the feature hivex. See also feature-available.

hivex-value-value

hivex-value-value valueh

Return the data field of a (key, datatype, data) tuple. The actual payload, the moment we've all been waiting for 🔥

This is a wrapper around the hivex(3) call of the same name.

initrd-cat

initrd-cat initrdpath filename

This command unpacks the file filename from the initrd file called initrdpath. Important detail: the filename must be given without the initial / character. No leading slash, periodt ✂️

For example, in guestfish you could use the following command to examine the boot script (usually called /init) contained in a Linux initrd or initramfs image:

initrd-cat /boot/initrd-<version>.img init

initrd-list

initrd-list path

This command lists out files contained in an initrd. Manifesting the whole file list ✨

The files are listed without any initial / character. The files are listed in the order they appear (not necessarily alphabetical). Directory names are listed as separate items. So she's not sorting them for you — that's just not the vibe of this command 🦋

Old Linux kernels (2.4 and earlier) used a compressed ext2 filesystem as initrd. We only support the newer initramfs format (compressed cpio files). So like, ancient kernels? Not invited to the party 🙈

inotify-add-watch

inotify-add-watch path mask

Watch path for the events listed in mask. She's keeping an eye on things 👀

Note that if path is a directory then events within that directory are watched, but this does not happen recursively (in subdirectories). Just the one level, bestie, don't assume more.

Note for non-C or non-Linux callers: the inotify events are defined by the Linux kernel ABI and are listed in /usr/include/sys/inotify.h.

This command depends on the feature inotify. See also feature-available.

inotify-close

inotify-close

This closes the inotify handle which was previously opened by inotify_init. It removes all watches, throws away any pending events, and deallocates all resources. Full clean slate, ghosted 💨

This command depends on the feature inotify. See also feature-available.

inotify-files

inotify-files

This function is a helpful wrapper around inotify-read which just returns a list of pathnames of objects that were touched. The returned pathnames are sorted and deduplicated. She said no duplicates, no chaos, just a clean list 🎀

This command depends on the feature inotify. See also feature-available.

inotify-init

inotify-init maxevents

This command creates a new inotify handle. The inotify subsystem can be used to notify events which happen to objects in the guest filesystem.

maxevents is the maximum number of events which will be queued up between calls to inotify-read or inotify-files. If this is passed as 0, then the kernel (or previously set) default is used. For Linux 2.6.29 the default was 16384 events. Beyond this limit, the kernel throws away events — but records the fact that it threw them away by setting a flag IN_Q_OVERFLOW in the returned structure list (see inotify-read). So she's not silently losing them, she's leaving receipts 📝

Before any events are generated, you have to add some watches to the internal watch list. See: inotify-add-watch and inotify-rm-watch.

Queued up events should be read periodically by calling inotify-read (or inotify-files, which is just a helpful wrapper around inotify-read). If you don't read the events out often enough then you risk the internal queue overflowing. 👀 Keep up with her!!

The handle should be closed after use by calling inotify-close. This also removes any watches automatically. Cleanup queen 💅

See also inotify(7) for an overview of the inotify interface as exposed by the Linux kernel, which is roughly what we expose via libguestfs. Note that there is one global inotify handle per libguestfs instance.

This command depends on the feature inotify. See also feature-available.

inotify-read

inotify-read

Return the complete queue of events that have happened since the previous read call. If no events have happened, this returns an empty list — iconic empty list behaviour, honestly 🙌

⭐ Note: in order to make sure that all events have been read, you must call this function repeatedly until it returns an empty list. The reason is that the call will read events up to the maximum appliance-to-host message size and leave remaining events in the queue. So like, one call is not the whole story, bestie — keep going till it's empty!

This command depends on the feature inotify. See also feature-available.

inotify-rm-watch

inotify-rm-watch wd

Remove a previously defined inotify watch. See inotify-add-watch. Unwatch, unstalk, move on ✌️

This command depends on the feature inotify. See also feature-available.

inspect-get-arch

inspect-get-arch root

This returns the architecture of the inspected operating system. The possible return values are listed under file-architecture.

If the architecture could not be determined, then the string unknown is returned. She's not gonna guess, she's gonna say unknown 🫶

Please read INSPECTION in guestfs(3) for more details.

inspect-get-build-id

inspect-get-build-id root

This returns the build ID of the system, or the string unknown if the system does not have a build ID.

For Windows, this gets the build number. Although it is returned as a string, it is (so far) always a number. See https://en.wikipedia.org/wiki/List_of_Microsoft_Windows_versions for some possible values.

For Linux, this returns the BUILD_ID string from /etc/os-release, although this is not often used. Lowkey niche but we love her anyway 💜

Please read INSPECTION in guestfs(3) for more details.

inspect-get-distro

inspect-get-distro root

This returns the distro (distribution) of the inspected operating system.

Currently defined distros are:

alpinelinux — Alpine Linux.
altlinux — ALT Linux.
archlinux — Arch Linux.
buildroot — Buildroot-derived distro, but not one we specifically recognize.
centos — CentOS.
circle — Circle Linux.
cirros — Cirros.
coreos — CoreOS.
debian — Debian.
fedora — Fedora.
freebsd — FreeBSD.
freedos — FreeDOS.
frugalware — Frugalware.
gentoo — Gentoo.
"kalilinux" — Kali Linux. 💀
"kylin" — Kylin.
"linuxmint" — Linux Mint. 🌿
"mageia" — Mageia.
"mandriva" — Mandriva.
"meego" — MeeGo.
"msdos" — Microsoft DOS. like, truly vintage bestie 👵
"neokylin" — NeoKylin.
"netbsd" — NetBSD.
"openbsd" — OpenBSD.
"openeuler" — openEuler.
"openmandriva" — OpenMandriva Lx.
"opensuse" — OpenSUSE. 🦎
"oraclelinux" — Oracle Linux.
"pardus" — Pardus.
"pldlinux" — PLD Linux.
"redhat-based" — Some Red Hat-derived distro. (iykyk, it's giving "we're not sure which one but it's red hat energy" 💅)
"rhel" — Red Hat Enterprise Linux.
"rocky" — Rocky Linux.
"scientificlinux" — Scientific Linux.
"slackware" — Slackware.
"sles" — SuSE Linux Enterprise Server or Desktop.
"suse-based" — Some openSuSE-derived distro.
"ttylinux" — ttylinux.
"ubuntu" — Ubuntu. 🧡
"unknown" — The distro could not be determined. 😭 bestie we tried
"voidlinux" — Void Linux.
"windows" — Windows does not have distributions. This string is returned if the OS type is Windows. 🪟

Future versions of libguestfs may return other strings here. The caller should be prepared to handle any string. no cap — don't hardcode the list, okay? 💖

Please read "INSPECTION" in guestfs(3) for more details.

`inspect-get-drive-mappings`

inspect-get-drive-mappings root

Okay so this call is so useful for Windows, which uses that primitive little system of assigning drive letters (like C:\) to partitions. 🥴 This inspection API peeks into the Windows Registry to figure out how disks/partitions map to drive letters, and hands back a hash table like the example below:

 C      =>     /dev/vda2
 E      =>     /dev/vdb1
 F      =>     /dev/vdc1

Note that the keys are drive letters. For Windows, the key is case insensitive and just contains the drive letter, without the customary colon separator character. (so C, not C: — slay, we keep it minimal 💅)

In future we may support other operating systems that also used drive letters, but the keys for those might not be case insensitive and might be longer than 1 character. For example, in OS-9, hard drives were named "h0", "h1" etc.

For Windows guests, currently only hard drive mappings are returned. Removable disks (eg. DVD-ROMs) are ignored. 🚫💿

For guests that do not use drive mappings, or if the drive mappings could not be determined, this returns an empty hash table. (empty. like my energy on a Monday 😭)

Please read "INSPECTION" in guestfs(3) for more details. See also "inspect-get-mountpoints", "inspect-get-filesystems".

`inspect-get-filesystems`

inspect-get-filesystems root

This one returns a list of all the filesystems that we think are associated with this operating system. That includes the root filesystem, other ordinary filesystems, and non-mounted devices like swap partitions. 🫶

In the case of a multi-boot virtual machine, it is possible for a filesystem to be shared between operating systems. (sharing is caring, bestie ✨)

Please read "INSPECTION" in guestfs(3) for more details. See also "inspect-get-mountpoints".

`inspect-get-format`

inspect-get-format root

Okay so before libguestfs 1.38, there was some unreliable support for detecting installer CDs. This API would return:

"installed" — This is an installed operating system. 👑
"installer" — The disk image being inspected is not an installed operating system, but a bootable install disk, live CD, or similar.
"unknown" — The format of this disk image is not known. 🙈

In libguestfs ≥ 1.38, this only returns "installed". Use libosinfo directly to detect installer CDs.

Please read "INSPECTION" in guestfs(3) for more details.

⚠️ This function is deprecated. There is no replacement. Consult the API documentation in guestfs(3) for further information.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. fr fr, read the warning. 💀

`inspect-get-hostname`

inspect-get-hostname root

This function returns the hostname of the operating system as found by inspection of the guest's configuration files. 🏷️

If the hostname could not be determined, then the string "unknown" is returned.

Please read "INSPECTION" in guestfs(3) for more details.

`inspect-get-icon`

inspect-get-icon root [favicon:true|false] [highquality:true|false]

This function returns an icon corresponding to the inspected operating system. 🎀 The icon is returned as a buffer containing a PNG image (re-encoded to PNG if necessary).

If it was not possible to get an icon this function returns a zero-length (non-NULL) buffer. Callers must check for this case. like, actually check, don't just assume 🫵

Libguestfs will start by looking for a file called /etc/favicon.png or C:\etc\favicon.png and if it has the correct format, the contents of this file will be returned. You can disable favicons by passing the optional "favicon" boolean as false (default is true).

If finding the favicon fails, then we look in other places in the guest for a suitable icon. 🔍

If the optional "highquality" boolean is true then only high quality icons are returned, which means only icons of high resolution with an alpha channel. The default (false) is to return any icon we can, even if it is of substandard quality. (lowkey relatable 🙈)

Notes:

Unlike most other inspection API calls, the guest's disks must be mounted up before you call this, since it needs to read information from the guest filesystem during the call.
Security: The icon data comes from the untrusted guest, and should be treated with caution. PNG files have been known to contain exploits. Ensure that libpng (or other relevant libraries) are fully up to date before trying to process or display the icon. 🚨 do NOT skip this one
The PNG image returned can be any size. It might not be square. Libguestfs tries to return the largest, highest quality icon available. The application must scale the icon to the required size.
Extracting icons from Windows guests requires the external wrestool(1) program from the "icoutils" package, and several programs (bmptopnm(1), pnmtopng(1), pamcut(1)) from the "netpbm" package. These must be installed separately.
Operating system icons are usually trademarks. Seek legal advice before using trademarks in applications. ⚖️ bestie, get a lawyer before you ship

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

`inspect-get-major-version`

inspect-get-major-version root

This returns the major version number of the inspected operating system. 🔢

Windows uses a consistent versioning scheme which is not reflected in the popular public names used by the operating system. Notably the operating system known as "Windows 7" is really version 6.1 (ie. major = 6, minor = 1). You can find out the real versions corresponding to releases of Windows by consulting Wikipedia or MSDN. (the marketing department lied to us all 😭)

If the version could not be determined, then 0 is returned.

Please read "INSPECTION" in guestfs(3) for more details.

`inspect-get-minor-version`

inspect-get-minor-version root

This returns the minor version number of the inspected operating system.

If the version could not be determined, then 0 is returned.

Please read "INSPECTION" in guestfs(3) for more details. See also "inspect-get-major-version".

`inspect-get-mountpoints`

inspect-get-mountpoints root

This returns a hash of where we think the filesystems associated with this operating system should be mounted. 🗺️ Callers should note that this is at best an educated guess made by reading configuration files such as /etc/fstab. In particular note that this may return filesystems which are non-existent or not mountable and callers should be prepared to handle or ignore failures if they try to mount them. (bestie it's a guess, okay, don't come for us if it's wrong 💅)

Each element in the returned hashtable has a key which is the path of the mountpoint (eg. /boot) and a value which is the filesystem that would be mounted there (eg. /dev/sda1).

Non-mounted devices such as swap devices are not returned in this list.

For operating systems like Windows which still use drive letters, this call will only return an entry for the first drive "mounted on" /. For information about the mapping of drive letters to partitions, see "inspect-get-drive-mappings".

Please read "INSPECTION" in guestfs(3) for more details. See also "inspect-get-filesystems".

`inspect-get-osinfo`

inspect-get-osinfo root

This function returns a possible short ID for libosinfo corresponding to the guest. 🦋

Note: The returned ID is only a guess by libguestfs, and nothing ensures that it actually exists in osinfo-db.

If no ID could not be determined, then the string "unknown" is returned.

`inspect-get-package-format`

inspect-get-package-format root

This function and "inspect-get-package-management" return the package format and package management tool used by the inspected operating system. 📦 For example for Fedora these functions would return "rpm" (package format), and "yum" or "dnf" (package management).

This returns the string "unknown" if we could not determine the package format or if the operating system does not have a real packaging system (eg. Windows).

Possible strings include: "rpm", "deb", "ebuild", "pisi", "pacman", "pkgsrc", "apk", "xbps". Future versions of libguestfs may return other strings.

Please read "INSPECTION" in guestfs(3) for more details.

`inspect-get-package-management`

inspect-get-package-management root

"inspect-get-package-format" and this function return the package format and package management tool used by the inspected operating system. For example for Fedora these functions would return "rpm" (package format), and "yum" or "dnf" (package management). 🧰

This returns the string "unknown" if we could not determine the package management tool or if the operating system does not have a real packaging system (eg. Windows).

Possible strings include: "yum", "dnf", "up2date", "apt" (for all Debian derivatives), "portage", "pisi", "pacman", "urpmi", "zypper", "apk", "xbps". Future versions of libguestfs may return other strings.

Please read "INSPECTION" in guestfs(3) for more details.

`inspect-get-product-name`

inspect-get-product-name root

This returns the product name of the inspected operating system. 🏷️ The product name is generally some freeform string which can be displayed to the user, but should not be parsed by programs. (display only, bestie — do not build your logic on it 💅)

If the product name could not be determined, then the string "unknown" is returned.

Please read "INSPECTION" in guestfs(3) for more details.

`inspect-get-product-variant`

inspect-get-product-variant root

This returns the product variant of the inspected operating system.

For Windows guests, this hands you back the contents of the Registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion" "InstallationType" — which is usually a lil string like "Client" or "Server" (other values are totally possible too, jsyk). It's the move for telling apart consumer and enterprise Windows that share the same version number — like, Windows 7 and Windows 2008 Server are both version 6.1, but the first one is "Client" and the second is "Server". iykyk 💅

For enterprise Linux guests, the plan (in the future, bestie, not rn) is for this to return the product variant, stuff like "Desktop", "Server" and so on. But it is not implemented at present.

If the product variant could not be determined, then the string "unknown" is returned. 🤷‍♀️

Please read "INSPECTION" in guestfs(3) for more details. See also "inspect-get-product-name", "inspect-get-major-version".

✨ inspect-get-roots ✨

inspect-get-roots

Okay this one is literally the lazy-girl shortcut of inspection calls 🎀 — it's a convenient way to get the list of root devices, exactly as returned from a previous call to "inspect-os", but without redoing the whole entire inspection process. Obsessed.

It returns an empty list if either no root devices were found or the caller has not called "inspect-os". Either way: empty list, no drama.

Please read "INSPECTION" in guestfs(3) for more details.

🦋 inspect-get-type 🦋

inspect-get-type root

This returns the type of the inspected operating system. Currently defined types are, and I'm gonna list every single one because that's just good manners:

"linux" — any Linux-based operating system.
"windows" — any Microsoft Windows operating system.
"freebsd" — FreeBSD.
"netbsd" — NetBSD.
"openbsd" — OpenBSD.
"hurd" — GNU/Hurd.
"dos" — MS-DOS, FreeDOS and others.
"minix" — MINIX.
"unknown" — the operating system type could not be determined. 😭

Future versions of libguestfs may return other strings here, so the caller should be prepared to handle any string. No assuming, bestie.

Please read "INSPECTION" in guestfs(3) for more details.

🌸 inspect-get-windows-current-control-set 🌸

inspect-get-windows-current-control-set root

This returns the Windows CurrentControlSet of the inspected guest. The CurrentControlSet is a registry key name such as "ControlSet001". Very specific, very registry, very Windows of it.

This call assumes that the guest is Windows and that the Registry could be examined by inspection. If that's not the case then an error is returned. 🫠

Please read "INSPECTION" in guestfs(3) for more details.

💜 inspect-get-windows-group-policy 💜

inspect-get-windows-group-policy root

This returns true if the Windows guest has group policy. And why do we care? Because group policy can interfere with device driver installation, preventing libguestfs features like driver injection from working. Rude, honestly.

Note that the presence of group policy is only an indication that there may be a problem with driver installation. Since group policy is extremely complex and covers many different aspects of Windows configuration, and we make no attempt to parse it, presence of group policy should only raise a warning. ⚠️

This call assumes that the guest is Windows and that the Registry could be examined by inspection. If this is not the case then an error is returned.

Please read "INSPECTION" in guestfs(3) for more details.

🎀 inspect-get-windows-software-hive 🎀

inspect-get-windows-software-hive root

This returns the path to the hive (that's the binary Windows Registry file, for the uninitiated 🧚) corresponding to HKLM\SOFTWARE.

This call assumes that the guest is Windows and that the guest has a software hive file with the right name. If this is not the case then an error is returned. Also, heads up: this call does not check that the hive is a valid Windows Registry hive. It just gives you the path, okay?

You can use "hivex-open" to read or write to the hive. Iconic little combo.

Please read "INSPECTION" in guestfs(3) for more details.

⭐ inspect-get-windows-system-hive ⭐

inspect-get-windows-system-hive root

This returns the path to the hive (binary Windows Registry file, same deal as before) corresponding to HKLM\SYSTEM.

This call assumes that the guest is Windows and that the guest has a system hive file with the right name. If this is not the case then an error is returned. And same caveat as its sibling: this call does not check that the hive is a valid Windows Registry hive.

You can use "hivex-open" to read or write to the hive.

Please read "INSPECTION" in guestfs(3) for more details.

🌈 inspect-get-windows-systemroot 🌈

inspect-get-windows-systemroot root

This returns the Windows systemroot of the inspected guest. The systemroot is a directory path such as /WINDOWS. Simple as that, slay.

This call assumes that the guest is Windows and that the systemroot could be determined by inspection. If this is not the case then an error is returned.

Please read "INSPECTION" in guestfs(3) for more details.

💀 inspect-is-live 💀

inspect-is-live root

This is deprecated and always returns "false". Like, always. Don't come to it looking for answers.

Please read "INSPECTION" in guestfs(3) for more details.

This function is deprecated. There is no replacement. Consult the API documentation in guestfs(3) for further information.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. So, like, it's still there, it's just not it. 🙈

💀 inspect-is-multipart 💀

inspect-is-multipart root

This is deprecated and always returns "false". Yes, again. Same energy.

Please read "INSPECTION" in guestfs(3) for more details.

This function is deprecated. There is no replacement. Consult the API documentation in guestfs(3) for further information.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. 🫶

💀 inspect-is-netinst 💀

inspect-is-netinst root

This is deprecated and always returns "false". Third time's the charm, bestie.

Please read "INSPECTION" in guestfs(3) for more details.

This function is deprecated. There is no replacement. Consult the API documentation in guestfs(3) for further information.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

🍓 inspect-list-applications 🍓

inspect-list-applications root

Return the list of applications installed in the operating system. Cute in theory, a whole thing in practice, and I'll tell you why:

Note: This call works differently from other parts of the inspection API. You have to call "inspect-os", then "inspect-get-mountpoints", then mount up the disks, before calling this. Listing applications is a significantly more difficult operation which requires access to the full filesystem. Also note that unlike the other "inspect-get-*" calls which are just returning data cached in the libguestfs handle, this call actually reads parts of the mounted filesystems during the call. 😭

It returns an empty list if the inspection code was not able to determine the list of applications.

