Developer Cheat Sheets
Commands You Actually Use

Everyday Git commands for branching, committing, syncing, and - most importantly - undoing mistakes safely.

• git status
  Show changed, staged, and untracked files on the current branch.
• git add -p
  Stage changes hunk by hunk, reviewing each one before it goes in.
• git commit -m "Describe the change"
  Commit the staged changes with a message.
• git commit --amend --no-edit
  Fold staged changes into the last commit. Only before you push it.
• git switch -c feature/login
  Create a new branch and switch to it.
• git switch main
  Switch to an existing branch.
• git log --oneline --graph --decorate --all
  Compact history graph of every branch.
• git diff --staged
  Show exactly what is staged for the next commit.
• git fetch --prune
  Download remote changes and forget remote branches that were deleted.
• git pull --rebase
  Update your branch by replaying your local commits on top of the remote ones.
• git push -u origin HEAD
  Push the current branch and set it to track the remote branch.
• git push --force-with-lease
  Force-push after a rebase, but refuse if someone else pushed in the meantime.
• git restore --staged file.txt
  Unstage a file and keep your edits.
• git restore file.txt
  Throw away unstaged edits to a file.

  Careful: The discarded edits cannot be recovered. Safer: git stash push file.txt

• git reset --soft HEAD~1
  Undo the last commit but keep its changes staged.
• git reset --hard HEAD
  Discard every uncommitted change in the working tree.

  Careful: Uncommitted work is lost for good. Safer: git stash push -m "backup"

• git revert a1b2c3d
  Create a new commit that undoes an earlier one - safe on shared branches.
• git stash push -m "wip"
  Shelve uncommitted changes; bring them back with git stash pop.
• git rebase -i HEAD~3
  Squash, reorder, or reword the last three commits (rewrites history).
• git cherry-pick a1b2c3d
  Copy a single commit onto the current branch.
• git reflog
  List where HEAD has been - the way to find "lost" commits after a bad reset.
• git blame -L 10,20 app.js
  Show who last changed lines 10 to 20 of a file.
• git bisect start
  Binary-search history for the commit that introduced a bug (mark commits with git bisect good / bad).
• git tag -a v1.2.0 -m "Release 1.2.0"
  Create an annotated tag; push it with git push origin v1.2.0.
• git branch -d feature/login
  Delete a branch that has been merged.
• git clean -fd
  Delete untracked files and folders.

  Careful: Untracked files are deleted permanently. Safer: git clean -nd

The shell commands you reach for every day on Linux, macOS, WSL, and servers.

• ls -lah
  List all files, including hidden ones, with human-readable sizes.
• cd -
  Jump back to the previous directory.
• mkdir -p app/src/utils
  Create nested directories in one step.
• cp -r src/ backup/
  Copy a directory recursively.
• mv old-name.txt new-name.txt
  Move or rename a file.
• rm -rf build/
  Delete a directory and everything in it without asking.

  Careful: No recycle bin - a typo in the path can wipe the wrong folder. Safer: rm -ri build/

• find . -name "*.log" -mtime +7
  Find .log files modified more than 7 days ago.
• grep -rn "TODO" src/
  Search files recursively and show line numbers.
• tail -f /var/log/syslog
  Follow a log file as new lines are written.
• command > out.txt 2>&1
  Send both output and errors to a file.
• command | tee out.txt
  Show output on screen and save it to a file at the same time.
• build && deploy
  Run the second command only if the first one succeeds.
• export NODE_ENV=production
  Set an environment variable for this shell and its child processes.
• ps aux | grep node
  Find running processes by name.
• kill -15 12345
  Ask a process to stop gracefully (SIGTERM).
• kill -9 12345
  Force-kill a process immediately (SIGKILL).

  Careful: The process gets no chance to clean up or save data. Safer: kill -15 12345

• lsof -i :3000
  See which process is listening on port 3000.
• df -h
  Show free disk space per filesystem.
• du -sh *
  Show the size of each file and folder in the current directory.
• tar -czf site.tar.gz site/
  Create a gzip-compressed archive (extract with tar -xzf site.tar.gz).
• ssh -i ~/.ssh/id_ed25519 user@server
  Connect to a server with a specific key.
• rsync -avz --dry-run dist/ user@server:/var/www/
  Preview a sync to a server; remove --dry-run to copy for real.
• chmod +x deploy.sh
  Make a script executable.
• history | grep ssh
  Search your command history (or press Ctrl+R to search interactively).

Unix permission numbers and symbols. Each digit is owner, group, others: read = 4, write = 2, execute = 1. Use the calculator below to convert.

