neulab/tldr huggingface dataset:
--whitelist=dirname_or_filename Whitelist directory or file. A temporary file system is mounted on the top directory, and the whitelisted files are mount-binded inside. Modifications to whitelisted files are persistent, everything else is discarded when the sandbox is closed. The top directory can be all directories in / (except /proc and /sys), /sys/module, /run/user/$UID, $HOME and all directories in /usr.
Symbolic link handling: with the exception of user home, both the link and the real file should be in the same top directory. For user home, both the link and the real file should be owned by the user.
File globbing is supported, see FILE GLOBBING section for more details.
Example: $ firejail --noprofile --whitelist=~/.mozilla $ firejail --whitelist=/tmp/.X11-unix --whitelist=/dev/null $ firejail "--whitelist=/home/username/My Virtual Machines" $ firejail --whitelist=~/work* --whitelist=/var/backups*
--writable-etc Mount /etc directory read-write.
Example: $ sudo firejail --writable-etc
--writable-run-user Disable the default blacklisting of /run/user/$UID/systemd and /run/user/$UID/gnupg.
Example: $ sudo firejail --writable-run-user
--writable-var Mount /var directory read-write.
Example: $ sudo firejail --writable-var
--writable-var-log Use the real /var/log directory, not a clone. By default, a tmpfs is mounted on top of /var/log directory, and a skeleton filesystem is created based on the original /var/log.
Example: $ sudo firejail --writable-var-log
--x11  Sandbox the application using Xpra, Xephyr, Xvfb or Xorg security extension.  The sandbox will prevent screenshot and keylogger applications started inside the sandbox from accessing clients running outside the sandbox.  Firejail will try Xpra first, and if Xpra is not installed on the system, it will try to find Xephyr. If all fails, Firejail will not attempt to use Xvfb or X11 security extension.
Xpra, Xephyr and Xvfb modes require a network namespace to be instantiated in order to disable X11 abstract Unix socket. If this is not possible, the user can disable the abstract socket by adding "-nolisten local" on Xorg command line at system level.
Example: $ firejail --x11 --net=eth0 firefox
--x11=none Blacklist /tmp/.X11-unix directory, ${HOME}/.Xauthority and the file specified in ${XAUTHORITY} environment variable.  Remove DISPLAY and XAUTHORITY environment variables.  Stop with error message if X11 abstract socket will be accessible in jail.
--x11=xephyr Start Xephyr and attach the sandbox to this server.  Xephyr is a display server implementing the X11 display server protocol.  A network namespace needs to be instantiated in order to deny access to X11 abstract Unix domain socket.
Xephyr runs in a window just like any other X11 application. The default window size is 800x600.  This can be modified in /etc/firejail/firejail.config file.
The recommended way to use this feature is to run a window manager inside the sandbox.  A security profile for OpenBox is provided.
Xephyr is developed by Xorg project. On Debian platforms it is installed with the command sudo apt-get install xserver-xephyr. This feature is not available when running as root.
Example: $ firejail --x11=xephyr --net=eth0 openbox
--x11=xorg Sandbox the application using the untrusted mode implemented by X11 security extension.  The extension is available in Xorg package and it is installed by default on most Linux distributions. It provides support for a simple trusted/untrusted connection model. Untrusted clients are restricted in certain ways to prevent them from reading window contents of other clients, stealing input events, etc.
The untrusted mode has several limitations. A lot of regular programs  assume they are a trusted X11 clients and will crash or lock up when run in untrusted mode. Chromium browser and xterm are two examples.  Firefox and transmission-gtk seem to be working fine.  A network namespace is not required for this option.
Example: $ firejail --x11=xorg firefox
--x11=xpra Start Xpra (https://xpra.org) and attach the sandbox to this server.  Xpra is a persistent remote display server and client for forwarding X11 applications and desktop screens.  A network namespace needs to be instantiated in order to deny access to X11 abstract Unix domain socket.
On Debian platforms Xpra is installed with the command sudo apt- get install xpra.  This feature is not available when running as root.
Example: $ firejail --x11=xpra --net=eth0 firefox
--x11=xvfb Start Xvfb X11 server and attach the sandbox to this server. Xvfb, short for X virtual framebuffer, performs all graphical operations in memory without showing any screen output. Xvfb is mainly used for remote access and software testing on headless servers.
On Debian platforms Xvfb is installed with the command sudo apt- get install xvfb.  This feature is not available when running as root.
Example: remote VNC access
On the server we start a sandbox using Xvfb and openbox window manager. The default size of Xvfb screen is 800x600 - it can be changed in /etc/firejail/firejail.config (xvfb-screen). Some sort of networking (--net) is required in order to isolate the abstract sockets used by other X servers.
$ firejail --net=none --x11=xvfb openbox
*** Attaching to Xvfb display 792 ***
Reading profile /etc/firejail/openbox.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-common.local Parent pid 5400, child pid 5401
On the server we also start a VNC server and attach it to the display handled by our Xvfb server (792).
$ x11vnc -display :792
On the client machine we start a VNC viewer and use it to connect to our server:
$ vncviewer
--xephyr-screen=WIDTHxHEIGHT Set screen size for --x11=xephyr. The setting will overwrite the default set in /etc/firejail/firejail.config for the current sandbox. Run xrandr to get a list of supported resolutions on your computer.
