*nix shell commands

NOTE: This page was generated from the OpenBolt source code based on version 5.6.0 on 2026-07-03 19:37:31 +0000. Do not edit it here; fix it upstream.

Command syntax

Bolt shell commands follow a noun-verb convention.

To view a full list of available commands, use the bolt help command:

bolt help

Commands

These subcommands, actions, and options are available for Bolt.

apply

Apply Puppet manifest code on the specified targets.

Documentation For documentation see http://pup.pt/bolt-apply.

Usage

bolt apply [manifest] {--targets TARGETS | --query QUERY | --rerun FILTER}
      [options]
</tbody> </table> ### command run Run a command on the specified targets. Documentation For documentation see http://pup.pt/bolt-commands. **Usage** ```bash bolt command run {--targets TARGETS | --query QUERY | --rerun FILTER} [options] ```
Option Description
-t, --targets TARGETS Identifies the targets of the command.

For more information, see 'bolt guide targets'.</td> </tr>

-q, --query QUERY Query PuppetDB to determine the targets.
--rerun FILTER Retry on targets from the last run.

Available filters are 'all', 'failure', and 'success'.</td> </tr>

-u, --user USER User to authenticate as.
-p, --password PASSWORD Password to authenticate with.
--password-prompt Prompt for user to input password.
--private-key KEY Path to private ssh key to authenticate with.
--[no-]host-key-check Check host keys with SSH.
--[no-]ssl Use SSL with WinRM.
--[no-]ssl-verify Verify remote host SSL certificate with WinRM.
--run-as USER User to run as using privilege escalation.
--sudo-password PASSWORD Password for privilege escalation.
--sudo-password-prompt Prompt for user to input escalation password.
--sudo-executable EXEC Experimental. Specify an executable for running as another user.
-c, --concurrency CONCURRENCY Maximum number of simultaneous connections.
-i, --inventoryfile PATH Specify where to load inventory from (default: <project>/inventory.yaml).
--[no-]save-rerun Whether to update the rerun file after this command.
--[no-]cleanup Whether to clean up temporary files created on targets.
--puppetdb INSTANCE The named PuppetDB instance to connect to by default.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
-m, --modulepath MODULES List of directories containing modules, separated by ':'

Directories are case-sensitive.</td> </tr>

--transport TRANSPORT Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm.

For more information, see 'bolt guide transports'.</td> </tr>

--connect-timeout TIMEOUT Connection timeout in seconds (defaults vary).
--[no-]tty Request a pseudo TTY on targets that support it.
--[no-]native-ssh Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
--ssh-command EXEC Experimental. Executable to use instead of the net-ssh Ruby library.
--copy-command EXEC Experimental. Command to copy files to remote hosts if using native SSH.
--choria-config-file PATH Path to a Choria/MCollective client configuration file.
--choria-mcollective-certname NAME Override the MCollective certname for Choria client identity.

The choria-mcorpc-support library identifies non-root clients

as '<username>.mcollective', which fails when authenticating

with a certificate that has a different CN (e.g. the host's

Puppet cert). Set this to the CN of the certificate being used.</td> </tr>

--choria-ssl-ca PATH CA certificate path for Choria TLS authentication.
--choria-ssl-cert PATH Client certificate path for Choria TLS authentication.
--choria-ssl-key PATH Client private key path for Choria TLS authentication.
--choria-collective NAME Choria collective to route messages through.
--choria-puppet-environment ENV Puppet environment for bolt_tasks file downloads (default: 'production').
--choria-rpc-timeout SECONDS Seconds to wait for replies to individual Choria RPC calls (default: 30).
--choria-task-timeout SECONDS Seconds to wait for task execution to complete (default: 300).
--choria-command-timeout SECONDS Seconds to wait for commands and scripts to complete (default: 60).
--choria-brokers BROKERS Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
--choria-broker-timeout SECONDS Seconds to wait for the TCP connection to a Choria broker (default: 30).
--format FORMAT Output format to use: human, json, or rainbow.
--[no-]color Whether to show output in color.
-v, --[no-]verbose Display verbose logging.
--trace Display error stack traces.
--stream Stream output from scripts and commands to the console.