• chmod 755 deploy.sh
  rwxr-xr-x: owner can do everything; group and others can read and run. Scripts and directories.
• chmod 644 index.html
  rw-r--r--: owner reads and writes; everyone else reads. Regular files.
• chmod 600 ~/.ssh/id_ed25519
  rw-------: owner only. SSH refuses private keys that others can read.
• chmod 700 ~/.ssh
  rwx------: a directory only its owner can enter.
• chmod u+x run.sh
  Add execute permission for the owner only.
• chmod g-w shared.txt
  Remove write permission from the group.
• chmod -R 755 site/
  Apply permissions recursively to a whole tree.

  Careful: Marks every file as executable, not just directories. Safer: find site/ -type f -exec chmod 644 {} +

• chmod 777 upload/
  Give everyone full access.

  Careful: Any user or compromised process can change or replace the files. Safer: chmod 775 upload/

• chown www-data:www-data -R /var/www
  Change the owner and group of files.
• umask 022
  Default permissions for new items: files 644, directories 755.
• chmod 1777 /tmp
  Sticky bit: anyone can create files, but only owners can delete theirs.
• chmod 2775 shared/
  Setgid on a directory: new files inherit the directory's group.

Run, inspect, and clean up containers and images, plus the Docker Compose commands for multi-container apps.

• docker ps -a
  List all containers, including stopped ones.
• docker run -d -p 8080:80 --name web nginx
  Run a container in the background, mapping host port 8080 to container port 80.
• docker run --rm -it ubuntu bash
  Start a throwaway interactive container that is deleted on exit.
• docker exec -it web sh
  Open a shell inside a running container.
• docker logs -f --tail 100 web
  Follow the last 100 log lines of a container.
• docker build -t myapp:1.0 .
  Build an image from the Dockerfile in the current directory.
• docker images
  List local images and their sizes.
• docker stop web && docker rm web
  Stop and remove a container.
• docker cp web:/app/logs/app.log .
  Copy a file out of a container.
• docker inspect web
  Show full configuration, IP address, mounts, and state as JSON.
• docker stats
  Live CPU, memory, and network usage per container.
• docker compose up -d
  Start every service in compose.yaml in the background.
• docker compose logs -f api
  Follow the logs of one Compose service.
• docker compose down
  Stop and remove the Compose containers and networks (volumes are kept).
• docker compose build --no-cache
  Rebuild service images from scratch.
• docker system df
  Show how much disk space images, containers, and volumes use.
• docker system prune
  Remove stopped containers, unused networks, and dangling images.

  Careful: Adding -a or --volumes also deletes unused images and data volumes. Safer: docker system df

Install, update, audit, and run JavaScript packages with npm and npx.

• npm ci
  Clean install exactly what package-lock.json says. Use it in CI.
• npm install express
  Add a dependency.
• npm install -D eslint
  Add a development-only dependency.
• npm uninstall express
  Remove a dependency.
• npm run build
  Run a script from package.json (npm test and npm start need no "run").
• npm outdated
  List packages that have newer versions.
• npm update
  Update packages within the version ranges in package.json.
• npm ls lodash
  Show why a package is installed and which version.
• npm audit
  Check dependencies for known vulnerabilities.
• npm audit fix --force
  Fix vulnerabilities even when it needs breaking upgrades.

  Careful: Can install new major versions that break your app. Safer: npm audit fix

• npx create-vite@latest
  Run a package command without installing it globally.
• npm version patch
  Bump the patch version, then commit and tag it.
• npm publish --dry-run
  See exactly what would be published without publishing.
• node --watch server.js
  Restart a Node.js script whenever its files change.
• npm init -y
  Create a package.json with default values.

JavaScript regex syntax with the patterns you need most. Try any of them live in the Regex Tester.

• .
  Any character except a line break (any character at all with the s flag).
• \d \w \s
  A digit, a word character [A-Za-z0-9_], whitespace. Uppercase (\D \W \S) negates.
• \b
  A word boundary - \bcat\b matches "cat" but not "concat".
• ^ $
  Start and end of the string (of each line with the m flag).
• * + ? {2,5}
  Zero or more, one or more, optional, between 2 and 5 times.
• .*?
  Lazy: match as little as possible instead of as much as possible.
• [abc] [^abc] [a-z]
  One of the listed characters, anything except them, or a range.
• (abc) (?:abc)
  Capturing group, and a group that does not capture.
• (?<year>\d{4})
  Named group - read it as match.groups.year.
• cat|dog
  Alternation: either side.
• (?=px) (?!px)
  Lookahead: followed by px, or not followed by px.
• (?<=\$)\d+
  Lookbehind: digits that come right after a dollar sign.
• \1 \k<year>
  Backreference to an earlier group: (\w)\1 finds doubled letters.
• /pattern/gimsuy
  Flags: global, ignore case, multiline, dotAll, unicode, sticky.
• \. \* \( \[ \\
  Escape special characters to match them literally.
• ^\d{4}-\d{2}-\d{2}$
  An ISO date shape, YYYY-MM-DD (shape only, not a valid-date check).
• str.replace(/(\w+) (\w+)/, "$2 $1")
  Swap two words using group references in the replacement.
• [...str.matchAll(/\d+/g)]
  Every match with its groups and index (needs the g flag).

