feat(images): implement RemoveImage gRPC API with extra protection for used images

.github/workflows/go-tests.yml

@@ -14,13 +14,12 @@ on:
       - "**.proto"
       - "go.*"
       - "Makefile"
-      - "mise.toml"
       - "scripts/**"
       - "test/**"
 permissions:
   contents: read
 env:
-  MISE_VERSION: "2026.10.22"
+  MISE_VERSION: "2026.3.7"
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -43,9 +42,9 @@ jobs:
 
       - name: Generate docs
         run: |
-          mise run docs:cli
+          make cli-docs
           git diff --exit-code ||
-            (echo "Documentation is out of date. Please run 'mise run docs:cli' and commit the changes." && exit 1)
+            (echo "Documentation is out of date. Please run 'make cli-docs' and commit the changes." && exit 1)
 
       - name: Run tests
         run: |
@@ -71,7 +70,7 @@ jobs:
           version: ${{ env.MISE_VERSION }}
 
       # TODO: figure out how to properly lock all platforms in the lockfile and remove this hack.
-      # `mise lock` doesn't generate checksums for some of the tools, e.g. protoc*
+      # `mise lock` (mise run mise:lock) doesn't generate checksums for some of the tools, e.g. protoc*
       - name: Reset changes in mise.lock after fresh mise install
         run: git checkout mise.lock
 

.github/workflows/lint.yml

@@ -14,7 +14,7 @@ on:
 permissions:
   contents: read
 env:
-  MISE_VERSION: "2026.10.22"
+  MISE_VERSION: "2026.3.7"
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -30,6 +30,6 @@ jobs:
         run: git checkout mise.lock
 
       - name: Lint
-        run: mise run lint
+        run: make lint
 
     timeout-minutes: 10

.github/workflows/nightly-build.yml

@@ -8,7 +8,7 @@ permissions:
   contents: write
 
 env:
-  MISE_VERSION: "2026.10.22"
+  MISE_VERSION: "2026.3.7"
 
 jobs:
   nightly:

AGENTS.md

@@ -98,6 +98,33 @@ management.
 
 - **`misc/`**: Design documents and guides
 
+## Key Technologies
+
+### Core Dependencies
+
+```go
+// Networking and orchestration
+github.com/docker/docker // Docker API client
+github.com/docker/compose/v2 // Docker Compose integration
+golang.zx2c4.com/wireguard // WireGuard implementation
+github.com/hashicorp/serf // Gossip protocol
+
+// State management
+github.com/ipfs/go-ds-crdt // CRDT distributed storage
+github.com/dgraph-io/badger/v3 // Embedded database
+
+// Web proxy
+github.com/caddyserver/caddy/v2 // HTTP server and reverse proxy
+
+// CLI and UX
+github.com/spf13/cobra // CLI framework
+github.com/charmbracelet/huh // Interactive forms
+
+// gRPC and networking
+google.golang.org/grpc                     // gRPC framework
+github.com/siderolabs/grpc-proxy // gRPC proxy for forwarding
+```
+
 ## Development Workflow
 
 ### Build and Development
@@ -108,18 +135,16 @@ go build -o uc ./cmd/uc
 go build -o uncloudd ./cmd/uncloudd
 ```
 
-### Formatting and Linting
-
-- `mise run lint`: Check Go code and formatting without changing files
-- `mise run lint:fix`: Apply formatting and available lint fixes
-
-### Other Development Tasks
+### Key Make Targets
 
 - `proto`: Generate protobuf code
 - `ucind-cluster`: Create development cluster
 - `update-dev`: Deploy to development machines
 - `demo-reset`: Reset demo environment
+- `fmt`: Format code
 - `test`: Run all tests
+- `lint`: Lint the code using golangci-lint
+- `lint-and-fix`: Lint the code and fix issues whenever possible
 
 ## CLI Commands Structure
 

HACKING.md

@@ -35,11 +35,10 @@ Build the CLI:
 go build -o uc ./cmd/uc
 ```
 