Run with --no-verbose to prevent Bolt from displaying output

a second time after the action is completed.</td> </tr>

-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--noop See what changes Bolt will make without actually executing the changes.
-e, --execute CODE Puppet manifest code to apply to the targets.
--compile-concurrency CONCURRENCY Maximum number of simultaneous manifest block compiles (default: number of cores).
--hiera-config PATH Specify where to load Hiera config from (default: <project>/hiera.yaml).
</tbody> </table> ### file download Download a file or directory from one or more targets. Downloaded files and directories are saved to the a subdirectory matching the target's name under the destination directory. The destination directory is expanded relative to the downloads subdirectory of the project directory. Documentation For documentation see http://pup.pt/bolt-commands. **Usage** ```bash bolt file download {--targets TARGETS | --query QUERY | --rerun FILTER} [options] ```
Option Description
-t, --targets TARGETS Identifies the targets of the command.

For more information, see 'bolt guide targets'.</td> </tr>

-q, --query QUERY Query PuppetDB to determine the targets.
--rerun FILTER Retry on targets from the last run.

Available filters are 'all', 'failure', and 'success'.</td> </tr>

-u, --user USER User to authenticate as.
-p, --password PASSWORD Password to authenticate with.
--password-prompt Prompt for user to input password.
--private-key KEY Path to private ssh key to authenticate with.
--[no-]host-key-check Check host keys with SSH.
--[no-]ssl Use SSL with WinRM.
--[no-]ssl-verify Verify remote host SSL certificate with WinRM.
--run-as USER User to run as using privilege escalation.
--sudo-password PASSWORD Password for privilege escalation.
--sudo-password-prompt Prompt for user to input escalation password.
--sudo-executable EXEC Experimental. Specify an executable for running as another user.
-c, --concurrency CONCURRENCY Maximum number of simultaneous connections.
-i, --inventoryfile PATH Specify where to load inventory from (default: <project>/inventory.yaml).
--[no-]save-rerun Whether to update the rerun file after this command.
--[no-]cleanup Whether to clean up temporary files created on targets.
--puppetdb INSTANCE The named PuppetDB instance to connect to by default.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
-m, --modulepath MODULES List of directories containing modules, separated by ':'

Directories are case-sensitive.</td> </tr>

--transport TRANSPORT Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm.

For more information, see 'bolt guide transports'.</td> </tr>

--connect-timeout TIMEOUT Connection timeout in seconds (defaults vary).
--[no-]tty Request a pseudo TTY on targets that support it.
--[no-]native-ssh Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
--ssh-command EXEC Experimental. Executable to use instead of the net-ssh Ruby library.
--copy-command EXEC Experimental. Command to copy files to remote hosts if using native SSH.
--choria-config-file PATH Path to a Choria/MCollective client configuration file.
--choria-mcollective-certname NAME Override the MCollective certname for Choria client identity.

The choria-mcorpc-support library identifies non-root clients

as '<username>.mcollective', which fails when authenticating

with a certificate that has a different CN (e.g. the host's

Puppet cert). Set this to the CN of the certificate being used.</td> </tr>

--choria-ssl-ca PATH CA certificate path for Choria TLS authentication.
--choria-ssl-cert PATH Client certificate path for Choria TLS authentication.
--choria-ssl-key PATH Client private key path for Choria TLS authentication.
--choria-collective NAME Choria collective to route messages through.
--choria-puppet-environment ENV Puppet environment for bolt_tasks file downloads (default: 'production').
--choria-rpc-timeout SECONDS Seconds to wait for replies to individual Choria RPC calls (default: 30).
--choria-task-timeout SECONDS Seconds to wait for task execution to complete (default: 300).
--choria-command-timeout SECONDS Seconds to wait for commands and scripts to complete (default: 60).
--choria-brokers BROKERS Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
--choria-broker-timeout SECONDS Seconds to wait for the TCP connection to a Choria broker (default: 30).
--format FORMAT Output format to use: human, json, or rainbow.
--[no-]color Whether to show output in color.
-v, --[no-]verbose Display verbose logging.
--trace Display error stack traces.
--stream Stream output from scripts and commands to the console.