Standard SQL for querying and changing data. Syntax shown works in PostgreSQL, MySQL, SQLite, and SQL Server unless noted.

• SELECT id, name FROM users WHERE active = 1 ORDER BY name;
  Filter and sort rows.
• SELECT DISTINCT country FROM users;
  Unique values only.
• WHERE name LIKE 'Ada%' AND age BETWEEN 18 AND 65
  Pattern match and inclusive range.
• WHERE deleted_at IS NULL
  Test for NULL - "= NULL" never matches.
• SELECT * FROM orders o JOIN users u ON u.id = o.user_id;
  Inner join: only rows that match on both sides.
• LEFT JOIN payments p ON p.order_id = o.id
  Keep every left row, with NULLs where nothing matches.
• SELECT country, COUNT(*) FROM users GROUP BY country HAVING COUNT(*) > 10;
  Aggregate per group and filter the groups.
• INSERT INTO users (name, email) VALUES ('Ada', '[email protected]');
  Insert a row.
• UPDATE users SET active = 0 WHERE id = 42;
  Change existing rows.

  Careful: Without WHERE, every row in the table is updated. Safer: SELECT * FROM users WHERE id = 42;

• DELETE FROM sessions WHERE expires_at < CURRENT_TIMESTAMP;
  Delete matching rows.

  Careful: Without WHERE, every row is deleted. Run the same WHERE as a SELECT first. Safer: BEGIN; DELETE ...; ROLLBACK;

• CREATE INDEX idx_users_email ON users (email);
  Speed up lookups and joins on a column.
• ALTER TABLE users ADD COLUMN last_login TIMESTAMP;
  Add a column to an existing table.
• WITH recent AS (SELECT * FROM orders WHERE total > 100) SELECT COUNT(*) FROM recent;
  Common table expression: a named subquery.
• ROW_NUMBER() OVER (PARTITION BY user_id ORDER BY created_at DESC)
  Window function: number rows within each group.
• COALESCE(nickname, name, 'Anonymous')
  First non-NULL value.
• CASE WHEN total > 100 THEN 'big' ELSE 'small' END
  Conditional value in a query.
• BEGIN; ... COMMIT;
  Run several statements as one transaction (ROLLBACK to undo).
• SELECT ... ORDER BY id OFFSET 20 ROWS FETCH NEXT 10 ROWS ONLY;
  Standard paging (LIMIT 10 OFFSET 20 in PostgreSQL, MySQL, SQLite).

Layout recipes for modern CSS - centering, spacing, responsive grids, and the overflow fixes nobody remembers.

• display: grid; place-items: center;
  Center anything horizontally and vertically.
• display: flex; justify-content: space-between; align-items: center;
  A row with items pushed to both ends and vertically centered.
• flex-direction: column; gap: 1rem;
  Stack items vertically with even spacing.
• flex-wrap: wrap;
  Let flex items wrap onto new lines.
• flex: 1;
  Let an item grow to fill the remaining space.
• flex-shrink: 0;
  Stop an item (an icon or avatar) from being squeezed.
• margin-left: auto;
  Push one flex item, and everything after it, to the right.
• min-width: 0;
  Let a flex or grid child shrink so long text truncates instead of overflowing.
• grid-template-columns: repeat(3, 1fr);
  Three equal columns.
• grid-template-columns: repeat(auto-fit, minmax(240px, 1fr));
  Responsive card grid with no media queries.
• grid-column: 1 / -1;
  Make a grid item span the full width.
• grid-template-areas: "header header" "sidebar main";
  Name layout regions and place items with grid-area.
• align-self: end; justify-self: start;
  Align a single item differently from the rest.
• order: -1;
  Move an item first visually (screen readers keep source order).
• aspect-ratio: 16 / 9;
  Keep a box at a fixed ratio, such as a video placeholder.
• position: sticky; top: 0;
  Stick an element to the top while its container scrolls.

Test APIs, inspect headers, and debug redirects and TLS from the command line. Pair it with the HTTP Status Codes reference.

• curl -I https://rjl.io
  Fetch only the response headers (a HEAD request).
• curl -iL https://rjl.io
  Show headers and body, and follow redirects.
• curl -sS -o report.pdf "$URL"
  Download quietly to a file, still showing errors.
• curl -X POST "$URL" -H "Content-Type: application/json" -d '{"name":"Ada"}'
  POST a JSON body.
• curl -H "Authorization: Bearer $TOKEN" "$URL"
  Send a bearer token from an environment variable.
• curl -u ada:secret "$URL"
  Basic authentication with the password on the command line.