-Or build and run the CLI with mise. It forwards arguments, including help flags, directly to the CLI:
+Or build and run the CLI with a single command:
 
 ```shell
-mise uc --help
-mise uc image rm -h
+go run ./cmd/uc --help
 ```
 
 The Uncloud daemon (`uncloudd`) only supports Linux, so you need to cross-compile it if you're developing on macOS or
@@ -100,16 +99,10 @@ mise run dev:reset user@host1 user@host2
 
 ## Linting and formatting
 
-Check the code and formatting without changing files:
+Lint and format the code:
 
 ```shell
-mise run lint
-```
-
-Apply formatting and available lint fixes:
-
-```shell
-mise run lint:fix
+make lint-and-fix
 ```
 
 ## Code generation
@@ -126,28 +119,6 @@ Regenerate mocks:
 mise run mocks
 ```
 
-## Documentation
-
-Regenerate the CLI reference docs after changing commands or flags:
-
-```shell
-mise run docs:cli
-```
-
-To preview the documentation website, install its dependencies from the project root:
-
-```shell
-npm ci --prefix website
-```
-
-Then start the local development server:
-
-```shell
-mise run docs:dev
-```
-
-The server opens the site (http://localhost:3000/) in your browser and reloads it as you edit files in `website/`.
-
 ## Uncloud in Docker (UCinD)
 
 The [`ucind`](./cmd/ucind) CLI lets you run Uncloud clusters locally using Docker containers instead of real machines.

Makefile

@@ -47,3 +47,25 @@ test-clean:
 	else \
 		echo "Nothing to clean."; \
 	fi
+
+.PHONY: vet
+vet:
+	go vet ./...
+
+.PHONY: format fmt
+format fmt:
+	GOOS=linux golangci-lint fmt
+
+LINT_TARGETS := lint lint-and-fix
+.PHONY: $(LINT_TARGETS) _lint
+$(LINT_TARGETS): _lint
+lint: ARGS=
+lint-and-fix: ARGS=--fix
+_lint:
+# Explicitly set OS to Linux to not skip *_linux.go files when running on macOS.
+# Uncloud daemon won't likely support OS other than Linux anytime soon, so for now we can rely on that.
+	GOOS=linux golangci-lint run $(ARGS)
+
+.PHONY: cli-docs
+cli-docs:
+	go run ./cmd/uc docs

api/pb/docker.pb.go

@@ -2259,137 +2259,6 @@ func (x *ServiceContainer) GetServiceSpec() []byte {
 	return nil
 }
 
-type UpdateServiceContainerRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	// Fields that are not set are left unchanged. CPU and memory limits can be changed but not removed.
-	// CPU limit in nanocores.
-	Cpu *int64 `protobuf:"varint,2,opt,name=cpu,proto3,oneof" json:"cpu,omitempty"`
-	// Memory limit in bytes.
-	Memory *int64 `protobuf:"varint,3,opt,name=memory,proto3,oneof" json:"memory,omitempty"`
-	// Memory reservation in bytes.
-	MemoryReservation *int64 `protobuf:"varint,4,opt,name=memory_reservation,json=memoryReservation,proto3,oneof" json:"memory_reservation,omitempty"`
-	// Service labels that replace all current service labels.
-	ServiceLabels *Labels `protobuf:"bytes,5,opt,name=service_labels,json=serviceLabels,proto3" json:"service_labels,omitempty"`
-}
-
-func (x *UpdateServiceContainerRequest) Reset() {
-	*x = UpdateServiceContainerRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_docker_proto_msgTypes[38]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *UpdateServiceContainerRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*UpdateServiceContainerRequest) ProtoMessage() {}
-
-func (x *UpdateServiceContainerRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_docker_proto_msgTypes[38]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use UpdateServiceContainerRequest.ProtoReflect.Descriptor instead.
-func (*UpdateServiceContainerRequest) Descriptor() ([]byte, []int) {
-	return file_api_pb_docker_proto_rawDescGZIP(), []int{38}
-}
-
-func (x *UpdateServiceContainerRequest) GetId() string {
-	if x != nil {
-		return x.Id
-	}
-	return ""
-}
-
-func (x *UpdateServiceContainerRequest) GetCpu() int64 {
-	if x != nil && x.Cpu != nil {
-		return *x.Cpu
-	}
-	return 0
-}
-
-func (x *UpdateServiceContainerRequest) GetMemory() int64 {
-	if x != nil && x.Memory != nil {
-		return *x.Memory
-	}
-	return 0
-}
-
-func (x *UpdateServiceContainerRequest) GetMemoryReservation() int64 {
-	if x != nil && x.MemoryReservation != nil {
-		return *x.MemoryReservation
-	}
-	return 0
-}
-
-func (x *UpdateServiceContainerRequest) GetServiceLabels() *Labels {
-	if x != nil {
-		return x.ServiceLabels
-	}
-	return nil
-}
-
-type Labels struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Labels map[string]string `protobuf:"bytes,1,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
