Skip to main content
For who prefers typing to clicking: CLI in the dashboard’s menu (right above Settings) opens a terminal where you type dnz commands and see what the command line prints, colours included, while it runs.
The dnz in front is optional: zone list and dnz zone list are the same. help lists the commands, <command> --help explains one.

As you, with your permissions

A command runs on the DNZ server you are signed in to, as you:
  • the same permissions as in the dashboard: what your role can’t do is refused exactly as it is with the CLI on your own machine (permission denied),
  • the same validation, and changes that wait for approval wait here too,
  • every change in the audit log under your name and your browser’s address.
Every line you type is in the audit log too (category CLI commands), with how it ended: ok, failed, stopped, timeout, output_limit or refused. Values that look like secrets (--password, --secret, --token, keys of the same names in JSON) show as ***.
Only people signed in to the dashboard can use it. API tokens and AI assistants signed in over MCP can’t; assistants have their own tools, and there is no MCP tool for the terminal.

What doesn’t run here

The terminal runs on the server, so anything that works on “the machine it runs on” would work on the server itself. That is refused before anything starts, with the reason: Without -o, an export prints in the terminal, and JSON can be typed in place of @file. For the rest, use the dnz CLI on your machine. The terminal doesn’t ask questions: a command that would ask for confirmation says to run it again with --yes, and one that would ask for a password or a secret says to do it in the dashboard or with the CLI on your machine (a secret typed here would stay in the terminal’s history). There is no shell behind it: pipes (|), redirects (>), ;, && and $( ) are refused instead of being passed on, *.example.com stays as typed, and quotes work as in a shell:

Keys

history lists the earlier lines; Copy output copies everything on the screen.

Limits

  • One command at a time per sign-in (another tab waits until it ends or is stopped), and at most 8 on a server at once.
  • A command stops after 5 minutes; one that follows something live (capture, proxy logs --follow) after an hour. Stopping, with Ctrl+C or by leaving the page, works like Ctrl+C in a terminal: capture still prints its summary.
  • At most 8 MiB of output per command.
dnz_web_terminal_runs_total{result} in Prometheus counts the lines by how they ended. A server running without the web UI (--no-ui) has no terminal: use the CLI.

How it keeps the server safe

Nothing runs in a shell. The line is split into words and checked against the CLI’s own definition of every command and flag; then DNZ starts its own binary with those words as arguments, with an empty environment, no input, and a private, empty folder (removed when the command ends). The command calls the server’s API over loopback with a credential that acts as your dashboard session: it exists only in the server’s memory, works only from the server itself, ends when the command does, and stops working as soon as you sign out. Even a file that slipped past the check is refused: the command doesn’t read or write files on the server’s disk. For scripts, the endpoints are GET /api/cli/commands (the command tree the terminal completes from), POST /api/cli/run ({"line": "zone list", "columns": 120}, answered with server-sent events start, out, err and end) and POST /api/cli/stop, all for a dashboard session only. To script DNZ, the CLI with an API token is the better tool.