Example: $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 firefox
AppArmor support is disabled by default at compile time. Use --enable- apparmor configuration option to enable it:
$ ./configure --prefix=/usr --enable-apparmor
During software install, a generic AppArmor profile file, firejail- default, is placed in /etc/apparmor.d directory. The local customizations must be placed in /etc/apparmor.d/local/firejail-local. The profile needs to be loaded into the kernel by reloading apparmor.service, rebooting the system or running the following command as root:
# apparmor_parser -r /etc/apparmor.d/firejail-default
The installed profile is supplemental for main firejail functions and among other things does the following:
- Disable ptrace. With ptrace it is possible to inspect and hijack running programs. Usually this is needed only for debugging. You should have no problems running Chromium or Firefox. This feature is available only on Ubuntu kernels.
- Whitelist write access to several files under /run, /proc and /sys.
- Allow running programs only from well-known system paths, such as /bin, /sbin, /usr/bin etc. Those paths are available as read- only. Running programs and scripts from user home or other directories writable by the user is not allowed.
- Prevent using non-standard network sockets. Only unix, inet, inet6, netlink, raw and packet are allowed.
- Deny access to known sensitive paths like .snapshots.
To enable AppArmor confinement on top of your current Firejail security features, pass --apparmor flag to Firejail command line. You can also include apparmor command in a Firejail profile file. Example:
$ firejail --apparmor firefox
A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox.  The symbolic link should be placed in the first $PATH position. On most systems, a good place is /usr/local/bin directory. Example:
Make a firefox symlink to /usr/bin/firejail:
$ sudo ln -s /usr/bin/firejail /usr/local/bin/firefox
Verify $PATH
$ which -a firefox /usr/local/bin/firefox /usr/bin/firefox
Starting firefox in this moment, automatically invokes “firejail firefox”.
This works for clicking on desktop environment icons, menus etc. Use "firejail --tree" to verify the program is sandboxed.
$ firejail --tree 1189:netblue:firejail firefox 1190:netblue:firejail firefox 1220:netblue:/bin/sh -c "/usr/lib/firefox/firefox" 1221:netblue:/usr/lib/firefox/firefox
We provide a tool that automates all this integration, please see firecfg(1) for more details.
firejail Sandbox a regular shell session.
firejail firefox Start Mozilla Firefox.
firejail --debug firefox Debug Firefox sandbox.
firejail --private firefox Start Firefox with a new, empty home directory.
firejail --net=none vlc Start VLC in an unconnected network namespace.
firejail --net=eth0 firefox Start Firefox in a new network namespace. An IP address is assigned automatically.
firejail --net=br0 --ip=10.10.20.5 --net=br1 --net=br2 Start a shell session in a new network namespace and connect it to br0, br1, and br2 host bridge devices. IP addresses are assigned automatically for the interfaces connected to br1 and b2
firejail --list List all sandboxed processes.
Globbing is the operation that expands a wildcard pattern into the list of pathnames matching the pattern.  This pattern is matched at firejail start, and is NOT UPDATED at runtime.  Files matching a blacklist, but created after firejail start will be accessible within the jail. Matching is defined by:
- '?' matches any character - '*' matches any string - '[' denotes a range of characters
The globbing feature is implemented using glibc glob command. For more information on the wildcard syntax see man 7 glob.
The following command line options are supported: --blacklist, --private-bin, --noexec, --read-only, --read-write, --tmpfs, and --whitelist.
$ firejail --private-bin=sh,bash,python* $ firejail --blacklist=~/dir[1234] $ firejail --read-only=~/dir[1-4]
These features allow the user to inspect the filesystem container of an existing sandbox and transfer files between the container and the host filesystem.
--cat=name|pid filename Write content of a container file to standard out. The container is specified by name or PID.  If standard out is a terminal, all ASCII control characters except new line and horizontal tab are replaced.
--get=name|pid filename Retrieve the container file and store it on the host in the current working directory.  The container is specified by name or PID.
--ls=name|pid dir_or_filename List container files. The container is specified by name or PID.
--put=name|pid src-filename dest-filename Put src-filename in sandbox container.  The container is specified by name or PID.
$ firejail --name=mybrowser --private firefox
$ firejail --ls=mybrowser ~/Downloads drwxr-xr-x netblue  netblue         4096 . drwxr-xr-x netblue  netblue         4096 .. -rw-r--r-- netblue  netblue         7847 x11-x305.png -rw-r--r-- netblue  netblue         6800 x11-x642.png -rw-r--r-- netblue  netblue        34139 xpra-clipboard.png
$ firejail --get=mybrowser ~/Downloads/xpra-clipboard.png
$ firejail --put=mybrowser xpra-clipboard.png ~/Downloads/xpra- clipboard.png
$ firejail --cat=mybrowser ~/.bashrc
Option --list prints a list of all sandboxes. The format for each process entry is as follows:
PID:USER:Sandbox Name:Command
Option --tree prints the tree of processes running in the sandbox. The format for each process entry is as follows:
Option --top is similar to the UNIX top command, however it applies only to sandboxes.
Option --netstats prints network statistics for active sandboxes installing new network namespaces.
Listed below are the available fields (columns) in alphabetical order for --top and --netstats options:
Command Command used to start the sandbox.
CPU%   CPU usage, the sandbox share of the elapsed CPU time since the last screen update
PID    Unique process ID for the task controlling the sandbox.