-}
-
-func (x *Labels) Reset() {
-	*x = Labels{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_docker_proto_msgTypes[39]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *Labels) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Labels) ProtoMessage() {}
-
-func (x *Labels) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_docker_proto_msgTypes[39]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Labels.ProtoReflect.Descriptor instead.
-func (*Labels) Descriptor() ([]byte, []int) {
-	return file_api_pb_docker_proto_rawDescGZIP(), []int{39}
-}
-
-func (x *Labels) GetLabels() map[string]string {
-	if x != nil {
-		return x.Labels
-	}
-	return nil
-}
-
 type ListServiceContainersRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2403,7 +2272,7 @@ type ListServiceContainersRequest struct {
 func (x *ListServiceContainersRequest) Reset() {
 	*x = ListServiceContainersRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_docker_proto_msgTypes[40]
+		mi := &file_api_pb_docker_proto_msgTypes[38]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2416,7 +2285,7 @@ func (x *ListServiceContainersRequest) String() string {
 func (*ListServiceContainersRequest) ProtoMessage() {}
 
 func (x *ListServiceContainersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_docker_proto_msgTypes[40]
+	mi := &file_api_pb_docker_proto_msgTypes[38]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2429,7 +2298,7 @@ func (x *ListServiceContainersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListServiceContainersRequest.ProtoReflect.Descriptor instead.
 func (*ListServiceContainersRequest) Descriptor() ([]byte, []int) {
-	return file_api_pb_docker_proto_rawDescGZIP(), []int{40}
+	return file_api_pb_docker_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *ListServiceContainersRequest) GetServiceId() string {
@@ -2459,7 +2328,7 @@ type ListServiceContainersResponse struct {
 func (x *ListServiceContainersResponse) Reset() {
 	*x = ListServiceContainersResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_docker_proto_msgTypes[41]
+		mi := &file_api_pb_docker_proto_msgTypes[39]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2472,7 +2341,7 @@ func (x *ListServiceContainersResponse) String() string {
 func (*ListServiceContainersResponse) ProtoMessage() {}
 
 func (x *ListServiceContainersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_docker_proto_msgTypes[41]
+	mi := &file_api_pb_docker_proto_msgTypes[39]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2485,7 +2354,7 @@ func (x *ListServiceContainersResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListServiceContainersResponse.ProtoReflect.Descriptor instead.
 func (*ListServiceContainersResponse) Descriptor() ([]byte, []int) {
-	return file_api_pb_docker_proto_rawDescGZIP(), []int{41}
+	return file_api_pb_docker_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *ListServiceContainersResponse) GetMessages() []*MachineServiceContainers {
@@ -2509,7 +2378,7 @@ type MachineServiceContainers struct {
 func (x *MachineServiceContainers) Reset() {
 	*x = MachineServiceContainers{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_api_pb_docker_proto_msgTypes[42]
+		mi := &file_api_pb_docker_proto_msgTypes[40]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -2522,7 +2391,7 @@ func (x *MachineServiceContainers) String() string {
 func (*MachineServiceContainers) ProtoMessage() {}
 
 func (x *MachineServiceContainers) ProtoReflect() protoreflect.Message {
-	mi := &file_api_pb_docker_proto_msgTypes[42]
+	mi := &file_api_pb_docker_proto_msgTypes[40]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2535,7 +2404,7 @@ func (x *MachineServiceContainers) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineServiceContainers.ProtoReflect.Descriptor instead.
 func (*MachineServiceContainers) Descriptor() ([]byte, []int) {
-	return file_api_pb_docker_proto_rawDescGZIP(), []int{42}
+	return file_api_pb_docker_proto_rawDescGZIP(), []int{40}
 }
 
 func (x *MachineServiceContainers) GetMetadata() *Metadata {
@@ -2769,153 +2638,125 @@ var file_api_pb_docker_proto_rawDesc = []byte{
 	0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69,
 	0x6e, 0x65, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x73,
 	0x70, 0x65, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x53, 0x70, 0x65, 0x63, 0x22, 0xf5, 0x01, 0x0a, 0x1d, 0x55, 0x70, 0x64, 0x61, 0x74,
