Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan NowHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk8 min

Essential Git Commands to Use Safely on Your Linux VPS

Use Git safely on a Linux VPS with a verify-fetch-integrate workflow, explicit pull policy, deliberate staging, conflict recovery, release tags, and production-focused safeguards.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

On a Linux VPS, the safest Git workflow is: verify the checkout, inspect remote changes with git fetch, integrate them using an explicit policy, and record the exact commit you deploy. The commands below cover daily updates, branches, commits, pushes, conflict recovery, tags, and rollback-oriented inspection without accidentally overwriting production code.

1. Verify the VPS checkout before touching code

Run these commands from the application directory before every pull, merge, deployment, or cleanup operation:

As an Amazon Associate I earn from qualifying purchases.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
pwd
git status --short --branch
git branch --show-current
git remote -v

pwd confirms that your shell is in the intended directory. git status --short --branch shows the current branch and any tracked or untracked changes in a compact form. git branch --show-current removes ambiguity when scripts or multiple checkouts are involved, while git remote -v verifies where fetches and pushes will go.

Do not continue until you understand every status line. A clean tree is easiest to update, but a dirty tree is not automatically wrong if the changes are deliberate and documented. Production-only configuration, generated files, and emergency edits should be handled according to your deployment policy rather than silently mixed into an upstream update.

2. Clone a repository or configure its remote

Clone into the deployment path

git clone [email protected]:ORG/REPO.git /srv/app
cd /srv/app

Cloning creates a working checkout, configures the remote under the conventional name origin, and checks out the repository’s default branch. Replace the organization, repository, and path with values appropriate to your application.

Add or correct a remote in an existing checkout

git remote add origin [email protected]:ORG/REPO.git
git remote set-url origin [email protected]:ORG/REPO.git
git remote -v

Use git remote add only when no remote with that name exists. If the URL is wrong, git remote set-url changes it without recloning. Verify the result immediately, especially on a server that contains several applications.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Choose SSH or HTTPS deliberately

Remote type Authentication Operational strengths Trade-offs on a VPS
SSH Server-side key pair and repository permission Well suited to unattended deployments; no interactive password prompt when the key is available Requires key generation, agent or key-file handling, and correct repository access
HTTPS Credential or token supplied through an approved credential mechanism Often works where outbound SSH is blocked; may fit an existing enterprise credential policy Unattended jobs need secure token storage and a non-interactive authentication design
git:// None Legacy read-only transport in some environments No authentication; avoid it for sensitive operations and deployment remotes

SSH access requires a key pair and permission to the repository. HTTPS can be preferable when a firewall blocks SSH, but never put a token directly in a remote URL that can be exposed in shell history, process listings, logs, or configuration backups.

3. Inspect branches and recent history

git branch -a
git switch main
git switch -c feature/name
git log --oneline --decorate --graph -n 20
git show --stat --oneline HEAD

git branch -a lists local and remote-tracking branches. Switch to the branch your deployment process expects with git switch main (substitute the real production branch). Create a new local branch with git switch -c feature/name; this creates and checks out the branch in one operation.

Use the graph view before integrating unfamiliar work. The last 20 commits, shown by git log --oneline --decorate --graph -n 20, reveal whether the branch is ahead, behind, or diverged. git show --stat --oneline HEAD gives a compact summary of the commit currently checked out, useful when confirming what a deployment job is about to run.

4. Stage and commit only an intentional snapshot

Review, stage, and review again

git diff
git add path/to/file
git diff --cached
git commit -m "Describe the change"

git diff displays unstaged edits. Stage only the paths that belong in this change with git add; avoid broad commands such as git add . when a checkout may contain secrets, build output, or unrelated operator edits.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

After staging, run git diff --cached. This is the exact snapshot the commit will contain. Check for credentials, private keys, environment files, debug output, accidental deletions, and generated artifacts before committing. Keep secrets in an environment file or secret manager excluded by .gitignore, not in the repository.

A commit records the reviewed snapshot in local history. Use a message that identifies the change and its intent, because operators may need to find or revert it months later.

5. Fetch first, then decide how to integrate

git fetch origin
git log --oneline HEAD..origin/main
git diff HEAD...origin/main

git fetch origin downloads objects and updates remote-tracking references such as origin/main; it does not merge those commits into your checked-out branch or modify your working files. That separation makes fetch the safer first step on a production VPS.

The range HEAD..origin/main lists commits present on the remote-tracking branch but not in your current branch. The three-dot diff HEAD...origin/main compares the branches from their common ancestor, helping you inspect the actual changes before choosing a merge or rebase.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

6. Pull with an explicit integration policy

git pull --ff-only origin main

Fast-forward-only mode updates the branch only when no local commit has diverged from the remote. If a merge would be required, the command stops instead of creating a commit or rewriting anything. This is a strong default for a deployment checkout that should mirror a tested remote branch.

git pull --no-rebase origin main

The no-rebase form fetches and then merges. If local and remote work diverged, Git may create a merge commit. Use it only when the project’s history policy permits merge commits and you are prepared to resolve conflicts on the server or in a controlled release environment.

git pull --rebase origin main

Rebase fetches the remote commits and replays local commits on top of them. It produces a linear-looking history but rewrites the IDs of the rebased local commits. Do not rebase commits that other people are already relying on unless the team explicitly allows that history rewrite.