Prcs   Number of processes running in sandbox, including the controlling process.
RES    Resident Memory Size (KiB), sandbox non-swapped physical memory. It is a sum of the RES values for all processes running in the sandbox.
RX(KB/s) Network receive speed.
Sandbox Name The name of the sandbox, if any.
SHR    Shared Memory Size (KiB), it reflects memory shared with other processes. It is a sum of the SHR values for all processes running in the sandbox, including the controlling process.
TX(KB/s) Network transmit speed.
Uptime Sandbox running time in hours:minutes:seconds format.
USER   The owner of the sandbox.
To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in /etc/passwd file for each user that needs to be restricted. Alternatively, you can specify /usr/bin/firejail  in adduser command:
adduser --shell /usr/bin/firejail username
Additional arguments passed to firejail executable upon login are declared in /etc/firejail/login.users file.
Several command line options can be passed to the program using profile files. Firejail chooses the profile file as follows:
1. If a profile file is provided by the user with --profile=FILE option, the profile FILE is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. If there is a file with the same name as the given profile name, it will be used instead of doing the profile search. To force a profile search, prefix the profile name with a colon (:), eg. --profile=:PROFILE_NAME.  Example:
$ firejail --profile=/home/netblue/icecat.profile icecat Reading profile /home/netblue/icecat.profile [...]
$ firejail --profile=icecat icecat-wrapper.sh Reading profile /etc/firejail/icecat.profile [...]
2. If a profile file with the same name as the application is present in ~/.config/firejail directory or in /etc/firejail, the profile is loaded. ~/.config/firejail takes precedence over /etc/firejail. Example:
$ firejail icecat Command name #icecat# Found icecat profile in /home/netblue/.config/firejail directory Reading profile /home/netblue/.config/firejail/icecat.profile [...]
3. Use default.profile file if the sandbox is started by a regular user, or server.profile file if the sandbox is started by root. Firejail looks for these files in ~/.config/firejail directory, followed by /etc/firejail directory.  To disable default profile loading, use --noprofile command option. Example:
$ firejail Reading profile /etc/firejail/default.profile Parent pid 8553, child pid 8554 Child process initialized [...]
See man 5 firejail-profile for profile file syntax information.
Network bandwidth is an expensive resource shared among all sandboxes running on a system.  Traffic shaping allows the user to increase network performance by controlling the amount of data that flows into and out of the sandboxes.
Firejail implements a simple rate-limiting shaper based on Linux command tc.  The shaper works at sandbox level, and can be used only for sandboxes configured with new network namespaces.
Set rate-limits:
$ firejail --bandwidth=name|pid set network download upload
Clear rate-limits:
$ firejail --bandwidth=name|pid clear network
$ firejail --bandwidth=name|pid status
where: name - sandbox name pid - sandbox pid network - network interface as used by --net option download - download speed in KB/s (kilobyte per second) upload - upload speed in KB/s (kilobyte per second)
Example: $ firejail --name=mybrowser --net=eth0 firefox & $ firejail --bandwidth=mybrowser set eth0 80 20 $ firejail --bandwidth=mybrowser status $ firejail --bandwidth=mybrowser clear eth0
Homepage: https://firejail.wordpress.com
firemon(1), firecfg(1), firejail-profile(5), firejail-login(5), firejail- users(5), jailcheck(1)
⟨https://github.com/netblue30/firejail/wiki⟩, ⟨https://github.com/netblue30/firejail⟩
BUKU(1)                           User Commands                          BUKU(1)
buku - Bookmark manager like a text-based mini-web
buku [OPTIONS] [KEYWORD [KEYWORD ...]]
buku is a command-line utility to store, tag, search and organize bookmarks.
* Store bookmarks with auto-fetched title, tags and description * Auto-import from Firefox, Google Chrome and Chromium * Open bookmarks and search results in browser * Shorten, expand URLs, browse cached page from Wayback Machine * Text editor integration * Lightweight, clean interface, custom colors * Powerful search options (regex, substring...) * Continuous search with on the fly mode switch * Portable, merge-able database to sync between systems * Import/export bookmarks from/to HTML, Markdown or Orgfile * Smart tag management using redirection (>>, >, <<) * Multithreaded full DB refresh, manual encryption support * Shell completion scripts, man page with handy examples
1.  The database file is stored in: - $XDG_DATA_HOME/buku/bookmarks.db, if XDG_DATA_HOME is defined (first preference) or - $HOME/.local/share/buku/bookmarks.db, if HOME is defined (second preference) or - %APPDATA%kkmarks.db, if you are on Windows or - the current directory.
2.  If the URL contains characters like ';', '&' or brackets they may be interpreted specially by the shell. To avoid it, add the URL within single or double quotes ('/").
3.  URLs are unique in DB. The same URL cannot be added twice.
4.  Bookmarks with immutable titles are listed with '(L)' after the title.
5.  Tags: - Comma (',') is the tag delimiter in DB. A tag cannot have comma(s) in it. Tags are filtered (for unique tags) and sorted. Tags are stored in lower case and can be replaced, appended or deleted. - Page keywords having a word to comma ratio > 3 are appended to description rather than tags. - Parent folder (and subfolder) names are converted to all- lowercase tags during bookmarks HTML import. - Releases prior to v2.7 support both capital and lower cases in tags. From v2.7 all tags are stored in lowercase. An undocumented option --fixtags is introduced to modify the older tags. It also fixes another issue where the same tag appears multiple times in the tagset of a record. Run buku --fixtags once. - Tags can be edited from the prompt very easily using '>>' (append), '>' (overwrite) and '<<' (remove) symbols. The LHS of the operands denotes the indices and ranges of tags to apply (as listed by --tag or key 't' at prompt) and the RHS denotes the actual DB indices and ranges of the bookmarks to apply the change to.
