AnchoreCTL Reference
AnchoreCTL (anchorectl) is the command-line client for Anchore Enterprise. Every
function available in the Anchore Enterprise UI is built on the same APIs that
AnchoreCTL calls, so anything you can do in the browser you can also do from a
terminal or a CI pipeline.
This is the complete reference for the AnchoreCTL command set: every command group,
every subcommand, and every flag with its environment variable and default. Each
top-level command group has its own page; the Command Index below
links to every individual command. It describes AnchoreCTL
v6.2.1; run anchorectl version to check yours.
AnchoreCTL reads its settings from a configuration file, environment variables, and
command-line flags, in ascending order of precedence. This page documents the flags;
for the configuration file and the full list of ANCHORECTL_* variables, see
Configuring AnchoreCTL.
Related Pages
- Deploying AnchoreCTL — download and install the binary for Linux, macOS, or Windows.
- Configuring AnchoreCTL — the configuration file, environment variables, and how settings are resolved.
- AnchoreCTL Release Notes — what changed in each release.
Command Syntax
anchorectl [command] [subcommand] [ARGUMENTS] [flags]
Arguments shown in UPPER_CASE in a command synopsis are positional and required.
Anything in [square brackets] is optional. A trailing ..., as in
anchorectl image delete IMAGE..., means the argument can be repeated.
In the flag tables on each page, the Flag column shows exactly what you type and the Type column shows the kind of value it takes:
| Type | Meaning |
|---|---|
bool | Takes no value. The flag’s presence turns it on, as in --wait. |
string | Takes one value, as in --output json. |
string (repeatable) | Takes one value and may be given more than once, as in --annotation owner=platform-team --annotation commit=a3f7c01. |
int | Takes a whole number, as in --timeout 300. |
count | Takes no value; repeat it to increase the effect, as in -vv. |
Global Flags
These four flags are accepted by every command.
| Flag | Type | Environment variable | Default | Required | Description |
|---|---|---|---|---|---|
-c, --config | string | ANCHORECTL_CONFIG | "" | No | Path to the AnchoreCTL configuration file. Bypasses the default search order. |
-h, --help | bool | — | false | No | Show help for the command and exit. |
-q, --quiet | bool | ANCHORECTL_QUIET | false | No | Suppress all logging output. Results are still written to stdout. |
-v, --verbose | count | ANCHORECTL_VERBOSITY | 0 | No | Increase log verbosity. -v sets info, -vv sets debug. Takes precedence over log.level. |
The settings that connect you to Anchore Enterprise — url, username, password,
and account — have no command-line flags at all. Set them in the configuration file
or through ANCHORECTL_URL, ANCHORECTL_USERNAME, ANCHORECTL_PASSWORD, and
ANCHORECTL_ACCOUNT. See Configuring AnchoreCTL.
registry add --username and user add --account are unrelated flags with their own
variables — the registry’s credential and the new user’s account.
Output Formats
-o/--output selects how results are printed. It is not a global flag — it is
defined per command, on 127 of the 148 commands, and the root command does not accept
it at all. Values and defaults differ per command; each command’s flag table lists
what it accepts. ANCHORECTL_FORMAT sets it on most of them, though
anchorectl image sbom, anchorectl system artifact-lifecycle-policy add and
update, and anchorectl version ignore the variable and need the flag passed
explicitly.
The app version export commands are the main exception. They emit a document rather
than a result listing, so they take --format for the document format and --file to
write it to disk instead of stdout. anchorectl image one-time-scan likewise uses
--format together with --output-directory.
| Value | Description |
|---|---|
text | Human-readable table. The default for most commands. |
json | Structured JSON, normalized by AnchoreCTL. |
json-raw | The unmodified JSON response from the Anchore Enterprise API. Use this when you need fields AnchoreCTL does not surface. |
id | The identifier of the affected object only. Useful for shell pipelines. |
csv | Comma-separated values, for export commands. |
html | Self-contained HTML report. Set ui-url in your configuration to make the report link back to the Anchore Enterprise UI. |
cyclonedx-json | CycloneDX document in JSON form. |
cyclonedx-xml | CycloneDX document in XML form. |
spdx-json | SPDX document in JSON form. |
spdx-tag-value | SPDX document in tag-value form. |
syft-json | Syft’s native JSON SBOM format. The default for anchorectl image sbom. |
purls | A plain list of Package URLs. |
table | Syft’s table rendering of an SBOM. |
--output-directory — available on anchorectl image check,
anchorectl image vulnerabilities, and anchorectl image one-time-scan — accepts
only json, json-raw, html, and csv. Any other value, including the default
text, fails with output directory can only be used with json, json-raw, html, or csv output format.
On anchorectl image vulnerabilities, the cyclonedx-json and cyclonedx-xml
formats require an image digest. Passing a tag fails with
digest required to call GetImage.
Exit Codes
| Code | Meaning |
|---|---|
0 | The command ran successfully. |
1 | The command failed — a request error, invalid input, or an unreachable server. |
The exit code reflects whether the command itself ran, not the outcome of a policy
evaluation: a fail result is still a successful command and exits 0. To make a
failing evaluation break a CI build, pass -f/--fail-based-on-results to
anchorectl image check or anchorectl app version policy status get, or
--fail-on-policy-error to anchorectl image one-time-scan.
Command Index
Each page below documents that command’s complete subcommand tree, with every flag and argument.
- account — Account related operations
- airgap — Airgap related operations
- app — App related operations
- archive — Archive rule and image operations
- auth — Auth related operations for the current user
- completion — Generate the autocompletion script for anchorectl for the specified shell.
- correction — Correction related operations
- event — Event related operations
- feed — Feed related operations
- generate — Generate analysis artifacts locally
- image — Image related operations
- inventory — Inventory list operation
- policy — Policy related operations
- registry — Registry credential operations
- repo — Repository related operations
- stig — STIG related operations
- subscription — Subscription related operations
- system — System related operations
- user — User related operations
- usergroup — User Group Management Operations
- version — Show anchorectl version information