Quick start
lens-system
lens-system --once
lens-system --plain
lens-system --jsonThe interactive screen keeps Clock/NTP, DNS, Users, Groups and Certificates as visible sections. Press Tab or Shift+Tab to move between sections, or 1–5 to jump directly. Arrow keys move within the current data and Enter opens the selected value.
Clock, timezone and NTP
Lens shows the configured timezone. On Linux it also asks timedatectl whether network time is enabled and synchronized. The clock in every Lens header helps correlate observations; synchronization state tells you whether the system considers that clock trusted.
Unavailable is not the same as unsynchronized. Containers commonly inherit the host clock and have no time service of their own, so timedatectl may be absent while effective time remains correct.
Resolver configuration
Lens reads nameserver and search/domain entries from /etc/resolv.conf. On systems using systemd-resolved, NetworkManager, Docker or Kubernetes this file may be generated or point at a stub resolver. The displayed server is the resolver used by the current namespace, not necessarily the final upstream DNS server.
A container can have different resolver configuration, identities and certificate mounts from its host. Lens reports the namespace in which it runs.
Users and groups visible locally
The interactive view concentrates on login-capable accounts and the groups relevant to them. Account detail includes name, UID, primary GID, home and shell; group detail includes GID and explicitly listed members. Full structured output remains available for scripts.
The view uses the local account and group databases while leaving protected credential data under the operating system's normal access controls.
Local certificates you can act on
Lens looks in locally managed certificate locations such as Let's Encrypt, local CA and SSL directories. Distribution-managed root stores are deliberately excluded from the interactive inventory because hundreds of root CA files obscure the certificates an operator is likely to renew or troubleshoot.
When OpenSSL is available, the detail view shows subject, issuer, expiry and path. Private keys are never opened. A container reports only certificates mounted into its own namespace, which makes host/container trust differences easier to spot.
Filtering, output and sensitive context
--once prints one readable snapshot instead of opening the interactive screen. --plain explicitly selects the same human-readable format, while --json emits the schema-versioned document. --filter matches account, group, certificate subject, issuer, expiry and path values. --limit bounds returned lists when you request it. JSON exposes clock, dns, accounts, groups, certificates and collection_warnings.
Account names, internal domains, resolver addresses and certificate paths can reveal operational details. Review snapshots before attaching them to a public issue.