6.  Update operation: - If --title, --tag or --comment is passed without argument, clear the corresponding field from DB. - If --url is passed (and --title is omitted), update the title from web using the URL. Description is updated (if --comment is omitted) and tags are appended to (if --tag is omitted). - If indices are passed without any other options (--url, --title, --tag, --comment and --immutable), read the URLs from DB and update titles, description and append tags from web. Bookmarks marked immutable are skipped. - Can update bookmarks matching a search, when combined with any of the search options and no arguments to update are passed.
7.  Delete operation: - When a record is deleted, the last record is moved to the index. - Delete doesn't work with range and indices provided together as arguments. It's an intentional decision to avoid extra sorting, in- range checks and to keep the auto-DB compaction functionality intact. On the same lines, indices are deleted in descending order. - Can delete bookmarks matching a search, when combined with any of the search options and no arguments to delete are passed.
8.  Search works in mysterious ways: - Case-insensitive. - Matches words in URL, title and tags. - --sany : match any of the keywords in URL, title or tags. Default search option. - --sall : match all the keywords in URL, title or tags. - --deep : match substrings (`match` matches `rematched`) in URL, title and tags. - --sreg : match a regular expression (ignores --deep). - --stag : search bookmarks by tags, or list all tags alphabetically with usage count (if no arguments). Delimit the list of tags in the query with `,` to search for bookmarks that match ANY of the listed tags. Delimit tags with `+` to search for bookmarks that match ALL of the listed tags. Note that `,` and `+` cannot be used together in the same search. Exclude bookmarks matching certain tags from the results by using ` - ` followed by the tags. Note that the ` - ` operator and the ` + ` delimiter must be space separated: ` - ` instead of `-` and ` + ` instead of `+`. This is to distinguish them from hyphenated tags (e.g., `some-tag-name`) and tags with '+'s (e.g., `some+tag+name`). - Search for keywords along with tag filtering is possible. Two searches are issued (one for keywords and another for tags) and the intersection of the 2 sets is returned as the resultset. - Search results are indexed incrementally. This index is different from actual database index of a bookmark record which is shown within '[]' after the title. - Results for any keyword matches are ordered by the number of keyword matches - results matching more keywords (match score) will appear earlier in the list. Results having the same number of matches will be ranked by their record DB index. If only one keyword is searched, results will be ordered by DB index, since all matching records will have the same match score.
9.  Import: - Auto-import looks in the default installation path and default user profile. - URLs starting with `place:`, `file://` and `apt:` are ignored during import. - Parent folder (and subfolder) names are automatically imported as tags if --tacit is used. - Tags are merged even if bookmark URL exists when --tacit is used. - An auto-generated tag in the format 'YYYYMonDD' is added if --tacit is not used in HTML, JSON, Markdown or Orgfile import.
10. Encryption is optional and manual. AES256 algorithm is used. To use encryption, the database file should be unlocked (-k) before using buku and locked (-l) afterwards. Between these 2 operations, the database file lies unencrypted on the disk, and NOT in memory. Also, note that the database file is unencrypted on creation.
11. Editor support: - A single bookmark can be edited before adding. The editor can be set using the environment variable *EDITOR* or by explicitly specifying the editor. The latter takes precedence. If -a is used along with -w, the details are populated in the editor template. - In case of edit and update (a single bookmark), the existing record details are fetched from DB and populated in the editor template. The environment variable EDITOR must be set. Note that -u works independently of -w. - All lines beginning with "#" will be stripped. Then line 1 will be treated as the URL, line 2 will be the title, line 3 will be comma separated tags, and the rest of the lines will be parsed as descriptions.
12. Proxy support: please refer to the ENVIRONMENT section.
-a --add URL [tag, ...] Bookmark URL along with comma-separated tags. A tag can have multiple words.
-u --update [...] Update fields of the bookmarks at specified indices in DB. If no arguments are specified, all titles and descriptions are refreshed from the web. Tags are appended. Works with update modifiers for the fields url, title, tag and comment. If only indices are passed without any edit options, titles and descriptions are fetched and updated (if not empty). Accepts hyphenated ranges and space- separated indices. Updates search results when used with search options, if no arguments.
-w --write [editor|index] Edit a bookmark in editor before adding it. To edit and update an existing bookmark, the index should be passed. However, in this case the environment variable EDITOR must be set. The last record is opened in EDITOR if index=-1.
-d --delete [...] Delete bookmarks. Accepts space-separated list of indices (e.g. 5 6 23 4 110 45) or a single hyphenated range (e.g. 100-200). Note that range and list don't work together. Deletes search results when combined with search options, if no arguments.
-v --version Show program version and exit.
-h --help Show program help and exit.
--url [...] Specify the URL, works with --update only. Fetches and updates title if --title is not used.
--tag [+|-] [...] Specify comma separated tags, works with --add, --update. Clears the tags, if no arguments passed. Appends or deletes tags, if list of tags is preceded by '+' or '-' respectively.
