Operate · 14 min

Command guide

A beginner-friendly reference for Linux services, Git, Docker, and Compose—with PAUIOps-specific safe defaults.

Know when sudo is needed

Use sudo for system-wide service installation, package changes, protected ownership repair, reboot, and shutdown. Do not add sudo to routine Git, project files, Docker commands already authorized for the service user, or status reads that work unprivileged.

systemd and journal logs

bash

sudo systemctl start pauiops
sudo systemctl stop pauiops
sudo systemctl restart pauiops
sudo systemctl enable pauiops
sudo systemctl disable pauiops
systemctl status pauiops
journalctl -u pauiops.service -n 100 --no-pager
journalctl -u docker.service -n 100 --no-pager

Linux ownership and permission basics

The owner, group, and mode decide who may read, write, or traverse a path. Directories need execute permission for traversal; a writable repository is still unreachable when a private parent directory blocks traversal. Use ls -ld for the target and namei -l for every parent component before changing ownership.

bash

ls -ld <actual-repository-path>
namei -l <actual-repository-path>
id <service-user>

# PAUIOps-scoped repair
sudo /usr/local/bin/pauiops -repair-permissions

Fix Git dubious ownership

When git status reports fatal: detected dubious ownership, first confirm the User and Group in the installed Manager unit. The repository owner must match that service identity. A direct root-account installation normally uses the dedicated pauiops account and /srv/pauiops/repos. An installation invoked with sudo by a non-root operator normally uses that original username and can keep the project below /home/<username>.

Inspect the Manager and repository owners

systemctl show pauiops.service -p User -p Group --no-pager
ls -ld <actual-repository-path> <actual-repository-path>/.git
namei -l <actual-repository-path>

Root-account installation

sudo chown -R pauiops:docker /srv/pauiops/repos

Non-root installation

pauiops_owner="deploy"
pauiops_project_folder="cktPMSWebApp"
sudo chown -R "$pauiops_owner":docker "/home/$pauiops_owner/$pauiops_project_folder"

Replace deploy and cktPMSWebApp with the actual non-root service username and project folder. If systemd reports a group other than docker, use that reported group. Scope chown to the configured managed root or exact project; never run it over the entire home directory.

Verify as the Manager service user

sudo -u <service-user> -H git -C <actual-repository-path> status

Git workflows

bash

git status
git diff
git add <file>
git commit -m "Describe the change"
git fetch
git pull
git push
git branch --all
git switch <branch>
git stash push -m "Before pull"
git stash pop
git revert <commit>

PAUIOps pull and push preflight takes priority over generic sync advice. It fetches the primary remote before calculating ahead/behind state. When local work exists, choose the guided commit/synchronize/push or stash/synchronize/restore path. Existing same-named remote branches can regain an upstream; new branches publish with upstream tracking.

Docker and Compose

bash

docker images
docker ps --all
docker logs <container>
docker inspect <container>
docker exec -it <container> sh
docker volume ls
docker network ls

docker compose up -d
docker compose down
docker compose build
docker compose pull
docker compose logs
docker compose ps
docker compose config
docker compose restart

Define quick commands with commands.md

Preset buttons in the Shell terminal come from a markdown file at the project root, not from environment configuration. Manager looks for commands.md first, then git-commands.md, then docker-commands.md — the first file found wins.

Example commands.md

# Deploy

# Pull the latest changes
```bash
git pull
```

# Restart the stack
```bash
docker compose up -d
```

Every command line inside a bash/sh/shell fenced block becomes one button, labeled with the command itself.
The tooltip comes from a # comment directly above the line, else the paragraph before the block, else the nearest heading. An H1 heading groups the buttons beneath it.
$ prompts are stripped, trailing-backslash lines are joined, and {{input}} marks a command as requiring a value collected before it runs.
Clicking a preset opens a confirmation dialog with the purpose, the exact resolved command, and a copy button before anything executes.

What non-admin terminal users can do

Non-admin terminal workflows are constrained to the Git and Docker operations allowed by their global role and selected project assignment. Approved top-level && chains remain bounded; they are not handed to an unrestricted shell. Typed input goes through a local line discipline — prompt, echo, backspace, history, and Ctrl+C/U/W/L — that still enforces the same validation as before. Administrators receive a full PTY and therefore cross a wider trust boundary.