ghostdock 0.0.13 → 0.0.15

package/dist/cli-reference.md

@@ -118,17 +118,19 @@ MCP tool: `images_add`.
 
 ### `ghostdock images add-compose`
 
-Add Compose files to the organization’s image catalog. Must include docker-compose.yml/yaml or compose.yml/yaml; ghostdock.* service labels become its manifest. Fails if the name is taken.
+Add a Compose project to the organization’s image catalog. Give its files, or a reference: a Compose project published as an OCI artifact (oci://…), used through include: with an optional override. ghostdock.* service labels (of the files, or of the override) become its manifest. Fails if the name is taken.
 
 ```
-ghostdock images add-compose --name <string> --files <object> [flags]
+ghostdock images add-compose --name <string> [flags]
 ```
 
 | Argument | Description |
 | --- | --- |
-| `--name <string>` | Image name, unique in the organization. Required. |
-| `--files <object>` | Compose files by file name. Must include docker-compose.yml/yaml or compose.yml/yaml. (JSON object) Required. |
 | `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--name <string>` | Image name, unique in the organization. Required. |
+| `--files <object>` | Compose files by file name. Must include docker-compose.yml/yaml or compose.yml/yaml. (JSON object) |
+| `--reference <string>` | A published Compose project instead of files, e.g. oci://docker.io/ghostdockhq/vm-compose:ubuntu-26.04. |
+| `--override <string>` | With reference: a Compose file merged into it (services, environment, labels). |
 
 MCP tool: `images_add_compose`.
 
@@ -194,7 +196,7 @@ MCP tool: `images_remove`.
 
