Skip to main content
For first-time installation, see the CLI overview. The msb install reference has moved to Sandbox commands. The msb uninstall reference has moved to Sandbox commands.

​
msb context

Show the selected backend, API endpoint, and how it was selected. Credentials are not printed. Alias: msb ctx.
All forms accept --format json. Listing and preference changes do not resolve credentials, contact cloud, or open the sandbox database. Incomplete or prohibited profiles remain visible. Plain msb context resolves the backend and reports configuration or credential errors. Environment variables and managed selection can override your saved preference; the command warns when they do. reset leaves those overrides and backend restrictions in effect. Add profiles in config.json; there is no context add command. An invalid configuration or empty backend allowlist stops these commands. To recover from a user restriction that leaves no usable profile, edit allowed_backends in your config file. For managed restrictions, contact your administrator.

​
msb self

Diagnose, update, downgrade, or remove the CLI. msb doctor, msb update (alias: upgrade), and msb downgrade are also available at the top level.
msb self update always targets the latest release; it does not accept a version argument. Use msb self downgrade <version> to move to a supported older release. Run downgrade from the newer CLI before replacing it: the older binary does not contain rollback steps for newer migrations. If you already installed an older binary and see database schema is newer than this msb binary, follow the catalog recovery steps. Snapshot groups can also block downgrade. Only one downgrade can run per installation. A second command fails immediately; wait for the first to finish or cancel it before retrying. Downgrade checks compatibility and requires affected sandboxes to be stopped. Releases below 0.6.0 and irreversible state changes are rejected. Database rollback creates a retained backup unless --no-backup is set; affected image caches are cleared unless --keep-cache is set. Doctor reports supported virtualization and storage capabilities. Disabled interrupt acceleration is a performance warning, not a failed health check; doctor does not reload kernel modules. A temporary clone probe checks whether flat roots can use native copy-on-write. Probe files are removed afterward. See Performance for details. See Performance for interpreting these checks, choosing sandbox-level policies, and preparing the host storage and virtualization environment.