Run with --no-verbose to prevent Bolt from displaying output

a second time after the action is completed.</td> </tr>

-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--env-var ENVIRONMENT_VARIABLES Environment variables to set on the target.
</tbody> </table> ### file upload Upload a local file or directory. Documentation For documentation see http://pup.pt/bolt-commands. **Usage** ```bash bolt file upload {--targets TARGETS | --query QUERY | --rerun FILTER} [options] ```
Option Description
-t, --targets TARGETS Identifies the targets of the command.

For more information, see 'bolt guide targets'.</td> </tr>

-q, --query QUERY Query PuppetDB to determine the targets.
--rerun FILTER Retry on targets from the last run.

Available filters are 'all', 'failure', and 'success'.</td> </tr>

-u, --user USER User to authenticate as.
-p, --password PASSWORD Password to authenticate with.
--password-prompt Prompt for user to input password.
--private-key KEY Path to private ssh key to authenticate with.
--[no-]host-key-check Check host keys with SSH.
--[no-]ssl Use SSL with WinRM.
--[no-]ssl-verify Verify remote host SSL certificate with WinRM.
--run-as USER User to run as using privilege escalation.
--sudo-password PASSWORD Password for privilege escalation.
--sudo-password-prompt Prompt for user to input escalation password.
--sudo-executable EXEC Experimental. Specify an executable for running as another user.
-c, --concurrency CONCURRENCY Maximum number of simultaneous connections.
-i, --inventoryfile PATH Specify where to load inventory from (default: <project>/inventory.yaml).
--[no-]save-rerun Whether to update the rerun file after this command.
--[no-]cleanup Whether to clean up temporary files created on targets.
--puppetdb INSTANCE The named PuppetDB instance to connect to by default.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
-m, --modulepath MODULES List of directories containing modules, separated by ':'

Directories are case-sensitive.</td> </tr>

--transport TRANSPORT Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm.

For more information, see 'bolt guide transports'.</td> </tr>

--connect-timeout TIMEOUT Connection timeout in seconds (defaults vary).
--[no-]tty Request a pseudo TTY on targets that support it.
--[no-]native-ssh Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
--ssh-command EXEC Experimental. Executable to use instead of the net-ssh Ruby library.
--copy-command EXEC Experimental. Command to copy files to remote hosts if using native SSH.
--choria-config-file PATH Path to a Choria/MCollective client configuration file.
--choria-mcollective-certname NAME Override the MCollective certname for Choria client identity.

The choria-mcorpc-support library identifies non-root clients

as '<username>.mcollective', which fails when authenticating

with a certificate that has a different CN (e.g. the host's

Puppet cert). Set this to the CN of the certificate being used.</td> </tr>

--choria-ssl-ca PATH CA certificate path for Choria TLS authentication.
--choria-ssl-cert PATH Client certificate path for Choria TLS authentication.
--choria-ssl-key PATH Client private key path for Choria TLS authentication.
--choria-collective NAME Choria collective to route messages through.
--choria-puppet-environment ENV Puppet environment for bolt_tasks file downloads (default: 'production').
--choria-rpc-timeout SECONDS Seconds to wait for replies to individual Choria RPC calls (default: 30).
--choria-task-timeout SECONDS Seconds to wait for task execution to complete (default: 300).
--choria-command-timeout SECONDS Seconds to wait for commands and scripts to complete (default: 60).
--choria-brokers BROKERS Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
--choria-broker-timeout SECONDS Seconds to wait for the TCP connection to a Choria broker (default: 30).
--format FORMAT Output format to use: human, json, or rainbow.
--[no-]color Whether to show output in color.
-v, --[no-]verbose Display verbose logging.
--trace Display error stack traces.
--stream Stream output from scripts and commands to the console.

Run with --no-verbose to prevent Bolt from displaying output

a second time after the action is completed.</td> </tr>

-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
</tbody> </table> ### group show Show the list of groups in the inventory. Documentation To learn more about the inventory run 'bolt guide inventory'. **Usage** ```bash bolt group show [options] ```
Option Description
-t, --targets TARGETS Identifies the targets of the command.

For more information, see 'bolt guide targets'.</td> </tr>

-q, --query QUERY Query PuppetDB to determine the targets.
--rerun FILTER Retry on targets from the last run.