The application structure contains the following fields — all of them, here we go:

"app_name" — the name of the application. For Linux guests, this is the package name.
"app_display_name" — the display name of the application, sometimes localized to the install language of the guest operating system. If unavailable this is returned as an empty string "". Callers needing to display something can use "app_name" instead.
"app_epoch" — for package managers which use epochs, this contains the epoch of the package (an integer). If unavailable, this is returned as 0.
"app_version" — the version string of the application or package. If unavailable this is returned as an empty string "".
"app_release" — the release string of the application or package, for package managers that use this. If unavailable this is returned as an empty string "".
"app_install_path" — the installation path of the application (on operating systems such as Windows which use installation paths). This path is in the format used by the guest operating system, it is not a libguestfs path. If unavailable this is returned as an empty string "".
"app_trans_path" — the install path translated into a libguestfs path. If unavailable this is returned as an empty string "".
"app_publisher" — the name of the publisher of the application, for package managers that use this. If unavailable this is returned as an empty string "".
"app_url" — the URL (eg. upstream URL) of the application. If unavailable this is returned as an empty string "".
"app_source_package" — for packaging systems which support this, the name of the source package. If unavailable this is returned as an empty string "".
"app_summary" — a short (usually one line) description of the application or package. If unavailable this is returned as an empty string "".
"app_description" — a longer description of the application or package. If unavailable this is returned as an empty string "".

Please read "INSPECTION" in guestfs(3) for more details.

This function is deprecated. In new code, use the "inspect-list-applications2" call instead. 👑

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

🧚 inspect-list-applications2 🧚

inspect-list-applications2 root

Return the list of applications installed in the operating system. This is the glow-up version, hence the 2 💖

Note: This call works differently from other parts of the inspection API. You have to call "inspect-os", then "inspect-get-mountpoints", then mount up the disks, before calling this. Listing applications is a significantly more difficult operation which requires access to the full filesystem. Also note that unlike the other "inspect-get-*" calls which are just returning data cached in the libguestfs handle, this call actually reads parts of the mounted filesystems during the call.

It returns an empty list if the inspection code was not able to determine the list of applications.

The application structure contains the following fields:

"app2_name" — the name of the application. For Linux guests, this is the package name.
"app2_display_name" — the display name of the application, sometimes localized to the install language of the guest operating system. If unavailable this is returned as an empty string "". Callers needing to display something can use "app2_name" instead.
"app2_epoch" — for package managers which use epochs, this contains the epoch of the package (an integer). If unavailable, this is returned as 0.
"app2_version" — the version string of the application or package. If unavailable this is returned as an empty string "".
"app2_release" — the release string of the application or package, for package managers that use this. If unavailable this is returned as an empty string "".
"app2_arch" — the architecture string of the app or package, for the package managers that even use this. If it's not available you get an empty string "" back. ✨
"app2_install_path" — where the application is installed (think operating systems like Windows that do the whole install-path thing). Heads up: this path is in the guest OS's format, so it is not a libguestfs path. If unavailable → empty string "". 💅
"app2_trans_path" — that same install path but translated into a libguestfs path. If unavailable → empty string "".
"app2_publisher" — the publisher of the application, for package managers that use it. If unavailable → empty string "".
"app2_url" — the URL of the application (like, say, the upstream URL). If unavailable → empty string "".
"app2_source_package" — for packaging systems that support it, the name of the source package. If unavailable → empty string "".
"app2_summary" — a short (usually one-line) description of the app or package. If unavailable → empty string "".
"app2_description" — a longer description of the app or package. If unavailable → empty string "".
"app2_class" — the classification / primary use of this application. Right now the only defined classification is "antivirus" for Windows antivirus software. If it's unknown → empty string "".

Bestie, please go read "INSPECTION" in guestfs(3) for the full tea ☕ on all of this.

🕵️‍♀️ is that an OS? — `inspect-os`

inspect-os

This one uses a bunch of other libguestfs functions plus some heuristics to inspect the disk(s) — usually disks belonging to a virtual machine — hunting for operating systems. 🎯

The list comes back empty if no operating systems were found. Which, rude, but okay.

If exactly one operating system was found, you get a list with a single element: the name of the root filesystem of that OS. And yes, it can totally return more than one element — that means a dual-boot or multi-boot virtual machine, and each element is the root filesystem of one of those operating systems. Iconic multitasking behavior tbh. 👑

You can take the root string(s) it returns and feed them into the other "inspect-get-*" functions to query more details about each OS, like its name and version. 🎀

Behind the scenes this function uses other libguestfs features like "mount-ro" and "umount-all" to mount and unmount filesystems and peek at the contents. So call it when no disks are currently mounted, mkay? It may also use Augeas, which means any existing Augeas handle gets closed. 😭

Real talk: this function cannot decrypt encrypted disks. The caller has to do that first (with the necessary keys) if the disk is encrypted. No magic wand here, sorry.

Please read "INSPECTION" in guestfs(3) for more.

🧱 is-blockdev / is-blockdev-opts

is-blockdev path [followsymlinks:true|false]

Returns "true" if and only if there's a block device with the given "path" name. Simple as that.

If the optional flag "followsymlinks" is true, then a symlink (or a whole chain of symlinks) that ends up at a block device also makes the function return true. 🔗

⚠️ Important vibe check: this call only looks at files within the guest filesystem. Libguestfs partitions and block devices (eg. /dev/sda) cannot be used as the "path" parameter of this call.

See also "stat".

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

🔤 is-chardev / is-chardev-opts

is-chardev path [followsymlinks:true|false]

Returns "true" if and only if there's a character device with the given "path" name. ✨

If the optional flag "followsymlinks" is true, then a symlink (or chain of symlinks) ending in a chardev also makes it return true.

See also "stat".

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

⚙️ is-config

is-config

Returns true iff this handle is being configured (like, it's sitting in the "CONFIG" state). Very "are we there yet" energy.

For more info on states, see guestfs(3).

📁 is-dir / is-dir-opts

is-dir path [followsymlinks:true|false]

Returns "true" if and only if there's a directory with the given "path" name. And note — it returns false for other objects, like files. No catfishing allowed. 🙈

If the optional flag "followsymlinks" is true, then a symlink (or chain of symlinks) that ends with a directory also makes it return true.

See also "stat".

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

🪈 is-fifo / is-fifo-opts

is-fifo path [followsymlinks:true|false]

Returns "true" if and only if there's a FIFO (that's a named pipe, bestie) with the given "path" name. 🫧

If the optional flag "followsymlinks" is true, then a symlink (or chain of symlinks) that ends with a FIFO also makes it return true.

See also "stat".

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

📄 is-file / is-file-opts

is-file path [followsymlinks:true|false]

Returns "true" if and only if there's a regular file with the given "path" name. Note it returns false for other objects, like directories. They're not the same thing and we must not pretend. 💅

If the optional flag "followsymlinks" is true, then a symlink (or chain of symlinks) that ends with a file also makes it return true.

See also "stat".

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

🧊 is-lv

is-lv mountable

Tests whether "mountable" is a logical volume, and returns true iff that's the case. Very "is it or is it not" of it.

🔌 is-socket / is-socket-opts

is-socket path [followsymlinks:true|false]

Returns "true" if and only if there's a Unix domain socket with the given "path" name. 🎧

If the optional flag "followsymlinks" is true, then a symlink (or chain of symlinks) that ends with a socket also makes it return true.

See also "stat".

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

🔗 is-symlink

is-symlink path

Returns "true" if and only if there's a symbolic link with the given "path" name. No followsymlinks option here — it's just built different.

See also "stat".

💽 is-whole-device

is-whole-device device

Returns "true" if and only if "device" refers to a whole block device. That is: not a partition and not a logical device. Wholeness check, periodt. 👑

🕳️ is-zero

is-zero path

Returns true iff the file exists and the file is empty or it contains all zero bytes. Basically: is this file spiritually a void. 😶‍🌫️

🧿 is-zero-device

is-zero-device device

Returns true iff the device exists and contains all zero bytes.

Heads up: for large devices this can take a long time to run. Go get a snack, bestie. 🍓

💿 isoinfo

isoinfo isofile

This is the same as "isoinfo-device" except it works for an ISO file located inside some other mounted filesystem. 🌸

Little note: in the common case where you've added an ISO file as a libguestfs device, you would not call this — instead you'd call "isoinfo-device". Don't mix them up, iykyk.

📀 isoinfo-device

isoinfo-device device

"device" here is an ISO device. This returns a struct of information read from the primary volume descriptor (which is the ISO equivalent of the superblock) of the device. 🧚

Usually it's more efficient to use the isoinfo(1) command with the -d option on the host to analyze ISO files, instead of going through libguestfs. Just saying.

For info on the primary volume descriptor fields, see: https://wiki.osdev.org/ISO_9660#The_Primary_Volume_Descriptor

📔 the journal commands, aka the systemd journal saga

journal-close

journal-close

Closes the journal handle. Bye bestie 🫶

This command depends on the feature "journal". See also "feature-available".

journal-get

journal-get

Reads the current journal entry. It returns all the fields in the journal as a set of (attrname, attrval) pairs. The "attrname" is the field name (a string). 🔤

The "attrval" is the field value (a binary blob — often but not always a string). And no cap: "attrval" is a byte array, not a \0-terminated C string. Do not come for me with C string assumptions. 💀

The length of data may be truncated to the data threshold (see: "journal-set-data-threshold", "journal-get-data-threshold").

If you set the data threshold to unlimited (0) then this call can read a journal entry of any size — ie. it's not limited by the libguestfs protocol. Big slay. 🎉

This command depends on the feature "journal". See also "feature-available".

journal-get-data-threshold

journal-get-data-threshold

Gets the current data threshold for reading journal entries. This is a hint to the journal that it may truncate data fields to this size when reading them (note also that it may not truncate them — it's a hint, not a promise, bestie). If this returns 0, then the threshold is unlimited. ♾️

See also "journal-set-data-threshold".

This command depends on the feature "journal". See also "feature-available".

journal-get-realtime-usec

journal-get-realtime-usec

Gets the realtime (wallclock) timestamp of the current journal entry. ⏰

This command depends on the feature "journal". See also "feature-available".

journal-next

journal-next

Moves to the next journal entry. You have to call this at least once after opening the handle before you're able to read data. Like, rules are rules. 🌈

The returned boolean tells you if there are any more journal records to read: "true" means you can read the next record (eg. using "journal-get"), and "false" means you've hit the end of the journal. 🏁

This command depends on the feature "journal". See also "feature-available".

journal-open

journal-open directory

Opens the systemd journal located in directory. Any previously opened journal handle gets closed. Out with the old, in with the new. 💅

You can read the contents of the journal using "journal-next" and "journal-get".

After you're done using the journal, you should close the handle by calling "journal-close". Clean up after yourself, queen. 🎀

This command depends on the feature "journal". See also "feature-available".

journal-set-data-threshold

journal-set-data-threshold threshold

Sets the data threshold for reading journal entries. Again, this is a hint to the journal that it may truncate data fields to this size when reading them (and again — it may not truncate them). If you set it to 0, then the threshold is unlimited. ✨

See also "journal-get-data-threshold".

This command depends on the feature "journal". See also "feature-available".

journal-skip

journal-skip skip

Skip forwards (skip ≥ 0) or backwards (skip < 0) in the journal. Direction era. 🔥

The number of entries actually skipped is returned (note rskip ≥ 0). If that's not the same as the absolute value of the skip parameter (|skip|) you passed in, then it means you've reached the end or the start of the journal. 🫡

💀 kill-subprocess 💀

kill-subprocess

Okay so this one "kills the hypervisor" 😭 and honestly? Do not call this. Like ever. The manpage literally says don't. Use shutdown instead, bestie, iykyk.

This function is deprecated. In new code, use the shutdown call instead.

Deprecated functions don't get yeeted from the API (they stay, sadly), but the deprecation flag is basically the devs going "there are problems with correct use of these functions" — so like, take the hint 🙈.

🚀 launch / run 🚀

launch

Call this after you've configured the handle (adding drives and all that) but before you do literally any actions. It's the "okay we're doing this" moment ✨.

Do not call launch twice on the same handle. It won't throw an error (for historical reasons 💀) but the precise behaviour when you do is not well defined. Handles are super cheap to create, so just make a fresh one for each launch. Periodt.

🫶 lchown 🫶

lchown owner group path

Changes the file owner to owner and the group to group. It's exactly like chown except when path is a symlink — then the link itself gets changed, not the target it points to 🎀.

Only numeric uid and gid are supported, no cap. If you want to use names you'll have to go hunt down and parse the password file yourself (Augeas support makes that relatively easy, so slay).

🪟 ldmtool-create-all 🪟

ldmtool-create-all

This one scans all the block devices looking for Windows dynamic disk volumes and partitions, and creates devices for anything it finds 👑

Call list-ldm-volumes and list-ldm-partitions to get all those devices back.

Pro tip: you don't normally need to call this explicitly, because it happens automatically at launch time. Iconic behaviour tbh.

This command depends on the feature ldm. See also feature-available.

🪟 ldmtool-diskgroup-disks 🪟

ldmtool-diskgroup-disks diskgroup

Returns the disks in a Windows dynamic disk group 💖. The diskgroup parameter should be the GUID of a disk group — like, one element from the list that ldmtool-scan hands you.

This command depends on the feature ldm. See also feature-available.

🪟 ldmtool-diskgroup-name 🪟

ldmtool-diskgroup-name diskgroup

Returns the name of a Windows dynamic disk group 🌸. Again, diskgroup should be the GUID of a disk group, one element from the list returned by ldmtool-scan.

This command depends on the feature ldm. See also feature-available.

🪟 ldmtool-diskgroup-volumes 🪟

ldmtool-diskgroup-volumes diskgroup

Returns the volumes in a Windows dynamic disk group ✨. And yes, diskgroup is the GUID of a disk group, one element from the list returned by ldmtool-scan. Same deal as the others.

This command depends on the feature ldm. See also feature-available.

🪟 ldmtool-remove-all 🪟

ldmtool-remove-all

Basically the opposite of ldmtool-create-all 😌. It removes the device mapper mappings for all Windows dynamic disk volumes.

This command depends on the feature ldm. See also feature-available.

🪟 ldmtool-scan 🪟

ldmtool-scan

Scans for Windows dynamic disks 🔍. It returns a list of identifiers (GUIDs) for every disk group it found, and you can pass those identifiers to the other ldmtool-* functions.

This one scans all block devices. If you only want to scan a subset, call ldmtool-scan-devices instead.

This command depends on the feature ldm. See also feature-available.

🪟 ldmtool-scan-devices 🪟

ldmtool-scan-devices 'devices ...'

Scans for Windows dynamic disks 🔍, returns a list of identifiers (GUIDs) for all the disk groups it found, and those identifiers can be passed to the other ldmtool-* functions.

The devices parameter is a list of block devices that get scanned. If that list is empty, then every block device gets scanned. Simple as that 💅.

This command depends on the feature ldm. See also feature-available.

🪟 ldmtool-volume-hint 🪟

ldmtool-volume-hint diskgroup volume

Returns the hint field of the volume named volume in the disk group with GUID diskgroup 👀. This might not be defined, and in that case you get the empty string back. The hint field is often (though not always) the name of a Windows drive, eg. E:.

This command depends on the feature ldm. See also feature-available.

🪟 ldmtool-volume-partitions 🪟

ldmtool-volume-partitions diskgroup volume

Returns the list of partitions in the volume named volume in the disk group with GUID diskgroup 🎀.

This command depends on the feature ldm. See also feature-available.

🪟 ldmtool-volume-type 🪟

ldmtool-volume-type diskgroup volume

Returns the type of the volume named volume in the disk group with GUID diskgroup ⭐.

Possible volume types that can come back here include: simple, spanned, striped, mirrored, raid5. Other types may also be returned, so don't @ me if you see something else.

This command depends on the feature ldm. See also feature-available.

🦋 lgetxattr 🦋

lgetxattr path name

Gets a single extended attribute from the file path named name 💜. And if path is a symlink, this call returns an extended attribute from the symlink itself.

Normally it's better to grab all the extended attributes from a file in one go by calling getxattrs. BUT — some Linux filesystem implementations are buggy 😭 and don't give you a way to list out attributes at all. For those filesystems (notably ntfs-3g) you have to know the names of the extended attributes you want in advance and call this function instead. Sad but true.

Extended attribute values are blobs of binary data, no cap. And if there's no extended attribute named name, this returns an error.

See also: lgetxattrs, getxattr, attr(5).

This command depends on the feature linuxxattrs. See also feature-available.

🦋 lgetxattrs 🦋

lgetxattrs path

Same as getxattrs, except if path is a symbolic link then it returns the extended attributes of the link itself 🫶.

This command depends on the feature linuxxattrs. See also feature-available.

💀 list-9p 💀

list-9p

Lowkey this call does nothing and returns an error 💀. That's the whole bit.

This function is deprecated. There is no replacement. Consult the API documentation in guestfs(3) for further information.

Deprecated functions don't get removed from the API, but the deprecation means there are problems with correct use of these functions. So like… don't.

👑 list-devices 👑

list-devices

Lists all the block devices 💅. You get the full block device names back, eg. /dev/sda.

🏷️ list-disk-labels 🏷️

list-disk-labels

If you added drives using the optional label parameter of add-drive-opts, you can use this call to map between disk labels and raw block device + partition names (like /dev/sda and /dev/sda1) 🎀.

It returns a hashtable where the keys are the disk labels (without the /dev/disk/guestfs prefix) and the values are the full raw block device and partition names (eg. /dev/sda and /dev/sda1). Match made in heaven tbh.

🌈 list-dm-devices 🌈

list-dm-devices

Lists all device mapper devices ✨.

The returned list contains /dev/mapper/* devices, eg. ones created by a previous call to luks-open.

Heads up: device mapper devices that correspond to logical volumes are not returned in this list. Call lvs if you want to list logical volumes instead 💜.

🔍 list-filesystems 🔍

list-filesystems

This inspection command looks for filesystems on partitions, block devices and logical volumes, returning a list of "mountables" containing filesystems and their type 👑

The return value is a hash where the keys are the devices containing filesystems and the values are the filesystem types. For example:

"/dev/sda1" => "ntfs"
"/dev/sda2" => "ext2"
"/dev/vg_guest/lv_root" => "ext4"
"/dev/vg_guest/lv_swap" => "swap"

The key isn't necessarily a block device — it may also be an opaque 'mountable' string which you can pass to mount.

The value can have the special value unknown, meaning the content of the device is undetermined or empty. swap means a Linux swap partition.

Important lore 🫶: in libguestfs ≤ 1.36 this command ran other libguestfs commands, which might have included mount and umount, and therefore you had to use this soon after launch and only when nothing else was mounted. That restriction is removed in libguestfs ≥ 1.38. Slay.

Not all of the filesystems returned will be mountable. In particular, swap partitions are returned in the list 🙈. Also this command does not check that each filesystem found is valid and mountable, and some filesystems might be mountable but require special options. Filesystems may not all belong to a single logical operating system — use inspect-os to look for OSes.

🪟 list-ldm-partitions 🪟

list-ldm-partitions

Returns all Windows dynamic disk partitions that were found at launch time 💖. It gives you a list of device names.

This command depends on the feature ldm. See also feature-available.

🪟 list-ldm-volumes 🪟

list-ldm-volumes

Returns all Windows dynamic disk volumes that were found at launch time ✨. It gives you a list of device names.

This command depends on the feature ldm. See also feature-available.

🧚 list-md-devices 🧚

list-md-devices

Lists all Linux md devices. That's it, that's the command 💅.

🎀 list-partitions 🎀

list-partitions

Lists all the partitions detected on all block devices 🌸.