--title [...] Manually specify the title, works with --add, --update. Omits or clears the title, if no arguments passed.
-c --comment [...] Add notes or description of the bookmark, works with --add, --update. Clears the comment, if no arguments passed.
--immutable N Set the title, description and tags of a bookmark immutable during autorefresh. Works with --add, --update. N=1 sets the immutable flag, N=0 removes it. If omitted, bookmarks are added with N=0.
-s --sany keyword [...] Search bookmarks with ANY of the keyword(s) in URL, title or tags and show the results. Prompts to enter result number to open in browser. Note that the sequential result index is not the DB index. The DB index is shown within '[]' after the title. This is the default search option for positional arguments if no other search option is specified.
-S --sall keyword [...] Search bookmarks with ALL keywords in URL, title or tags and show the results. Behaviour same as --sany. Special keywords: "blank": list entries with empty title/tag "immutable": list entries with locked title NOTE: To search the keywords, use --sany
--deep Search modifier to match substrings. Works with --sany, --sall.
-r --sreg expression Scan for a regular expression match.
-t --stag [tag [,|+] ...] [- tag, ...] Search bookmarks by tags. Use ',' delimiter to find entries matching ANY of the tags Use ' + ' delimiter to find entries matching ALL of the tags. (Note that the ' + ' delimiter must be space separated) NOTE: Cannot combine ',' and '+' in the same search Use ' - ' to exclude bookmarks that match the tags that follow. (Note that the '-' operator must be space separated). List all tags alphabetically, if no arguments. The usage count (number of bookmarks having the tag) is shown within first brackets.
-x --exclude keyword [...] Exclude bookmarks matching the specified keywords. Works with --sany, --sall, --sreg and --stag.
-l --lock [N] Encrypt (lock) the DB file with N (> 0, default 8) hash passes to generate key.
-k --unlock [N] Decrypt (unlock) the DB file with N (> 0, default 8) hash passes to generate key.
--ai   Auto-import bookmarks from Firefox, Google Chrome and Chromium browsers.
-e --export file Export bookmarks to Firefox bookmarks formatted HTML. Works with all search options. Markdown is used if file has extension '.md'. Markdown format: [title](url), 1 entry per line. Orgfile is used if file has extension '.org' Orgfile format: * [[url][title]], 1 entry per line. A buku database is generated if file has extension '.db'.
-i --import file Import bookmarks from Firefox bookmarks formatted HTML.  file is considered Firefox-exported JSON if it has '.md' extension, Markdown (compliant with --export format) if it is '.md', Orgfile if the extension is '.org' or another buku database if the extension is '.db'.
-p --print [...] Show details (DB index, URL, title, tags and comment) of bookmark record by DB index. If no arguments, all records with actual index from DB are shown. Accepts hyphenated ranges and space-separated indices. A negative value (introduced for convenience) behaves like the tail utility, e.g., -n shows the details of the last n bookmarks.
-f --format N Show selective monochrome output with specific fields. Works with --print. Search results honour the option when used along with --json. Useful for creating batch scripts. N = 1, show only URL. N = 2, show URL and tags in a single line. N = 3, show only title. N = 4, show URL, title and tags in a single line To omit DB index from printed results, use N0, e.g., 10, 20, 30, 40.
-j --json Output data formatted as JSON, works with --print output and search results.
--colors COLORS Set output colors. Refer to the COLORS section below for details.
--nc   Disable color output in all messages. Useful on terminals which can't handle ANSI color codes or scripted environments.
-n --count N Number of results to show per page (default 10).
--np   Do not show the prompt, run and exit.
-o --open [...] Open bookmarks by DB indices or ranges in browser. Open a random index if argument is omitted.
--oa   Open all search results immediately in the browser. Works best with --np. When used along with --update or --delete, URLs are opened in the browser first and then modified or deleted.
--replace old new Replace old tag with new tag if both are passed; delete old tag if new tag is not specified.
--shorten index|URL Shorten the URL at DB index or an independent URL using the tny.im URL shortener service.
--expand index|URL Expand the URL at DB index or an independent URL shortened using tny.im.
--cached index|URL Browse the latest cached version of the URL at DB index or an independent URL using the Wayback Machine. Useful for viewing the content of bookmarks which are not live any more.
--suggest Show a list of similar tags to choose from when adding a new bookmark.
--tacit Show lesser output. Reduces the verbosity of certain operations like add, update etc.
--threads Maximum number of parallel network connection threads to use during full DB refresh. By default 4 connections are spawned.  N can range from 1 to 10.
-V     Check the latest upstream version available. This is FYI. It is possible the latest upstream released version is still not available in your package manager as the process takes a while.
-z --debug Show debug information and additional logs.
1-N    Browse search results by indices and ranges.
O [id|range [...]] Try to open search results or indices (when not in a search context) in a GUI browser. Toggle try to open urls in a GUI based browser (even if BROWSER is set) if no arguments. Toggling is useful when trying to open bookmarks by DB index.
a      Open all search results in browser.
s keyword [...] Search for records with ANY keyword.
S keyword [...] Search for records with ALL keywords.
d      Toggle deep search to match substrings ('pen' matches 'opened').
r expression Run a regular expression search.
t [...] Search bookmarks by a tag. List all tags alphabetically, if no arguments.
g taglist id|range [...] [>>|>|<<] [record id|range ...] Append, set, remove specific or all tags by indices and/or ranges to bookmark indices and/or ranges (see EXAMPLES section below). Search by space-separated taglist id(s) and/or range if records are omitted.
o id|range [...] Browse bookmarks by indices and/or ranges.
p id|range [...] Print bookmarks by indices and/or ranges.
w [editor|id] Edit and add or update a bookmark.
c id   Copy url at search result index to clipboard.
?      Show help on prompt keys.
q, ^D, double Enter Exit buku.
Completion scripts Shell completion scripts for Bash, Fish and Zsh can be found in: https://github.com/jarun/Buku/blob/master/auto-completion
BROWSER Overrides the default browser. Refer to: http://docs.python.org/library/webbrowser.html
EDITOR If defined, will be used as the editor to edit bookmarks with option --write.
https_proxy If defined, will be used to access http and https resources through the configured proxy. Supported format: http[s]://[username:password@]proxyhost:proxyport/
GUI integration buku can be integrated in a GUI environment with simple tweaks. Please refer to: https://github.com/jarun/Buku/wiki/System-integration
buku allows you to customize the color scheme via a five-letter string, reminiscent of BSD LSCOLORS. The five letters represent the colors of
- index - title - URL - description/comment/note - tag
respectively. The five-letter string is passed is as the argument to the --colors option, or as the value of the environment variable BUKU_COLORS.
We offer the following colors/styles:
┌───────┬───────────────────────────────────────────────────┐ │Letter │ Color/Style                                       │ ├───────├───────────────────────────────────────────────────┤ │a      │ black                                             │ │b      │ red                                               │ │c      │ green                                             │ │d      │ yellow                                            │ │e      │ blue                                              │ │f      │ magenta                                           │ │g      │ cyan                                              │ │h      │ white                                             │ │i      │ bright black                                      │ │j      │ bright red                                        │ │k      │ bright green                                      │ │l      │ bright yellow                                     │ │m      │ bright blue                                       │ │n      │ bright magenta                                    │ │o      │ bright cyan                                       │ │p      │ bright white                                      │ │A-H    │ bold version of the lowercase-letter color        │ │I-P    │ bold version of the lowercase-letter bright color │ │x      │ normal                                            │ │X      │ bold                                              │ │y      │ reverse video                                     │ │Y      │ bold reverse video                                │ └───────┴───────────────────────────────────────────────────┘
The default colors string is oKlxm, which stands for
- bright cyan index - bold bright green title - bright yellow URL - normal description - bright blue tag
- Bright colors (implemented as \x1b[90m - \x1b[97m) may not be available in all color-capable terminal emulators;
- Some terminal emulators draw bold text in bright colors instead;
- Some terminal emulators only distinguish between bold and bright colors via a default-off switch.
Please consult the manual of your terminal emulator as well as https://en.wikipedia.org/wiki/ANSI_escape_code for details.
1.  Edit and add a bookmark from editor:
buku -w buku -w 'gedit -w' buku -w 'macvim -f' -a https://ddg.gg search engine, privacy
The first command picks editor from the environment variable EDITOR. The second command opens gedit in blocking mode. The third command opens macvim with option -f and the URL and tags populated in template.
2.  Add a bookmark with tags 'search engine' and 'privacy', comment 'Search engine with perks', fetch page title from the web:
buku -a https://ddg.gg search engine, privacy -c Search engine with perks
In the output, >: url, +: comment, #: tags.
3.  Add a bookmark with tags 'search engine' & 'privacy' and immutable custom title 'DDG':
buku -a https://ddg.gg search engine, privacy --title 'DDG' --immutable 1
Note that URL must precede tags.
4.  Add a bookmark without a title (works for update too):
buku -a https://ddg.gg search engine, privacy --title
5.  Edit and update a bookmark from editor:
buku -w 15012014
This will open the existing bookmark's details in the editor for modifications. Environment variable EDITOR must be set.
6.  Update existing bookmark at index 15012014 with new URL, tags and comments, fetch title from the web:
buku -u 15012014 --url http://ddg.gg/ --tag web search, utilities -c Private search engine
7.  Fetch and update only title for bookmark at 15012014:
buku -u 15012014
8.  Update only comment for bookmark at 15012014:
buku -u 15012014 -c this is a new comment
Applies to --url, --title and --tag too.
9.  Export bookmarks tagged 'tag 1' or 'tag 2' to HTML, Markdown, Orgfile or a new database:
buku -e bookmarks.html --stag tag 1, tag 2 buku -e bookmarks.md --stag tag 1, tag 2 buku -e bookmarks.org --stag tag 1, tag 2 buku -e bookmarks.db --stag tag 1, tag 2
All bookmarks are exported if search is not opted.
10. Import bookmarks from HTML, Markdown or Orgfile:
buku -i bookmarks.html buku -i bookmarks.md buku -i bookmarks.db
11. Delete only comment for bookmark at 15012014:
buku -u 15012014 -c
Applies to --title and --tag too. URL cannot be deleted without deleting the bookmark.
12. Update or refresh full DB with page titles from the web:
buku -u buku -u --tacit (show only failures and exceptions)
This operation does not modify the indexes, URLs, tags or comments. Only title is refreshed if fetched title is non-empty.
13. Delete bookmark at index 15012014:
buku -d 15012014
The last index is moved to the deleted index to keep the DB compact.
14. Delete all bookmarks:
buku -d
15. Delete a range or list of bookmarks:
buku -d 100-200 buku -d 100 15 200
16. Search bookmarks for ANY of the keywords 'kernel' and 'debugging' in URL, title or tags:
buku kernel debugging buku -s kernel debugging
17. Search bookmarks with ALL the keywords 'kernel' and 'debugging' in URL, title or tags:
buku -S kernel debugging
18. Search bookmarks tagged 'general kernel concepts':
buku --stag general kernel concepts
19. Search for bookmarks matching ANY of the tags 'kernel', 'debugging', 'general kernel concepts':
buku --stag kernel, debugging, general kernel concepts
20. Search for bookmarks matching ALL of the tags 'kernel', 'debugging', 'general kernel concepts':
buku --stag kernel + debugging + general kernel concepts
21. Search for bookmarks matching any of the keywords 'hello' or 'world', excluding the keywords 'real' and 'life', matching both the tags 'kernel' and 'debugging', but excluding the tags 'general kernel concepts' and 'books':
buku hello world --exclude real life --stag 'kernel + debugging - general kernel concepts, books'
22. List all unique tags alphabetically:
buku --stag
23. Run a search and update the results:
buku -s kernel debugging -u --tag + linux kernel
24. Run a search and delete the results:
buku -s kernel debugging -d
25. Encrypt or decrypt DB with custom number of iterations (15) to generate key:
buku -l 15 buku -k 15
The same number of iterations must be specified for one lock & unlock instance. Default is 8, if omitted.
26. Show details of bookmarks at index 15012014 and ranges 20-30, 40-50:
buku -p 20-30 15012014 40-50
27. Show details of the last 10 bookmarks:
buku -p -10
28. Show all bookmarks with real index from database:
buku -p buku -p | more
29. Replace tag 'old tag' with 'new tag':
buku --replace 'old tag' 'new tag'
30. Delete tag 'old tag' from DB:
buku --replace 'old tag'
31. Append (or delete) tags 'tag 1', 'tag 2' to (or from) existing tags of bookmark at index 15012014:
buku -u 15012014 --tag + tag 1, tag 2 buku -u 15012014 --tag - tag 1, tag 2
32. Open URL at index 15012014 in browser:
buku -o 15012014
33. List bookmarks with no title or tags for bookkeeping:
buku -S blank
34. List bookmarks with immutable title:
buku -S immutable
35. Shorten the URL www.google.com and the URL at index 20:
buku --shorten www.google.com buku --shorten 20
36. Append, remove tags at prompt (taglist index to the left, bookmark index to the right):
// append tags at taglist indices 4 and 6-9 to existing tags in bookmarks at indices 5 and 2-3 buku (? for help) g 4 9-6 >> 5 3-2 // set tags at taglist indices 4 and 6-9 as tags in bookmarks at indices 5 and 2-3 buku (? for help) g 4 9-6 > 5 3-2 // remove all tags from bookmarks at indices 5 and 2-3 buku (? for help) g > 5 3-2 // remove tags at taglist indices 4 and 6-9 from tags in bookmarks at indices 5 and 2-3 buku (? for help) g 4 9-6 << 5 3-2
37. List bookmarks with colored output:
$ buku --colors oKlxm -p
Arun Prakash Jana <engineerarun@gmail.com>
https://github.com/jarun/Buku
https://github.com/jarun/Buku/wiki
https://github.com/jarun/Buku/issues
Copyright © 2015-2019 Arun Prakash Jana <engineerarun@gmail.com>.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
MYSQLDUMP(1)                  MySQL Database System                 MYSQLDUMP(1)
mysqldump - a database backup program
mysqldump [options] [db_name [tbl_name ...]]
The mysqldump client utility performs logical backups, producing a set of SQL statements that can be executed to reproduce the original database object definitions and table data. It dumps one or more MySQL databases for backup or transfer to another SQL server. The mysqldump command can also generate output in CSV, other delimited text, or XML format.
Tip Consider using the MySQL Shell dump utilities[1], which provide parallel dumping with multiple threads, file compression, and progress information display, as well as cloud features such as Oracle Cloud Infrastructure Object Storage streaming, and MySQL Database Service compatibility checks and modifications. Dumps can be easily imported into a MySQL Server instance or a MySQL Database Service DB System using the MySQL Shell load dump utilities[2]. Installation instructions for MySQL Shell can be found here[3].
•   Performance and Scalability Considerations
•   Invocation Syntax
•   Option Syntax - Alphabetical Summary
•   Connection Options
•   Option-File Options
•   DDL Options
•   Debug Options
•   Help Options
•   Internationalization Options
•   Replication Options
•   Format Options
•   Filtering Options
•   Performance Options
•   Transactional Options
•   Option Groups
•   Examples
•   Restrictions
mysqldump requires at least the SELECT privilege for dumped tables, SHOW VIEW for dumped views, TRIGGER for dumped triggers, LOCK TABLES if the --single-transaction option is not used, and (as of MySQL 8.0.21) PROCESS if the --no-tablespaces option is not used. Certain options might require other privileges as noted in the option descriptions.
To reload a dump file, you must have the privileges required to execute the statements that it contains, such as the appropriate CREATE privileges for objects created by those statements.
mysqldump output can include ALTER DATABASE statements that change the database collation. These may be used when dumping stored programs to preserve their character encodings. To reload a dump file containing such statements, the ALTER privilege for the affected database is required.
Note A dump made using PowerShell on Windows with output redirection creates a file that has UTF-16 encoding:
mysqldump [options] > dump.sql
However, UTF-16 is not permitted as a connection character set (see the section called “Impermissible Client Character Sets”), so the dump file cannot be loaded correctly. To work around this issue, use the --result-file option, which creates the output in ASCII format:
mysqldump [options] --result-file=dump.sql Performance and Scalability Considerations
mysqldump advantages include the convenience and flexibility of viewing or even editing the output before restoring. You can clone databases for development and DBA work, or produce slight variations of an existing database for testing. It is not intended as a fast or scalable solution for backing up substantial amounts of data. With large data sizes, even if the backup step takes a reasonable time, restoring the data can be very slow because replaying the SQL statements involves disk I/O for insertion, index creation, and so on.
For large-scale backup and restore, a physical backup is more appropriate, to copy the data files in their original format that can be restored quickly:
•   If your tables are primarily InnoDB tables, or if you have a mix of InnoDB and MyISAM tables, consider using the mysqlbackup command of the MySQL Enterprise Backup product. (Available as part of the Enterprise subscription.) It provides the best performance for InnoDB backups with minimal disruption; it can also back up tables from MyISAM and other storage engines; and it provides a number of convenient options to accommodate different backup scenarios. See Section 30.2, “MySQL Enterprise Backup Overview”.
mysqldump can retrieve and dump table contents row by row, or it can retrieve the entire content from a table and buffer it in memory before dumping it. Buffering in memory can be a problem if you are dumping large tables. To dump tables row by row, use the --quick option (or --opt, which enables --quick). The --opt option (and hence --quick) is enabled by default, so to enable memory buffering, use --skip-quick.
If you are using a recent version of mysqldump to generate a dump to be reloaded into a very old MySQL server, use the --skip-opt option instead of the --opt or --extended-insert option.
For additional information about mysqldump, see Section 7.4, “Using mysqldump for Backups”.  Invocation Syntax
There are in general three ways to use mysqldump—in order to dump a set of one or more tables, a set of one or more complete databases, or an entire MySQL server—as shown here:
mysqldump [options] db_name [tbl_name ...] mysqldump [options] --databases db_name ... mysqldump [options] --all-databases
To dump entire databases, do not name any tables following db_name, or use the --databases or --all-databases option.
To see a list of the options your version of mysqldump supports, issue the command mysqldump --help.  Option Syntax - Alphabetical Summary
mysqldump supports the following options, which can be specified on the command line or in the [mysqldump] and [client] groups of an option file. For information about option files used by MySQL programs, see Section 4.2.2.2, “Using Option Files”.  Connection Options
The mysqldump command logs into a MySQL server to extract information. The following options specify how to connect to the MySQL server, either on the same machine or a remote system.
•   --bind-address=ip_address On a computer having multiple network interfaces, use this option to select which interface to use for connecting to the MySQL server.
•   --compress, -C Compress all information sent between the client and the server if possible. See Section 4.2.8, “Connection Compression Control”.
As of MySQL 8.0.18, this option is deprecated. Expect it to be removed in a future version of MySQL. See the section called “Configuring Legacy Connection Compression”.
•   --compression-algorithms=value The permitted compression algorithms for connections to the server. The available algorithms are the same as for the protocol_compression_algorithms system variable. The default value is uncompressed.
For more information, see Section 4.2.8, “Connection Compression Control”.
This option was added in MySQL 8.0.18.
•   --default-auth=plugin A hint about which client-side authentication plugin to use. See Section 6.2.17, “Pluggable Authentication”.
•   --enable-cleartext-plugin Enable the mysql_clear_password cleartext authentication plugin. (See Section 6.4.1.4, “Client-Side Cleartext Pluggable Authentication”.)
•   --get-server-public-key Request from the server the public key required for RSA key pair-based password exchange. This option applies to clients that authenticate with the caching_sha2_password authentication plugin. For that plugin, the server does not send the public key unless requested. This option is ignored for accounts that do not authenticate with that plugin. It is also ignored if RSA-based password exchange is not used, as is the case when the client connects to the server using a secure connection.
If --server-public-key-path=file_name is given and specifies a valid public key file, it takes precedence over --get-server-public-key.
For information about the caching_sha2_password plugin, see Section 6.4.1.2, “Caching SHA-2 Pluggable Authentication”.
•   --host=host_name, -h host_name Dump data from the MySQL server on the given host. The default host is localhost.
•   --login-path=name Read options from the named login path in the .mylogin.cnf login path file. A “login path” is an option group containing options that specify which MySQL server to connect to and which account to authenticate as. To create or modify a login path file, use the mysql_config_editor utility. See mysql_config_editor(1).
For additional information about this and other option-file options, see Section 4.2.2.3, “Command-Line Options that Affect Option-File Handling”.
•   --password[=password], -p[password] The password of the MySQL account used for connecting to the server. The password value is optional. If not given, mysqldump prompts for one. If given, there must be no space between --password= or -p and the password following it. If no password option is specified, the default is to send no password.
Specifying a password on the command line should be considered insecure. To avoid giving the password on the command line, use an option file. See Section 6.1.2.1, “End-User Guidelines for Password Security”.
To explicitly specify that there is no password and that mysqldump should not prompt for one, use the --skip-password option.