---
title: Handy CLI tools
description: A handful of terminal tools worth installing on a home server, what each one replaces, and step-by-step instructions to install and use them.
---


:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

A minimal Debian install ships with the strict minimum, which means the tools you get are the ones from 1995. They work, but reading `df` output or hunting for what filled a disk with `du` is needlessly painful when better versions exist and cost nothing to install.

Everything below except the last one comes straight from Debian's repositories, so there's no third-party source to trust and `apt` keeps them updated along with the rest of the system.

::note{to="/general/linux/cli-basics"}
Every command here is typed in a terminal over SSH. If `sudo`, `apt` and `cd` don't mean much yet, start with the **command line basics**.
::

## The short version

| Tool | Replaces | What for |
| --- | --- | --- |
| `btop` | `top`, `htop` | Watching CPU, RAM and processes |
| `duf` | `df -h` | Free space, readable |
| `ncdu` | `du -sh` | Finding what filled the disk |
| `tldr` | `man` | The five commands you actually need |
| `lazydocker` | `docker ps` and friends | Managing containers over SSH |
| `ufw` | raw `iptables` | A firewall you can actually read |

## The impatient version

One line installs all the packaged ones, and each section below explains what you just got.

```bash [Terminal]
sudo apt update
sudo apt install btop duf ncdu tealdeer ufw
```

## btop, watching what the machine is doing

The modern replacement for `top` and `htop`: CPU, RAM, disks, network and processes on one screen, with graphs, colors and a working mouse. This is what you open when something feels slow.

::steps{level="4"}
#### Install it

```bash [Terminal]
sudo apt install btop
```

#### Run it

```bash [Terminal]
sudo btop
```

![btop showing CPU, memory, disks, network and processes](/img/global/linux/btop.png)

Click a process to select it, :kbd{value="Esc"} opens the menu, :kbd{value="Q"} quits. The `+` and `-` keys fold and unfold the panels if the screen feels crowded.

#### Done !
::

## duf, disk space that reads like a table

`df -h` prints every loop device Docker ever created and leaves you squinting at the columns. `duf` shows the same information grouped, aligned and colored, with a usage bar per filesystem.

::steps{level="4"}
#### Install it

```bash [Terminal]
sudo apt install duf
```

#### Run it

```bash [Terminal]
sudo duf
```

![duf listing local, network and special filesystems](/img/global/linux/duf.png)

Local disks, network shares and system mounts are grouped separately. Add `--only local` to hide the pseudo-filesystems Docker leaves behind.

#### Done !
::

## ncdu, finding what ate the disk

When `duf` tells you the disk is full, `ncdu` tells you why. It walks a folder, sorts everything by real size, and lets you drill down with the arrow keys instead of running `du -sh *` twenty times.

::steps{level="4"}
#### Install it

```bash [Terminal]
sudo apt install ncdu
```

#### Point it at a folder

```bash [Terminal]
sudo ncdu /srv/docker
```

Arrows to move, :kbd{value="Enter"} to open a folder, :kbd{value="D"} to delete the selected item, :kbd{value="Q"} to quit. On a big disk the first scan takes a moment, it's reading everything.

::warning
:kbd{value="D"} deletes immediately, with a single confirmation and no recycle bin. Run `ncdu` without `sudo` when you're only looking, so a mistyped key can't touch anything the system owns.
::

#### Done !
::

## tldr, the manual without the 400 lines

`man tar` is exhaustive and unreadable. `tldr tar` gives you the five commands people actually type, with a one-line explanation each. It's community-maintained examples rather than a substitute for the real manual, and on Debian the client is packaged as `tealdeer`.

::steps{level="4"}
#### Install it

```bash [Terminal]
sudo apt install tealdeer
```

#### Download the page cache

```bash [Terminal]
tldr --update
```

The examples are fetched once and stored locally, so the command works offline afterwards. Run it again every few months.