-	0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
-	0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x15, 0x0a, 0x03, 0x63, 0x70, 0x75, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x03, 0x48, 0x00, 0x52, 0x03, 0x63, 0x70, 0x75, 0x88, 0x01, 0x01, 0x12,
-	0x1b, 0x0a, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x48,
-	0x01, 0x52, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x88, 0x01, 0x01, 0x12, 0x32, 0x0a, 0x12,
-	0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x5f, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x48, 0x02, 0x52, 0x11, 0x6d, 0x65, 0x6d, 0x6f,
-	0x72, 0x79, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01,
-	0x12, 0x32, 0x0a, 0x0e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6c, 0x61, 0x62, 0x65,
-	0x6c, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c,
-	0x61, 0x62, 0x65, 0x6c, 0x73, 0x52, 0x0d, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4c, 0x61,
-	0x62, 0x65, 0x6c, 0x73, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x63, 0x70, 0x75, 0x42, 0x09, 0x0a, 0x07,
-	0x5f, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x42, 0x15, 0x0a, 0x13, 0x5f, 0x6d, 0x65, 0x6d, 0x6f,
-	0x72, 0x79, 0x5f, 0x72, 0x65, 0x73, 0x65, 0x72, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x74,
-	0x0a, 0x06, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x12, 0x2f, 0x0a, 0x06, 0x6c, 0x61, 0x62, 0x65,
-	0x6c, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c,
-	0x61, 0x62, 0x65, 0x6c, 0x73, 0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72,
-	0x79, 0x52, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x1a, 0x39, 0x0a, 0x0b, 0x4c, 0x61, 0x62,
-	0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x3a, 0x02, 0x38, 0x01, 0x22, 0x57, 0x0a, 0x1c, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f,
-	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x5a, 0x0a,
-	0x1d, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74,
-	0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x39,
-	0x0a, 0x08, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x65,
+	0x63, 0x65, 0x53, 0x70, 0x65, 0x63, 0x22, 0x57, 0x0a, 0x1c, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65,
 	0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x52,
-	0x08, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x22, 0xbc, 0x01, 0x0a, 0x18, 0x4d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74,
-	0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x29, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x12, 0x35, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x18,
-	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x0a, 0x63, 0x6f,
-	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x3e, 0x0a, 0x0f, 0x68, 0x6f, 0x6f, 0x6b,
-	0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43,
-	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x0e, 0x68, 0x6f, 0x6f, 0x6b, 0x43, 0x6f,
-	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x32, 0x93, 0x0c, 0x0a, 0x06, 0x44, 0x6f, 0x63,
-	0x6b, 0x65, 0x72, 0x12, 0x4c, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6f, 0x6e,
-	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x4f, 0x0a, 0x10, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x74,
-	0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70,
-	0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63,
-	0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x44, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61,
-	0x69, 0x6e, 0x65, 0x72, 0x12, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x74, 0x61, 0x72, 0x74,
-	0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x42, 0x0a, 0x0d, 0x53, 0x74, 0x6f, 0x70,
-	0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x53, 0x74, 0x6f, 0x70, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x49, 0x0a, 0x0e,
-	0x4c, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x1a,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e,
-	0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x46, 0x0a, 0x0f, 0x52, 0x65, 0x6d, 0x6f, 0x76,
-	0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12,
-	0x4a, 0x0a, 0x0d, 0x45, 0x78, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
-	0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x45, 0x78, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x61,
-	0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x45, 0x78, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x12, 0x32, 0x0a, 0x0d, 0x43,
