Reference

workbench CLI

The container entrypoint is the workbench binary. With no subcommand it runs the long-lived Workbench daemon. A small set of one-shot subcommands run a single task and exit without starting the server — they are what the container healthcheck and the offline flows use. Most day-to-day operations happen over the authenticated HTTP API, not the CLI.

Run the daemon (default)

Invoked with no recognised subcommand, workbenchstarts the server, reading its configuration with the standard precedence (flag > env > YAML > default — see the configuration reference). This is what the container runs by default; you rarely invoke it by hand.

Health check

-healthcheck performs a single GET /healthz against the configured address and exits 0 on HTTP 200, non-zero otherwise. It starts no server — it is the in-container probe the Compose healthcheck and the Kubernetes liveness probe call:

# what the container healthcheck runs:
/usr/local/bin/workbench -healthcheck

Offline backup

backup writes a consistent one-shot snapshot of the SQLite store to a file and exits — it never starts the server, so run it while the daemon is stopped (or use it from a sidecar that has the volume mounted):

workbench backup --out /backup/workbench.sqlite
# optional: --sqlite-path <path> to point at a non-default store

Show the EULA

workbench eula show   # prints the bundled EULA text and exits

License one-shots

Two licensing tasks are CLI one-shots because they run outside a normal session — the rest of licensing is operator-driven over the API (activate, activate offline):

# Export an offline activation request from the persistent identity dir:
workbench license-key request-export --identity-dir /var/lib/arq ...

# Invalidate (decommission) a license on this install:
workbench license invalidate ...

Every subcommand follows the same exit-code convention: 0 success, 2 usage / flag error, non-zero for a runtime failure — with a single structured level=ERROR line and no secrets in the output.