Available filters are 'all', 'failure', and 'success'.</td> </tr>

-u, --user USER User to authenticate as.
-p, --password PASSWORD Password to authenticate with.
--password-prompt Prompt for user to input password.
--private-key KEY Path to private ssh key to authenticate with.
--[no-]host-key-check Check host keys with SSH.
--[no-]ssl Use SSL with WinRM.
--[no-]ssl-verify Verify remote host SSL certificate with WinRM.
--run-as USER User to run as using privilege escalation.
--sudo-password PASSWORD Password for privilege escalation.
--sudo-password-prompt Prompt for user to input escalation password.
--sudo-executable EXEC Experimental. Specify an executable for running as another user.
-c, --concurrency CONCURRENCY Maximum number of simultaneous connections.
-i, --inventoryfile PATH Specify where to load inventory from (default: <project>/inventory.yaml).
--[no-]save-rerun Whether to update the rerun file after this command.
--[no-]cleanup Whether to clean up temporary files created on targets.
--puppetdb INSTANCE The named PuppetDB instance to connect to by default.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
-m, --modulepath MODULES List of directories containing modules, separated by ':'

Directories are case-sensitive.</td> </tr>

--transport TRANSPORT Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm.

For more information, see 'bolt guide transports'.</td> </tr>

--connect-timeout TIMEOUT Connection timeout in seconds (defaults vary).
--[no-]tty Request a pseudo TTY on targets that support it.
--[no-]native-ssh Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
--ssh-command EXEC Experimental. Executable to use instead of the net-ssh Ruby library.
--copy-command EXEC Experimental. Command to copy files to remote hosts if using native SSH.
--choria-config-file PATH Path to a Choria/MCollective client configuration file.
--choria-mcollective-certname NAME Override the MCollective certname for Choria client identity.

The choria-mcorpc-support library identifies non-root clients

as '<username>.mcollective', which fails when authenticating

with a certificate that has a different CN (e.g. the host's

Puppet cert). Set this to the CN of the certificate being used.</td> </tr>

--choria-ssl-ca PATH CA certificate path for Choria TLS authentication.
--choria-ssl-cert PATH Client certificate path for Choria TLS authentication.
--choria-ssl-key PATH Client private key path for Choria TLS authentication.
--choria-collective NAME Choria collective to route messages through.
--choria-puppet-environment ENV Puppet environment for bolt_tasks file downloads (default: 'production').
--choria-rpc-timeout SECONDS Seconds to wait for replies to individual Choria RPC calls (default: 30).
--choria-task-timeout SECONDS Seconds to wait for task execution to complete (default: 300).
--choria-command-timeout SECONDS Seconds to wait for commands and scripts to complete (default: 60).
--choria-brokers BROKERS Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
--choria-broker-timeout SECONDS Seconds to wait for the TCP connection to a Choria broker (default: 30).
--format FORMAT Output format to use: human, json, or rainbow.
--[no-]color Whether to show output in color.
-v, --[no-]verbose Display verbose logging.
--trace Display error stack traces.
--stream Stream output from scripts and commands to the console.

Run with --no-verbose to prevent Bolt from displaying output

a second time after the action is completed.</td> </tr>

-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--tmpdir DIR The directory to upload and execute temporary files on the target.
</tbody> </table> ### guide View guides for Bolt's concepts and features. Omitting a topic will display a list of available guides, while providing a topic will display the relevant guide. **Usage** ```bash bolt guide [topic] [options] ```
Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
--format FORMAT Output format to use: human, json, or rainbow.
-i, --inventoryfile PATH Specify where to load inventory from (default: <project>/inventory.yaml).
</tbody> </table> ### inventory show Show the list of targets an action would run on. This command will list all targets in the project's inventory by default. To filter the targets in the list, use the --targets, --query, or --rerun options. To view detailed configuration and data for targets, use the --detail option. To learn more about the inventory run 'bolt guide inventory'. Documentation To learn more about the inventory run 'bolt guide inventory'. **Usage** ```bash bolt inventory show [options] ```
Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--format FORMAT Output format to use: human, json, or rainbow.
</tbody> </table> ### lookup Look up a value with Hiera. Documentation Learn more about using Hiera with Bolt at https://pup.pt/bolt-hiera. **Usage** ```bash bolt lookup {--targets TARGETS | --query QUERY | --rerun FILTER | --plan-hierarchy} [options] ```
Option Description
-t, --targets TARGETS Identifies the targets of the command.

