> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idyl.network/llms.txt
> Use this file to discover all available pages before exploring further.

# idyl deploy

> Deploy an application from the command line

Deploy an application imperatively from the command line.

Automatically creates the appropriate resource type:

* Job: when --completions or --parallelism is specified
* Deployment: otherwise (default)

Use --platform, --isolation-class, and --network-class to declare workload
runtime intent. Admission and scheduling still require a target subnet policy
and provider nodes that match the requested runtime capabilities.

For isolated secure-container admission, declare linux/amd64, secure-container
isolation, and a network class of none or restricted-egress. The CLI records
this intent; the platform validates it before scheduling.

## Usage

```bash theme={null}
idyl deploy IMAGE [flags]
```

## Flags

| Flag                                    | Description                                                                                               |
| --------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| `--backoff-limit <uint64>`              | Number of retries before the Job is marked failed. Default: `6`.                                          |
| `--completions <uint64>`                | Number of successful pod completions required for the Job. Default: `0`.                                  |
| `--cpu <string>`                        | CPU limit, such as 500m or 1. Defaults to the configured value.                                           |
| `-e <stringArray>, --env <stringArray>` | Environment variable in KEY=VALUE form; repeatable.                                                       |
| `--fleet <string>`                      | Constrain scheduling to eligible members of this fleet within the workload's subnet, by fleet ID.         |
| `--gpu <string>`                        | GPU requirement, such as rtx5090, 2:h100, or nvidia:24Gi.                                                 |
| `--image-pull-secret <string>`          | Stored image pull secret reference (secret://name or secret://namespace/name).                            |
| `--isolation-class <string>`            | Workload isolation class (container, secure-container, or microvm); must be allowed by the target subnet. |
| `--memory <string>`                     | Memory limit, such as 256Mi or 1Gi. Defaults to the configured value.                                     |
| `--name <string>`                       | Required. Name for the resource.                                                                          |
| `-n <string>, --namespace <string>`     | Namespace name, overriding the current context.                                                           |
| `--network-class <string>`              | Workload network class: none, restricted-egress, or unrestricted.                                         |
| `--node <string>`                       | Constrain scheduling to this single node within the workload's subnet, by node ID.                        |
| `--parallelism <uint64>`                | Maximum number of pods the Job runs in parallel. Default: `0`.                                            |
| `--platform <string>`                   | Target workload platform: linux/amd64 or linux/arm64.                                                     |
| `--replicas <uint64>`                   | Number of replicas for the Deployment. Default: `1`.                                                      |
| `--restart <string>`                    | Restart policy: always, on\_failure, or never. Default: `always`.                                         |
| `--subnet <string>`                     | Subnet for workload placement.                                                                            |

## Inherited flags

| Flag                                 | Description                                                        |
| ------------------------------------ | ------------------------------------------------------------------ |
| `-a <string>, --account-id <string>` | Account ID to use, overriding the current context.                 |
| `-c <string>, --context <string>`    | Use the named context for this command.                            |
| `--homedir <string>`                 | Override the configuration directory. Defaults to \~/.config/idyl. |
| `-o <string>, --output <string>`     | Output format (json\|yaml).                                        |
| `-p <string>, --profile <string>`    | Override the access profile for this command.                      |
| `--realm <string>`                   | Override the realm for this command.                               |

## Examples

```bash theme={null}
# Deploy a single-replica deployment
idyl deploy nginx

# Deploy a deployment with 3 replicas
idyl deploy nginx --replicas=3

# Deploy a job that runs to completion
idyl deploy busybox --completions=5 --parallelism=2

# Deploy with resource limits
idyl deploy myapp:v2 --name=api --cpu=500m --memory=256Mi

# Deploy with GPU requirements
idyl deploy vllm:latest --name=llm --gpu=rtx5090
idyl deploy nvidia/cuda:12.0 --name=gpu-job --gpu="2:h100"
idyl deploy ollama --name=inference --gpu="nvidia:24Gi"

# Declare container isolation intent
idyl deploy nginx --name=web --platform linux/amd64 --isolation-class container

# Declare secure-container isolation intent
idyl deploy nginx --name=web --platform linux/amd64 --isolation-class secure-container

# Use the subnet default isolation class, when configured by runtime policy
idyl deploy nginx --name=web --subnet=secure-subnet --platform linux/amd64

# Declare isolated secure-container intent with no workload network
idyl deploy nginx --name=web --platform linux/amd64 --isolation-class secure-container --network-class none

# Declare microvm isolation intent (single container, enforced networking)
idyl deploy nginx --name=web --platform linux/amd64 --isolation-class microvm --network-class none

# Deploy to a subnet
idyl deploy nginx --name=web --subnet=my-subnet

# Deploy from a private registry using a stored secret
idyl deploy ghcr.io/acme/private-api:latest --name=api --image-pull-secret secret://ghcr-prod --subnet=my-subnet
```