doctl CLI reference, Droplet/VPC/Volume core concepts, and a production-ready provisioning checklist.
| Category | Command | Description |
|---|---|---|
| Auth | doctl auth init | Authenticates the CLI with a personal access token from the control panel. |
| Droplets | doctl compute droplet list | Lists every Droplet on the account with ID, name, region, and status. |
| Droplets | doctl compute droplet create NAME --image ubuntu-24-04-x64 --size s-1vcpu-1gb --region nyc1 | Creates a new Droplet with the given image, size, and region slugs. |
| Droplets | doctl compute droplet delete ID | Permanently destroys a Droplet — irreversible, all data is lost. |
| Access | doctl compute ssh NAME | SSHes into a Droplet by name using the key configured on the account. |
| Snapshots | doctl compute droplet-action snapshot ID --snapshot-name NAME | Takes a point-in-time snapshot of a Droplet's disk. |
| Networking | doctl compute floating-ip create --droplet-id ID | Creates a Floating IP and assigns it to a Droplet — reassignable without a DNS change. |
| DNS | doctl compute domain records list DOMAIN | Lists DNS records for a domain managed in DigitalOcean's nameservers. |
| Databases | doctl databases list | Lists managed database clusters (Postgres, MySQL, Redis, etc.). |
| Firewalls | doctl compute firewall list | Lists cloud firewalls and the Droplets/tags they're applied to. |
| Volumes | doctl compute volume create NAME --region nyc1 --size 100GiB | Creates a Block Storage volume that can attach to any Droplet in the same region. |
| Kubernetes | doctl kubernetes cluster kubeconfig save NAME | Downloads and merges a DOKS cluster's kubeconfig for local kubectl use. |
| Account | doctl account get | Shows account email, droplet limit, and status — a quick sanity check after auth. |
Core Building Blocks
Droplet
DigitalOcean's name for a virtual machine — sized by vCPU/RAM/disk, billed hourly up to a monthly cap.
Image
The OS or pre-built application (a "1-Click App") a Droplet boots from — a snapshot of an existing Droplet can also be used as a custom image.
Region
The datacenter a resource lives in (e.g. nyc1, sfo3) — Droplets, Volumes, and Load Balancers in the same region attach over a private network for free.
VPC
A private, isolated network per region — resources inside talk to each other without traversing the public internet.
Load Balancer
Distributes traffic across multiple Droplets (often tagged as a group) — handles SSL termination and health checks.
Spaces
S3-compatible object storage for static assets, backups, and CDN-fronted files — same API surface as AWS S3.
Tagging & Automation
Tags
Cloud-init / User Data
Cloud Firewall
Monitoring & Alerts
Deploy with SSH keys, not a password
Add a public key in the control panel (or doctl compute ssh-key) and select it at creation — skips a mailed root password and a forced first-login reset.
Attach a Cloud Firewall immediately
Restrict inbound to only the ports actually needed (22, 80, 443) — the firewall applies at the network edge, before traffic even reaches the Droplet's own iptables.
Enable weekly backups
A small percentage-of-Droplet-cost add-on that snapshots automatically — far cheaper than losing a server with no recent snapshot.
Put a Floating IP in front if the Droplet may ever be rebuilt
Point DNS at the Floating IP, not the Droplet's own address — reassigning it to a replacement Droplet needs no DNS propagation wait.