For more information, see 'bolt guide targets'.</td> </tr>

-q, --query QUERY Query PuppetDB to determine the targets.
--rerun FILTER Retry on targets from the last run.

Available filters are 'all', 'failure', and 'success'.</td> </tr>

-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
--format FORMAT Output format to use: human, json, or rainbow.
-i, --inventoryfile PATH Specify where to load inventory from (default: <project>/inventory.yaml).
--detail Show resolved configuration for the targets.
</tbody> </table> ### module add Add a module to the project. Module declarations are loaded from the project's configuration file. Bolt will automatically resolve all module dependencies, generate a Puppetfile, and install the modules. Documentation To learn more about Bolt modules, run 'bolt guide module'. **Usage** ```bash bolt module add [options] ```
Option Description
-t, --targets TARGETS Identifies the targets of the command.

For more information, see 'bolt guide targets'.</td> </tr>

-q, --query QUERY Query PuppetDB to determine the targets.
--rerun FILTER Retry on targets from the last run.

Available filters are 'all', 'failure', and 'success'.</td> </tr>

-u, --user USER User to authenticate as.
-p, --password PASSWORD Password to authenticate with.
--password-prompt Prompt for user to input password.
--private-key KEY Path to private ssh key to authenticate with.
--[no-]host-key-check Check host keys with SSH.
--[no-]ssl Use SSL with WinRM.
--[no-]ssl-verify Verify remote host SSL certificate with WinRM.
--run-as USER User to run as using privilege escalation.
--sudo-password PASSWORD Password for privilege escalation.
--sudo-password-prompt Prompt for user to input escalation password.
--sudo-executable EXEC Experimental. Specify an executable for running as another user.
-c, --concurrency CONCURRENCY Maximum number of simultaneous connections.
-i, --inventoryfile PATH Specify where to load inventory from (default: <project>/inventory.yaml).
--[no-]save-rerun Whether to update the rerun file after this command.
--[no-]cleanup Whether to clean up temporary files created on targets.
--puppetdb INSTANCE The named PuppetDB instance to connect to by default.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
-m, --modulepath MODULES List of directories containing modules, separated by ':'

Directories are case-sensitive.</td> </tr>

--transport TRANSPORT Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm.

For more information, see 'bolt guide transports'.</td> </tr>

--connect-timeout TIMEOUT Connection timeout in seconds (defaults vary).
--[no-]tty Request a pseudo TTY on targets that support it.
--[no-]native-ssh Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
--ssh-command EXEC Experimental. Executable to use instead of the net-ssh Ruby library.
--copy-command EXEC Experimental. Command to copy files to remote hosts if using native SSH.
--choria-config-file PATH Path to a Choria/MCollective client configuration file.
--choria-mcollective-certname NAME Override the MCollective certname for Choria client identity.

The choria-mcorpc-support library identifies non-root clients

as '<username>.mcollective', which fails when authenticating

with a certificate that has a different CN (e.g. the host's

Puppet cert). Set this to the CN of the certificate being used.</td> </tr>

--choria-ssl-ca PATH CA certificate path for Choria TLS authentication.
--choria-ssl-cert PATH Client certificate path for Choria TLS authentication.
--choria-ssl-key PATH Client private key path for Choria TLS authentication.
--choria-collective NAME Choria collective to route messages through.
--choria-puppet-environment ENV Puppet environment for bolt_tasks file downloads (default: 'production').
--choria-rpc-timeout SECONDS Seconds to wait for replies to individual Choria RPC calls (default: 30).
--choria-task-timeout SECONDS Seconds to wait for task execution to complete (default: 300).
--choria-command-timeout SECONDS Seconds to wait for commands and scripts to complete (default: 60).
--choria-brokers BROKERS Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
--choria-broker-timeout SECONDS Seconds to wait for the TCP connection to a Choria broker (default: 30).
--format FORMAT Output format to use: human, json, or rainbow.
--[no-]color Whether to show output in color.
-v, --[no-]verbose Display verbose logging.
--trace Display error stack traces.
--stream Stream output from scripts and commands to the console.