 ### `ghostdock images update-compose`
 
-Replace a catalog Compose image’s files and/or name. Re-parses its labels.
+Replace a catalog Compose image’s files, reference, override and/or name. Re-parses its labels.
 
 ```
 ghostdock images update-compose <image-id> [flags]
@@ -205,6 +207,8 @@ ghostdock images update-compose <image-id> [flags]
 | `<image-id>` | Catalog image id, from images list or images get. Required. |
 | `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
 | `--files <object>` | New Compose files by file name. Omit to keep the current files. (JSON object) |
+| `--reference <string>` | A new reference (oci://…): the image becomes a Compose reference. |
+| `--override <string>` | A reference’s new override; null removes it. |
 | `--name <string>` | New image name. Omit to keep it. |
 
 MCP tool: `images_update_compose`.
@@ -749,7 +753,9 @@ ghostdock sandboxes commands get <command-id> --sandbox-id <string> --session-id
 | `<command-id>` | Command id returned by sandboxes commands run. Required. |
 | `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
 | `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
 | `--session-id <string>` | Session id returned by sandboxes commands run together with the commandId. Required. |
+| `--start` | Start the container first when it is not running, without asking. |
 
 MCP tool: `sandboxes_commands_get`.
 
@@ -766,7 +772,9 @@ ghostdock sandboxes commands kill <command-id> --sandbox-id <string> --session-i
 | `<command-id>` | Command id returned by sandboxes commands run. Required. |
 | `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
 | `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
 | `--session-id <string>` | Session id returned by sandboxes commands run together with the commandId. Required. |
+| `--start` | Start the container first when it is not running, without asking. |
 
 MCP tool: `sandboxes_commands_kill`.
 
@@ -783,8 +791,10 @@ ghostdock sandboxes commands logs <command-id> --sandbox-id <string> --session-i
 | `<command-id>` | Command id returned by sandboxes commands run. Required. |
 | `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
 | `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
 | `--session-id <string>` | Session id returned by sandboxes commands run together with the commandId. Required. |
 | `--offset <integer>` | Character offset to continue reading from. Default 0. |
+| `--start` | Start the container first when it is not running, without asking. |
 
 MCP tool: `sandboxes_commands_logs`.
 
@@ -800,13 +810,119 @@ ghostdock sandboxes commands run <sandbox-id> --command <string> [flags]
 | --- | --- |
 | `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
 | `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
 | `--command <string>` | Shell command to run. Never include secret values: commands are logged. Required. |
 | `--session-id <string>` | Session from sandboxes shells create, to keep cwd and environment from earlier commands. Omit for a one-off session. |
 | `--cwd <string>` | Directory to run the command in. |
 | `--wait-seconds <number>` | Seconds to wait before returning handles to poll: 1 to 120, default 120. |
+| `--start` | Start the container first when it is not running, without asking. |
 
 MCP tool: `sandboxes_commands_run`.
 
+### `ghostdock sandboxes containers`
+
+Containers of a sandbox’s Docker engine.
+
+### `ghostdock sandboxes containers list`
+
+List the containers of a sandbox, running or not. Each with state, health, restart policy, ports, Compose project and service, deletion protection, ghostdock.* labels, and which one is the default. A stopped sandbox lists none (it is not started for this).
+
+```
+ghostdock sandboxes containers list <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_containers_list`.
+
+### `ghostdock sandboxes containers logs`
+
+Read a container’s output, as docker logs does. Oldest first, each line with its stream (stdout, stderr) and time. The last tail lines (default 200), or with after only the lines after that time: pass the last line’s time to follow. truncated says lines were left out. A stopped sandbox has none (it is not started for this).
+
+```
+ghostdock sandboxes containers logs <sandbox-id> <container> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `<container>` | Container, by name. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--tail <integer>` | The last N lines (at most 5000). |
+| `--after <string>` | Only lines after this time: the time of the last line already read. |
+| `--follow` | Keep printing new lines until Ctrl-C. |
+| `--timestamps` | Put each line's time in front of it. |
+
+MCP tool: `sandboxes_containers_logs`.
+
+### `ghostdock sandboxes containers protection`
+
+Switch a container’s deletion protection on or off. A protected container cannot be removed or recreated (docker rm, compose down) until its protection is off. Starts the sandbox when needed.
+
+```
+ghostdock sandboxes containers protection <sandbox-id> <container> --protected <value> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `<container>` | Container, by name. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--protected` | true: protect it; false: allow removing it. Required. |
+
+MCP tool: `sandboxes_containers_protection`.