-	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x73, 0x12, 0x10, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x4c, 0x6f, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0d,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x30, 0x01, 0x12,
-	0x36, 0x0a, 0x09, 0x50, 0x75, 0x6c, 0x6c, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x12, 0x15, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x50, 0x75, 0x6c, 0x6c, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x10, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4a, 0x53, 0x4f, 0x4e, 0x4d, 0x65,
-	0x73, 0x73, 0x61, 0x67, 0x65, 0x30, 0x01, 0x12, 0x43, 0x0a, 0x0c, 0x49, 0x6e, 0x73, 0x70, 0x65,
-	0x63, 0x74, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x12, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e,
-	0x73, 0x70, 0x65, 0x63, 0x74, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x49,
-	0x6d, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x55, 0x0a, 0x12,
-	0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x49, 0x6d, 0x61,
-	0x67, 0x65, 0x12, 0x1e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74,
-	0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74,
-	0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x3d, 0x0a, 0x0a, 0x4c, 0x69, 0x73, 0x74, 0x49, 0x6d, 0x61, 0x67, 0x65,
-	0x73, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x49, 0x6d, 0x61, 0x67,
-	0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x4c, 0x69, 0x73, 0x74, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x40, 0x0a, 0x0b, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x49, 0x6d, 0x61, 0x67,
-	0x65, 0x12, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x49, 0x6d,
-	0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x43, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x56, 0x6f,
-	0x6c, 0x75, 0x6d, 0x65, 0x12, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x19,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x56, 0x6f, 0x6c, 0x75, 0x6d,
-	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x0b, 0x4c, 0x69, 0x73,
-	0x74, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x73, 0x12, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c,
-	0x69, 0x73, 0x74, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x6f, 0x6c, 0x75,
-	0x6d, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x0c, 0x52,
-	0x65, 0x6d, 0x6f, 0x76, 0x65, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x12, 0x18, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x5a, 0x0a,
-	0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f,
-	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x22, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61,
-	0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
-	0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4e, 0x0a, 0x17, 0x49, 0x6e, 0x73,
-	0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61,
-	0x69, 0x6e, 0x65, 0x72, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65,
-	0x63, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x54, 0x0a, 0x16, 0x55, 0x70, 0x64,
-	0x61, 0x74, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69,
-	0x6e, 0x65, 0x72, 0x12, 0x22, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22,
+	0x5a, 0x0a, 0x1d, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x39, 0x0a, 0x08, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
 	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
+	0x73, 0x52, 0x08, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x22, 0xbc, 0x01, 0x0a, 0x18,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x29, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x12, 0x35, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x0a,
+	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x3e, 0x0a, 0x0f, 0x68, 0x6f,
+	0x6f, 0x6b, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x0e, 0x68, 0x6f, 0x6f, 0x6b,
+	0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x32, 0xbd, 0x0b, 0x0a, 0x06, 0x44,
+	0x6f, 0x63, 0x6b, 0x65, 0x72, 0x12, 0x4c, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43,
+	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43,
+	0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x4f, 0x0a, 0x10, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x43, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e,
+	0x73, 0x70, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70,