The full partition device names are returned, eg. /dev/sda1.

Heads up: this does not return logical volumes. For those you'll need to call lvs.

💅 ll 💅

ll directory

Lists the files in directory (relative to the root directory — there is no cwd, bestie) in the format of ls -la 👑

This command is mostly useful for interactive sessions. It is not intended that you try to parse the output string. Like, don't.

💅 llz 💅

llz directory

Lists the files in directory in the format of ls -laZ ✨.

This command is mostly useful for interactive sessions. It is not intended that you try to parse the output string, fr fr.

This function is deprecated. In new code, use the lgetxattrs call instead.

Deprecated functions won't be removed from the API, but the deprecation indicates there are problems with correct use of these functions 🙈.

🔗 ln 🔗

ln target linkname

Creates a hard link. Short, sweet, iconic 🎀.

🔗 ln-f 🔗

ln-f target linkname

Creates a hard link, and removes the link linkname first if it already exists 💅.

🔗 ln-s 🔗

ln-s target linkname

Creates a symbolic link using the ln -s command ✨.

🔗 ln-sf 🔗

ln-sf target linkname

Creates a symbolic link using the ln -sf command 🌸. The -f option removes the link (linkname) if it exists already.

🦋 lremovexattr 🦋

lremovexattr xattr path

Same as removexattr, but if path is a symbolic link then it removes an extended attribute of the link itself 💜.

This command depends on the feature linuxxattrs. See also feature-available.

🗂️ `ls`

ls directory

Lists the files in directory (relative to the root directory — there is no cwd, bestie, none at all). The "." and ".." entries are not returned, but hidden files are shown. 👀

`ls0`

ls0 dir (filenames|-)

This one's a specialized little icon 💅 — it gets you a listing of the filenames in the directory "dir", and writes that list of filenames to the local file filenames (on the host, not in the guest).

In the output file, the filenames are separated by "\0" characters. No cap.

"." and ".." are not returned. The filenames are not sorted. 🙈

Use "-" instead of a filename to read/write from stdin/stdout.

`lsetxattr`

lsetxattr xattr val vallen path

Same as setxattr, but if "path" is a symbolic link, then it sets an extended attribute of the link itself. Sneaky link behavior, we love to see it 🦋

This command depends on the feature "linuxxattrs". See also "feature-available".

`lstat`

lstat path

Returns file information for the given "path".

This is the same as stat except that if "path" is a symbolic link, then the link is stat-ed, not the file it refers to.

This is the same as the lstat(2) system call.

⚠️ This function is deprecated. In new code, use the "lstatns" call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. 💀

`lstatlist`

lstatlist path 'names ...'

This call lets you do the lstat operation on multiple files at once, where all the files are in the directory "path". "names" is the list of files from that directory. Batch it, slay ✨

On return you get a list of stat structs, with a one-to-one correspondence to the "names" list. If any name did not exist or could not be lstat'd, then the "st_ino" field of that structure is set to -1. Marked, not broken 😭

This call is intended for programs that want to efficiently list a directory's contents without making many round-trips. See also "lxattrlist" for a similarly efficient call for getting extended attributes.

⚠️ This function is deprecated. In new code, use the "lstatnslist" call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

`lstatns`

lstatns path

Returns file information for the given "path".

This is the same as statns except that if "path" is a symbolic link, then the link is stat-ed, not the file it refers to.

This is the same as the lstat(2) system call. The non-deprecated icon 👑

`lstatnslist`

lstatnslist path 'names ...'

This call lets you perform the lstatns operation on multiple files, where all files are in the directory "path". "names" is the list of files from this directory.

🔐 `luks-add-key`

luks-add-key device keyslot

This command adds a new key on the LUKS device "device". "key" is any existing key, and is used to access the device. "newkey" is the new key to add. "keyslot" is the key slot that will be replaced.

🚨 Note that if "keyslot" already contains a key, then this command will fail. You have to use "luks-kill-slot" first to remove that key. No shortcuts, bestie.

This command has one or more key or passphrase parameters. Guestfish will prompt for these separately. 🔑

This command depends on the feature "luks". See also "feature-available".

`luks-close`

luks-close device

This closes a LUKS device that was created earlier by "luks-open" or "luks-open-ro". The "device" parameter must be the name of the LUKS mapping device (ie. /dev/mapper/mapname) and not the name of the underlying block device. Read the label, girl 🙈

⚠️ This function is deprecated. In new code, use the "cryptsetup-close" call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

This command depends on the feature "luks". See also "feature-available".

`luks-format`

luks-format device keyslot

This command erases existing data on "device" 😱 and formats the device as a LUKS encrypted device. "key" is the initial key, which is added to key slot "keyslot". (LUKS supports 8 key slots, numbered 0-7 — yes, literally 0 through 7.)

This command has one or more key or passphrase parameters. Guestfish will prompt for these separately.

This command depends on the feature "luks". See also "feature-available".

`luks-format-cipher`

luks-format-cipher device keyslot cipher

This command is the same as "luks-format" but it also allows you to set the "cipher" used. Fancy 💅

This command has one or more key or passphrase parameters. Guestfish will prompt for these separately.

This command depends on the feature "luks". See also "feature-available".

`luks-kill-slot`

luks-kill-slot device keyslot

This command deletes the key in key slot "keyslot" from the encrypted LUKS device "device". "key" must be one of the other keys. Bye bye key 👋

This command has one or more key or passphrase parameters. Guestfish will prompt for these separately.

This command depends on the feature "luks". See also "feature-available".

`luks-open`

luks-open device mapname

This command opens a block device which has been encrypted according to the Linux Unified Key Setup (LUKS) standard. 🔓

"device" is the encrypted block device or partition.

The caller must supply one of the keys associated with the LUKS block device, in the "key" parameter.

This creates a new block device called /dev/mapper/mapname. Reads and writes to this block device are decrypted from and encrypted to the underlying "device" respectively. It's giving magic door ✨

If this block device contains LVM volume groups, then calling "lvm-scan" with the "activate" parameter "true" will make them visible.

Use "list-dm-devices" to list all device mapper devices.

This command has one or more key or passphrase parameters. Guestfish will prompt for these separately.

⚠️ This function is deprecated. In new code, use the "cryptsetup-open" call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

This command depends on the feature "luks". See also "feature-available".

`luks-open-ro`

luks-open-ro device mapname

This is the same as "luks-open" except that a read-only mapping is created. Look, don't touch 🫶

This command has one or more key or passphrase parameters. Guestfish will prompt for these separately.

⚠️ This function is deprecated. In new code, use the "cryptsetup-open" call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

This command depends on the feature "luks". See also "feature-available".

`luks-uuid`

luks-uuid device

This returns the UUID of the LUKS device "device". Its literal government name 🎀

This command depends on the feature "luks". See also "feature-available".

📦 `lvcreate`

lvcreate logvol volgroup mbytes

This creates an LVM logical volume called "logvol" on the volume group "volgroup", with "size" megabytes.

This command depends on the feature "lvm2". See also "feature-available".

`lvcreate-free`

lvcreate-free logvol volgroup percent

Create an LVM logical volume called /dev/volgroup/logvol, using approximately "percent" % of the free space remaining in the volume group. Most usefully, when "percent" is 100 this will create the largest possible LV. Maximalist queen 👑

This command depends on the feature "lvm2". See also "feature-available".

`lvm-canonical-lv-name`

lvm-canonical-lv-name lvname

This converts alternative naming schemes for LVs that you might find to the canonical name. For example, /dev/mapper/VG-LV is converted to /dev/VG/LV. Glow-up complete ✨

This command returns an error if the "lvname" parameter does not refer to a logical volume. In this case errno will be set to "EINVAL".

See also "is-lv", "canonical-device-name".

`lvm-clear-filter`

lvm-clear-filter

This undoes the effect of "lvm-set-filter". LVM will be able to see every block device. Full access, no filter 💅

This command also clears the LVM cache and performs a volume group scan.

`lvm-remove-all`

lvm-remove-all

This command removes all LVM logical volumes, volume groups and physical volumes. Everything. Gone. Ngl that's a lot 😭

This command depends on the feature "lvm2". See also "feature-available".

`lvm-scan`

lvm-scan true|false

This scans all block devices and rebuilds the list of LVM physical volumes, volume groups and logical volumes.

If the "activate" parameter is "true" then newly found volume groups and logical volumes are activated, meaning the LV /dev/VG/LV devices become visible. 👀

When a libguestfs handle is launched it scans for existing devices, so you do not normally need to use this API. However it is useful when you have added a new device or deleted an existing device (such as when the "luks-open" API is used).

`lvm-set-filter`

lvm-set-filter 'devices ...'

This sets the LVM device filter so that LVM will only be able to "see" the block devices in the list "devices", and will ignore all other attached block devices.

Where disk image(s) contain duplicate PVs or VGs, this command is useful to get LVM to ignore the duplicates, otherwise LVM can get confused. Note also there are two types of duplication possible: either cloned PVs/VGs which have identical UUIDs; or VGs that are not cloned but just happen to have the same name. In normal operation you cannot create this situation, but you can do it outside LVM, eg. by cloning disk images or by bit twiddling inside the LVM metadata. Chaos behavior 🌀

This command also clears the LVM cache and performs a volume group scan.

You can filter whole block devices or individual partitions.

🚨 You cannot use this if any VG is currently in use (eg. contains a mounted filesystem), even if you are not filtering out that VG.

This command depends on the feature "lvm2". See also "feature-available".

`lvremove`

lvremove device

Remove an LVM logical volume "device", where "device" is the path to the LV, such as /dev/VG/LV.

You can also remove all LVs in a volume group by specifying the VG name, /dev/VG. Wholesale deletion, iconic 🗑️

This command depends on the feature "lvm2". See also "feature-available".

`lvrename`

lvrename logvol newlogvol

Rename a logical volume "logvol" with the new name "newlogvol". New name, who dis 🦋

`lvresize`

lvresize device mbytes

so like — this one resizes (expands or shrinks) an existing LVM logical volume to mbytes. 💅

⚠️ reducing it means the data in the reduced part is lost. not "moved somewhere safe", not "recoverable later" — gone. 😭

this command depends on the feature "lvm2". see also "feature-available".

`lvresize-free`

lvresize-free lv percent

okay so this expands an existing logical volume lv so it fills pc% of the remaining free space in the volume group ✨. the classic move is calling it with pc = 100, which expands the logical volume as much as it possibly can, eating up all the remaining free space in the volume group. slay, no wasted bytes 💖.

this command depends on the feature "lvm2". see also "feature-available".

`lvs`

lvs

list all the logical volumes detected 👑. this is the equivalent of the lvs(8) command.

it returns a list of the logical volume device names (eg. /dev/VolGroup00/LogVol00).

see also "lvs-full", "list-filesystems".

this command depends on the feature "lvm2". see also "feature-available".

`lvs-full`

lvs-full

list all the logical volumes detected — same energy as lvs(8), except the "full" version includes all the fields 🫶 (so yes, more columns, more lore).

this command depends on the feature "lvm2". see also "feature-available".

`lvuuid`

lvuuid device

this command returns the UUID of the LVM LV device. that's it. that's the whole vibe 💜.

`lxattrlist`

lxattrlist path 'names ...'

this call lets you get the extended attributes of multiple files, where all the files live in the directory path. names is the list of files from that directory 📁.

on return you get a flat list of xattr structs which must be interpreted sequentially — iykyk, read them in order, don't get cute with it. the first xattr struct always has a zero-length "attrname". "attrval" in this struct is zero-length to indicate there was an error doing "lgetxattr" for this file, or is a C string which is a decimal number (the number of following attributes for this file, which could be "0"). then after that first xattr struct come the zero-or-more attributes for the first named file. this repeats for the second and subsequent files 🔁.

this call is intended for programs that want to efficiently list a directory contents without making a million round-trips. see also "lstatlist" for a similarly efficient call for getting standard stats ✨.

this command depends on the feature "linuxxattrs". see also "feature-available".

`max-disks`

max-disks

return the maximum number of disks that may be added to a handle (eg. by "add-drive-opts" and similar calls) 💾.

this function was added in libguestfs 1.19.7. in previous versions of libguestfs the limit was 25.

see "MAXIMUM NUMBER OF DISKS" in guestfs(3) for additional information on this topic.

`md-create`

md-create name 'devices ...' [missingbitmap:N] [nrdevices:N] [spare:N] [chunk:N] [level:..]

create a Linux md (RAID) device named name on the devices in the list devices 🔥.

the optional parameters are:

"missingbitmap" — a bitmap of missing devices. if a bit is set it means that a missing device is added to the array. the least significant bit corresponds to the first device in the array.

as examples:

if devices = ["/dev/sda"] and missingbitmap = 0x1 then the resulting array would be [<missing>, "/dev/sda"].

if devices = ["/dev/sda"] and missingbitmap = 0x2 then the resulting array would be ["/dev/sda", <missing>].

this defaults to 0 (no missing devices).

the length of devices + the number of bits set in missingbitmap must equal nrdevices + spare.

"nrdevices" — the number of active RAID devices.

if not set, this defaults to the length of devices plus the number of bits set in missingbitmap.

"spare" — the number of spare devices.

if not set, this defaults to 0.

"chunk" — the chunk size in bytes.

the chunk parameter does not make sense, and should not be specified, when level is raid1 (which is the default; see below). 🙈

"level" — the RAID level, which can be one of: linear, raid0, 0, stripe, raid1, 1, mirror, raid4, 4, raid5, 5, raid6, 6, raid10, 10. some of these are synonymous, and more levels may be added in future.

if not set, this defaults to raid1.

this command has one or more optional arguments. see "OPTIONAL ARGUMENTS".

this command depends on the feature "mdadm". see also "feature-available".

`md-detail`

md-detail md

this command exposes the output of mdadm -DY <md> ✨. the following fields are usually present in the returned hash. other fields may also be present.

"level" — the raid level of the MD device.
"devices" — the number of underlying devices in the MD device.
"metadata" — the metadata version used.
"uuid" — the UUID of the MD device.
"name" — the name of the MD device.

this command depends on the feature "mdadm". see also "feature-available".

`md-stat`

md-stat md

this call returns a list of the underlying devices which make up the single software RAID array device md 🧚.

to get a list of software RAID devices, call "list-md-devices".

each structure returned corresponds to one device along with additional status information:

"mdstat_device" — the name of the underlying device.
"mdstat_index" — the index of this device within the array.
"mdstat_flags" — flags associated with this device. this is a string containing (in no specific order) zero or more of the following flags:
- "W" write-mostly
- "F" device is faulty
- "S" device is a RAID spare
- "R" replacement

this command depends on the feature "mdadm". see also "feature-available".

`md-stop`

md-stop md

this command deactivates the MD array named md. the device is stopped, but it is not destroyed or zeroed 💀 — so like, it's asleep, not deleted. important distinction, bestie.

this command depends on the feature "mdadm". see also "feature-available".

`mkdir`

mkdir path

create a directory named path. short, sweet, iconic 🎀.

`mkdir-mode`

mkdir-mode path mode

this command creates a directory, setting the initial permissions of the directory to mode 🔐.

for common Linux filesystems, the actual mode which is set will be mode & ~umask & 01777. non-native-Linux filesystems may interpret the mode in other ways.

`mkdir-p`

mkdir-p path

create a directory named path, creating any parent directories as necessary — literally like the mkdir -p shell command 🌸. no need to build the whole tree yourself, it's got you.

`mkdtemp`

mkdtemp tmpl

this command creates a temporary directory ⭐. the tmpl parameter should be a full pathname for the temporary directory name with the final six characters being XXXXXX.

for example: /tmp/myprogXXXXXX or /Temp/myprogXXXXXX, the second one being suitable for Windows filesystems 🪟.

the name of the temporary directory that was created is returned.

the temporary directory is created with mode 0700 and is owned by root.

the caller is responsible for deleting the temporary directory and its contents after use — yes, you, bestie. it's your mess 🫶.

`mke2fs`

mke2fs device [blockscount:N] [blocksize:N] [fragsize:N] [blockspergroup:N] [numberofgroups:N] [bytesperinode:N] [inodesize:N] [journalsize:N] [numberofinodes:N] [stridesize:N] [stripewidth:N] [maxonlineresize:N] [reservedblockspercentage:N] [mmpupdateinterval:N] [journaldevice:..] [label:..] [lastmounteddir:..] [creatoros:..] [fstype:..] [usagetype:..] [uuid:..] [forcecreate:true|false] [writesbandgrouponly:true|false] [lazyitableinit:true|false] [lazyjournalinit:true|false] [testfs:true|false] [discard:true|false] [quotatype:true|false] [extent:true|false] [filetype:true|false] [flexbg:true|false] [hasjournal:true|false] [journaldev:true|false] [largefile:true|false] [quota:true|false] [resizeinode:true|false] [sparsesuper:true|false] [uninitbg:true|false]

mke2fs is used to create an ext2, ext3, or ext4 filesystem on device 💾✨.

the optional blockscount is the size of the filesystem in blocks. if omitted it defaults to the size of device. ⚠️ note: if the filesystem is too small to contain a journal, mke2fs will silently create an ext2 filesystem instead — sneaky little plot twist, no warning, just vibes.

this command has one or more optional arguments. see "OPTIONAL ARGUMENTS".

`mke2fs-J`

mke2fs-J fstype blocksize device journal

this creates an ext2/3/4 filesystem on device with an external journal on journal. it is equivalent to the command:

mke2fs -t fstype -b blocksize -J device=<journal> <device>

`mke2fs-JL`

mke2fs-JL fstype blocksize device label

this creates an ext2/3/4 filesystem on device with an external journal on the journal labeled label 🏷️.

`mke2fs-JU`

mke2fs-JU fstype blocksize device uuid

this creates an ext2/3/4 filesystem on device with an external journal on the journal with UUID uuid 🆔.

`mke2journal`

mke2journal blocksize device

this creates an ext2 external journal on device. it is equivalent to the command:

mke2fs -O journal_dev -b blocksize device

🚨 this function is deprecated. in new code, use the "mke2fs" call instead.

deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

`mke2journal-L`

mke2journal-L blocksize label device

this creates an ext2 external journal on device with label label 🏷️💜.

🚨 this function is deprecated. in new code, use the "mke2fs" call instead.

deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

`mke2journal-U`

mke2journal-U blocksize uuid device

this creates an ext2 external journal on device with UUID uuid 🆔✨.

🚨 this function is deprecated. in new code, use the "mke2fs" call instead.

Deprecated functions are never, ever getting yeeted from the API, bestie — but the whole "deprecated" tag is basically a vibe check saying there are problems with using these correctly, so like… heads up. 🙈

This command depends on the feature "linuxfsuuid". See also "feature-available".

`mkfifo` 🎀

mkfifo mode path

Creates a FIFO (aka a named pipe, iconic behaviour) called path with mode mode. It's literally just a convenient little wrapper around "mknod". 💅

But unlike with "mknod", the mode has to contain only permissions bits, okay? No sneaky extra constants.

The mode that actually gets set is affected by the umask, because of course it is. 🫠

This command depends on the feature "mknod". See also "feature-available".

`mkfs` / `mkfs-opts` ⭐

mkfs fstype device [blocksize:N] [features:..] [inode:N] [sectorsize:N] [label:..]

This one creates a filesystem on device, and the filesystem type is fstype — like ext3, iykyk.

The optional arguments are:

blocksize — the filesystem block size. What sizes you can actually use depends on the filesystem type, but typically they're 1024, 2048 or 4096 for Linux ext2/3 filesystems. For VFAT and NTFS the blocksize parameter gets treated as the requested cluster size. And for UFS block sizes, go read mkfs.ufs(8) 💖
features — this passes the -O parameter to the external mkfs program. For certain filesystem types this lets you select extra filesystem features. See mke2fs(8) and mkfs.ufs(8) for the full tea. You cannot use this optional parameter with the "gfs" or "gfs2" filesystem type, no cap.
inode — this passes the -I parameter to the external mke2fs(8) program, which sets the inode size (only for ext2/3/4 filesystems at present).
sectorsize — this passes the -S parameter to the external mkfs.ufs(8) program, which sets the sector size for the ufs filesystem.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS". 🌈

`mkfs-b` 🦋

mkfs-b fstype blocksize device

Basically "mkfs"'s cousin — similar call, except this one lets you control the block size of the resulting filesystem. Supported block sizes depend on the filesystem type, but typically they're 1024, 2048 or 4096 only.