You can make the policy explicit in configuration rather than relying on an implicit default:

git config pull.rebase false   # merge
git config pull.rebase true    # rebase
Policy History rewritten? Can create a merge commit? Conflict handling Production suitability
--ff-only No No Stops before integration if branches diverged Safest for a checkout that must match a tested upstream branch
--no-rebase No existing commits rewritten Yes, when necessary Resolve conflicts during the merge, then commit Appropriate when merge commits are part of the project policy
--rebase Yes, local commits are replayed No merge commit for the replay itself Resolve each conflict while the rebase pauses Use only when the team permits rebasing and the checkout is not a shared history source

7. Push changes and establish upstream tracking

git push -u origin main
git push
git push origin feature/name

git push -u origin main sends the local main branch to origin and records origin/main as its upstream. Later, an argument-less git push can use that association. Push a branch explicitly with git push origin feature/name when it has no upstream or when you want to make the destination unmistakable.

On a VPS, avoid making a working checkout the place where unreviewed production changes are authored. A bare repository with a controlled deployment hook, or a pull-based deployment script that checks out a reviewed commit, provides a repeatable release path. Whichever design you use, run Git as the unprivileged account that owns the checkout and ensure filesystem ownership is consistent.

8. Fix a non-fast-forward push rejection

A non-fast-forward rejection means the remote branch contains commits that your local branch does not. Git refuses the push because accepting it as-is would discard the remote history.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Fetch the remote branch:

    git fetch origin
  2. Compare both sides:

    git log --oneline --left-right HEAD...origin/main

    Commits marked on the left exist only locally; commits on the right exist only on the remote.

  3. Integrate according to project policy:

    git rebase origin/main

    Use a merge instead if the repository requires merge-based history.

  4. Resolve conflicts if Git pauses. Edit each conflicted file, remove the conflict markers, then stage the resolved paths:

    git add <resolved-files>
    git rebase --continue

    For a merge, finish with git commit after staging the resolutions.

    Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  5. Run tests or deployment checks, then retry:

    git push

Never answer a non-fast-forward rejection with an unreviewed force push to a shared production branch. A force push can remove commits other operators or release jobs still need; if it is ever necessary, use the team’s protected, reviewed procedure and communicate the exact target.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

9. Tag releases and remove remote branches carefully

git tag -a v1.2.0 -m "Release v1.2.0"
git push origin v1.2.0
git push origin --tags

An annotated tag records a named release point and message. Push one tag when releasing a specific version, or push all local tags when that is an intentional repository operation. Confirm the commit being tagged with git show first; tags should identify an immutable release decision, not an unverified working tree.

git push origin :old-branch

The colon syntax deletes the named remote branch. Treat branch deletion as a controlled operation: verify the spelling, confirm that the branch is no longer needed, and check branch-protection or release rules before running it.

10. Inspect changes and recover from mistakes

Command What it shows or does Risk
git diff Unstaged edits in tracked files Read-only
git diff --cached Exact staged snapshot for the next commit Read-only
git restore path/to/file Discards unstaged edits in the specified path Destructive for those local edits
git reflog Previous positions of HEAD, useful for locating commits after resets or rebases Read-only, but recovery still requires careful selection
git reset --hard HEAD Discards all local tracked edits and resets files to the current commit Destructive; uncommitted tracked work is lost
git clean -nd Preview of untracked files and directories that cleaning would remove Preview only; do not skip this check

Run the preview and inspection commands before any destructive cleanup. A VPS checkout may contain production-only configuration or generated assets that are not recoverable from the remote repository. Preserve backups or deployment artifacts before resetting or cleaning when those files matter.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

11. VPS operating practices that prevent avoidable outages

  • Use a dedicated deployment account. Do not run routine Git operations as root. The account should own the checkout and have only the permissions needed to deploy.
  • Keep credentials and secrets outside Git. Use environment files or a secret manager, exclude them with .gitignore, and inspect the staged diff before every commit.
  • Verify branch and remote immediately before deployment. A correct command run in the wrong directory or against the wrong remote can deploy another application.
  • Record the deployed revision. Run git rev-parse --short HEAD after the checkout is updated and store that value in the deployment log, release metadata, or service banner.
  • Prefer repeatable deployment automation. A bare repository plus a reviewed hook, or a pull script that fetches and checks out a known commit, is safer than manually editing files and later overwriting them with a pull.
  • Test before restarting services. Fetching and merging changes files; it does not prove that dependencies, migrations, configuration, or application startup will succeed.

12. A conservative update sequence for a production checkout

When the server is intended to mirror a remote branch and contains no local application work, this sequence makes each decision visible:

  1. cd /srv/app
    pwd
    git status --short --branch
    git branch --show-current
    git remote -v
  2. git fetch origin
    git log --oneline HEAD..origin/main
    git diff HEAD...origin/main
  3. If the review is acceptable and the branch should never diverge locally, run:

    git pull --ff-only origin main
  4. Run the application’s tests, dependency checks, migrations, or build steps required by your release procedure.

  5. git rev-parse --short HEAD

    Record the resulting commit as the deployed revision.

    Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

If fast-forward-only mode stops, do not bypass the warning. Investigate local commits with git log, decide whether they belong in the project, and integrate them through the reviewed merge or rebase process instead of forcing the production branch into an unknown state.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.