+	0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x44, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x43, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x42, 0x0a, 0x0d, 0x53, 0x74,
+	0x6f, 0x70, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x19, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x53, 0x74, 0x6f, 0x70, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x49,
+	0x0a, 0x0e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73,
+	0x12, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61,
+	0x69, 0x6e, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x46, 0x0a, 0x0f, 0x52, 0x65, 0x6d,
+	0x6f, 0x76, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e,
+	0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74,
+	0x79, 0x12, 0x4a, 0x0a, 0x0d, 0x45, 0x78, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e,
+	0x65, 0x72, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x45, 0x78, 0x65, 0x63, 0x43, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x45, 0x78, 0x65, 0x63, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x12, 0x32, 0x0a,
+	0x0d, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x73, 0x12, 0x10,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x6f, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x30,
+	0x01, 0x12, 0x36, 0x0a, 0x09, 0x50, 0x75, 0x6c, 0x6c, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x12, 0x15,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x75, 0x6c, 0x6c, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x10, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4a, 0x53, 0x4f, 0x4e,
+	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x30, 0x01, 0x12, 0x43, 0x0a, 0x0c, 0x49, 0x6e, 0x73,
+	0x70, 0x65, 0x63, 0x74, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x12, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63,
+	0x74, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x55,
+	0x0a, 0x12, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x49,
+	0x6d, 0x61, 0x67, 0x65, 0x12, 0x1e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65,
+	0x63, 0x74, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65,
+	0x63, 0x74, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3d, 0x0a, 0x0a, 0x4c, 0x69, 0x73, 0x74, 0x49, 0x6d, 0x61,
+	0x67, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x49, 0x6d,
+	0x61, 0x67, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x0b, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x49, 0x6d,
+	0x61, 0x67, 0x65, 0x12, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65,
+	0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x43, 0x0a, 0x0c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x12, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x56, 0x6f, 0x6c,
+	0x75, 0x6d, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x0b, 0x4c,
+	0x69, 0x73, 0x74, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x73, 0x12, 0x17, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x56, 0x6f,
+	0x6c, 0x75, 0x6d, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a,
+	0x0c, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65, 0x12, 0x18, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x56, 0x6f, 0x6c, 0x75, 0x6d, 0x65,
 	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
 	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12,
-	0x5e, 0x0a, 0x15, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f,
-	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x12, 0x21, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c,
+	0x5a, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x22, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69,
+	0x6e, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4e, 0x0a, 0x17, 0x49,
+	0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73,
+	0x70, 0x65, 0x63, 0x74, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x5e, 0x0a, 0x15, 0x4c,
 	0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69,
-	0x6e, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e,
-	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x4d, 0x0a, 0x16, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x42, 0x26,
-	0x5a, 0x24, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76,
-	0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f,
-	0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x6e, 0x65, 0x72, 0x73, 0x12, 0x21, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69,