For VFAT and NTFS the blocksize parameter gets treated as the requested cluster size, same as before. 💅

This function is deprecated. In new code, use the "mkfs" call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. 😭

`mkfs-btrfs` 🔥

mkfs-btrfs 'devices ...' [allocstart:N] [bytecount:N] [datatype:..] [leafsize:N] [label:..] [metadata:..] [nodesize:N] [sectorsize:N]

Create a btrfs filesystem, with all the configurables available to set. For more info on the optional arguments, see mkfs.btrfs(8).

Since btrfs filesystems can span multiple devices, this one takes a non-empty list of devices — like, it needs at least one, bestie. 🫶

To create general filesystems, use "mkfs" instead.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

This command depends on the feature "btrfs". See also "feature-available".

`mklost-and-found` 🍓

mklost-and-found mountpoint

Makes the lost+found directory — you know, the one that's normally chillin' in the root directory of an ext2/3/4 filesystem. mountpoint is the directory under which we try to create that lost+found directory. ✨

`mkmountpoint` 🧚

mkmountpoint exemptpath

Okay so "mkmountpoint" and "rmmountpoint" are these specialized calls that let you create extra mountpoints before you mount the first filesystem. Very niche, very main character.

These calls are only necessary in some very limited circumstances — mainly the case where you wanna mount a mix of unrelated and/or read-only filesystems together.

For example, live CDs often contain a "Russian doll" nest of filesystems: an ISO outer layer, with a squashfs image inside, with an ext2/3 image inside that. 🪆 You can unpack all that in guestfish like this:

add-ro Fedora-11-i686-Live.iso
run
mkmountpoint /cd
mkmountpoint /sqsh
mkmountpoint /ext3fs
mount /dev/sda /cd
mount-loop /cd/LiveOS/squashfs.img /sqsh
mount-loop /sqsh/LiveOS/ext3fs.img /ext3fs

The inner filesystem is now unpacked under the /ext3fs mountpoint. Slay. 💅

Heads up: "mkmountpoint" is not compatible with "umount-all". You may get unexpected errors if you try to mix these calls. It's safest to manually unmount filesystems and remove mountpoints after use.

"umount-all" unmounts filesystems by sorting the paths longest first, so for this to work with manual mountpoints, you gotta make sure the innermost mountpoints have the longest pathnames — exactly like in the example code up there. 👑

For more details see https://bugzilla.redhat.com/show_bug.cgi?id=599503

Autosync [see "set-autosync", this is set by default on handles] can cause "umount-all" to be called when the handle is closed, which can also trigger these issues. 😭

`mknod` 🌸

mknod mode devmajor devminor path

This call creates block or character special devices, or named pipes (FIFOs). Truly the multitasker of the group chat. 🎀

The mode parameter should be the mode, using the standard constants. devmajor and devminor are the device major and minor numbers — only used when creating block and character special devices.

Note: just like mknod(2), the mode must be bitwise OR'd with S_IFBLK, S_IFCHR, S_IFIFO or S_IFSOCK — otherwise this call just creates a regular file, which is not the vibe. 😬 These constants are available in the standard Linux header files, or you can use "mknod-b", "mknod-c" or "mkfifo", which are wrappers around this command that bitwise OR in the appropriate constant for you.

The mode actually set is affected by the umask.

This command depends on the feature "mknod". See also "feature-available".

`mknod-b` 💜

mknod-b mode devmajor devminor path

Creates a block device node called path with mode mode and device major/minor devmajor and devminor. Just a convenient wrapper around "mknod". 🫶

Unlike with "mknod", mode must contain only permissions bits.

The mode actually set is affected by the umask.

This command depends on the feature "mknod". See also "feature-available".

`mknod-c` 🦋

mknod-c mode devmajor devminor path

Creates a char device node called path with mode mode and device major/minor devmajor and devminor. Again, just a convenient wrapper around "mknod". ✨

Unlike with "mknod", mode must contain only permissions bits.

The mode actually set is affected by the umask.

This command depends on the feature "mknod". See also "feature-available".

`mksquashfs` 🌈

mksquashfs path (filename|-) [compress:..] [excludes:..]

Create a squashfs filesystem for the specified path.

The optional compress flag controls compression. If it's not given, then the output is compressed using "gzip". Otherwise one of these strings may be given to select the compression type of the squashfs: "gzip", "lzma", "lzo", "lz4", "xz". 🎀

The other optional arguments are:

excludes — a list of wildcards. Files are excluded if they match any of the wildcards. 💅

Please note: this API may fail when used to compress directories with large files — like, the resulting squashfs will be over 3GB big. 😭

Use - instead of a filename to read/write from stdin/stdout.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

This command depends on the feature "squashfs". See also "feature-available".

`mkswap` / `mkswap-opts` ⭐

mkswap device [label:..] [uuid:..]

Create a Linux swap partition on device. 🫶

The option arguments label and uuid let you set the label and/or UUID of the new swap partition.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

`mkswap-L` 🌸

mkswap-L label device

Create a swap partition on device with label label.

Note: you cannot attach a swap label to a block device (eg. /dev/sda), just to a partition. This appears to be a limitation of the kernel or swap tools — not us, we swear. 😤

This function is deprecated. In new code, use the "mkswap" call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. 💀

`mkswap-U` 💜

mkswap-U uuid device

Create a swap partition on device with UUID uuid. 🎀

This function is deprecated. In new code, use the "mkswap" call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

This command depends on the feature "linuxfsuuid". See also "feature-available".

`mkswap-file` 🍓

mkswap-file path

Create a swap file. ✨

This command just writes a swap file signature to an existing file — that's all it does, bestie. To create the file itself, use something like "fallocate".

`mktemp` 🧚

mktemp tmpl [suffix:..]

This command creates a temporary file. The tmpl parameter should be a full pathname for the temporary directory name, with the final six characters being XXXXXX. 👑

For example: /tmp/myprogXXXXXX or /Temp/myprogXXXXXX — the second one being suitable for Windows filesystems, iykyk. 🪟

The name of the temporary file that was created is returned.

The temporary file is created with mode 0600 and is owned by root.

The caller is responsible for deleting the temporary file after use. Yes, that's you. Don't leave it lying around. 🫠

If the optional suffix parameter is given, then the suffix (eg. .txt) is appended to the temporary name. 🎀

`modprobe` 🔥

modprobe modulename

This loads a kernel module in the appliance. Load it up, it's giving main character energy. 💅

This command depends on the feature "linuxmodules". See also "feature-available".

`mount` 👑

mount mountable mountpoint

Mount a guest disk at a position in the filesystem. Block devices are named /dev/sda, /dev/sdb and so on, as they were added to the guest. If those block devices contain partitions, they'll have the usual names (eg. /dev/sda1). Also LVM /dev/VG/LV-style names can be used, or ‘mountable’ strings returned by "list-filesystems" or "inspect-get-mountpoints". So many options, so little time. 🌈

The rules are the same as for mount(2): a filesystem must first be mounted on / before others can be mounted. Other filesystems can only be mounted on directories which already exist. No inventing directories out of thin air, bestie. 😤

The mounted filesystem is writable, if we have sufficient permissions on the underlying device.

History tea: before libguestfs 1.13.16, this call implicitly added the options "sync" and "noatime". The "sync" option greatly slowed writes and caused many problems for users. 😭 If your program might need to work with older versions of libguestfs, use "mount-options" instead (using an empty string for the first parameter if you don't want any options).

`mount-9p` 🦋

mount-9p mounttag mountpoint [options:..]

This call does literally nothing and just hands you back an error. That's the whole vibe. 🫠

Bestie, this command has one or more optional arguments — go peek at "OPTIONAL ARGUMENTS" if you need the tea.

This function is deprecated. There is no replacement. Like, none. Consult the API documentation in guestfs(3) for further info, iykyk.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. So like... they're staying, but they're problematic. 💀

🧚 mount-local

mount-local localmountpoint [readonly:true|false] [options:..] [cachetimeout:N] [debugcalls:true|false]

Okay so this call exports the libguestfs-accessible filesystem to a local mountpoint (that's a directory, bestie) called localmountpoint. Ordinary reads and writes to files and directories under localmountpoint get redirected through libguestfs. It's giving portal energy. ✨

If the optional readonly flag is set to true, then writes to the filesystem return error EROFS. No take-backsies.

options is a comma-separated list of mount options. See guestmount(1) for some useful ones.

cachetimeout sets the timeout (in seconds) for cached directory entries. The default is 60 seconds. See guestmount(1) for further information.

If debugcalls is set to true, then additional debugging information is generated for every FUSE call. Full detective mode. 🔍

When mount-local returns, the filesystem is ready, but is not processing requests (access to it will block). You have to call mount-local-run to run the main loop. Don't forget, or you'll be standing there like 🧍‍♀️ wondering why nothing happens.

See "MOUNT LOCAL" in guestfs(3) for full documentation.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

🌀 mount-local-run

mount-local-run

Run the main loop which translates kernel calls to libguestfs calls. It's the translator bestie of the group. 🫶

This should only be called after mount-local returns successfully. The call will not return until the filesystem is unmounted.

Note you must not make concurrent libguestfs calls on the same handle from another thread. Fr fr, don't do it.

You may call this from a different thread than the one which called mount-local, subject to the usual rules for threads and libguestfs (see "MULTIPLE HANDLES AND MULTIPLE THREADS" in guestfs(3)).

See "MOUNT LOCAL" in guestfs(3) for full documentation.

💿 mount-loop

mount-loop file mountpoint

This command lets you mount file (a filesystem image in a file) on a mount point. It is entirely equivalent to the command mount -o loop file mountpoint. Same energy, different font. 💅

🎀 mount-options

mount-options options mountable mountpoint

This is the same as the mount command, but it allows you to set the mount options as for the mount(8) -o flag.

If the options parameter is an empty string, then no options are passed (all options default to whatever the filesystem uses). Empty string supremacy. 🫙

❄️ mount-ro

mount-ro mountable mountpoint

This is the same as the mount command, but it mounts the filesystem with the read-only (-o ro) flag. Look but don't touch, bestie. 👀

🌈 mount-vfs

mount-vfs options vfstype mountable mountpoint

This is the same as the mount command, but it allows you to set both the mount options and the vfstype as for the mount(8) -o and -t flags. Two flags, one command, main character energy. 👑

🔎 mountable-device

mountable-device mountable

Returns the device name of a mountable. In quite a lot of cases, the mountable is the device name.

However this doesn't apply for btrfs subvolumes, where the mountable is a combination of both the device name and the subvolume path (see also mountable-subvolume to extract the subvolume path of the mountable if any). Btrfs really said "why have one thing when two things" 😭

🦋 mountable-subvolume

mountable-subvolume mountable

Returns the subvolume path of a mountable. Btrfs subvolumes mountables are a combination of both the device name and the subvolume path (see also mountable-device to extract the device of the mountable).

If the mountable does not represent a btrfs subvolume, then this function fails and the errno is set to EINVAL. Not a btrfs girlie? Then no subvolume for you. 🙈

🍓 mountpoints

mountpoints

This call is similar to mounts. That call returns a list of devices. This one returns a hash table (map) of device name to directory where the device is mounted. Glow-up from list to map, honestly. ✨

🧾 mounts

mounts

This returns the list of currently mounted filesystems. It returns the list of devices (eg. /dev/sda1, /dev/VG/LV).

Some internal mounts are not shown. They're shy. 🫣

🚚 mv

mv src dest

This moves a file from src to dest where dest is either a destination filename or destination directory.

🔢 nr-devices

nr-devices

This returns the number of whole block devices that were added. This is the same as the number of devices that would be returned if you called list-devices.

To find out the maximum number of devices that could be added, call max-disks. Max vs. actual, the classic duo. 💜

🪟 ntfs-3g-probe

ntfs-3g-probe true|false device

This command runs the ntfs-3g.probe(8) command which probes an NTFS device for mountability. (Not all NTFS volumes can be mounted read-write, and some cannot be mounted at all — rude but true.)

rw is a boolean flag. Set it to true if you want to test if the volume can be mounted read-write. Set it to false if you want to test if the volume can be mounted read-only.

The return value is an integer which 0 if the operation would succeed, or some non-zero value documented in the ntfs-3g.probe(8) manual page.

This command depends on the feature "ntfs3g". See also feature-available.

🔐 ntfs-chmod

ntfs-chmod device mode path [recursive:true|false]

Change file permissions on an NTFS filesystem with a chmod-style permission mask, using ntfssecaudit(8). Only numeric modes are supported. No symbolic mode bullies allowed. 🚫

Note: When using this command from guestfish, mode by default would be decimal, unless you prefix it with 0 to get octal, ie. use 0700 not 700. This is the trap, bestie, do not fall into it. 😭

The device parameter is the NTFS partition device (eg. /dev/sda5). This must be unmounted. The mode parameter is the permission mode (eg. 0744). The path parameter is the file or directory path within the filesystem. If the optional recursive flag is set, directory permissions are set recursively. Go deep. 🌊

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

This command depends on the feature "ntfs3g". See also feature-available.

📥 ntfscat-i

ntfscat-i device inode (filename|-)

Download a file given its inode from a NTFS filesystem and save it as filename on the local machine.

This allows to download some otherwise inaccessible files such as the ones within the $Extend folder. Sneaky little files that they are. 🕵️‍♀️

The filesystem from which to extract the file must be unmounted, otherwise the call will fail.

Use - instead of a filename to read/write from stdin/stdout.

📦 ntfsclone-in

ntfsclone-in (backupfile|-) device

Restore the backupfile (from a previous call to ntfsclone-out) to device, overwriting any existing contents of this device. Yes, overwriting, so be sure, bestie. 💀

Use - instead of a filename to read/write from stdin/stdout.

This command depends on the feature "ntfs3g". See also feature-available.

📤 ntfsclone-out

ntfsclone-out device (backupfile|-) [metadataonly:true|false] [rescue:true|false] [ignorefscheck:true|false] [preservetimestamps:true|false] [force:true|false]

Stream the NTFS filesystem device to the local file backupfile. The format used for the backup file is a special format used by the ntfsclone(8) tool. Special format, special girl. 🎀

If the optional metadataonly flag is true, then only the metadata is saved, losing all the user data (this is useful for diagnosing some filesystem problems). Your data said "and I oop" and vanished.

The optional rescue, ignorefscheck, preservetimestamps and force flags have precise meanings detailed in the ntfsclone(8) man page. Read it, fr fr.

Use ntfsclone-in to restore the file back to a libguestfs device. Round trip! ✈️

Use - instead of a filename to read/write from stdin/stdout.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

This command depends on the feature "ntfs3g". See also feature-available.

🔧 ntfsfix

ntfsfix device [clearbadsectors:true|false]

This command repairs some fundamental NTFS inconsistencies, resets the NTFS journal file, and schedules an NTFS consistency check for the first boot into Windows.

This is not an equivalent of Windows chkdsk. It does not scan the filesystem for inconsistencies. Different tool, different job, don't get it twisted. 😤

The optional clearbadsectors flag clears the list of bad sectors. This is useful after cloning a disk with bad sectors to a new disk. Fresh start energy. ✨

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

This command depends on the feature "ntfs3g". See also feature-available.

📐 ntfsresize

📐 ntfsresize-opts

ntfsresize device [size:N] [force:true|false]

This command resizes an NTFS filesystem, expanding or shrinking it to the size of the underlying device. Glow-up or glow-down, dealer's choice. 💅

The optional parameters are:

size — The new size (in bytes) of the filesystem. If omitted, the filesystem is resized to fit the container (eg. partition).
force — If this option is true, then force the resize of the filesystem even if the filesystem is marked as requiring a consistency check.

After the resize operation, the filesystem is always marked as requiring a consistency check (for safety). You have to boot into Windows to perform this check and clear this condition. If you don't set the force option then it is not possible to call ntfsresize multiple times on a single filesystem without booting into Windows between each resize. So like... book a Windows appointment between resizes. 😭

📏 ntfsresize-size

ntfsresize-size device size

This command is the same as ntfsresize except that it allows you to specify the new size (in bytes) explicitly.

This function is deprecated. In new code, use the ntfsresize call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. Still here, still problematic. 🫠

This command depends on the feature "ntfsprogs". See also feature-available.

🌱 parse-environment

parse-environment

Parse the program’s environment and set flags in the handle accordingly. For example if LIBGUESTFS_DEBUG=1 then the ‘verbose’ flag is set in the handle. It's reading the room (the environment, technically). 🧚

Most programs do not need to call this. It is done implicitly when you call create. So like, the work is already done for you, bestie.

See "ENVIRONMENT VARIABLES" in guestfs(3) for a list of environment variables that can affect libguestfs handles. See also "guestfs_create_flags" in guestfs(3), and parse-environment-list.

🌸 parse-environment-list

parse-environment-list 'environment ...'

Parse the list of strings in the argument environment and set flags in the handle accordingly. For example if LIBGUESTFS_DEBUG=1 is a string in the list, then the ‘verbose’ flag is set in the handle. Same energy as parse-environment, but you hand it the list yourself instead of letting the environment do it. 💜

Okay so this one is literally the same energy as parse-environment, except it parses an explicit list of strings instead of the program’s environment. Slay. ✨

🧩 `part-add`

part-add device prlogex startsect endsect

This command adds a partition to device. If there is no partition table on the device, call part-init first. Fr fr, do that first.

The prlogex parameter is the type of partition. Normally you should pass p or primary here, but MBR partition tables also support l (or logical) and e (or extended) partition types.

startsect and endsect are the start and end of the partition in sectors. endsect may be negative, which means it counts backwards from the end of the disk (-1 is the last sector). Cute little backwards math moment.

Creating a partition which covers the whole disk is not so easy. Use part-disk to do that. 💅

🗑️ `part-del`

part-del device partnum

This command deletes the partition numbered partnum on device.

⚠️ Note that in the case of MBR partitioning, deleting an extended partition also deletes any logical partitions it contains. That’s not a drill, bestie. 💀

💾 `part-disk`

part-disk device parttype

This command is simply a combination of part-init followed by part-add to create a single primary partition covering the whole disk.

parttype is the partition table type, usually mbr or gpt, but other possible values are described in part-init.

📈 `part-expand-gpt`

part-expand-gpt device

Move backup GPT data structures to the end of the disk. This is useful in case of in-place image expand since disk space after backup GPT header is not usable. This is equivalent to sgdisk -e.

👢 `part-get-bootable`

part-get-bootable device partnum

This command returns true if the partition partnum on device has the bootable flag set.

🆔 `part-get-disk-guid`

part-get-disk-guid device

Return the disk identifier (GUID) of a GPT-partitioned device. Behaviour is undefined for other partition types.

⚠️ Undefined behaviour means exactly that, bestie — don’t go assuming it’ll be cute for non-GPT. 🙈

🏷️ `part-get-gpt-attributes`

part-get-gpt-attributes device partnum

Return the attribute flags of numbered GPT partition partnum. An error is returned for MBR partitions.

🔑 `part-get-gpt-guid`

part-get-gpt-guid device partnum

Return the GUID of numbered GPT partition partnum.

🧬 `part-get-gpt-type`

part-get-gpt-type device partnum

Return the type GUID of numbered GPT partition partnum.

🆔 `part-get-mbr-id`

part-get-mbr-id device partnum

Returns the MBR type byte (also known as the ID byte) from the numbered partition partnum.