Run with --no-verbose to prevent Bolt from displaying output

a second time after the action is completed.</td> </tr>

-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--hiera-config PATH Specify where to load Hiera config from (default: <project>/hiera.yaml).
--plan-hierarchy Look up a value with Hiera in the context of a specific plan.
</tbody> </table> ### module generate-types Generate type references to register in plans. To learn more about Bolt modules, run 'bolt guide module'. Documentation To learn more about Bolt modules, run 'bolt guide module'. **Usage** ```bash bolt module generate-types [options] ```
Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).

Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
-m, --modulepath MODULES List of directories containing modules, separated by ':'

Directories are case-sensitive.</td> </tr> </tbody> </table> ### module install Install the project's modules. Module declarations are loaded from the project's configuration file. Bolt will automatically resolve all module dependencies, generate a Puppetfile, and install the modules. Documentation To learn more about Bolt modules, run 'bolt guide module'. **Usage** ```bash bolt module install [options] ```

Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
--force Force a destructive action.
--[no-]resolve Use --no-resolve to install modules listed in the Puppetfile without resolving modules configured

in Bolt project configuration.</td> </tr> </tbody> </table> ### module show List modules available to the Bolt project. Providing the name of a module will display detailed documentation for the module. Documentation To learn more about Bolt modules, run 'bolt guide module'. **Usage** ```bash bolt module show [module name] [options] ```

Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
-m, --modulepath MODULES List of directories containing modules, separated by ':'

Directories are case-sensitive.</td> </tr> </tbody> </table> ### plan convert Convert a YAML plan to a Puppet language plan and print the converted plan to stdout. Converting a YAML plan might result in a plan that is syntactically correct but has different behavior. Always verify a converted plan's functionality. Note that the converted plan is not written to a file. Documentation Learn more about Bolt plans at https://pup.pt/bolt-plans. **Usage** ```bash bolt plan convert [options] ```

Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
-m, --modulepath MODULES List of directories containing modules, separated by ':'

Directories are case-sensitive.</td> </tr> </tbody> </table> ### plan new Create a new plan in the current project. Documentation Learn more about Bolt plans at https://pup.pt/bolt-plans. **Usage** ```bash bolt plan new [options] ```

</tbody> </table> ### plan run Run a plan on the specified targets. Documentation Learn more about Bolt plans at https://pup.pt/bolt-plans. **Usage** ```bash bolt plan run [parameters] [options] ```
Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
--pp Create a new Puppet language plan.
</tbody> </table> ### plan show Show available plans and plan documentation. Omitting the name of a plan will display a list of plans available in the Bolt project. Providing the name of a plan will display detailed documentation for the plan, including a list of available parameters. Documentation Learn more about Bolt plans at https://pup.pt/bolt-plans. **Usage** ```bash bolt plan show [plan name] [options] ```
Option Description
-t, --targets TARGETS Identifies the targets of the command.

For more information, see 'bolt guide targets'.</td> </tr>

-q, --query QUERY Query PuppetDB to determine the targets.
--rerun FILTER Retry on targets from the last run.

Available filters are 'all', 'failure', and 'success'.</td> </tr>

-u, --user USER User to authenticate as.
-p, --password PASSWORD Password to authenticate with.
--password-prompt Prompt for user to input password.
--private-key KEY Path to private ssh key to authenticate with.
--[no-]host-key-check Check host keys with SSH.
--[no-]ssl Use SSL with WinRM.
--[no-]ssl-verify Verify remote host SSL certificate with WinRM.
--run-as USER User to run as using privilege escalation.
--sudo-password PASSWORD Password for privilege escalation.
--sudo-password-prompt Prompt for user to input escalation password.
--sudo-executable EXEC Experimental. Specify an executable for running as another user.
-c, --concurrency CONCURRENCY Maximum number of simultaneous connections.
-i, --inventoryfile PATH Specify where to load inventory from (default: <project>/inventory.yaml).
--[no-]save-rerun Whether to update the rerun file after this command.
--[no-]cleanup Whether to clean up temporary files created on targets.
--puppetdb INSTANCE The named PuppetDB instance to connect to by default.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
-m, --modulepath MODULES List of directories containing modules, separated by ':'

Directories are case-sensitive.</td> </tr>

--transport TRANSPORT Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm.

