Python Automation Cheat Sheet

1Repo & setupGitPython 3.1

pip install GitPython import git★
The import name is git (package GitPython). It shells out to the installed git executable.
repo = git.Repo(".") # open existing repo = git.Repo.clone_from(url, "dest/") # clone repo = git.Repo.init("newdir") # create★
Three ways to get a Repo — the entry point for everything.
repo.is_dirty(untracked_files=True) · repo.untracked_files★
Working-tree status. Note: is_dirty() ignores untracked files unless you pass untracked_files=True.
repo.git.status() · repo.git.checkout("main") # raw git passthrough
repo.git.<cmd>(...) runs any git command — the escape hatch when the object API doesn't cover something.

2Commit & branchesstage, commit, log

repo.index.add(["a.py", "b.py"]) commit = repo.index.commit("Add files")★
Stage then commit via the index. commit.hexsha is the new SHA.
for c in repo.iter_commits("main", max_count=10): print(c.hexsha[:7], c.summary, c.author.name)★
Walk history. Commit objects expose .message/.summary, .author, .committed_datetime, .parents.
repo.active_branch.name · repo.heads feature = repo.create_head("feature"); feature.checkout()★
Branches are Head objects in repo.heads. Create, then checkout(). Tags: repo.create_tag("v1.0").

3Remotes & diffsync & compare

origin = repo.remote("origin") origin.fetch() · origin.pull() · origin.push()★
Remote sync. push()/pull() return info objects you can inspect for flags/errors. Add one with repo.create_remote(name, url).
repo.index.diff(None) # unstaged changes repo.index.diff("HEAD") # staged changes
Structured diffs between the index and the working tree / a commit.
print(repo.git.diff("HEAD~1", "HEAD")) # textual diff
For a plain unified diff, drop to the git passthrough.

4Client & rundocker 7.2

pip install docker import docker client = docker.from_env()★
from_env() connects via the local socket / DOCKER_HOST env. The import is docker (package also docker).
c = client.containers.run("nginx", detach=True, ports={"80/tcp": 8080}, name="web")★
Start a container. detach=True returns a Container immediately; add environment=, volumes=, network=.
out = client.containers.run("alpine", "echo hi", remove=True)★
Run-to-completion: with detach=False (default) it blocks and returns the logs as bytes. remove=True cleans up after.
client.containers.list() # running client.containers.list(all=True) · client.containers.get("web")★
List/lookup containers. list() shows running only; all=True includes stopped.

5Container opslogs, exec, lifecycle

c = client.containers.get("web") c.logs(tail=100).decode() · c.logs(stream=True)★
Fetch logs (bytes), or stream them live. c.status, c.reload() to refresh attributes.
code, output = c.exec_run("ls /app")★
Run a command inside a running container — returns (exit_code, output_bytes). Add workdir=, environment=.
c.stop() · c.start() · c.restart() · c.remove(force=True)★
Lifecycle control. c.stats(stream=False) for a one-shot CPU/memory snapshot.

6Images & resourcespull, build, networks

client.images.pull("python:3.12-slim")★
Pull an image (blocks until done). client.images.list() / .get(tag) / .remove(tag).
image, logs = client.images.build(path=".", tag="myapp:latest") for line in logs: print(line.get("stream", ""), end="")★
Build from a Dockerfile — returns the image and a stream of build-log dicts.
client.networks.create("appnet") · client.volumes.create("data")
Create networks/volumes, then wire them into containers.run(..., network="appnet", volumes={"data": {...}}).

7Connect & execParamiko 5.0

import paramiko ssh = paramiko.SSHClient() ssh.load_system_host_keys() ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())★
Create the client and set a host-key policy. AutoAddPolicy trusts unknown hosts (handy in scripts, risky in prod — see gotchas).
ssh.connect("host.example.com", username="deploy", key_filename="~/.ssh/id_ed25519") # or password=★
Authenticate with a key file (preferred) or password=. Add port=, timeout= as needed.
stdin, stdout, stderr = ssh.exec_command("uptime") print(stdout.read().decode()) rc = stdout.channel.recv_exit_status()★
Run one command. Read stdout/stderr, and get the exit code via recv_exit_status(). Each call is a fresh channel — no shell state persists.
ssh.close() # or: with SSHClient() as ssh: ...
Always close the connection (or use it as a context manager).

8SFTP & keysmove files

sftp = ssh.open_sftp() sftp.put("local.txt", "/remote/local.txt") sftp.get("/remote/data.csv", "data.csv")★
Transfer files over the same SSH connection. put uploads, get downloads.
sftp.listdir("/remote") · sftp.mkdir("/remote/new") · sftp.remove("/remote/f") sftp.stat("/remote/f").st_size★
Remote filesystem ops — list, make/remove dirs, stat. sftp.close() when done.
key = paramiko.Ed25519Key.from_private_key_file("id_ed25519") ssh.connect(host, username="u", pkey=key)
Load a key object explicitly (Ed25519Key, RSAKey, ECDSAKey) — e.g. for an in-memory or passphrase-protected key.

!Common gotchasacross all three

GitPython needs the git binary + close()
It shells out to git (must be on PATH). It also holds OS handles — call repo.close() (or use a context manager), especially on Windows, to avoid leaks.
is_dirty() ignores untracked
By default untracked files don't count as "dirty". Pass untracked_files=True when you mean "any local change".
Docker: daemon must be running
from_env() fails without a reachable Docker daemon and socket permission. On CI/rootless setups, check DOCKER_HOST.
Docker: detach changes the return value
containers.run(detach=True) returns a Container; the default (detach=False) blocks and returns log bytes. Clean up with remove=True/auto_remove=True or they accumulate.
Paramiko: AutoAddPolicy trusts any host
Convenient but MITM-risky. In production load_system_host_keys() / verify against known_hosts and use RejectPolicy for unknown hosts.
Paramiko: exec_command returns immediately
It doesn't wait. Read stdout fully and/or call recv_exit_status() before assuming the command finished. No shell state carries between calls.
close your connections
Repos, Docker clients, SSH/SFTP sessions all hold resources. Use context managers or explicit close() to avoid leaked sockets/handles. For richer SSH workflows, Fabric builds on Paramiko.

Python Automation cheat sheet