⚠️ Note that only MBR (old DOS-style) partitions have type bytes. You will get undefined results for other partition table types (see part-get-parttype). So yeah, don’t expect MBR vibes from GPT. 💀

🧩 `part-get-mbr-part-type`

part-get-mbr-part-type device partnum

This returns the partition type of an MBR partition numbered partnum on device device.

It returns primary, logical, or extended.

📛 `part-get-name`

part-get-name device partnum

This gets the partition name on partition numbered partnum on device device. Note that partitions are numbered from 1.

The partition name can only be read on certain types of partition table. This works on gpt but not on mbr partitions.

🔍 `part-get-parttype`

part-get-parttype device

This command examines the partition table on device and returns the partition table type (format) being used.

Common return values include: msdos (a DOS/Windows style MBR partition table), gpt (a GPT/EFI-style partition table). Other values are possible, although unusual. See part-init for a full list.

🌱 `part-init`

part-init device parttype

This creates an empty partition table on device of one of the partition types listed below. Usually parttype should be either msdos or gpt (for large disks).

Initially there are no partitions. Following this, you should call part-add for each partition required. Like, one by one, bestie. ✨

Possible values for parttype are:

efi, gpt — Intel EFI / GPT partition table.

This is recommended for >= 2 TB partitions that will be accessed from Linux and Intel-based Mac OS X. It also has limited backwards compatibility with the mbr format.

mbr, msdos — The standard PC “Master Boot Record” (MBR) format used by MS-DOS and Windows. This partition type will only work for device sizes up to 2 TB. For large disks we recommend using gpt.

Other partition table types that may work but are not supported include:

aix — AIX disk labels.
amiga, rdb — Amiga “Rigid Disk Block” format.
bsd — BSD disk labels.
dasd — DASD, used on IBM mainframes.
dvh — MIPS/SGI volumes.
mac — Old Mac partition format. Modern Macs use gpt.
pc98 — NEC PC-98 format, common in Japan apparently.
sun — Sun disk labels.

📋 `part-list`

part-list device

This command parses the partition table on device and returns the list of partitions found. It’s giving very detective energy. 🔍

The fields in the returned structure are:

part_num — Partition number, counting from 1.
part_start — Start of the partition in bytes. To get sectors you have to divide by the device’s sector size, see blockdev-getss.
part_end — End of the partition in bytes.
part_size — Size of the partition in bytes.

📏 `part-resize`

part-resize device partnum endsect

This command resizes the partition numbered partnum on device by moving the end position.

Note that this does not modify any filesystem present in the partition. If you wish to do this, you will need to use filesystem resizing commands like resize2fs.

When growing a partition you will want to grow the filesystem afterwards, but when shrinking, you need to shrink the filesystem before the partition. Order matters, bestie — this is not a vibe-only situation. 💅

👢 `part-set-bootable`

part-set-bootable device partnum true|false

This sets the bootable flag on partition numbered partnum on device device. Note that partitions are numbered from 1.

The bootable flag is used by some operating systems (notably Windows) to determine which partition to boot from. It is by no means universally recognized. So it’s more of a “some systems care” situation. 🙈

🆔 `part-set-disk-guid`

part-set-disk-guid device guid

Set the disk identifier (GUID) of a GPT-partitioned device to guid. Return an error if the partition table of device isn’t GPT, or if guid is not a valid GUID.

🎲 `part-set-disk-guid-random`

part-set-disk-guid-random device

Set the disk identifier (GUID) of a GPT-partitioned device to a randomly generated value. Return an error if the partition table of device isn’t GPT.

🏷️ `part-set-gpt-attributes`

part-set-gpt-attributes device partnum attributes

Set the attribute flags of numbered GPT partition partnum to attributes. Return an error if the partition table of device isn’t GPT.

See https://en.wikipedia.org/wiki/GUID_Partition_Table#Partition_entries for a useful list of partition attributes.

🔑 `part-set-gpt-guid`

part-set-gpt-guid device partnum guid

Set the GUID of numbered GPT partition partnum to guid. Return an error if the partition table of device isn’t GPT, or if guid is not a valid GUID.

🧬 `part-set-gpt-type`

part-set-gpt-type device partnum guid

Set the type GUID of numbered GPT partition partnum to guid. Return an error if the partition table of device isn’t GPT, or if guid is not a valid GUID.

See https://en.wikipedia.org/wiki/GUID_Partition_Table#Partition_type_GUIDs for a useful list of type GUIDs.

🆔 `part-set-mbr-id`

part-set-mbr-id device partnum idbyte

Sets the MBR type byte (also known as the ID byte) of the numbered partition partnum to idbyte. Note that the type bytes quoted in most documentation are in fact hexadecimal numbers, but usually documented without any leading 0x which might be confusing. So yes, hex girlie, but make it mysterious. 💅

⚠️ Note that only MBR (old DOS-style) partitions have type bytes. You will get undefined results for other partition table types (see part-get-parttype).

📛 `part-set-name`

part-set-name device partnum name

This sets the partition name on partition numbered partnum on device device. Note that partitions are numbered from 1.

The partition name can only be set on certain types of partition table. This works on gpt but not on mbr partitions.

🔙 `part-to-dev`

part-to-dev partition

This function takes a partition name (eg. /dev/sdb1) and removes the partition number, returning the device name (eg. /dev/sdb).

The named partition must exist, for example as a string returned from list-partitions.

See also part-to-partnum, device-index.

🔢 `part-to-partnum`

part-to-partnum partition

This function takes a partition name (eg. /dev/sdb1) and returns the partition number (eg. 1).

The named partition must exist, for example as a string returned from list-partitions.

🏓 `ping-daemon`

ping-daemon

This is a test probe into the guestfs daemon running inside the libguestfs appliance. Calling this function checks that the daemon responds to the ping message, without affecting the daemon or attached block device(s) in any other way. Just a little “u up?” to the daemon. 🫶

📖 `pread`

pread path count offset

This command lets you read part of a file. It reads count bytes of the file, starting at offset, from file path.

This may read fewer bytes than requested. For further details see the pread(2) system call.

📖 `pread-device`

pread-device device count offset

This command lets you read part of a block device. It reads count bytes of device, starting at offset.

This may read fewer bytes than requested. For further details see the pread(2) system call.

🆔 `pvchange-uuid`

pvchange-uuid device

Generate a new random UUID for the physical volume device.

This command depends on the feature lvm2. See also feature-available.

🎲 `pvchange-uuid-all`

pvchange-uuid-all

Generate new random UUIDs for all physical volumes.

This command depends on the feature lvm2. See also feature-available.

🧱 `pvcreate`

pvcreate device

This creates an LVM physical volume on the named device, where device should usually be a partition name such as /dev/sda1.

This command depends on the feature lvm2. See also feature-available.

🧹 `pvremove`

pvremove device

This wipes a physical volume device so that LVM will no longer recognise it. 🧹

The implementation uses the pvremove(8) command, which is lowkey stubborn — it absolutely refuses to wipe physical volumes that contain any volume groups, so you have to remove those first. No shortcuts, bestie. ✨

This command depends on the feature "lvm2". See also "feature-available".

pvresize

pvresize device

This resizes (expands or shrinks) an existing LVM physical volume to match the new size of the underlying device. It's giving "grow into your new era" energy. 📏

This command depends on the feature "lvm2". See also "feature-available".

pvresize-size

pvresize-size device size

Literally the same as "pvresize" except that it lets you specify the new size (in bytes) explicitly. You're the main character here, you pick the number. 💅

This command depends on the feature "lvm2". See also "feature-available".

pvs

pvs

List all the physical volumes detected. This is the equivalent of the pvs(8) command. 👑

This returns a list of just the device names that contain PVs (eg. /dev/sda2). Short and sweet, no extra lore.

pvs-full

pvs-full

List all the physical volumes detected. This is the equivalent of the pvs(8) command. The "full" version includes all fields — it's the director's cut, nothing cut for time. 🎬

This command depends on the feature "lvm2". See also "feature-available".

pvuuid

pvuuid device

This command returns the UUID of the LVM PV device. Its literal government name, if you will. 🪪

pwrite

pwrite path content offset

This command writes to part of a file. It writes the data buffer "content" to the file "path" starting at offset "offset".

This command implements the pwrite(2) system call, and like that system call it may not write the full data requested. The return value is the number of bytes that were actually written to the file. This could even be 0, although short writes are unlikely for regular files in ordinary circumstances. 😭 Yes, you have to check the return value. Yes, everyone forgets. Be the one who doesn't.

pwrite-device

pwrite-device device content offset

This command writes to part of a device. It writes the data buffer "content" to "device" starting at offset "offset".

This command implements the pwrite(2) system call, and like that system call it may not write the full data requested (although short writes to disk devices and partitions are probably impossible with standard Linux kernels). Probably. 🙈

read-file

read-file path

This call returns the contents of the file "path" as a buffer. 📖

Unlike "cat", this function can correctly handle files that contain embedded ASCII NUL characters. That's the flex. The others simply cannot, and honestly? Not their fault.

read-lines

read-lines path

Return the contents of the file named "path".

The file contents are returned as a list of lines. Trailing "LF" and "CRLF" character sequences are not returned. Cleaned up, no crumbs. 🧼

Note that this function cannot correctly handle binary files (specifically, files containing "\0" character which is treated as end of string). For those you need to use the "read-file" function and split the buffer into lines yourself. Doing it manually is the vibe check here. 💅

readdir

readdir dir

This returns the list of directory entries in directory "dir". ✨

All entries in the directory are returned, including "." and "..". The entries are not sorted, but returned in the same order as the underlying filesystem. Chaotic? Maybe. Faithful to the source? Absolutely.

Also this call returns basic file type information about each file. The "ftyp" field will contain one of the following characters:

'b' — Block special
'c' — Char special
'd' — Directory
'f' — FIFO (named pipe)
'l' — Symbolic link
'r' — Regular file
's' — Socket
'u' — Unknown file type
'?' — The readdir(3) call returned a "d_type" field with an unexpected value

This function is primarily intended for use by programs. To get a simple list of names, use "ls". To get a printable directory for human consumption, use "ll". iykyk. 🫶

readlink

readlink path

This command reads the target of a symbolic link. Follow the yellow brick road. 🌈

readlinklist

readlinklist path 'names ...'

This call allows you to do a "readlink" operation on multiple files, where all files are in the directory "path". "names" is the list of files from this directory. Batch it, bestie — one round trip, many links. 🔥

On return you get a list of strings, with a one-to-one correspondence to the "names" list. Each string is the value of the symbolic link.

If the readlink(2) operation fails on any name, then the corresponding result string is the empty string "". However the whole operation is completed even if there were readlink(2) errors, and so you can call this function with names where you don't know if they are symbolic links already (albeit slightly less efficient). It ate and left no crumbs. 💀

This call is intended for programs that want to efficiently list a directory contents without making many round-trips. Efficiency queen. 👑

realpath

realpath path

Return the canonicalized absolute pathname of "path". The returned path has no ".", ".." or symbolic link path elements. It's the "no fake friends, only real ones" of path resolution. ✨

remount

remount mountpoint [rw:true|false]

This call allows you to change the "rw" (readonly/read-write) flag on an already mounted filesystem at "mountpoint", converting a readonly filesystem to be read-write, or vice-versa. Flip the switch, change the era. 🦋

Note that at the moment you must supply the "optional" "rw" parameter. In future we may allow other flags to be adjusted. So yes, it's optional but also mandatory. We know. We know. 😭

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

remove-drive

remove-drive label

This call does nothing and returns an error. 💀💀💀

This function is deprecated. There is no replacement. Consult the API documentation in guestfs(3) for further information.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. It's still here, it's just not thriving. 🫠

removexattr

removexattr xattr path

This call removes the extended attribute named "xattr" of the file "path". Yeet the metadata, keep the file. 🎀

rename

rename oldpath newpath

Rename a file to a new place on the same filesystem. This is the same as the Linux rename(2) system call. In most cases you are better to use "mv" instead. Glow-up advice from your local Unix bestie: "mv" is the moment, rename is the technicality. 💅

resize2fs

resize2fs device

This resizes an ext2, ext3 or ext4 filesystem to match the size of the underlying device. Snatch that waist, girl. 📏✨

See also "RESIZE2FS ERRORS" in guestfs(3).

resize2fs-M

resize2fs-M device

This command is the same as "resize2fs", but the filesystem is resized to its minimum size. This works like the -M option to the resize2fs(8) command. Getting small is also a serve. 🧚

To get the resulting size of the filesystem you should call "tune2fs-l" and read the "Block size" and "Block count" values. These two numbers, multiplied together, give the resulting size of the minimal filesystem in bytes. Math is required. Sorry. 😭

See also "RESIZE2FS ERRORS" in guestfs(3).

resize2fs-size

resize2fs-size device size

This command is the same as "resize2fs" except that it allows you to specify the new size (in bytes) explicitly. You set the number, you own the number. 👑

See also "RESIZE2FS ERRORS" in guestfs(3).

rm

rm path

Remove the single file "path". One file. One. Don't get ambitious. 🙈

rm-f

rm-f path

Remove the file "path".

If the file doesn't exist, that error is ignored. (Other errors, eg. I/O errors or bad paths, are not ignored.) So it's forgiving, not reckless. 🫶

This call cannot remove directories. Use "rmdir" to remove an empty directory, or "rm-rf" to remove directories recursively. Wrong tool, wrong job, bestie.

rm-rf

rm-rf path

Remove the file or directory "path", recursively removing the contents if its a directory. This is like the rm -rf shell command. Handle with care — this is the "no thoughts, head empty, everything gone" command. 💀🔥

rmdir

rmdir path

Remove the single directory "path". It has to be empty already — no freeloaders inside. 🚪

rmmountpoint

rmmountpoint exemptpath

This call removes a mountpoint that was previously created with "mkmountpoint". See "mkmountpoint" for full details. Undo the thing, but only the thing that was set up by the matching thing. You know the drill. ✨

rsync

rsync src dest [archive:true|false] [deletedest:true|false]

This call may be used to copy or synchronize two directories under the same libguestfs handle. This uses the rsync(1) program, which uses a fast algorithm that avoids copying files unnecessarily. Efficient and iconic. 🦋

"src" and "dest" are the source and destination directories. Files are copied from "src" to "dest".

The optional arguments are:

"archive" — Turns on archive mode. This is the same as passing the --archive flag to "rsync".
"deletedest" — Delete files at the destination that do not exist at the source.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

This command depends on the feature "rsync". See also "feature-available".

rsync-in

rsync-in remote dest [archive:true|false] [deletedest:true|false]

This call may be used to copy or synchronize the filesystem on the host or on a remote computer with the filesystem within libguestfs. This uses the rsync(1) program, which uses a fast algorithm that avoids copying files unnecessarily. It's bringing the outside world in. 🌍➡️📁

This call only works if the network is enabled. See "set-network" or the --network option to various tools like guestfish(1). No network, no vibes.

Files are copied from the remote server and directory specified by "remote" to the destination directory "dest".

The format of the remote server string is defined by rsync(1). Note that there is no way to supply a password or passphrase, so the target must be set up not to require one. Key-based trust only, bestie. 🔑

The optional arguments are the same as those of "rsync".

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

This command depends on the feature "rsync". See also "feature-available".

rsync-out

rsync-out src remote [archive:true|false] [deletedest:true|false]

This call may be used to copy or synchronize the filesystem within libguestfs with a filesystem on the host or on a remote computer. This uses the rsync(1) program, which uses a fast algorithm that avoids copying files unnecessarily. Same energy, opposite direction — taking it out. 📁➡️🌍

This call only works if the network is enabled. See "set-network" or the --network option to various tools like guestfish(1).

Files are copied from the source directory "src" to the remote server and directory specified by "remote".

The format of the remote server string is defined by rsync(1). Note that there is no way to supply a password or passphrase, so the target must be set up not to require one. Same rule, same key-based trust. 🔑

The optional arguments are the same as those of "rsync".

Globbing does not happen on the "src" parameter. In programs which use the API directly you have to expand wildcards yourself (see "glob-expand"). In guestfish you can use the "glob" command (see "glob"), for example:

><fs> glob rsync-out /* rsync://remote/

That's the whole move — glob handles the wildcards so you don't have to. 🎀

Like, this command also has one or more optional arguments — go peek at "OPTIONAL ARGUMENTS" for the deets ✨

And this one lowkey depends on the feature rsync. See also "feature-available" if you wanna vibe-check that.

`scrub-device` 🧼

scrub-device device

Okay so this one writes patterns over device to make data retrieval more difficult — it's giving "good luck recovering THIS" energy 💀 It's literally an interface to the scrub(1) program, so go read that manual page for the full details, bestie.

This command depends on the feature scrub. See also "feature-available".

`scrub-file` 🧽

scrub-file file

Writes patterns over a file to make data retrieval more difficult. The file is removed after scrubbing — gone, deleted, no cap 🫶

It's an interface to the scrub(1) program. See that manual page for more details.

This command depends on the feature scrub. See also "feature-available".

`scrub-freespace` 🌸

scrub-freespace dir

This creates the directory dir and then fills it with files until the filesystem is full, scrubs the files as for "scrub-file", and then deletes them. The whole intention is to scrub any free space on the partition containing dir — iconic cleanup behaviour tbh 👑

It's an interface to the scrub(1) program. See that manual page for more details.

This command depends on the feature scrub. See also "feature-available".

`selinux-relabel` 🎀

selinux-relabel specfile path [force:true|false]

SELinux relabel parts of the filesystem, slay 💅

The specfile parameter controls the policy spec file used. You have to parse /etc/selinux/config to find the correct SELinux policy and then pass the spec file, usually: /etc/selinux/ + selinuxtype + /contexts/files/file_contexts.

The required path parameter is the top level directory where relabelling starts. Normally you should pass path as / to relabel the whole guest filesystem — like, the whole thing, main character energy.

The optional force boolean controls whether the context is reset for customizable files, and also whether the user, role and range parts of the file context is changed.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

⚠️ Heads up: this function is deprecated. In new code, use the setfiles call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions — iykyk, just don't build new stuff on it 🙈

This command depends on the feature selinuxrelabel. See also "feature-available".

`set-append` / `append` 📎

set-append append

This one's used to add additional options to the libguestfs appliance kernel command line.

The default is NULL unless overridden by setting the LIBGUESTFS_APPEND environment variable.

Setting append to NULL means no additional options are passed — and yeah, libguestfs always adds a few of its own, so it's never truly bare.

`set-attach-method` / `attach-method` 🔌

set-attach-method backend

Sets the method that libguestfs uses to connect to the backend guestfsd daemon.

See "BACKEND" in guestfs(3).

⚠️ Deprecated alert 💀 In new code, use the set-backend call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

`set-autosync` / `autosync` 🔄

set-autosync true|false

If autosync is true, this enables autosync. Libguestfs will make a best effort attempt to make filesystems consistent and synchronized when the handle is closed — also if the program exits without closing handles, which is honestly so forgiving of us 😭

This is enabled by default (since libguestfs 1.5.24, previously it was disabled by default). Glow-up era ✨

`set-backend` / `backend` 🛠️

set-backend backend

Set the method that libguestfs uses to connect to the backend guestfsd daemon.

This handle property was previously called the "attach method" — rebrand, honestly.

See "BACKEND" in guestfs(3).

`set-backend-setting` ⚙️

set-backend-setting name val

Append name=value to the backend settings string list. However if a string already exists matching name or beginning with name=, then that setting is replaced.

See "BACKEND" in guestfs(3), "BACKEND SETTINGS" in guestfs(3).

`set-backend-settings` 🧾

set-backend-settings 'settings ...'

Set a list of zero or more settings which are passed through to the current backend. Each setting is a string which is interpreted in a backend-specific way, or ignored if not understood by the backend.

The default value is an empty list, unless the environment variable LIBGUESTFS_BACKEND_SETTINGS was set when the handle was created. This environment variable contains a colon-separated list of settings.

