ov/skills/status/SKILL.md
Service status display with tool probes and device detection. MUST be invoked before any work involving: ov status command, checking container state, tool availability, port mapping, or JSON status output.
npx skillsauth add overthinkos/overthink-plugins statusInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Display running container status in table or detail mode. Includes concurrent tool probes (CDP, VNC, Sway, Wayland) with 2-second timeouts, GPU device detection, and port mapping.
| Action | Command | Description |
|--------|---------|-------------|
| Table (running) | ov status | Show all running services |
| Table (all) | ov status --all | Include stopped and enabled services |
| Detail | ov status <image> | Key-value detail for one service |
| JSON output | ov status --json | Machine-readable JSON |
| Column | Description | |--------|-------------| | IMAGE | Image name | | STATUS | running, stopped, enabled, etc. | | PORTS | Mapped host:container ports | | DEVICES | Detected GPU devices (nvidia, amd) | | TOOLS | Available tools with ports or socket names |
ov status <image> shows:
| Field | Example |
|-------|---------|
| Image | ghcr.io/overthinkos/jupyter:latest |
| Status | running |
| Container | ov-jupyter |
| Mode | quadlet |
| Ports | 8888/tcp -> 127.0.0.1:8888 |
| Devices | nvidia (CUDA) |
| Tools | cdp:9222, vnc:5900, sway, wl |
| Volumes | data: bind /home/user/data |
| Network | host |
| Tunnel | cloudflare: jupyter.example.com |
Tools are detected via concurrent 2-second timeout probes:
| Tool | Probe Method | Display |
|------|-------------|---------|
| cdp | HTTP request to CDP port | cdp:9222 |
| vnc | RFB protocol handshake | vnc:5900 |
| sway | IPC socket check | sway |
| wl | Command detection | wl |
Port-based tools show name:port. Socket-based tools show just the name.
Volumes: reads from image labelsThe Volumes: field is populated from the image's OCI labels (ExtractMetadata in ov/status.go:686–698), not from the live container's actual mounts. This means a volume deployed with --bind <name>=<path> will appear in ov status as ov-<image>-<volume> -> /container/path (the image default from the OCI label), not as <host-path> -> /container/path (the actual runtime bind mount).
The running container is functionally correct — only the display is misleading. Authoritative sources for the live volume backing:
# What the live container is actually mounting
podman inspect <container> --format '{{range .Mounts}}{{.Type}}:{{.Source}}->{{.Destination}} {{"\n"}}{{end}}'
# The deploy.yml record (what ov config resolved)
ov deploy show <image>
Use either of the above when you need to confirm that a --bind / --encrypt override actually took effect.
# Quick overview of all running services
ov status
# Include stopped services
ov status --all
# Detailed info for one service
ov status jupyter
# JSON for scripting
ov status --json | jq '.[] | select(.status == "running")'
/ov:pull -- Prerequisite: fetch the image into local storage; handles remote refs (@github.com/...) and the ErrImageNotLocal recovery path
/ov:start -- start a service
/ov:stop -- stop a service (via /ov:service)
/ov:logs -- view service logs (via /ov:service)
/ov:service -- full service lifecycle management
/ov:test 10 standards)Changes that touch this verb's output must reach a healthy deployment on a target explicitly marked disposable: true (see /ov-dev:disposable). Use ov rebuild <name> to destroy + rebuild unattended on any disposable target. Never experiment on a non-disposable deploy — set up a disposable one first with ov deploy add <name> <ref> --disposable or mark a VM in vms.yml.
After committing the source-level fix, ov rebuild the disposable target ONCE MORE from clean and re-run the full verification. A fix that passes only on a hand-patched target is not a real fix — it's a regression waiting for the next unrelated rebuild. Paste BOTH the exploratory-pass output and the fresh-rebuild-pass output into the conversation.
Unit tests + a clean compile are necessary but not sufficient. See CLAUDE.md R1–R10.
tools
Use when authoring or modifying a charly PLUGIN — a candy with a `plugin:` block that contributes Providers (verbs/kinds/deploy-targets/steps/builders/commands), its own CUE schema, builtin (compiled-in) or external (out-of-tree git repo). Covers the unified Provider model, the per-plugin CUE-schema contract (single source → Go params for dev + schema-over-Describe RPC for runtime), the SDK, and the loader.
tools
The CUE data-validation / configuration CLI (cue), pinned to v0.16.1. Use when working with the cue candy, installing the cue binary into a box or onto a target:local dev host, or running the offline schema-vendoring pipeline that feeds charly's egress validation.
tools
CUE EGRESS validation — validating (and, where it adds value, generating) the config files charly WRITES to a system BEFORE the bytes hit disk. MUST be invoked before working on charly/egress.go, the vendored schemas under candy/plugin-egress/egress-schemas/vendor/, the ValidateEgress / registerVendoredEgressKind path, the offline `task cue:vendor` pipeline, or adding an egress schema for any written artifact (cloud-init, k8s manifests, traefik routes, runtime config, install ledger, systemd/quadlet units, ssh_config, libvirt XML).
tools
Kubernetes cluster-probe declarative check verb — the `kube:` check verb (nodes, pods, ingress, storage class, addon health, apply/delete, and arbitrary resource GETs) served out-of-process by the candy/plugin-kube plugin (vendored client-go; no external kubectl required).