+
+### `ghostdock sandboxes containers restart`
+
+Restart a container, as docker restart does (stopping as docker stop does). Starts the sandbox when needed.
+
+```
+ghostdock sandboxes containers restart <sandbox-id> <container> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `<container>` | Container, by name. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_containers_restart`.
+
+### `ghostdock sandboxes containers start`
+
+Start a stopped container, as docker start does. A running container stays as it is. Starts the sandbox when needed.
+
+```
+ghostdock sandboxes containers start <sandbox-id> <container> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `<container>` | Container, by name. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_containers_start`.
+
+### `ghostdock sandboxes containers stop`
+
+Stop a container, as docker stop does. It gets its own stop signal, then a kill after its own stop timeout. It stays stopped while the sandbox sleeps and wakes, as Docker keeps a stopped container stopped, unless its restart policy is always. On a stopped sandbox it does nothing (note sandbox_stopped). The container main runs the sandbox: its stop is refused (main_is_the_sandbox), pause the sandbox instead. Deletion protection does not block it. note says when it was the default container or the last one running: then SSH, commands and files have nowhere to land until one runs.
+
+```
+ghostdock sandboxes containers stop <sandbox-id> <container> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `<container>` | Container, by name. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_containers_stop`.
+
 ### `ghostdock sandboxes create`
 
 Create a sandbox from a snapshot, OCI image, Dockerfile or Compose files. Inline content only: for a directory or ZIP (Dockerfile COPY/ADD, Compose build files) use `ghostdock sandboxes build`. Snapshots and catalog images can require environment entries, URL ports and MCP names (requiredEnvironment / requiredUrls / requiredMcps); a missing environment entry fails with its names (missingEnvironment), and removing a required URL or MCP fails with them (missingUrls / missingMcps). Returns once the sandbox is running, with `boot`: how long the sandbox (VM) and, when one was started, its container took to start, each in ms. Idle-stop and auto-delete apply (defaults 20 minutes / 14 days). Read the sandboxes skill (`ghostdock skills get sandboxes`) for sources, manifests, lifecycle and providers.
@@ -819,7 +935,7 @@ ghostdock sandboxes create --source <object> [flags]
 | --- | --- |
 | `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
 | `--display-name <string>` | Display name for the sandbox. Optional. |
-| `--source <object>` | What the sandbox boots from. Required. "image" boots an org catalog row by id ({ id } from images list / images get — images add OCI bookmarks, images add-dockerfile, and images add-compose rows) or any OCI ref ({ ref }); "dockerfile" builds inline Dockerfile text only (ghostdock.* LABEL lines parsed for manifest; this tool has no build directory, so COPY/ADD of local files fails — use the CLI `ghostdock sandboxes build --kind dockerfile` with a directory or ZIP); "compose" boots Docker-in-Docker from the given inline files (must include docker-compose.yml/yaml or compose.yml/yaml; ghostdock.* service labels parsed for manifest). A Compose project that needs extra files is not accepted here — use `ghostdock sandboxes build --kind compose`. Image, dockerfile, and compose sources never appear in snapshots list. Published static sites use sites publish (CDN), not a snapshot. (JSON object) Required. |
+| `--source <object>` | What the sandbox boots from. Required. "image" boots an org catalog row by id ({ id } from images list / images get — images add OCI bookmarks, images add-dockerfile, and images add-compose rows) or any OCI ref ({ ref }); "dockerfile" builds inline Dockerfile text only (ghostdock.* LABEL lines parsed for manifest; this tool has no build directory, so COPY/ADD of local files fails — use the CLI `ghostdock sandboxes build --kind dockerfile` with a directory or ZIP); "compose" boots Docker-in-Docker from the given inline files (must include docker-compose.yml/yaml or compose.yml/yaml; ghostdock.* service labels parsed for manifest). A Compose project that needs extra files is not accepted here — use `ghostdock sandboxes build --kind compose`. "compose" also takes a published Compose project instead of files ({ reference: "oci://…", override? }): it runs through include:, the override merged into it. Image, dockerfile, and compose sources never appear in snapshots list. Published static sites use sites publish (CDN), not a snapshot. (JSON object) Required. |
 | `--resources <object>` | Compute sizing. For image/dockerfile/compose: layered on platform defaults when omitted. For snapshot: optional override applied via resize after create. (JSON object) |
 | `--auto-stop-interval-minutes <number>` | Minutes of inactivity before the platform worker idle-stops the sandbox. -1 means always on. 0 is rejected. Omit for the platform default. Provider-native timers are optional backup. |
 | `--auto-delete-interval-minutes <number>` | Minutes the sandbox stays stopped before the platform worker deletes the record. 0 deletes it when it stops. -1 keeps it until a person deletes it. Omit for the platform default. Provider-native timers are optional backup. |