#### Ask it something

```bash [Terminal]
tldr rsync
```

#### Done !
::

## lazydocker, managing containers from the terminal

The one exception: it isn't packaged by Debian. It's a full text interface for Docker, containers, images, volumes and logs in one screen, with keys to restart, stop or follow the logs of anything. Handy when you're already in SSH and don't feel like opening Dockge.

::steps{level="4"}
#### Download the latest release

```bash [Terminal]
curl -Lo /tmp/lazydocker.tar.gz "https://github.com/jesseduffield/lazydocker/releases/latest/download/lazydocker_0.25.2_Linux_x86_64.tar.gz"
```

Check the [releases page](https://github.com/jesseduffield/lazydocker/releases) for the current version number, and take `arm64` instead of `x86_64` if the server is a Raspberry Pi or similar.

#### Install the binary

```bash [Terminal]
sudo tar -xzf /tmp/lazydocker.tar.gz -C /usr/local/bin lazydocker
rm /tmp/lazydocker.tar.gz
```

`/usr/local/bin` is the folder meant for software you install yourself, which is why `apt` never touches it.

#### Check it landed

```bash [Terminal]
lazydocker --version
```

#### Run it

```bash [Terminal]
sudo lazydocker
```

![lazydocker showing services, containers, images, volumes and a container's config](/img/global/linux/lazydocker.png)

It needs access to the Docker socket, hence the `sudo` unless your user is in the `docker` group. The keys worth knowing:

| Key | What it does |
| --- | --- |
| `1` to `6` | Jump to a panel: projects, services, containers, images, volumes, networks |
| Arrows | Move inside the panel, the right side follows the selection |
| :kbd{value="Enter"} | Focus the main panel on the right, :kbd{value="Esc"} comes back |
| `x` | Open the menu of everything you can do with what's selected |
| `m` | Follow the logs |
| `s` / `r` / `p` | Stop, restart, pause the selected container |
| `E` | Open a shell inside the container |
| `d` | Remove it |
| `b` | Bulk commands, pruning images and volumes among others |
| `/` | Filter the list |
| `+` and `_` | Grow or shrink the panels |
| `q` | Quit |

Case matters: `E` opens a shell in the container, `e` hides the stopped ones.

The [full list](https://github.com/jesseduffield/lazydocker/blob/master/docs/keybindings/Keybindings_en.md) is in the project's documentation.

::note
Being outside `apt` also means it won't be updated by `apt full-upgrade`. Repeat these steps when you want a newer version.
::

#### Done !
::

## ufw, a firewall you can actually read

Debian's firewall (`iptables`/`nftables` under the hood) is powerful and unreadable directly. `ufw`, *uncomplicated firewall*, is a thin layer on top that turns it into short, plain-English rules, block everything by default and open only what you actually expose.

::steps{level="4"}
#### Install it

```bash [Terminal]
sudo apt install ufw
```

#### Set the default policy

```bash [Terminal]
sudo ufw default deny incoming
sudo ufw default allow outgoing
```

Nothing gets in unless a rule says so, everything the server itself initiates still goes out normally.

#### Allow what you actually need

```bash [Terminal]
sudo ufw allow OpenSSH
sudo ufw allow 443/tcp
```

`OpenSSH` is a built-in profile that matches the SSH port, no need to remember which one. Add one `allow` per port you expose, [SWAG](/serveex/core/swag) on `443` for instance.

::warning
Allow SSH **before** enabling the firewall, in the next step. Enable it first and the very connection you're typing in gets cut, with no screen left plugged in to fix it.
::

#### Enable it

```bash [Terminal]
sudo ufw enable
```

#### Check the rules

```bash [Terminal]
sudo ufw status verbose
```

```console [Output]
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)

To                         Action      From
--                         ------      ----
22/tcp (OpenSSH)           ALLOW IN    Anywhere
443/tcp                    ALLOW IN    Anywhere
```

#### Done !
::