This call replaces all backend settings. If you want to replace a single backend setting, see "set-backend-setting". If you want to clear a single backend setting, see "clear-backend-setting". Three different tools for three different jobs, periodt 💅

See "BACKEND" in guestfs(3), "BACKEND SETTINGS" in guestfs(3).

`set-cachedir` / `cachedir` 🗄️

set-cachedir cachedir

Set the directory used by the handle to store the appliance cache, when using a supermin appliance. The appliance is cached and shared between all handles which have the same effective user ID — sharing is caring 🫶

The environment variables LIBGUESTFS_CACHEDIR and TMPDIR control the default value: if LIBGUESTFS_CACHEDIR is set, then that's the default. Else if TMPDIR is set, then that's the default. Else /var/tmp is the default.

`set-direct` / `direct` 📡

set-direct true|false

If the direct appliance mode flag is enabled, then stdin and stdout are passed directly through to the appliance once it is launched.

One consequence of this is that log messages aren't caught by the library and handled by set-log-message-callback, but go straight to stdout — no middleman.

You probably don't want to use this unless you know what you are doing. Like, genuinely. Not a cute beginner-friendly vibe 😭

The default is disabled.

⚠️ Also deprecated! In new code, use the internal-get-console-socket call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

`set-e2attrs` 🏷️

set-e2attrs file attrs [clear:true|false]

This sets or clears the file attributes attrs associated with the inode file.

attrs is a string of characters representing file attributes. See "get-e2attrs" for a list of possible attributes. Not all attributes can be changed — some are just built different.

If optional boolean clear is not present or false, then the attrs listed are set in the inode.

If clear is true, then the attrs listed are cleared in the inode.

In both cases, other attributes not present in the attrs string are left unchanged.

These attributes are only present when the file is located on an ext2/3/4 filesystem. Using this call on other filesystem types will result in an error 💀

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

`set-e2generation` 🔢

set-e2generation file generation

This sets the ext2 file generation of a file.

See "get-e2generation".

`set-e2label` 🏷️✨

set-e2label device label

This sets the ext2/3/4 filesystem label of the filesystem on device to label. Filesystem labels are limited to 16 characters — so keep it short, bestie.

You can use either tune2fs-l or get-e2label to return the existing label on a filesystem.

⚠️ Deprecated! In new code, use the set-label call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

`set-e2uuid` 🆔

set-e2uuid device uuid

This sets the ext2/3/4 filesystem UUID of the filesystem on device to uuid. The format of the UUID and alternatives such as clear, random and time are described in the tune2fs(8) manpage.

You can use vfs-uuid to return the existing UUID of a filesystem.

⚠️ Deprecated, sorry babe 😭 In new code, use the set-uuid call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

`set-hv` / `hv` 🖥️

set-hv hv

Set the hypervisor binary that we will use. The hypervisor depends on the backend, but is usually the location of the qemu/KVM hypervisor.

You can also override this by setting the LIBGUESTFS_HV environment variable.

Note that you should call this function as early as possible after creating the handle. This is because some pre-launch operations depend on testing qemu features (by running qemu -help). If the qemu binary changes, we don't retest features, and so you might see inconsistent results — messy. Using the environment variable LIBGUESTFS_HV is safest of all since that picks the qemu binary at the same time as the handle is created 👑

`set-identifier` / `identifier` 🏷️

set-identifier identifier

This is an informative string which the caller may optionally set in the handle. It is printed in various places, allowing the current handle to be identified in debugging output.

One important place is when tracing is enabled. If the identifier string is not an empty string, then trace messages change from this:

libguestfs: trace: get_tmpdir
libguestfs: trace: get_tmpdir = "/tmp"

to this:

libguestfs: trace: ID: get_tmpdir
libguestfs: trace: ID: get_tmpdir = "/tmp"

where ID is the identifier string set by this call. Cute, right? 🎀

The identifier must only contain alphanumeric ASCII characters, underscore and minus sign. The default is the empty string.

See also "set-program", "set-trace", "get-identifier".

`set-label` 🏷️💖

set-label mountable label

Set the filesystem label on mountable to label.

Only some filesystem types support labels, and libguestfs supports setting labels on only a subset of these. Here's the tea:

ext2, ext3, ext4 — labels are limited to 16 bytes.
NTFS — labels are limited to 128 unicode characters.
XFS — the label is limited to 12 bytes. The filesystem must not be mounted when trying to set the label.
btrfs — the label is limited to 255 bytes and some characters are not allowed. Setting the label on a btrfs subvolume will set the label on its parent filesystem. The filesystem must not be mounted when trying to set the label.
fat — the label is limited to 11 bytes.
swap — the label is limited to 16 bytes.

If there is no support for changing the label for the type of the specified filesystem, set_label will fail and set errno as ENOTSUP. Rude but fair 💀

To read the label on a filesystem, call vfs-label.

`set-libvirt-requested-credential` 🔐

set-libvirt-requested-credential index cred

After requesting the index'th credential from the user, call this function to pass the answer back to libvirt.

See "LIBVIRT AUTHENTICATION" in guestfs(3) for documentation and example code — yes, there's example code, you're welcome 🫶

💖 `set-libvirt-supported-credentials`

set-libvirt-supported-credentials 'creds ...'

okay so bestie, call this one before you set an event handler for GUESTFS_EVENT_LIBVIRT_AUTH — it's literally how you tell the program which credential types it knows how to handle.

The creds list has to be a non-empty list of strings, no exceptions. The possible strings are:

username
authname
language
cnonce
passphrase
echoprompt
noechoprompt
realm
external

peep the libvirt docs for what each credential type actually means 💅 and see "LIBVIRT AUTHENTICATION" in guestfs(3) for the documentation and example code. slay.

🧠 `set-memsize` / `memsize`

set-memsize memsize

this sets the memory size (in megabytes, bestie) allocated to the hypervisor. ngl it only does anything if you call it before launch.

you can also change it by setting the env var LIBGUESTFS_MEMSIZE before the handle is created ✨

want the full architecture tea? see guestfs(3).

🌐 `set-network` / `network`

set-network true|false

if network is true, the network is enabled in the libguestfs appliance. the default is false (yes, off by default, that's the vibe).

this affects whether commands can access the network — see "RUNNING COMMANDS" in guestfs(3).

⚠️ you must call this before calling launch, otherwise it's giving absolutely nothing. no effect whatsoever.

📁 `set-path` / `path`

set-path searchpath

sets the path that libguestfs searches for kernel and initrd.img 🧚

the default is $libdir/guestfs unless you override it by setting the LIBGUESTFS_PATH environment variable.

setting path to NULL restores the default path. cute, right?

🫶 `set-pgroup` / `pgroup`

set-pgroup true|false

if pgroup is true, child processes get placed into their own process group.

the practical upshot (lowkey important): signals like SIGINT — you know, from users pressing ^C — won't be received by the child process.

the default for this flag is false, because usually you want ^C to kill the subprocess. guestfish sets this flag to true when used interactively, so that ^C can cancel long-running commands gracefully (see "user-cancel") 💅

🏷️ `set-program` / `program`

set-program program

sets the program name. it's just an informative string that the main program may optionally set in the handle.

when the handle is created, the program name in the handle is set to the basename from argv[0]. and bestie, the program name can never ever be NULL. periodt.

🔥 `set-qemu` / `qemu`

set-qemu hv

sets the hypervisor binary (usually qemu) that we're gonna use.

you can also override this by setting the LIBGUESTFS_HV environment variable ✨

setting hv to NULL restores the default qemu binary.

⚠️ note that you should call this function as early as possible after creating the handle. why? because some pre-launch operations depend on testing qemu features (by running qemu -help). if the qemu binary changes, we don't retest features, and so you might see inconsistent results 😭. using the environment variable LIBGUESTFS_HV is safest of all since that picks the qemu binary at the same time as the handle is created.

this function is deprecated. in new code, use the set-hv call instead.

deprecated functions will not be removed from the API, but the fact that they're deprecated indicates that there are problems with correct use of these functions. iykyk 💀

🩹 `set-recovery-proc` / `recovery-proc`

set-recovery-proc true|false

if this is called with the parameter false then launch doesn't create a recovery process. the purpose of the recovery process? to stop runaway hypervisor processes in the case where the main program aborts abruptly 👑

this only has any effect if called before launch, and the default is true.

about the only time you'd want to disable this is if the main process will fork itself into the background ("daemonize" itself). in that case the recovery process thinks the main program has disappeared and so kills the hypervisor, which is… not very helpful 🙈

🎀 `set-selinux` / `selinux`

set-selinux true|false

this sets the selinux flag that is passed to the appliance at boot time. the default is selinux=0 (disabled).

note that if SELinux is enabled, it is always in Permissive mode (enforcing=0).

for more info on the architecture of libguestfs, see guestfs(3).

this function is deprecated. in new code, use the setfiles call instead.

deprecated functions will not be removed from the API, but the fact that they're deprecated indicates that there are problems with correct use of these functions 💅

⚡ `set-smp` / `smp`

set-smp smp

change the number of virtual CPUs assigned to the appliance. default is 1. increasing this may improve performance, though often it has no effect (the audacity 😭).

this function must be called before launch.

🗂️ `set-tmpdir` / `tmpdir`

set-tmpdir tmpdir

set the directory used by the handle to store temporary files 🧚

the environment variables LIBGUESTFS_TMPDIR and TMPDIR control the default value: if LIBGUESTFS_TMPDIR is set, then that's the default. else if TMPDIR is set, then that's the default. else /tmp is the default. three-tier queen behavior, honestly.

🔍 `set-trace` / `trace`

set-trace true|false

if the command trace flag is set to 1, then libguestfs calls, parameters and return values are all traced ✨

if you want to trace C API calls into libguestfs (and other libraries) then possibly a better way is to use the external ltrace(1) command.

command traces are disabled unless the environment variable LIBGUESTFS_TRACE is defined and set to 1.

trace messages are normally sent to stderr, unless you register a callback to send them somewhere else (see "set-event-callback").

🆔 `set-uuid`

set-uuid device uuid

set the filesystem UUID on device to uuid. if this fails and the errno is ENOTSUP, that means there's no support for changing the UUID for that type of filesystem 🫠

only some filesystem types support setting UUIDs. that's just how it is, bestie.

to read the UUID on a filesystem, call vfs-uuid 💅

🎲 `set-uuid-random`

set-uuid-random device

set the filesystem UUID on device to a random UUID. if this fails and the errno is ENOTSUP, that means there's no support for changing the UUID for that type of filesystem.

only some filesystem types support setting UUIDs, same deal as above.

to read the UUID on a filesystem, call vfs-uuid 🌈

📢 `set-verbose` / `verbose`

set-verbose true|false

if verbose is true, this turns on verbose messages ✨

verbose messages are disabled unless the environment variable LIBGUESTFS_DEBUG is defined and set to 1.

verbose messages are normally sent to stderr, unless you register a callback to send them somewhere else (see "set-event-callback").

🔒 `setcon`

setcon context

this sets the SELinux security context of the daemon to the string context 🛡️

see the documentation about SELINUX in guestfs(3).

this function is deprecated. in new code, use the setfiles call instead.

deprecated functions will not be removed from the API, but the fact that they're deprecated indicates that there are problems with correct use of these functions.

this command depends on the feature "selinux". see also "feature-available".

🏷️ `setfiles`

setfiles specfile 'paths ...' [force:true|false] [excludes:..]

this invokes the SELinux setfiles command — a low level tool used to relabel parts of the filesystem.

the specfile parameter controls the policy spec file used. you have to parse /etc/selinux/config to find the correct SELinux policy and then pass the spec file, usually:

/etc/selinux/ + selinuxtype + /contexts/files/file_contexts

the required paths parameter is the list of top level directories where relabelling starts. setfiles will only relabel up to filesystem boundaries so, for example, passing just / will relabel the whole root filesystem, but no other mounted filesystems. if the list is empty, setfiles is not called 🫶

the optional force boolean controls whether the context is reset for customizable files, and also whether the user, role and range parts of the file context is changed.

the optional excludes list lets you exclude parts of the directory tree by appending the setfiles -e option 💅

this command has one or more optional arguments. see "OPTIONAL ARGUMENTS".

this command depends on the feature "selinuxrelabel". see also "feature-available".

🧷 `setxattr`

setxattr xattr val vallen path

this call sets the extended attribute named xattr of the file path to the value val (of length vallen). the value is arbitrary 8 bit data, no cap.

💽 `sfdisk`

sfdisk device cyls heads sectors 'lines ...'

this is a direct interface to the sfdisk(8) program for creating partitions on block devices.

device should be a block device, for example /dev/sda.

cyls, heads and sectors are the number of cylinders, heads and sectors on the device, which are passed directly to sfdisk(8) as the -C, -H and -S parameters. if you pass 0 for any of these, then the corresponding parameter is omitted. usually for 'large' disks, you can just pass 0 for these, but for small (floppy-sized) disks, sfdisk(8) (or rather, the kernel) cannot work out the right geometry and you'll need to tell it 😭

lines is a list of lines that we feed to sfdisk(8). for more info refer to the sfdisk(8) manpage.

to create a single partition occupying the whole disk, you'd pass lines as a single element list, with the single element being the string "," (comma).

see also: sfdisk-l, sfdisk-N, part-init.

this function is deprecated. in new code, use the part-add call instead.

deprecated functions will not be removed from the API, but the fact that they're deprecated indicates that there are problems with correct use of these functions.

📐 `sfdiskM`

sfdiskM device 'lines ...'

this is a simplified interface to the sfdisk command, where partition sizes are specified in megabytes only (rounded to the nearest cylinder) and you don't need to specify the cyls, heads and sectors parameters which were rarely if ever used anyway 🙈

see also: sfdisk, the sfdisk(8) manpage and part-disk.

this function is deprecated. in new code, use the part-add call instead.

deprecated functions will not be removed from the API, but the fact that they're deprecated indicates that there are problems with correct use of these functions.

🎯 `sfdisk-N`

sfdisk-N device partnum cyls heads sectors line

this runs sfdisk(8)'s option to modify just the single partition n (note: n counts from 1, bestie, not 0 💅).

for other parameters, see sfdisk. you should usually pass 0 for the cyls/heads/sectors parameters.

🫶 oh and before we move on: See also: part-add. ⚠️ Deprecated alert: this function is deprecated. In new code, use the part-add call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

🌸 `sfdisk-disk-geometry`

sfdisk-disk-geometry device

This one displays the disk geometry of device, read from the partition table. Especially when the underlying block device has been resized, this can be different from the kernel’s idea of the geometry — see sfdisk-kernel-geometry for that vibe check. The result is in human-readable format, and it is not designed to be parsed. 💅

🦋 `sfdisk-kernel-geometry`

sfdisk-kernel-geometry device

This displays the kernel’s idea of the geometry of device. Again: human-readable format, not designed to be parsed. No cap.

💀 `sfdisk-l`

sfdisk-l device

This displays the partition table on device, in the human-readable output of the sfdisk(8) command. It is not intended to be parsed.

🐚 `sh`

sh command

This call runs a command from the guest filesystem via the guest’s /bin/sh. It’s like command, but passes the command to:

/bin/sh -c "command"

Depending on the guest’s shell, this usually results in wildcards being expanded, shell expressions being interpolated and so on. All the provisos about command apply to this call too. Fr fr. ✨

🧵 `sh-lines`

sh-lines command

Same as sh, but splits the result into a list of lines. See also: command-lines.

🌊 `sh-out`

sh-out command (output|-)

Same as sh, but streams the output back, handling the case where the output from the command is larger than the protocol limit. See also: command-out.

Use - instead of a filename to read/write from stdin/stdout.

🛑 `shutdown`

shutdown

This is the opposite of launch. It performs an orderly shutdown of the backend process(es). If the autosync flag is set (which is the default) then the disk image is synchronized.

If the subprocess exits with an error then this function will return an error, which should not be ignored — it may indicate that the disk image could not be written out properly. 😭

It is safe to call this multiple times. Extra calls are ignored.

This call does not close or free up the handle. You still need to call close afterwards. And yeah, close will call this if you don’t do it explicitly, but note that any errors are ignored in that case.

😴 `sleep`

sleep secs

Sleep for secs seconds. That’s it. That’s the whole command. 💤

📊 `stat`

stat path

Returns file information for the given path. This is the same as the stat(2) system call.

⚠️ Deprecated alert: this function is deprecated. In new code, use the statns call instead. Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

🌟 `statns`

statns path

Returns file information for the given path. This is the same as the stat(2) system call.

🧮 `statvfs`

statvfs path

Returns file system statistics for any mounted file system. path should be a file or directory in the mounted file system — typically it is the mount point itself, but it doesn’t need to be. This is the same as the statvfs(2) system call.

🔤 `strings`

strings path

This runs the strings(1) command on a file and returns the list of printable strings found.

The strings command has, in the past, had problems with parsing untrusted files. These are mitigated in the current version of libguestfs, but see CVE-2014-8484 in guestfs(3).

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See PROTOCOL LIMITS in guestfs(3).

🌈 `strings-e`

strings-e encoding path

This is like the strings command, but allows you to specify the encoding of strings that are looked for in the source file path.

Allowed encodings are:

s — Single 7-bit-byte characters like ASCII and the ASCII-compatible parts of ISO-8859-X (this is what strings uses).
S — Single 8-bit-byte characters.
b — 16-bit big endian strings such as those encoded in UTF-16BE or UCS-2BE.
l (lower case letter L) — 16-bit little endian such as UTF-16LE and UCS-2LE. This is useful for examining binaries in Windows guests.
B — 32-bit big endian such as UCS-4BE.
L — 32-bit little endian such as UCS-4LE.

The returned strings are transcoded to UTF-8.

The strings command has, in the past, had problems with parsing untrusted files. These are mitigated in the current version of libguestfs, but see CVE-2014-8484 in guestfs(3).

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See PROTOCOL LIMITS in guestfs(3).

🔌 `swapoff-device`

swapoff-device device

This command disables the libguestfs appliance swap device or partition named device. See swapon-device.

📁 `swapoff-file`

swapoff-file file

This command disables the libguestfs appliance swap on file.

🏷️ `swapoff-label`

swapoff-label label

This command disables the libguestfs appliance swap on labeled swap partition.

🆔 `swapoff-uuid`

swapoff-uuid uuid

This command disables the libguestfs appliance swap partition with the given UUID.

This command depends on the feature linuxfsuuid. See also feature-available.

🔋 `swapon-device`

swapon-device device

This command enables the libguestfs appliance to use the swap device or partition named device. The increased memory is made available for all commands, for example those run using command or sh.

⚠️ Bestie, be careful: you should not swap to existing guest swap partitions unless you know what you are doing. They may contain hibernation information, or other information that the guest doesn’t want you to trash. You also risk leaking information about the host to the guest this way. Instead, attach a new host device to the guest and swap on that. 💅

📄 `swapon-file`

swapon-file file

This command enables swap to a file. See swapon-device for other notes.

🏷️ `swapon-label`

swapon-label label

This command enables swap to a labeled swap partition. See swapon-device for other notes.

🆔 `swapon-uuid`

swapon-uuid uuid

This command enables swap to a swap partition with the given UUID. See swapon-device for other notes.

This command depends on the feature linuxfsuuid. See also feature-available.

🔄 `sync`

sync

This syncs the disk, so that any writes are flushed through to the underlying disk image. You should always call this if you have modified a disk image, before closing the handle. Periodt. 💾

🥾 `syslinux`

syslinux device [directory:..]

Install the SYSLINUX bootloader on device.

The device parameter must be either a whole disk formatted as a FAT filesystem, or a partition formatted as a FAT filesystem. In the latter case, the partition should be marked as "active" (part-set-bootable) and a Master Boot Record must be installed (eg. using pwrite-device) on the first sector of the whole disk. The SYSLINUX package comes with some suitable Master Boot Records. See the syslinux(1) man page for further information.

The optional arguments are:

directory — Install SYSLINUX in the named subdirectory, instead of in the root directory of the FAT filesystem.