  Careful: The password ends up in shell history and process lists. Safer: curl -u ada "$URL"

• curl -F "[email protected]" "$URL"
  Upload a file as multipart form data.
• curl -s -o /dev/null -w "%{http_code} %{time_total}s\n" "$URL"
  Print only the status code and total time.
• curl -v "$URL"
  Verbose: see the TLS handshake, request headers, and response headers.
• curl --resolve rjl.io:443:203.0.113.10 https://rjl.io
  Test a new server before changing DNS.
• curl --retry 3 --max-time 10 "$URL"
  Retry transient failures and give up after 10 seconds.
• curl --compressed "$URL"
  Ask for gzip or brotli and decompress automatically.
• curl -k https://localhost:8443
  Skip TLS certificate checks.

  Careful: Disables protection against man-in-the-middle attacks. Safer: curl --cacert dev-ca.pem https://localhost:8443

GitHub-flavored Markdown for READMEs, issues, and docs. Preview it in the Markdown Viewer.

• # Heading 1 ... ###### Heading 6
  Headings - one # per level.
• **bold** *italic* ~~strikethrough~~
  Text emphasis.
• [link text](https://rjl.io)
  A link.
• ![Alt text](screenshot.png)
  An image - always write meaningful alt text.
• - item - nested item
  Bulleted list; indent two spaces to nest.
• 1. first 2. second
  Numbered list.
• - [ ] todo - [x] done
  Task list checkboxes.
• > Quoted text
  Blockquote.
• `inline code`
  Inline code.
• ```js console.log("hi"); ```
  Fenced code block with syntax highlighting.
• | Name | Role | | ---- | ---- | | Ada | Dev |
  A table.
• ---
  Horizontal rule.
• Line one<br>Line two
  Line break inside a paragraph (or end the line with two spaces).
• <details><summary>More</summary>Hidden text</details>
  Collapsible section on GitHub.
• [Jump to setup](#setup)
  Link to a heading anchor on the same page.

PowerShell 7 equivalents for common Unix commands, for developers working on Windows.

• Get-ChildItem -Recurse -Filter *.log
  Find files recursively (like find . -name "*.log").
• Get-Content app.log -Tail 20 -Wait
  Follow a log file (like tail -f).
• Select-String -Path *.js -Pattern "TODO"
  Search file contents (like grep).
• Get-Command git | Select-Object Source
  Where a command lives (like which).
• $env:NODE_ENV = "production"
  Set an environment variable for this session.
• New-Item -ItemType Directory -Force .\app\src
  Create nested folders (like mkdir -p).
• Test-Path .\package.json
  Check whether a file or folder exists.
• Copy-Item -Recurse .\src .\backup
  Copy a folder.
• Remove-Item -Recurse -Force .\dist
  Delete a folder and its contents.

  Careful: Skips the Recycle Bin - deleted files are gone. Safer: Remove-Item -Recurse -Force .\dist -WhatIf

• Get-NetTCPConnection -LocalPort 3000 | Select-Object OwningProcess
  Find which process is using a port.
• Stop-Process -Name node
  Stop processes by name.

  Careful: Stops every node process, not just the one you meant. Safer: Stop-Process -Id 12345

• Invoke-RestMethod -Uri $url -Method Post -Body ($data | ConvertTo-Json) -ContentType "application/json"
  Call a JSON API and get parsed objects back.
• Get-Content data.json -Raw | ConvertFrom-Json
  Read a JSON file into objects.
• (Get-Content file.txt | Measure-Object -Line).Lines
  Count lines (like wc -l).
• npm run build && npm test
  Run the second command only if the first succeeds (PowerShell 7+).
• Get-Help Get-ChildItem -Examples
  Show usage examples for any command.

Five-field cron syntax: minute, hour, day of month, month, day of week. Build and explain expressions in the Cron Expression Generator.

• * * * * *
  Every minute.
• */15 * * * *
  Every 15 minutes.
• 0 * * * *
  At the start of every hour.
• 30 2 * * *
  Every day at 02:30.
• 0 9 * * 1-5
  Weekdays at 09:00.
• 0 0 1 * *
  At midnight on the first day of every month.
• 0 0 * * 0
  Every Sunday at midnight (0 and 7 both mean Sunday).
• @reboot /home/ada/start.sh
  Run once at system startup (cron daemons that support @ shortcuts).
• crontab -e
  Edit the current user's crontab.
• crontab -l
  List the current user's scheduled jobs.
• crontab -r
  Remove the current user's crontab.

  Careful: Deletes every job with no confirmation - it sits next to -e on the keyboard. Safer: crontab -l > crontab-backup.txt