shadowob-cloud is the standalone deployment CLI for Shadow Cloud. It can create a config from a template, validate secrets and schema, deploy to Kubernetes, open the dashboard, and manage bare-server k3s clusters.
Verify your workstation:
doctor checks local prerequisites such as kubectl, Docker, and Pulumi.
Templates use ${env:VAR_NAME} for secrets:
| Command | Purpose |
|---|---|
shadowob-cloud init | Create shadowob-cloud.json, optionally from a built-in template. |
shadowob-cloud init --list | List available templates. |
shadowob-cloud validate --strict | Validate schema, template references, security, and environment variables. |
shadowob-cloud up | Deploy to the current Kubernetes context. |
shadowob-cloud up --local | Start a local Kind cluster before deploying. |
shadowob-cloud status | Show deployments and pods. |
shadowob-cloud logs <agent-id> | Stream agent logs. |
shadowob-cloud scale <agent-id> --replicas 3 | Scale an agent deployment. |
shadowob-cloud down | Tear down deployed resources. |
shadowob-cloud dashboard | Open the Cloud dashboard. |
shadowob-cloud serve | Start the API server and dashboard. |
shadowob-cloud generate manifests | Export Kubernetes manifests without applying them. |
shadowob-cloud sandbox status | List agent-sandbox workloads and their current state. |
shadowob-cloud sandbox pause <agent> | Pause an agent-sandbox workload by scaling to 0. |
shadowob-cloud sandbox resume <agent> | Resume a paused agent-sandbox workload. |
shadowob-cloud sandbox backup <agent> | Create a VolumeSnapshot backup for an agent-sandbox state PVC. |
shadowob-cloud sandbox restore <agent> | Resume a sandbox after PVC restore completes. |
Agent-sandbox workloads support pause/resume and state backup/restore directly from the CLI:
The sandbox status command shows every agent-sandbox workload with its runtime state, ready count, and state PVC name.
Cloud can bootstrap k3s on Ubuntu or Debian servers over SSH.
A minimal cluster file:
Kubeconfigs are stored under ~/.shadow-cloud/clusters/<name>.yaml.
Use generate openclaw-config when you need to inspect the final model provider, tools, permissions, and Shadow channel configuration that will be mounted into the agent.