CLI Reference

Containment Chamber exposes four top-level command families:

Command	Purpose
containment-chamber server	Run the signer process. Runtime options are documented in the Configuration Reference.
containment-chamber operator	Break-glass seal, status inspection, TEE attestation, and auth policy and token management.
containment-chamber config	Local configuration utilities.
containment-chamber completions	Generate shell completion scripts.

Use --help at any level for the exact flags accepted by the installed binary:

containment-chamber --help
containment-chamber server --help
containment-chamber operator auth token create --help

Server

containment-chamber server starts the signing server.

containment-chamber server -c config.yaml

Server configuration can come from:

1. containment-chamber server flags
2. CONTAINMENT_ environment variables
3. YAML config
4. built-in defaults

See Configuration Reference for the server config tree, environment variable names, defaults, and matching server flags.

Operator

containment-chamber operator commands call the signer API. Under the kms_auto-static custody model, the chamber initialises and unseals itself automatically at boot — no init ceremony, no unseal quorum, no passphrase. Operator commands cover break-glass control (seal), health inspection (status, attestation), and auth management (auth).

Common global options (all are --global; valid on every subcommand):

Option	Purpose
--signer-url	Signer URL. Defaults to http://localhost:9000.
--allow-plaintext-signer	Permit HTTP operator calls for non-enclave development deployments.
--signer-ca-cert	Trust a file-mode TLS CA certificate.
--known-measurements	Path to the RA-TLS TOFU measurement store for enclave measurement pinning.
--attestation-max-age-seconds	Maximum accepted age for a server attestation document before it is rejected as stale.

operator seal

Break-glass seal. Requires a token with chamber_seal scope.

containment-chamber operator seal \
  --auth-token env:CC_ROOT_TOKEN \
  --signer-url https://signer:9443

Writes a cluster-wide SEAL_OVERRIDE latch to the state table (HMAC’d with a master-key subkey), zeroises the in-memory master key on the local replica, and clears the auth plane. Every replica’s background watcher observes the latch and seals. The latch persists across restarts, so the cluster is sealed fleet-wide until recovery.

Recovery requires out-of-band IAM access: issue a DeleteItem on the SEAL_OVERRIDE row (pk attribute = SEAL_OVERRIDE) in the signer state table, then restart every replica. There is no HTTP unseal endpoint.

operator status

Inspect chamber seal state and backend health. Requires a token with chamber_status scope.

containment-chamber operator status \
  --auth-token env:CC_AUTH_TOKEN \
  --signer-url https://signer:9443

Returns the current seal state (unsealed or sealed), the count of loaded validator keys, and a backend health summary.

operator attestation

Fetch the NSM attestation document. Requires a token with chamber_status scope.

containment-chamber operator attestation \
  --auth-token env:CC_AUTH_TOKEN \
  --signer-url https://signer:9443

Returns the Nitro Secure Module attestation document for the running enclave. Use it to verify PCR0 measurements and confirm the compiled-in ceremony parameters are present in the attestation. Available only on Nitro builds; returns an error on non-enclave deployments.

Auth

operator auth manages state-backed auth policies and tokens. Stateless deployments use static_auth in server configuration instead; see Auth Policies & Tokens.

Policy commands:

Command	Purpose
operator auth policy create	Create a policy from JSON rules.
operator auth policy list	List policies.
operator auth policy get	Get one policy.
operator auth policy update	Replace a policy’s rules.
operator auth policy delete	Delete a policy.

Token commands:

Command	Purpose
operator auth token create	Create a client token (policies, TTL, metadata, optional CIDR binding), or a management token with --management. Auth administration is management-token-only.
operator auth token list	List tokens by accessor and metadata.
operator auth token lookup	Inspect one token by accessor.
operator auth token revoke	Revoke one token by accessor.

Token flags: seal, status, and attestation use --auth-token; all auth subcommands use --token. Both accept env:VAR_NAME or stdin. Literal token values are refused for operator safety.

Config

containment-chamber config digest computes the expected merged_config_digest for a YAML file.

containment-chamber config digest -f config.yaml

Use it to compare a local config file with the merged_config_digest emitted on the server’s server_started log event.

Completions

Generate shell completions with:

containment-chamber completions bash
containment-chamber completions zsh
containment-chamber completions fish

The supported shell names are reported by:

containment-chamber completions --help