For more information, see 'bolt guide transports'.</td> </tr>

--connect-timeout TIMEOUT Connection timeout in seconds (defaults vary).
--[no-]tty Request a pseudo TTY on targets that support it.
--[no-]native-ssh Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
--ssh-command EXEC Experimental. Executable to use instead of the net-ssh Ruby library.
--copy-command EXEC Experimental. Command to copy files to remote hosts if using native SSH.
--choria-config-file PATH Path to a Choria/MCollective client configuration file.
--choria-mcollective-certname NAME Override the MCollective certname for Choria client identity.

The choria-mcorpc-support library identifies non-root clients

as '<username>.mcollective', which fails when authenticating

with a certificate that has a different CN (e.g. the host's

Puppet cert). Set this to the CN of the certificate being used.</td> </tr>

--choria-ssl-ca PATH CA certificate path for Choria TLS authentication.
--choria-ssl-cert PATH Client certificate path for Choria TLS authentication.
--choria-ssl-key PATH Client private key path for Choria TLS authentication.
--choria-collective NAME Choria collective to route messages through.
--choria-puppet-environment ENV Puppet environment for bolt_tasks file downloads (default: 'production').
--choria-rpc-timeout SECONDS Seconds to wait for replies to individual Choria RPC calls (default: 30).
--choria-task-timeout SECONDS Seconds to wait for task execution to complete (default: 300).
--choria-command-timeout SECONDS Seconds to wait for commands and scripts to complete (default: 60).
--choria-brokers BROKERS Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
--choria-broker-timeout SECONDS Seconds to wait for the TCP connection to a Choria broker (default: 30).
--format FORMAT Output format to use: human, json, or rainbow.
--[no-]color Whether to show output in color.
-v, --[no-]verbose Display verbose logging.
--trace Display error stack traces.
--stream Stream output from scripts and commands to the console.

Run with --no-verbose to prevent Bolt from displaying output

a second time after the action is completed.</td> </tr>

-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--params PARAMETERS Parameters to a task or plan as json, a json file '@<file>', or on stdin '-'.
--compile-concurrency CONCURRENCY Maximum number of simultaneous manifest block compiles (default: number of cores).
--tmpdir DIR The directory to upload and execute temporary files on the target.
--hiera-config PATH Specify where to load Hiera config from (default: <project>/hiera.yaml).
</tbody> </table> ### plugin show Show available plugins. Documentation Learn more about Bolt plugins at https://pup.pt/bolt-plugins. **Usage** ```bash bolt plugin show [options] ```
Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
-m, --modulepath MODULES List of directories containing modules, separated by ':'

Directories are case-sensitive.</td> </tr>

--filter FILTER Filter tasks and plans by a matching substring.
--format FORMAT Output format to use: human, json, or rainbow.
</tbody> </table> ### policy apply Apply a policy to the specified targets. **Usage** ```bash bolt policy apply [options] ```
Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--[no-]color Whether to show output in color.
--format FORMAT Output format to use: human, json, or rainbow.
-m, --modulepath MODULES List of directories containing modules, separated by ':'

Directories are case-sensitive.</td> </tr>

--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
</tbody> </table> ### policy new Create a new policy in the current project. **Usage** ```bash bolt policy new [options] ```
Option Description
-t, --targets TARGETS Identifies the targets of the command.

For more information, see 'bolt guide targets'.</td> </tr>

-q, --query QUERY Query PuppetDB to determine the targets.
--rerun FILTER Retry on targets from the last run.

Available filters are 'all', 'failure', and 'success'.</td> </tr>

-u, --user USER User to authenticate as.
-p, --password PASSWORD Password to authenticate with.
--password-prompt Prompt for user to input password.
--private-key KEY Path to private ssh key to authenticate with.
--[no-]host-key-check Check host keys with SSH.
--[no-]ssl Use SSL with WinRM.
--[no-]ssl-verify Verify remote host SSL certificate with WinRM.
--run-as USER User to run as using privilege escalation.
--sudo-password PASSWORD Password for privilege escalation.
--sudo-password-prompt Prompt for user to input escalation password.
--sudo-executable EXEC Experimental. Specify an executable for running as another user.
-c, --concurrency CONCURRENCY Maximum number of simultaneous connections.
-i, --inventoryfile PATH Specify where to load inventory from (default: <project>/inventory.yaml).
--[no-]save-rerun Whether to update the rerun file after this command.
--[no-]cleanup Whether to clean up temporary files created on targets.
--puppetdb INSTANCE The named PuppetDB instance to connect to by default.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
-m, --modulepath MODULES List of directories containing modules, separated by ':'

Directories are case-sensitive.</td> </tr>

--transport TRANSPORT Specify a default transport: choria, docker, jail, local, lxd, podman, remote, ssh, winrm.

