Troubleshooting

Start with the symptom. Run the smallest command that exercises the failing path, then add --strict when warnings should fail the run or -o json / -o yaml when another tool needs stable diagnostics.

drydock get apps --path .
drydock test apps --path .
drydock diag --path .

Symptom: No Applications Discovered

Check that the selected --path points at the GitOps repository root or pass the directory that contains Argo CD objects. If the repository stores bootstrap inputs as Kustomize rather than committed inflated objects, add an explicit entrypoint:

drydock get apps --path . --discover-kustomize clusters/prod/argocd

If the repository uses ApplicationSet providers, make sure the workflow passes the same fixture inputs used for local verification.

Symptom: Render Fails In CI But Works Locally

Confirm whether CI has the same source access and caches. Default runs may fetch declared Git, Helm, OCI Helm, and remote Kustomize sources into drydock caches. --offline disables those source network fetches and requires local files, repo maps, or existing cache entries.

drydock test apps --path . --offline
drydock diag --path . --cache-events

--cache-events renders Applications so source-acquisition events match the rendering path.

Symptom: Changed-Only Falls Back To All Apps

Multi-Application diffs use changed-only selection by default. If a changed file cannot be safely mapped to Application inputs, non-strict mode warns and renders all Applications. Use strict mode when ambiguous ownership should fail:

drydock diff apps --repo . --ref HEAD --ref-orig main --strict-changed-only

Symptom: Plugin Source Fails Closed

The CLI and default Go client do not execute config management plugin commands by default. Safe Kustomize wrapper plugins may render natively. Other plugin sources need trusted drydock plugin policy, and exec policy also needs --enable-plugins.

drydock test apps --path . --plugin-policy-ref main --enable-plugins

See Plugin policy for the operator gate.

Symptom: Diff Noise Is Hiding Or Showing Too Much

drydock hides common Helm chart/version labels and pod-template checksum annotations by default. Use --show-ignored-fields to inspect them, or --strip-attr KEY to remove additional label or annotation keys before comparison.

Symptom: PR Comment Is Too Large Or Hard To Scan

Use markdown output for the review surface and keep full artifacts for deeper inspection:

drydock diff apps --repo . --ref HEAD --ref-orig main -o markdown
drydock diff images --repo . --ref HEAD --ref-orig main -o markdown

For sensitive or noisy resource classes, use explicit filters such as --skip-secrets, --skip-crds, or repeatable --strip-attr KEY.

For deeper reference, see the CLI usage guide , Compatibility , and Source acquisition .