@@ -831,6 +947,24 @@ ghostdock sandboxes create --source <object> [flags]
 
 MCP tool: `sandboxes_create`.
 
+### `ghostdock sandboxes default-container`
+
+Show, set or clear the sandbox’s default container. SSH, the terminal, files, commands and MCP land there when no container is named. Without container or clear it only shows the setting.
+
+```
+ghostdock sandboxes default-container <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--container <string>` | Container to make the default, by name. The running sandbox must have it. |
+| `--clear` | Clear the default. |
+| `--start` | Start the container first when it is not running, without asking. |
+
+MCP tool: `sandboxes_default_container`.
+
 ### `ghostdock sandboxes delete`
 
 Permanently delete a sandbox and its files.
@@ -936,7 +1070,9 @@ ghostdock sandboxes files list <sandbox-id> [flags]
 | --- | --- |
 | `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
 | `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
 | `--path <string>` | Directory to list. Absolute or relative to /. Defaults to /workspace. |
+| `--start` | Start the container first when it is not running, without asking. |
 
 MCP tool: `sandboxes_files_list`.
 
@@ -953,6 +1089,8 @@ ghostdock sandboxes files read <path> --sandbox-id <string> [flags]
 | `<path>` | File path. Absolute or relative to / (for example /workspace/src/App.vue). Required. |
 | `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
 | `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `--start` | Start the container first when it is not running, without asking. |
 
 MCP tool: `sandboxes_files_read`.
 
@@ -1125,6 +1263,8 @@ ghostdock sandboxes shells close <session-id> --sandbox-id <string> [flags]
 | `<session-id>` | Session id from sandboxes shells create. Required. |
 | `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
 | `--sandbox-id <string>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `--start` | Start the container first when it is not running, without asking. |
 
 MCP tool: `sandboxes_shells_close`.
 
@@ -1140,7 +1280,9 @@ ghostdock sandboxes shells create <sandbox-id> [flags]
 | --- | --- |
 | `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
 | `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
 | `--session-id <string>` | Id for the new session: a slug; user-cmd, image-cmd and compose are reserved. Omit to generate one. |
+| `--start` | Start the container first when it is not running, without asking. |
 
 MCP tool: `sandboxes_shells_create`.
 
@@ -1160,6 +1302,8 @@ ghostdock sandboxes ssh get <sandbox-id> [flags]
 | --- | --- |
 | `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
 | `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--container <string>` | Container to work in, by name, from sandboxes containers list. Default: the sandbox’s default container, else the one running container. With several running and no default the call fails and lists them. |
+| `--start` | Start the container first when it is not running, without asking. |
 
 MCP tool: `sandboxes_ssh_get`.
 
@@ -1208,6 +1352,40 @@ ghostdock sandboxes stop <sandbox-id> [flags]
 
 MCP tool: `sandboxes_stop`.
 
+### `ghostdock sandboxes storage`
+
+### `ghostdock sandboxes storage delete`
+
+Delete a named volume or a top-level sandbox folder, with everything in it. Refused while a container mounts it (in any state: a stopped one counts, so stopping does not help), mounts a folder above it (a bind of /), or a volume keeps its data in the folder: remove those first.
+
+```
+ghostdock sandboxes storage delete <sandbox-id> --kind <string> --name <string> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+| `--kind <string>` | volume or folder. Required. |
+| `--name <string>` | The volume’s name, or the folder’s path in the sandbox (/srv, not /srv/app). Required. |
+
+MCP tool: `sandboxes_storage_delete`.
+
+### `ghostdock sandboxes storage list`
+
+List a sandbox’s volumes and sandbox folders. The sandbox folders are where bind mounts land. Each with its size and sizeState (measured; measuring: ask again in a few seconds; tooBig: too big to measure cheaply; outside: a volume bound outside the sandbox folders, not measured nor browsable) and the containers using it, plus every container’s mounts. truncated says entries were left out. A stopped sandbox lists none (it is not started for this).
+
+```
+ghostdock sandboxes storage list <sandbox-id> [flags]
+```
+
+| Argument | Description |
+| --- | --- |
+| `<sandbox-id>` | Sandbox name (e.g. quiet-harbor) or id, from sandboxes list or sandboxes create. Names are unique within the organization. Required. |
+| `--org <string>` | Organization id or slug, from organizations list. Ids survive renames; slugs change when the organization is renamed. Defaults to GHOSTDOCK_ORG, then `organizations use`. |
+
+MCP tool: `sandboxes_storage_list`.
+
 ### `ghostdock sandboxes tools`
 
 Tools of the MCP servers inside a sandbox.

package/dist/cli.md

@@ -314,6 +314,25 @@ ghostdock sandboxes create --org org_123 --display-name "Marketing site"
 ghostdock sandboxes urls create quiet-harbor --port 8080 --auto-wake true --public true
 ```
 