For more information, see 'bolt guide transports'.</td> </tr>

--connect-timeout TIMEOUT Connection timeout in seconds (defaults vary).
--[no-]tty Request a pseudo TTY on targets that support it.
--[no-]native-ssh Experimental. Whether to shell out to native SSH or use the net-ssh Ruby library.
--ssh-command EXEC Experimental. Executable to use instead of the net-ssh Ruby library.
--copy-command EXEC Experimental. Command to copy files to remote hosts if using native SSH.
--choria-config-file PATH Path to a Choria/MCollective client configuration file.
--choria-mcollective-certname NAME Override the MCollective certname for Choria client identity.

The choria-mcorpc-support library identifies non-root clients

as '<username>.mcollective', which fails when authenticating

with a certificate that has a different CN (e.g. the host's

Puppet cert). Set this to the CN of the certificate being used.</td> </tr>

--choria-ssl-ca PATH CA certificate path for Choria TLS authentication.
--choria-ssl-cert PATH Client certificate path for Choria TLS authentication.
--choria-ssl-key PATH Client private key path for Choria TLS authentication.
--choria-collective NAME Choria collective to route messages through.
--choria-puppet-environment ENV Puppet environment for bolt_tasks file downloads (default: 'production').
--choria-rpc-timeout SECONDS Seconds to wait for replies to individual Choria RPC calls (default: 30).
--choria-task-timeout SECONDS Seconds to wait for task execution to complete (default: 300).
--choria-command-timeout SECONDS Seconds to wait for commands and scripts to complete (default: 60).
--choria-brokers BROKERS Choria broker addresses in host or host:port format (comma-separated). Port defaults to 4222 if omitted.
--choria-broker-timeout SECONDS Seconds to wait for the TCP connection to a Choria broker (default: 30).
--format FORMAT Output format to use: human, json, or rainbow.
--[no-]color Whether to show output in color.
-v, --[no-]verbose Display verbose logging.
--trace Display error stack traces.
--stream Stream output from scripts and commands to the console.

Run with --no-verbose to prevent Bolt from displaying output

a second time after the action is completed.</td> </tr>

-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--compile-concurrency CONCURRENCY Maximum number of simultaneous manifest block compiles (default: number of cores).
--hiera-config PATH Specify where to load Hiera config from (default: <project>/hiera.yaml).
--noop See what changes Bolt will make without actually executing the changes.
</tbody> </table> ### policy show Show available policies. **Usage** ```bash bolt policy show [options] ```
Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
</tbody> </table> ### project init Create a new Bolt project in the current working directory. Specify a name for the Bolt project. Defaults to the basename of the current working directory. Documentation To learn more about Bolt projects, run 'bolt guide project'. **Usage** ```bash bolt project init [name] [options] ```
Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).

Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--modules MODULES A comma-separated list of modules to install from the Puppet Forge

when initializing a project. Resolves and installs all dependencies.</td> </tr> </tbody> </table> ### project migrate Migrate a Bolt project to use current best practices and the latest version of configuration files. Documentation To learn more about Bolt projects, run 'bolt guide project'. **Usage** ```bash bolt project migrate [options] ```

</tbody> </table> ### script run Run a script on the specified targets. Arguments passed to a script are passed literally and are not interpolated by the shell. Any arguments containing spaces or special characters should be quoted. Documentation Learn more about running scripts at https://pup.pt/bolt-commands. **Usage** ```bash bolt script run

Option Description
-h, --help Display help.
--version Display the version.
--log-level LEVEL Set the log level for the console. Available options are

trace, debug, info, warn, error, fatal.</td> </tr>

--clear-cache Clear plugin, plan, and task caches before executing.
--project PATH Path to load the Bolt project from (default: autodiscovered from current dir).
-i, --inventoryfile PATH Specify where to load inventory from (default: <project>/inventory.yaml).

Last updated: