grafos deploy
Push a project (or a single tasklet) onto the fabric. The bare deploy form is the customer-facing path; deploy run is the lower-level form that scripts call directly.
grafos deploy
Deploy a program onto the fabric
Usage: grafos deploy [OPTIONS] [PROGRAM] grafos deploy <COMMAND>
Commands: run Deploy and run a WASM program on the fabric plan Dry-run a deploy and show hashes, provider readiness, and refusal reasons before module upload, lease allocation, or tasklet start help Print this message or the help of the given subcommand(s)
Arguments: [PROGRAM] Path to the.wasm or.wat program file.
Omit this when deploying a validated grafos project via `--project` or from inside a directory containing grafos.toml.
Options: --fabric <FABRIC> Fabric address (host:port). Overrides GRAFOS_FABRIC env var
[env: GRAFOS_FABRIC=]
--json Output in JSON format for scripting
--project <PROJECT> Path to a grafos project directory.
Project deploys load grafos.toml +.grafos/validation.json, require a compiled tasklet artifact, verify source/module hashes, and then submit the selected WASM module.
--wide Show additional columns in table output
--no-color Disable color output
--tasklet <TASKLET> Tasklet target name to deploy from grafos.toml.
Required when the project declares more than one tasklet.
--pool <POOL> Pool name (default: "default")
[default: default]
--scheduler <SCHEDULER> Scheduler or orchestrator URL.
When pointing at an orchestrator (port 9200), the request is routed to the best cell. When pointing at a cell scheduler (port 9100), the request goes directly to that cell.
[env: GRAFOS_SCHEDULER=]
--tenant <TENANT> Tenant name for quota and billing.
When using mTLS (--cert/--key/--ca), the tenant is extracted from the client certificate's URI SAN and this flag is ignored.
[default: default]
--mem <MEM> Memory capacity to lease, in bytes
[default: 4096]
--lease-secs <LEASE_SECS> How long the lease should last, in seconds.
The program must complete within this window. After expiry, the lease is freed and the node reclaims the resources.
[default: 120]
--fuel <FUEL> WASM fuel (instruction budget).
Limits the number of WASM instructions the program can execute. If exhausted, the program is terminated with STATUS_FUEL_EXHAUSTED.
[default: 1000000]
--priority <PRIORITY> Scheduling priority: best_effort, guaranteed, or scavenger.
guaranteed: reserved capacity, never preempted. best_effort: may be preempted by guaranteed workloads. scavenger: lowest priority, cheapest, preempted first.
[default: best_effort]
--input <INPUT> Path to an input data file passed to the program
--output <OUTPUT> Output path for project graph deploys such as image-indexer.
Single-tasklet deploys return tasklet output on stdout or via run artifacts; this path is only used when the project has a supported graph runner.
--provider <PROVIDER> Explicit provider target for orchestrator placement.
Examples: `docker`, `aws`. Only valid when deploying through an orchestrator; direct cell deploys reject this flag because no provider selection is happening.
[env: GRAFOS_PROVIDER=]
--idempotency-key <IDEMPOTENCY_KEY> Explicit retry key for deploy idempotency.
Omit this for a new execution on every deploy. When set, retries with the same request and key return the original run; a different request with the same key is rejected.
[env: GRAFOS_IDEMPOTENCY_KEY=]
--timeout <TIMEOUT> Client-side timeout in seconds. If the scheduler does not respond within this window, the deploy fails
[default: 300]
--cert <CERT> Client certificate (PEM) for mTLS authentication.
Must be issued by the same CA configured on the scheduler (grafos admin issue-cert). The certificate's URI SAN (urn:fabricbios:tenant:<name>) identifies the tenant.
[env: GRAFOS_CERT=]
--key <KEY> Client private key (PEM) for mTLS authentication
[env: GRAFOS_KEY=]
--ca <CA> CA certificate (PEM) for verifying the scheduler's server certificate
[env: GRAFOS_CA=]
--direct Force the cell-direct deploy path (`/api/v1/deploy`) even when the scheduler URL doesn't contain `:9100`. Use when targeting a single-cell fabric on a non-default port (Phase 199 `grafos dev up` / Phase 200 `cloud provision`)
-h, --help Print help (see a summary with '-h')
-V, --version Print versiongrafos deploy run
Deploy and run a WASM program on the fabric.
Reads a compiled WASM or WAT program file, sends it to the scheduler (or orchestrator), which handles node placement, lease allocation, tasklet execution, and cleanup. Returns the program's exit code and output.
The scheduler picks the best node based on available capacity and placement strategy. The program runs as a WASM tasklet on that node, with access to leased fabric memory.
Examples:
# Deploy to orchestrator (auto-selects best cell and node) grafos deploy program.wasm --scheduler http://localhost:9200
# Deploy to a specific cell scheduler grafos deploy program.wasm --scheduler http://10.10.0.20:9100
# Deploy with mTLS authentication grafos deploy program.wasm --scheduler http://localhost:9200 \ --cert client.pem --key client-key.pem --ca ca.pem
# Deploy with custom resource requirements grafos deploy program.wasm --scheduler http://localhost:9200 \ --tenant acme --mem 65536 --lease-secs 300 --fuel 5000000
# Deploy with input data grafos deploy transform.wasm --scheduler http://localhost:9200 \ --input data.bin
Usage: grafos deploy run [OPTIONS] [PROGRAM]
Arguments: [PROGRAM] Path to the.wasm or.wat program file.
Omit this when deploying a validated grafos project via `--project` or from inside a directory containing grafos.toml.
Options: --fabric <FABRIC> Fabric address (host:port). Overrides GRAFOS_FABRIC env var
[env: GRAFOS_FABRIC=]
--project <PROJECT> Path to a grafos project directory.
Project deploys load grafos.toml +.grafos/validation.json, require a compiled tasklet artifact, verify source/module hashes, and then submit the selected WASM module.
--json Output in JSON format for scripting
--tasklet <TASKLET> Tasklet target name to deploy from grafos.toml.
Required when the project declares more than one tasklet.
--scheduler <SCHEDULER> Scheduler or orchestrator URL.
When pointing at an orchestrator (port 9200), the request is routed to the best cell. When pointing at a cell scheduler (port 9100), the request goes directly to that cell.
[env: GRAFOS_SCHEDULER=]
--wide Show additional columns in table output
--no-color Disable color output
--tenant <TENANT> Tenant name for quota and billing.
When using mTLS (--cert/--key/--ca), the tenant is extracted from the client certificate's URI SAN and this flag is ignored.
[default: default]
--mem <MEM> Memory capacity to lease, in bytes
[default: 4096]
--pool <POOL> Pool name (default: "default")
[default: default]
--lease-secs <LEASE_SECS> How long the lease should last, in seconds.
The program must complete within this window. After expiry, the lease is freed and the node reclaims the resources.
[default: 120]
--fuel <FUEL> WASM fuel (instruction budget).
Limits the number of WASM instructions the program can execute. If exhausted, the program is terminated with STATUS_FUEL_EXHAUSTED.
[default: 1000000]
--priority <PRIORITY> Scheduling priority: best_effort, guaranteed, or scavenger.
guaranteed: reserved capacity, never preempted. best_effort: may be preempted by guaranteed workloads. scavenger: lowest priority, cheapest, preempted first.
[default: best_effort]
--input <INPUT> Path to an input data file passed to the program
--output <OUTPUT> Output path for project graph deploys such as image-indexer.
Single-tasklet deploys return tasklet output on stdout or via run artifacts; this path is only used when the project has a supported graph runner.
--provider <PROVIDER> Explicit provider target for orchestrator placement.
Examples: `docker`, `aws`. Only valid when deploying through an orchestrator; direct cell deploys reject this flag because no provider selection is happening.
[env: GRAFOS_PROVIDER=]
--idempotency-key <IDEMPOTENCY_KEY> Explicit retry key for deploy idempotency.
Omit this for a new execution on every deploy. When set, retries with the same request and key return the original run; a different request with the same key is rejected.
[env: GRAFOS_IDEMPOTENCY_KEY=]
--timeout <TIMEOUT> Client-side timeout in seconds. If the scheduler does not respond within this window, the deploy fails
[default: 300]
--cert <CERT> Client certificate (PEM) for mTLS authentication.
Must be issued by the same CA configured on the scheduler (grafos admin issue-cert). The certificate's URI SAN (urn:fabricbios:tenant:<name>) identifies the tenant.
[env: GRAFOS_CERT=]
--key <KEY> Client private key (PEM) for mTLS authentication
[env: GRAFOS_KEY=]
--ca <CA> CA certificate (PEM) for verifying the scheduler's server certificate
[env: GRAFOS_CA=]
--direct Force the cell-direct deploy path (`/api/v1/deploy`) even when the scheduler URL doesn't contain `:9100`. Use when targeting a single-cell fabric on a non-default port (Phase 199 `grafos dev up` / Phase 200 `cloud provision`)
-h, --help Print help (see a summary with '-h')
-V, --version Print versiongrafos deploy plan
Dry-run a deploy and show hashes, provider readiness, and refusal reasons before module upload, lease allocation, or tasklet start
Usage: grafos deploy plan [OPTIONS] [PROGRAM]
Arguments: [PROGRAM] Path to the.wasm or.wat program file.
Omit this when deploying a validated grafos project via `--project` or from inside a directory containing grafos.toml.
Options: --fabric <FABRIC> Fabric address (host:port). Overrides GRAFOS_FABRIC env var
[env: GRAFOS_FABRIC=]
--project <PROJECT> Path to a grafos project directory.
Project deploys load grafos.toml +.grafos/validation.json, require a compiled tasklet artifact, verify source/module hashes, and then submit the selected WASM module.
--tasklet <TASKLET> Tasklet target name to deploy from grafos.toml.
Required when the project declares more than one tasklet.
--scheduler <SCHEDULER> Scheduler or orchestrator URL.
When pointing at an orchestrator (port 9200), the request is routed to the best cell. When pointing at a cell scheduler (port 9100), the request goes directly to that cell.
[env: GRAFOS_SCHEDULER=]
--wide Show additional columns in table output
--no-color Disable color output
--tenant <TENANT> Tenant name for quota and billing.
When using mTLS (--cert/--key/--ca), the tenant is extracted from the client certificate's URI SAN and this flag is ignored.
[default: default]
--mem <MEM> Memory capacity to lease, in bytes
[default: 4096]
--pool <POOL> Pool name (default: "default")
[default: default]
--lease-secs <LEASE_SECS> How long the lease should last, in seconds.
The program must complete within this window. After expiry, the lease is freed and the node reclaims the resources.
[default: 120]
--fuel <FUEL> WASM fuel (instruction budget).
Limits the number of WASM instructions the program can execute. If exhausted, the program is terminated with STATUS_FUEL_EXHAUSTED.
[default: 1000000]
--priority <PRIORITY> Scheduling priority: best_effort, guaranteed, or scavenger.
guaranteed: reserved capacity, never preempted. best_effort: may be preempted by guaranteed workloads. scavenger: lowest priority, cheapest, preempted first.
[default: best_effort]
--input <INPUT> Path to an input data file passed to the program
--output <OUTPUT> Output path for project graph deploys such as image-indexer.
Single-tasklet deploys return tasklet output on stdout or via run artifacts; this path is only used when the project has a supported graph runner.
--provider <PROVIDER> Explicit provider target for orchestrator placement.
Examples: `docker`, `aws`. Only valid when deploying through an orchestrator; direct cell deploys reject this flag because no provider selection is happening.
[env: GRAFOS_PROVIDER=]
--idempotency-key <IDEMPOTENCY_KEY> Explicit retry key for deploy idempotency.
Omit this for a new execution on every deploy. When set, retries with the same request and key return the original run; a different request with the same key is rejected.
[env: GRAFOS_IDEMPOTENCY_KEY=]
--timeout <TIMEOUT> Client-side timeout in seconds. If the scheduler does not respond within this window, the deploy fails
[default: 300]
--cert <CERT> Client certificate (PEM) for mTLS authentication.
Must be issued by the same CA configured on the scheduler (grafos admin issue-cert). The certificate's URI SAN (urn:fabricbios:tenant:<name>) identifies the tenant.
[env: GRAFOS_CERT=]
--key <KEY> Client private key (PEM) for mTLS authentication
[env: GRAFOS_KEY=]
--ca <CA> CA certificate (PEM) for verifying the scheduler's server certificate
[env: GRAFOS_CA=]
--direct Force the cell-direct deploy path (`/api/v1/deploy`) even when the scheduler URL doesn't contain `:9100`. Use when targeting a single-cell fabric on a non-default port (Phase 199 `grafos dev up` / Phase 200 `cloud provision`)
--json
-h, --help Print help (see a summary with '-h')
-V, --version Print version