Additional configuration can be supplied to SYSLINUX by placing a file called syslinux.cfg on the FAT filesystem, either in the root directory, or under directory if that optional argument is being used. For further information about the contents of this file, see syslinux(1).

🐾 `tail`

tail path

This command returns up to the last 10 lines of a file as a list of strings.

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See PROTOCOL LIMITS in guestfs(3).

🔢 `tail-n`

tail-n nrlines path

If the parameter nrlines is a positive number, this returns the last nrlines lines of the file path.

If the parameter nrlines is a negative number, this returns lines from the file path, starting with the -nrlines’th line.

If the parameter nrlines is zero, this returns an empty list.

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See PROTOCOL LIMITS in guestfs(3).

📦 `tar-in`, `tar-in-opts`

tar-in (tarfile|-) directory [compress:..] [xattrs:true|false] [selinux:true|false] [acls:true|false] [keepdirlink:true|false]

This command uploads and unpacks local file tarfile into directory.

The optional compress flag controls compression. If not given, then the input should be an uncompressed tar file. Otherwise one of the following strings may be given to select the compression type of the input file: compress, gzip, bzip2, xz, lzop, lzma, zstd. (Note that not all builds of libguestfs will support all of these compression types.)

The other optional arguments are:

xattrs — If set to true, extended attributes are restored from the tar file.
selinux — If set to true, SELinux contexts are restored from the tar file.
acls — If set to true, POSIX ACLs are restored from the tar file.
keepdirlink — If set to true, existing symlinks to directories are followed when extracting from the tar file. This is important for usrmerge systems where /lib is a symlink to /usr/lib.

Use - instead of a filename to read/write from stdin/stdout.

This command has one or more optional arguments. See OPTIONAL ARGUMENTS.

🎁 `tar-out`, `tar-out-opts`

tar-out directory (tarfile|-) [compress:..] [numericowner:true|false] [excludes:..] [xattrs:true|false] [selinux:true|false] [acls:true|false]

This command packs the contents of directory and downloads it to local file tarfile.

The optional compress flag controls compression. If not given, then the output will be an uncompressed tar file. Otherwise one of the following strings may be given to select the compression type of the output file: compress, gzip, bzip2, xz, lzop, lzma, zstd. (Note that not all builds of libguestfs will support all of these compression types.)

The other optional arguments are:

excludes — A list of wildcards. Files are excluded if they match any of the wildcards.
"numericowner" — set this to true and your output tar will carry UID/GID numbers instead of user/group names 💅
"xattrs" — true means extended attributes get saved into the output tar ✨
"selinux" — true means SELinux contexts get saved into the output tar 🎀
"acls" — true means POSIX ACLs get saved into the output tar 🦋

Use - instead of a filename to read/write from stdin/stdout.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

✨ `tgz-in`

tgz-in (tarball|-) directory

This one uploads and unpacks a local file tarball — which is a gzip compressed tar file, okurrr — into directory.

Use - instead of a filename to read/write from stdin/stdout.

This function is deprecated. In new code, use the "tar-in" call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. Translation: it still works, bestie, but it's giving "old news" — use the new one.

✨ `tgz-out`

tgz-out directory (tarball|-)

This packs up the contents of directory and downloads it to the local file tarball.

Use - instead of a filename to read/write from stdin/stdout.

This function is deprecated. In new code, use the "tar-out" call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. Same energy as above — still here, still functional, still not the vibe you should be building on.

🫶 `touch`

touch path

Touch acts like the touch(1) command. It can be used to update the timestamps on a file, or — if the file doesn't exist — to create a new zero-length file. Iconic behavior honestly.

Heads up though: this command only works on regular files, and will fail on other file types such as directories, symbolic links, block special etc. So don't come for it with a directory and expect it to slay 😭

🌸 `truncate`

truncate path

This command truncates path to a zero-length file. The file must exist already — no creating things out of thin air, bestie 💅

🌈 `truncate-size`

truncate-size path size

This command truncates path to size size bytes. The file must exist already.

If the current file size is less than size, then the file is extended to the required size with zero bytes. This creates a sparse file (ie. disk blocks are not allocated for the file until you write to it). So chill, it's not secretly eating your disk.

To create a non-sparse file of zeroes, use "fallocate64" instead.

👑 `tune2fs`

tune2fs device [force:true|false] [maxmountcount:N] [mountcount:N] [errorbehavior:..] [group:N] [intervalbetweenchecks:N] [reservedblockspercentage:N] [lastmounteddirectory:..] [reservedblockscount:N] [user:N]

This call lets you adjust various filesystem parameters of an ext2/ext3/ext4 filesystem called device. It's the glow-up button for your filesystem parameters 💅

The optional parameters are:

"force" — force tune2fs to complete the operation even when errors are being dramatic. This is the same as the tune2fs(8) -f option.
"maxmountcount" — sets the number of mounts after which the filesystem gets checked by e2fsck(8). If this is 0 then the number of mounts is disregarded. This is the same as the tune2fs(8) -c option.
"mountcount" — sets the number of times the filesystem has been mounted. This is the same as the tune2fs(8) -C option.
"errorbehavior" — changes the behavior of the kernel code when errors are detected. Possible values currently are: "continue", "remount-ro", "panic". In practice these options don't really make any difference, particularly for write errors. No cap, they kind of just sit there.

This is the same as the tune2fs(8) -e option.

"group" — sets the group which can use reserved filesystem blocks. This is the same as the tune2fs(8) -g option except that it can only be specified as a number.
"intervalbetweenchecks" — adjusts the maximal time between two filesystem checks (in seconds). If the option is passed as 0 then time-dependent checking is disabled.

This is the same as the tune2fs(8) -i option.

"reservedblockspercentage" — sets the percentage of the filesystem which may only be allocated by privileged processes. This is the same as the tune2fs(8) -m option.
"lastmounteddirectory" — sets the last mounted directory. This is the same as the tune2fs(8) -M option.
"reservedblockscount" — sets the number of reserved filesystem blocks. This is the same as the tune2fs(8) -r option.
"user" — sets the user who can use the reserved filesystem blocks. This is the same as the tune2fs(8) -u option except that it can only be specified as a number. Do not try to put a name there, it will simply Not.

To get the current values of filesystem parameters, see "tune2fs-l". For precise details of how tune2fs works, see the tune2fs(8) man page.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

⭐ `tune2fs-l`

tune2fs-l device

This returns the contents of the ext2, ext3 or ext4 filesystem superblock on device. Superblock reveal ✨

It is the same as running tune2fs -l device. See tune2fs(8) manpage for more details. The list of fields returned isn't clearly defined, and depends on both the version of tune2fs that libguestfs was built against, and the filesystem itself. So like… don't hardcode your expectations, bestie 🙈

🦋 `txz-in`

txz-in (tarball|-) directory

This command uploads and unpacks local file tarball (an xz compressed tar file) into directory.

Use - instead of a filename to read/write from stdin/stdout.

This function is deprecated. In new code, use the "tar-in" call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

This command depends on the feature "xz". See also "feature-available".

🧚 `txz-out`

txz-out directory (tarball|-)

This command packs the contents of directory and downloads it to local file tarball (as an xz compressed tar archive).

Use - instead of a filename to read/write from stdin/stdout.

This function is deprecated. In new code, use the "tar-out" call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

This command depends on the feature "xz". See also "feature-available".

🎀 `umask`

umask mask

This function sets the mask used for creating new files and device nodes to mask & 0777. Bitwise math my beloved.

Typical umask values would be 022 which creates new files with permissions like -rw-r--r-- or -rwxr-xr-x, and 002 which creates new files with permissions like -rw-rw-r-- or -rwxrwxr-x.

The default umask is 022. This is important because it means that directories and device nodes will be created with 0644 or 0755 mode even if you specify 0777. Yes really. The mask ate your 0777. That's the whole point of it.

See also "get-umask", umask(2), "mknod", "mkdir".

This call returns the previous umask. Free nostalgia with every call 🫶

💜 `umount` / `unmount` / `umount-opts`

umount pathordevice [force:true|false] [lazyunmount:true|false]

This unmounts the given filesystem. The filesystem may be specified either by its mountpoint (a path) or the device which contains the filesystem.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

🌟 `umount-all` / `unmount-all`

umount-all

This unmounts all mounted filesystems. Clean slate era 💅

Some internal mounts are not unmounted by this call. So not literally everything, before you @ me.

🍓 `umount-local`

umount-local [retry:true|false]

If libguestfs is exporting the filesystem on a local mountpoint, then this unmounts it.

See "MOUNT LOCAL" in guestfs(3) for full documentation.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

💖 `upload`

upload (filename|-) remotefilename

Upload local file filename to remotefilename on the filesystem.

filename can also be a named pipe. Fun fact, pipes are welcome here too.

🔥 `upload-offset`

upload-offset (filename|-) remotefilename offset

Upload local file filename to remotefilename on the filesystem.

remotefilename is overwritten starting at the byte offset specified. The intention is to overwrite parts of existing files or devices, although if a non-existent file is specified then it is created with a "hole" before offset. The size of the data written is implicit in the size of the source filename. It just knows. Vibes-based sizing.

Note that there is no limit on the amount of data that can be uploaded with this call, unlike with "pwrite", and this call always writes the full amount unless an error occurs.

🦋 `user-cancel`

user-cancel

This function cancels the current upload or download operation. Ctrl-C energy, but official.

Unlike most other libguestfs calls, this function is signal safe and thread safe. You can call it from a signal handler or from another thread, without needing to do any locking.

The transfer that was in progress (if there is one) will stop shortly afterwards, and will return an error. The errno (see "guestfs_last_errno") is set to EINTR, so you can test for this to find out if the operation was cancelled or failed because of another error.

Real talk: no cleanup is performed. For example, if a file was being uploaded then after cancellation there may be a partially uploaded file. It is the caller's responsibility to clean up if necessary.

There are two common places that you might call "user-cancel":

In an interactive text-based program, you might call it from a "SIGINT" signal handler so that pressing ^C cancels the current operation. (You also need to call "set-pgroup" so that child processes don't receive the ^C signal). Important detail, don't skip it!
In a graphical program, when the main thread is displaying a progress bar with a cancel button, wire up the cancel button to call this function. Yes bestie, make the button actually do the thing 🫶

⭐ `utimens`

utimens path atsecs atnsecs mtsecs mtnsecs

This command sets the timestamps of a file with nanosecond precision. Precision era ✨

atsecs, atnsecs are the last access time (atime) in secs and nanoseconds from the epoch.

mtsecs, mtnsecs are the last modification time (mtime) in secs and nanoseconds from the epoch.

If the *nsecs field contains the special value -1 then the corresponding timestamp is set to the current time. (The *secs field is ignored in this case).

If the *nsecs field contains the special value -2 then the corresponding timestamp is left unchanged. (The *secs field is ignored in this case).

So -1 means "now" and -2 means "don't touch it" — and in both cases whatever you put in *secs is just decorative 🎀

🌈 `utsname`

utsname

This returns the kernel version of the appliance, where this is available. This information is only useful for debugging. Nothing in the returned structure is defined by the API. Ngl, it's giving "diagnostic only, don't build a personality around it."

👑 `version`

version

Return the libguestfs version number that the program is linked against. Simple, iconic, no notes 💅

Note that because of dynamic linking this is not necessarily the version of libguestfs that you compiled against. Like, you can compile the program, and then at runtime dynamically link against a completely different libguestfs.so library. Bestie, the chaos potential is real 😭

This call was added in version 1.0.58. In previous versions of libguestfs there was no way to get the version number. From C code you can use dynamic linker functions to find out if this symbol exists (if it doesn't, then it's an earlier version). iykyk 🫶

The call returns a structure with four elements. The first three ("major", "minor" and "release") are numbers and correspond to the usual version triplet. The fourth element ("extra") is a string and is normally empty, but may be used for distro-specific information.

To construct the original version string: "$major.$minor.$release$extra"

See also: "LIBGUESTFS VERSION NUMBERS" in guestfs(3).

Note: do not use this call to test for availability of features. In enterprise distributions we backport features from later versions into earlier versions, making this an unreliable way to test for features. Use "available" or "feature-available" instead. fr fr, don't do it 🙈

vfs-label

vfs-label mountable

This returns the label of the filesystem on mountable. 🏷️

If the filesystem is unlabeled, this returns the empty string. (sad but valid 💀)

To find a filesystem from the label, use "findfs-label".

vfs-minimum-size

vfs-minimum-size mountable

Get the minimum size of filesystem in bytes. This is the minimum possible size for filesystem shrinking. 📉

If getting minimum size of specified filesystem is not supported, this will fail and set errno as ENOTSUP.

See also ntfsresize(8), resize2fs(8), btrfs(8), xfs_info(8).

vfs-type

vfs-type mountable

This command gets the filesystem type corresponding to the filesystem on mountable. 🔍

For most filesystems, the result is the name of the Linux VFS module which would be used to mount this filesystem if you mounted it without specifying the filesystem type. For example a string such as "ext3" or "ntfs". Slay, that's literally the vibe check for your disk ✨

vfs-uuid / get-uuid

vfs-uuid mountable

This returns the filesystem UUID of the filesystem on mountable. 🆔

If the filesystem does not have a UUID, this returns the empty string.

To find a filesystem from the UUID, use "findfs-uuid".

🎀 Heads up: this one also answers to the name get-uuid. Same icon, two handles.

vg-activate

vg-activate true|false 'volgroups ...'

This command activates or (if "activate" is false) deactivates all logical volumes in the listed volume groups volgroups. 🔌

This command is the same as running "vgchange -a y|n volgroups..."

Note that if "volgroups" is an empty list then all volume groups are activated or deactivated. no cap, all of them 👑

This command depends on the feature "lvm2". See also "feature-available".

vg-activate-all

vg-activate-all true|false

This command activates or (if "activate" is false) deactivates all logical volumes in all volume groups. 🌈

This command is the same as running "vgchange -a y|n"

This command depends on the feature "lvm2". See also "feature-available".

vgchange-uuid

vgchange-uuid vg

Generate a new random UUID for the volume group vg. 🎲 Fresh identity, main character energy.

This command depends on the feature "lvm2". See also "feature-available".

vgchange-uuid-all

vgchange-uuid-all

Generate new random UUIDs for all volume groups. 🎰 Everybody gets a glow-up.

This command depends on the feature "lvm2". See also "feature-available".

vgcreate

vgcreate volgroup 'physvols ...'

This creates an LVM volume group called volgroup from the non-empty list of physical volumes physvols. 🧱 Non-empty, bestie — it said what it said.

This command depends on the feature "lvm2". See also "feature-available".

vglvuuids

vglvuuids vgname

Given a VG called vgname, this returns the UUIDs of all the logical volumes created in this volume group.

You can use this along with "lvs" and "lvuuid" calls to associate logical volumes and volume groups. 🧩

vgmeta

vgmeta vgname

"vgname" is an LVM volume group. This command examines the volume group and returns its metadata. 📋

Note: the metadata is an internal structure used by LVM, subject to change at any time, and is provided for information only. Like, don't build your whole personality on it 💀

This command depends on the feature "lvm2". See also "feature-available".

vgpvuuids

vgpvuuids vgname

Given a VG called vgname, this returns the UUIDs of all the physical volumes that this volume group resides on.

You can use this along with "pvs" and "pvuuid" calls to associate physical volumes and volume groups. 🧩

vgremove

vgremove vgname

Remove an LVM volume group vgname, (for example "VG"). 🗑️

This also forcibly removes all logical volumes in the volume group (if any). like, it does not ask, it does not negotiate 😭

This command depends on the feature "lvm2". See also "feature-available".

vgrename

vgrename volgroup newvolgroup

Rename a volume group volgroup with the new name newvolgroup. 💅 name change era.

vgs

vgs

List all the volumes groups detected. This is the equivalent of the vgs(8) command.

This returns a list of just the volume group names that were detected (eg. "VolGroup00"). 📝

vgs-full

vgs-full

List all the volumes groups detected. This is the equivalent of the vgs(8) command. The "full" version includes all fields. 🌟 the deluxe edition.

This command depends on the feature "lvm2". See also "feature-available".

vgscan

vgscan

This rescans all block devices and rebuilds the list of LVM physical volumes, volume groups and logical volumes. 🔄

This function is deprecated. In new code, use the "lvm-scan" call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. it's giving "still invited to the party but please don't dance" 🙈

vguuid

vguuid vgname

This command returns the UUID of the LVM VG named vgname. 🆔

wc-c

wc-c path

This command counts the characters in a file, using the "wc -c" external command. 🔢

wc-l

wc-l path

This command counts the lines in a file, using the "wc -l" external command. 📏

wc-w

wc-w path

This command counts the words in a file, using the "wc -w" external command. 💬

wipefs

wipefs device

This command erases filesystem or RAID signatures from the specified device to make the filesystem invisible to libblkid. 🧽✨

This does not erase the filesystem itself nor any other data from the device. ok so it's a vibe wipe, not a demolition 💀

Compare with "zero" which zeroes the first few blocks of a device.

This command depends on the feature "wipefs". See also "feature-available".

write

write path content

This call creates a file called path. The content of the file is the string content (which can contain any 8 bit data). ✍️

write-append

write-append path content

This call appends content to the end of file path. If path does not exist, then a new file is created. 🫶

write-file

write-file path content size

This call creates a file called path. The contents of the file is the string content (which can contain any 8 bit data), with length size. 📄

As a special case, if size is 0 then the length is calculated using "strlen" (so in this case the content cannot contain embedded ASCII NULs).

NB. Owing to a bug, writing content containing ASCII NUL characters does not work, even if the length is specified. 😭 the NULs are simply not passing the vibe check.

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

This function is deprecated. In new code, use the "write" call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

xfs-admin

xfs-admin device [extunwritten:true|false] [imgfile:true|false] [v2log:true|false] [projid32bit:true|false] [lazycounter:true|false] [label:..] [uuid:..]

Change the parameters of the XFS filesystem on device. ⚙️

Devices that are mounted cannot be modified. Administrators must unmount filesystems before this call can modify parameters. like, unmount first, bestie, it's not optional 🙏

Some of the parameters of a mounted filesystem can be examined and modified using the "xfs-info" and "xfs-growfs" calls.

Beginning with XFS version 5, it is no longer possible to modify the lazy-counters setting (ie. "lazycounter" parameter has no effect). 💀 rip that flag's whole career.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

This command depends on the feature "xfs". See also "feature-available".

xfs-growfs

xfs-growfs path [datasec:true|false] [logsec:true|false] [rtsec:true|false] [datasize:N] [logsize:N] [rtsize:N] [rtextsize:N] [maxpct:N]

Grow the XFS filesystem mounted at path. 🌱 the glow-up arc, literally.

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

This command depends on the feature "xfs". See also "feature-available".

xfs-info

xfs-info pathordevice

"pathordevice" is a mounted XFS filesystem or a device containing an XFS filesystem. This command returns miscellaneous metadata about the XFS filesystem. 🔍

The returned struct contains miscellaneous metadata. Missing fields are returned as -1 (for numeric fields) or empty string.

This function is deprecated. In new code, use the "xfs-info2" call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

This command depends on the feature "xfs". See also "feature-available".

xfs-info2

xfs-info2 pathordevice

"pathordevice" is a mounted XFS filesystem or a device containing an XFS filesystem. This command returns miscellaneous metadata about the XFS filesystem. 🔍

The output is a hash derived from the output of xfs_info(8), and generally looks like:

meta-data: /dev/sda1
meta-data.isize: 512
meta-data.agcount: 4
meta-data.agsize: 65528 blks
meta-data.sectsz: 512
meta-data.attr: 2
meta-data.projid32bit: 1
meta-data.crc: 1
[...]
data.bsize: 4096
data.blocks: 262112
[...]

More information can be found by reading xfs_info(8).