+#### Containers in a sandbox
+
+On Ghostdock Cloud a sandbox runs one Docker engine; everything in it is an ordinary container.
+`ssh get`, `files`, `commands` and `shells` land in one of them: `--container <name>`, else the
+sandbox's default container, else the one running container. With several running and no default,
+the CLI asks which one at the keyboard and offers to make it the default; without a terminal it
+fails and lists the names. A command runs as `docker exec` does there: as the container's
+`ghostdock.login.user`, else the image's `USER`, else root.
+
+```bash
+ghostdock sandboxes containers list quiet-harbor
+ghostdock sandboxes default-container quiet-harbor --container web     # --clear true removes it
+ghostdock sandboxes commands run quiet-harbor --container db --command 'pg_isready'
+ghostdock sandboxes containers protection quiet-harbor workstation --protected false
+```
+
+A shell session lives in its container: pass the same `--container` to every `shells` and
+`commands` call on it.
+
 #### Environment in a sandbox
 
 A sandbox exports **nothing** by default (unless you boot from an organization snapshot or catalog
@@ -612,12 +631,12 @@ or read [`cli-reference.md`](cli-reference.md) for every command's full descript
 | Command | What it does |
 | --- | --- |
 | `ghostdock images add --ref <string> [flags]` | Bookmark an OCI image ref in the organization’s image catalog. |
-| `ghostdock images add-compose --name <string> --files <object> [flags]` | Add Compose files to the organization’s image catalog. |
+| `ghostdock images add-compose --name <string> [flags]` | Add a Compose project to the organization’s image catalog. |
 | `ghostdock images add-dockerfile --name <string> --dockerfile <string> [flags]` | Add a Dockerfile to the organization’s image catalog. |
 | `ghostdock images get <image-id> [flags]` | Get one catalog image with its spec, manifest and requirements. |
 | `ghostdock images list [flags]` | List the images an organization can boot sandboxes from. |
 | `ghostdock images remove <image-id> [flags]` | Remove an image from the organization’s catalog. |
-| `ghostdock images update-compose <image-id> [flags]` | Replace a catalog Compose image’s files and/or name. |
+| `ghostdock images update-compose <image-id> [flags]` | Replace a catalog Compose image’s files, reference, override and/or name. |
 | `ghostdock images update-dockerfile <image-id> --dockerfile <string> [flags]` | Replace a catalog Dockerfile, optionally renaming it. |
 
 #### login
@@ -695,7 +714,14 @@ or read [`cli-reference.md`](cli-reference.md) for every command's full descript
 | `ghostdock sandboxes commands kill <command-id> --sandbox-id <string> --session-id <string> [flags]` | Interrupt a running shell command. |
 | `ghostdock sandboxes commands logs <command-id> --sandbox-id <string> --session-id <string> [flags]` | Get a page of a shell command’s stdout and stderr. |
 | `ghostdock sandboxes commands run <sandbox-id> --command <string> [flags]` | Run a shell command in a sandbox. |
+| `ghostdock sandboxes containers list <sandbox-id> [flags]` | List the containers of a sandbox, running or not. |
+| `ghostdock sandboxes containers logs <sandbox-id> <container> [flags]` | Read a container’s output, as docker logs does. |
+| `ghostdock sandboxes containers protection <sandbox-id> <container> --protected <value> [flags]` | Switch a container’s deletion protection on or off. |
+| `ghostdock sandboxes containers restart <sandbox-id> <container> [flags]` | Restart a container, as docker restart does (stopping as docker stop does). |
+| `ghostdock sandboxes containers start <sandbox-id> <container> [flags]` | Start a stopped container, as docker start does. |
+| `ghostdock sandboxes containers stop <sandbox-id> <container> [flags]` | Stop a container, as docker stop does. |
 | `ghostdock sandboxes create --source <object> [flags]` | Create a sandbox from a snapshot, OCI image, Dockerfile or Compose files. |
+| `ghostdock sandboxes default-container <sandbox-id> [flags]` | Show, set or clear the sandbox’s default container. |
 | `ghostdock sandboxes delete <sandbox-id> [flags]` | Permanently delete a sandbox and its files. |
 | `ghostdock sandboxes env delete <name> --sandbox-id <string> [flags]` | Delete one of a sandbox’s own variables or secrets. |
 | `ghostdock sandboxes env get <sandbox-id> [flags]` | Get a sandbox’s environment: selections, bindings and local entries. |
@@ -718,6 +744,8 @@ or read [`cli-reference.md`](cli-reference.md) for every command's full descript
 | `ghostdock sandboxes ssh revoke <sandbox-id> [flags]` | Revoke a sandbox’s active SSH access. |
 | `ghostdock sandboxes status <sandbox-id> [flags]` | Get a sandbox’s status and lifecycle deadlines without waking it. |
 | `ghostdock sandboxes stop <sandbox-id> [flags]` | Stop a running sandbox without deleting its files. |
+| `ghostdock sandboxes storage delete <sandbox-id> --kind <string> --name <string> [flags]` | Delete a named volume or a top-level sandbox folder, with everything in it. |
+| `ghostdock sandboxes storage list <sandbox-id> [flags]` | List a sandbox’s volumes and sandbox folders. |
 | `ghostdock sandboxes tools call <name> --sandbox-id <string> --arguments <object> [flags]` | Call a tool on an MCP server inside a sandbox. |
 | `ghostdock sandboxes tools list <sandbox-id> [flags]` | List the tools of the MCP servers a sandbox exposes. |
 | `ghostdock sandboxes update <sandbox-id> [flags]` | Change a sandbox’s display name, idle-stop or auto-delete interval. |