macOS Cheatsheet

macOS ships BSD userland tools, not GNU coreutils, so some flags differ from Linux even when the command name matches. Differences are called out inline.

Files and directories

ls -la

Lists all files, including hidden ones, in long format.

ls -G

Enables colorized output for this invocation (or add export CLICOLOR=1 to your shell profile to make it permanent).

cd -

Jumps back to the previous working directory.

mkdir -p a/b/c

Creates nested directories in one shot.

cp -R src/ dest/

Copies a directory recursively (-R, not -r, on BSD cp - both work in practice, but -R is the documented flag).

mv old.txt new.txt

Renames or moves a file.

rm -rf build/

Deletes a directory and its contents without confirmation.

find . -name "*.log" -mtime -7

Finds files named *.log modified in the last 7 days.

mdfind -name "invoice"

Searches the Spotlight index by filename (BSD find has no -printf; Spotlight is macOS’s fast-search equivalent to locate).

mdls file.pdf

Shows Spotlight metadata (author, page count, kind) for a file.

Finder and clipboard integration

open .

Opens the current directory in Finder.

open -a "Visual Studio Code" file.txt

Opens a file with a specific application.

pbcopy < file.txt

Copies a file’s contents to the system clipboard.

pbpaste > file.txt

Writes the clipboard’s contents to a file.

ditto src/ dest/

Copies files while preserving macOS-specific metadata (resource forks, extended attributes) - more reliable than cp -R for app bundles.

Permissions and attributes

chmod 755 script.sh

Sets rwx for owner, rx for group and others.

chown user:group file.txt

Changes owner and group (needs sudo for files you don’t own).

xattr -l file.txt

Lists extended attributes on a file, such as the quarantine flag on downloads.

xattr -d com.apple.quarantine file.txt

Removes the “downloaded from the internet” quarantine flag.

spctl --status

Shows whether Gatekeeper is enforcing code-signing checks.

Homebrew package management

brew install wget

Installs a formula.

brew uninstall wget

Removes a formula.

brew update

Refreshes Homebrew’s own package index (does not upgrade installed formulae).

brew upgrade

Upgrades all outdated installed formulae.

brew list

Lists installed formulae.

brew search ripgrep

Searches available formulae and casks by name.

brew cleanup

Removes old versions and cached downloads to free disk space.

brew services start postgresql

Starts a formula’s background service via launchd and keeps it running across reboots.

brew --prefix

Prints Homebrew’s install root (/opt/homebrew on Apple Silicon, /usr/local on Intel) - useful when a build script needs it explicitly.

Processes

ps aux

Lists every running process with user, PID, CPU and memory usage.

top -o cpu

Live process view sorted by CPU (macOS top flags differ from Linux top; q to quit).

kill -9 1234

Force-kills the process with PID 1234.

killall Safari

Kills every process matching a name.

lsof -i :3000

Shows which process is listening on port 3000.

caffeinate -i

Prevents the Mac from sleeping while the command runs (macOS-specific; no Linux equivalent).

nice -n 10 ./cpu_heavy.sh

Runs a command with lower scheduling priority.

System info

sw_vers

Prints the macOS product name, version, and build number.

system_profiler SPHardwareDataType

Prints detailed hardware info (chip, memory, serial number).

sysctl -n hw.ncpu

Prints the number of logical CPU cores.

uptime

Shows how long the system has been running plus load averages.

diskutil list

Lists disks and partitions (macOS equivalent of Linux lsblk).

vm_stat

Shows virtual memory statistics (macOS has no free -h; this is the closest equivalent, in pages not bytes).

Networking

ifconfig en0

Shows the primary network interface’s configuration (macOS still uses ifconfig, not ip).

ipconfig getifaddr en0

Prints just the IPv4 address of an interface - faster than parsing ifconfig.

networksetup -listallhardwareports

Lists network interfaces with their hardware names (Wi-Fi, Ethernet).

dscacheutil -flushcache

Flushes the local DNS resolver cache after sudo killall -HUP mDNSResponder.

ping -c 4 example.com

Sends 4 ICMP echo requests and stops.

curl -I https://example.com

Fetches only the response headers.

See networking.md and ssh.md for a deeper cross-OS networking reference.

Disk usage and archives

df -h

Shows disk space usage per mounted volume, human-readable.

du -sh dir/

Shows a directory’s total size, human-readable.

du -h -d 1 . | sort -rh

Lists immediate subdirectory sizes, largest first (BSD du uses -d for depth, not --max-depth).

tar -czvf archive.tar.gz dir/

Creates a gzip-compressed tarball.

hdiutil create -srcfolder dir/ -volname "Backup" backup.dmg

Creates a disk image (.dmg) from a folder - a macOS-native archive format.

Environment and shell

echo $SHELL

Shows the current login shell (zsh by default since Catalina).

launchctl list

Lists background services (launchd agents/daemons - macOS’s systemctl equivalent).

defaults write com.apple.finder AppleShowAllFiles YES

Changes a macOS app preference directly (here, showing hidden files in Finder); follow with killall Finder to apply.

export PATH="$HOME/bin:$PATH"

Prepends a directory to the current shell’s PATH.

alias ll="ls -la"

Defines a shell shortcut for the current session (add to ~/.zshrc to persist).

sed -i '' 's/foo/bar/g' file.txt

In-place find-and-replace with BSD sed, which requires the empty '' backup-suffix argument that GNU sed doesn’t need.