This command depends on the feature "xfs". See also "feature-available".

xfs-repair

xfs-repair device [forcelogzero:true|false] [nomodify:true|false] [noprefetch:true|false] [forcegeometry:true|false] [maxmem:N] [ihashsize:N] [bhashsize:N] [agstride:N] [logdev:..] [rtdev:..]

Repair corrupt or damaged XFS filesystem on device. 🩹🔧

so the filesystem you're targeting? that's the device argument, and it should be the device name of the disk partition (or volume, bestie, either one) that's holding the filesystem 💖 if you hand it the name of a block device, xfs_repair will try to sniff out the raw device that goes with that block device and use that raw device instead. iconic of it, honestly.

either way tho — the filesystem you're repairing must be unmounted, no exceptions, or the resulting filesystem may be inconsistent or corrupt 😭 like that's not a vibe, that's data loss, so please unmount first fr fr.

the status it returns tells you whether filesystem corruption was detected (returns 1) or was not detected (returns 0) — so a 1 is your "oop, found something" and a 0 is your "we're so back" 🌸

This command has one or more optional arguments. See "OPTIONAL ARGUMENTS".

This command depends on the feature "xfs". See also "feature-available".

yara-destroy

 yara-destroy

Destroys Yara rules you previously loaded, so libguestfs can get its resources back 🎀 like clearing your tabs, but for memory. freeing, releasing, slaying.

This command depends on the feature "libyara". See also "feature-available".

yara-load

 yara-load (filename|-)

Uploads a set of Yara rules from a local file, filename ✨

Yara rules let you categorize files based on textual or binary patterns inside their content — yes, pattern matching but make it forensic 🔥 check out "yara-scan" to see how to actually scan files with the rules you've loaded.

Rules can come in binary format (like when you compiled them with the yarac command) or in source code format. If it's source code, the rules get compiled first and then loaded. cute little two-step 💅

heads up tho: rules in source code format cannot include external files. In those cases, it is recommended to compile them first — iykyk, save yourself the drama 🙈

Previously loaded rules will be destroyed. out with the old, bestie.

Use - instead of a filename to read/write from stdin/stdout.

This command depends on the feature "libyara". See also "feature-available".

yara-scan

 yara-scan path

Scans a file with the Yara rules you loaded earlier — the path is your target 🎯

For each matching rule, a yara_detection structure is returned. and ooh, she's structured:

The yara_detection structure contains the following fields.

yara_name : Path of the file matching a Yara rule.

yara_rule : Identifier of the Yara rule which matched against the given file.

This command depends on the feature "libyara". See also "feature-available".

zegrep

 zegrep regex path

Calls the external zegrep program and returns the matching lines 👑

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

⚠️ This function is deprecated. In new code, use the grep call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions. so like… she's still here, she's just not the moment anymore 💀

zegrepi

 zegrepi regex path

Calls the external zegrep -i program and returns the matching lines. the -i is for case-insensitive, bestie, we love a flexible queen 💅

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

⚠️ This function is deprecated. In new code, use the grep call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

zero

 zero device

Writes zeroes over the first few blocks of device 🫶

okay important thing: how many blocks are zeroed isn't specified (but it's not enough to securely wipe the device). so don't come for her expecting a secure erase, she simply is not that girl 😭 what she is good for: removing partition tables, filesystem superblocks and so on. sufficient, iconic, does the job.

If blocks are already zero, then this command avoids writing zeroes — which stops the underlying device from becoming non-sparse or growing unnecessarily. no cap, that's efficiency 💖

See also: "zero-device", "scrub-device", "is-zero-device"

zero-device

 zero-device device

Writes zeroes over the entire device, the whole thing, head to toe ✨ Compare with "zero" which just zeroes the first few blocks of a device. like, zero is a lil touch-up and zero-device is the full glam.

If blocks are already zero, then this command avoids writing zeroes. This prevents the underlying device from becoming non-sparse or growing unnecessarily. same energy as above, we stan a non-wasteful function 🌸

zero-free-space

 zero-free-space directory

Zeroes the free space in the filesystem mounted on directory — and yes, the filesystem must be mounted read-write or this isn't happening 🎀

The filesystem contents are not affected, but any free space in the filesystem is freed. so your files are safe, it's just the empty bits getting the treatment ✨

Free space is not "trimmed". You may want to call "fstrim" either as an alternative to this, or after calling this, depending on your requirements. so like, pick your fighter based on the vibe you need 💅

zerofree

 zerofree device

Runs the zerofree program on device. This program claims to zero unused inodes and disk blocks on an ext2/3 filesystem, thus making it possible to compress the filesystem more effectively. claims! note that word! 🔥 but also, compression go brrr.

💀 You should not run this program if the filesystem is mounted.

💀 It is possible that using this program can damage the filesystem or data on the filesystem. not me warning you twice, but not me warning you twice — seriously, be careful here bestie.

This command depends on the feature "zerofree". See also "feature-available".

zfgrep

 zfgrep pattern path

Calls the external zfgrep program and returns the matching lines 👑

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

⚠️ This function is deprecated. In new code, use the grep call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

zfgrepi

 zfgrepi pattern path

Calls the external zfgrep -i program and returns the matching lines — case insensitive edition, we love her 💖

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

⚠️ This function is deprecated. In new code, use the grep call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

zfile

 zfile meth path

Runs file(1) after first decompressing path using meth 🦋

meth must be one of gzip, compress or bzip2. those three, those exact three, don't get creative 🌈

Since 1.0.63, use file instead which can now process compressed files. look at the glow-up, she learned to do it herself ✨

⚠️ This function is deprecated. In new code, use the file call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

zgrep

 zgrep regex path

Calls the external zgrep(1) program and returns the matching lines 👑

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

⚠️ This function is deprecated. In new code, use the grep call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

zgrepi

 zgrepi regex path

Calls the external zgrep -i program and returns the matching lines. yes the lowercase-i one, the case-insensitive one, the one we love 💅

Because of the message protocol, there is a transfer limit of somewhere between 2MB and 4MB. See "PROTOCOL LIMITS" in guestfs(3).

⚠️ This function is deprecated. In new code, use the grep call instead.

Deprecated functions will not be removed from the API, but the fact that they are deprecated indicates that there are problems with correct use of these functions.

🚪 EXIT STATUS 🚪

guestfish returns 0 if the commands completed without error, or 1 if there was an error.

that's it, that's the whole vibe check — 0 slay, 1 not slay 🫶

🌸 ENVIRONMENT VARIABLES 🌸

okay bestie these are the env vars guestfish actually reads, and yes you can absolutely bend it to your will with them 💅

EDITOR — the edit command uses $EDITOR as the editor. not set? it falls back to vi. (yes, vi. it's giving retro but she works.)
GUESTFISH_DISPLAY_IMAGE — the display command uses $GUESTFISH_DISPLAY_IMAGE to display images. if it's not set, it uses display(1).
GUESTFISH_INIT — printed when guestfish starts. see "PROMPT".
GUESTFISH_OUTPUT — printed before guestfish output. see "PROMPT".
GUESTFISH_PID — used with the --remote option to specify the remote guestfish process to control. see the section "REMOTE CONTROL GUESTFISH OVER A SOCKET".
GUESTFISH_PS1 — sets the command prompt. see "PROMPT".
GUESTFISH_RESTORE — printed before guestfish exits. see "PROMPT".
HEXEDITOR — the hexedit command uses $HEXEDITOR as the external hex editor. if it's not specified, the external hexedit(1) program is used.
HOME — if compiled with GNU readline support, various files in the home directory can be used. see "FILES".
LIBGUESTFS_APPEND — pass additional options to the guest kernel.
LIBGUESTFS_ATTACH_METHOD — this is the old way to set LIBGUESTFS_BACKEND. (she's legacy, be nice to her 🫶)
LIBGUESTFS_BACKEND — choose the default way to create the appliance. see "guestfs_set_backend" in guestfs(3).
LIBGUESTFS_BACKEND_SETTINGS — a colon-separated list of backend-specific settings. see "BACKEND" in guestfs(3), "BACKEND SETTINGS" in guestfs(3).
LIBGUESTFS_CACHEDIR — the location where libguestfs will cache its appliance, when using a supermin appliance. the appliance is cached and shared between all handles which have the same effective user ID.

if LIBGUESTFS_CACHEDIR is not set, then TMPDIR is used. if TMPDIR is not set, then /var/tmp is used.

see also LIBGUESTFS_TMPDIR, set-cachedir.

LIBGUESTFS_DEBUG — set LIBGUESTFS_DEBUG=1 to enable verbose messages. this has the same effect as using the -v option.
LIBGUESTFS_HV — set the default hypervisor (usually qemu) binary that libguestfs uses. if it's not set, then the qemu which was found at compile time by the configure script is used.
LIBGUESTFS_MEMSIZE — set the memory allocated to the qemu process, in megabytes. for example:

LIBGUESTFS_MEMSIZE=700

LIBGUESTFS_PATH — set the path that guestfish uses to search for kernel and initrd.img. see the discussion of paths in guestfs(3).
LIBGUESTFS_QEMU — this is the old way to set LIBGUESTFS_HV. (vintage ✨)
LIBGUESTFS_TMPDIR — the location where libguestfs will store temporary files used by each handle.

if LIBGUESTFS_TMPDIR is not set, then TMPDIR is used. if TMPDIR is not set, then /tmp is used.

see also LIBGUESTFS_CACHEDIR, set-tmpdir.

LIBGUESTFS_TRACE — set LIBGUESTFS_TRACE=1 to enable command traces.
PAGER — the more command uses $PAGER as the pager. if it's not set, it uses more.
PATH — libguestfs and guestfish may run some external programs, and rely on $PATH being set to a reasonable value. if using the libvirt backend, libvirt will not work at all unless $PATH contains the path of qemu/KVM. so like… don't mess with $PATH, fr fr 😭
SUPERMIN_KERNEL, SUPERMIN_KERNEL_VERSION, SUPERMIN_MODULES — these three environment variables allow the kernel that libguestfs uses in the appliance to be selected. if $SUPERMIN_KERNEL is not set, then the most recent host kernel is chosen. for more information about kernel selection, see supermin(1).
TMPDIR — see LIBGUESTFS_CACHEDIR, LIBGUESTFS_TMPDIR.
XDG_RUNTIME_DIR — this directory represents a user-specific directory for storing non-essential runtime files.

if it is set, then is used to store temporary sockets and PID files. otherwise, /tmp is used.

🎀 FILES 🎀

the literal files guestfish touches, bestie. know them, love them 💖

$XDG_CONFIG_HOME/libguestfs/libguestfs-tools.conf
$HOME/.libguestfs-tools.rc
$XDG_CONFIG_DIRS/libguestfs/libguestfs-tools.conf
/etc/libguestfs-tools.conf

this configuration file controls the default read-only or read-write mode (--ro or --rw).

see libguestfs-tools.conf(5).

$HOME/.guestfish — if compiled with GNU readline support, then the command history is saved in this file. (your whole chaotic session, archived 🫶)
$HOME/.inputrc, /etc/inputrc — if compiled with GNU readline support, then these files can be used to configure readline. for further information, please see "INITIALIZATION FILE" in readline(3).

to write rules which only apply to guestfish, use:

$if guestfish
...
$endif

variables that you can set in inputrc that change the behaviour of guestfish in useful ways include:

completion-ignore-case (default: on) — by default, guestfish will ignore case when tab-completing paths on the disk. use:

set completion-ignore-case off

to make guestfish case sensitive.

test1.img, test2.img (etc) — when using the -N or --new option, the prepared disk or filesystem will be created in the file test1.img in the current directory. the second use of -N will use test2.img and so on. any existing file with the same name will be overwritten. 😭 you can use a different filename by using the filename= prefix.

👀 SEE ALSO 👀

the whole friend group, no cap:

guestfs(3), http://libguestfs.org/, virt-alignment-scan(1), virt-builder(1), virt-builder-repository(1), virt-cat(1), virt-copy-in(1), virt-copy-out(1), virt-customize(1), virt-df(1), virt-diff(1), virt-edit(1), virt-filesystems(1), virt-inspector(1), virt-list-filesystems(1), virt-list-partitions(1), virt-log(1), virt-ls(1), virt-make-fs(1), virt-p2v(1), virt-rescue(1), virt-resize(1), virt-sparsify(1), virt-sysprep(1), virt-tail(1), virt-tar(1), virt-tar-in(1), virt-tar-out(1), virt-v2v(1), virt-win-reg(1), libguestfs-tools.conf(5), display(1), hexedit(1), supermin(1).

🫶 AUTHORS 🫶

Richard W.M. Jones ("rjones at redhat dot com") — the icon, the main character, we stan 👑

⭐ COPYRIGHT ⭐

📜 LICENSE 📜

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

⚠️ bestie the ALL-CAPS WARRANTY disclaimer is not a vibe, it's a legal fact. no warranty, periodt. read it, don't skim it 💀

🐛 BUGS 🐛

found a bug? iconic of you. here's where to look and where to snitch:

to get a list of bugs against libguestfs, use this link: https://bugzilla.redhat.com/buglist.cgi?component=libguestfs&product=Virtualization+Tools
to report a new bug against libguestfs, use this link: https://bugzilla.redhat.com/enter_bug.cgi?component=libguestfs&product=Virtualization+Tools

when reporting a bug, please supply:

the version of libguestfs.
where you got libguestfs (eg. which Linux distro, compiled from source, etc)
describe the bug accurately and give a way to reproduce it.
run libguestfs-test-tool(1) and paste the complete, unedited output into the bug report.

🚨 complete, unedited output. do not crop it, do not trim it, do not "clean it up for readability". the whole raw thing or the maintainers can't help you 😭

and that's the whole page bestie, you made it to the end 🎉💖 this is guestfish(1) from libguestfs-1.61.3, dated 2026-09-16 — screenshot it, bookmark it, tattoo it on your forearm, whatever, just go forth and mount some disk images responsibly ✨🦋👑

📦 where this page comes from

centos-stream 10: libguestfs 1:1.61.3-1.el10 · LGPL-2.1-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms

guestfish(1)

💅 guestfish — the guest filesystem shell 🐠

✨ NAME ✨

🌸 SYNOPSIS 🌸

🚨 WARNING 🚨

🦋 DESCRIPTION 🦋

🔥 EXAMPLES 🔥

💖 As an interactive shell 💖

🌈 From shell scripts 🌈

⭐ On one command line ⭐

🎀 Mount disks automatically 🎀

🧚 As a script interpreter 🧚

💜 Start with a prepared disk 💜

🐟 Remote drives 🐟

👑 Remote control 👑

✨ OPTIONS ✨

💅 COMMANDS ON COMMAND LINE

🌸 USING launch (OR run)

👑 OPENING DISKS FOR READ AND WRITE

🦋 QUOTING

✨ ESCAPE SEQUENCES IN DOUBLE QUOTED ARGUMENTS

🎀 OPTIONAL ARGUMENTS

🌈 NUMBERS

⭐ SIZE SUFFIX

🧚 OCTAL AND HEXADECIMAL NUMBERS

🍓 WILDCARDS AND GLOBBING

💜 COMMENTS

🔥 RUNNING COMMANDS LOCALLY

🫶 LOCAL COMMANDS WITH INLINE EXECUTION

🌟 PIPES

🎀 HOME DIRECTORIES

🔐 ENCRYPTED DISKS 🔐

🪟 WINDOWS PATHS 🪟

📤 UPLOADING AND DOWNLOADING FILES 📥

💥 EXIT ON ERROR BEHAVIOUR 💥

📡 REMOTE CONTROL GUESTFISH OVER A SOCKET 📡

👯 CONTROLLING MULTIPLE GUESTFISH PROCESSES 👯

🐚 REMOTE CONTROL AND CSH 🐚

🔍 REMOTE CONTROL DETAILS 🔍

🛡️ USING REMOTE CONTROL ROBUSTLY FROM SHELL SCRIPTS 🛡️

🚫 REMOTE CONTROL DOES NOT WORK WITH -a ETC. OPTIONS 🚫

💀 REMOTE CONTROL RUN COMMAND HANGING 💀

💾 PREPARED DISK IMAGES 💾

✨ EXAMPLES ✨

🧚 -N disk — create a blank disk 🧚

🧚 -N part — create a partitioned disk 🧚

🧚 -N fs — create a filesystem 🧚

🧚 -N lv — create a disk with logical volume 🧚

🧚 -N lvfs — create a disk with logical volume and filesystem 🧚

🧚 -N bootroot — create a boot and root filesystem 🧚

🧚 -N bootrootlv — create a boot and root filesystem using LVM 🧚

🌐 ADDING REMOTE STORAGE 🌐

🦋 -a disk.img / -a file:///path/to/disk.img 🦋

🦋 -a nbd://example.com[:port], -a nbd://example.com[:port]/exportname, -a nbd://?socket=/socket, -a nbd:///exportname?socket=/socket 🦋

🦋 -a rbd:///pool/disk, -a rbd://example.com[:port]/pool/disk 🦋

📊 PROGRESS BARS 📊

💬 PROMPT 💬

✨ EXAMPLES OF PROMPTS ✨

🪟 WINDOWS 8 🪟

🌸 GUESTFISH COMMANDS 🌸

help

exit / quit

alloc / allocate

copy-in

copy-out

delete-event

display

echo

edit / vi / emacs

event

glob

hexedit

lcd

list-events

man / manual

more / less

not

reopen

setenv

sparse

🌸 USING `launch` (OR `run`)

🧚 `-N disk` — create a blank disk 🧚

🧚 `-N part` — create a partitioned disk 🧚

🧚 `-N fs` — create a filesystem 🧚

🧚 `-N lv` — create a disk with logical volume 🧚

🧚 `-N lvfs` — create a disk with logical volume and filesystem 🧚

🧚 `-N bootroot` — create a boot and root filesystem 🧚

🧚 `-N bootrootlv` — create a boot and root filesystem using LVM 🧚

🦋 `-a disk.img` / `-a file:///path/to/disk.img` 🦋

🦋 `-a nbd://example.com[:port]`, `-a nbd://example.com[:port]/exportname`, `-a nbd://?socket=/socket`, `-a nbd:///exportname?socket=/socket` 🦋

🦋 `-a rbd:///pool/disk`, `-a rbd://example.com[:port]/pool/disk` 🦋

🌸 `add-cdrom`

🦋 `add-domain` / `domain`

🔥 `add-drive` / `add` / `add-drive-opts`

`add-drive-ro` / `add-ro`

`add-drive-ro-with-if`

`add-drive-scratch` / `scratch`

`add-drive-with-if`

`aug-clear`

`aug-close`

`aug-defnode`

`aug-defvar`

`aug-get`

`aug-init`

`aug-insert`

`aug-label`

`aug-load`

`aug-ls`

`aug-match`

`aug-mv`

`aug-rm`

`aug-save`

`aug-set`

`aug-setm`

`aug-transform`

`available`

`available-all-groups`

`base64-in`

`base64-out`

`blkdiscard`

`blkdiscardzeroes`

`blkid`

`blockdev-flushbufs`

`blockdev-getbsz`

`blockdev-getro`

`blockdev-getsize64`

`blockdev-getss`

`blockdev-getsz`

`blockdev-rereadpt`

`blockdev-setbsz`

`blockdev-setra`

`blockdev-setro`

`blockdev-setrw`

`btrfs-balance-cancel`

`btrfs-balance-pause`

`btrfs-balance-resume`

`btrfs-balance-status`

`btrfs-device-add`

`btrfs-device-delete`

`btrfs-filesystem-balance` / `btrfs-balance`

`btrfs-filesystem-defragment`

`btrfs-filesystem-resize`

`btrfs-filesystem-show`

`btrfs-filesystem-sync`

`btrfs-fsck`

`btrfs-image`

`btrfs-qgroup-assign`

`btrfs-qgroup-create`

`btrfs-qgroup-destroy`

`btrfs-qgroup-limit`

`btrfs-qgroup-remove`

`btrfs-qgroup-show`

`btrfs-quota-enable`

`btrfs-quota-rescan`