+	0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e,
+	0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4d, 0x0a, 0x16, 0x52,
+	0x65, 0x6d, 0x6f, 0x76, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x6d, 0x6f,
+	0x76, 0x65, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x42, 0x26, 0x5a, 0x24, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f,
+	0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -2931,7 +2772,7 @@ func file_api_pb_docker_proto_rawDescGZIP() []byte {
 }
 
 var file_api_pb_docker_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_api_pb_docker_proto_msgTypes = make([]protoimpl.MessageInfo, 44)
+var file_api_pb_docker_proto_msgTypes = make([]protoimpl.MessageInfo, 41)
 var file_api_pb_docker_proto_goTypes = []any{
 	(CreateServiceContainerRequest_ContainerType)(0), // 0: api.CreateServiceContainerRequest.ContainerType
 	(*CreateContainerRequest)(nil),                   // 1: api.CreateContainerRequest
@@ -2972,88 +2813,81 @@ var file_api_pb_docker_proto_goTypes = []any{
 	(*RemoveVolumeRequest)(nil),                      // 36: api.RemoveVolumeRequest
 	(*CreateServiceContainerRequest)(nil),            // 37: api.CreateServiceContainerRequest
 	(*ServiceContainer)(nil),                         // 38: api.ServiceContainer
-	(*UpdateServiceContainerRequest)(nil),            // 39: api.UpdateServiceContainerRequest
-	(*Labels)(nil),                                   // 40: api.Labels
-	(*ListServiceContainersRequest)(nil),             // 41: api.ListServiceContainersRequest
-	(*ListServiceContainersResponse)(nil),            // 42: api.ListServiceContainersResponse
-	(*MachineServiceContainers)(nil),                 // 43: api.MachineServiceContainers
-	nil,                                              // 44: api.Labels.LabelsEntry
-	(*Metadata)(nil),                                 // 45: api.Metadata
-	(*LogsRequest)(nil),                              // 46: api.LogsRequest
-	(*emptypb.Empty)(nil),                            // 47: google.protobuf.Empty
-	(*LogEntry)(nil),                                 // 48: api.LogEntry
+	(*ListServiceContainersRequest)(nil),             // 39: api.ListServiceContainersRequest
+	(*ListServiceContainersResponse)(nil),            // 40: api.ListServiceContainersResponse
+	(*MachineServiceContainers)(nil),                 // 41: api.MachineServiceContainers
+	(*Metadata)(nil),                                 // 42: api.Metadata
+	(*LogsRequest)(nil),                              // 43: api.LogsRequest
+	(*emptypb.Empty)(nil),                            // 44: google.protobuf.Empty
+	(*LogEntry)(nil),                                 // 45: api.LogEntry
 }
 var file_api_pb_docker_proto_depIdxs = []int32{
 	9,  // 0: api.ListContainersResponse.messages:type_name -> api.MachineContainers
-	45, // 1: api.MachineContainers.metadata:type_name -> api.Metadata
+	42, // 1: api.MachineContainers.metadata:type_name -> api.Metadata
 	12, // 2: api.ExecContainerRequest.config:type_name -> api.ExecConfig
 	13, // 3: api.ExecContainerRequest.resize:type_name -> api.ResizeEvent
 	19, // 4: api.InspectImageResponse.messages:type_name -> api.Image
-	45, // 5: api.Image.metadata:type_name -> api.Metadata
+	42, // 5: api.Image.metadata:type_name -> api.Metadata
 	22, // 6: api.InspectRemoteImageResponse.messages:type_name -> api.RemoteImage
-	45, // 7: api.RemoteImage.metadata:type_name -> api.Metadata
+	42, // 7: api.RemoteImage.metadata:type_name -> api.Metadata
 	25, // 8: api.RemoveImageRequest.platforms:type_name -> api.ImagePlatform
 	27, // 9: api.RemoveImageResponse.messages:type_name -> api.MachineImageRemoval
-	45, // 10: api.MachineImageRemoval.metadata:type_name -> api.Metadata
+	42, // 10: api.MachineImageRemoval.metadata:type_name -> api.Metadata
 	28, // 11: api.MachineImageRemoval.results:type_name -> api.ImageRemoval
 	30, // 12: api.ListImagesResponse.messages:type_name -> api.MachineImages
-	45, // 13: api.MachineImages.metadata:type_name -> api.Metadata
+	42, // 13: api.MachineImages.metadata:type_name -> api.Metadata
 	35, // 14: api.ListVolumesResponse.messages:type_name -> api.MachineVolumes
-	45, // 15: api.MachineVolumes.metadata:type_name -> api.Metadata
+	42, // 15: api.MachineVolumes.metadata:type_name -> api.Metadata
 	0,  // 16: api.CreateServiceContainerRequest.container_type:type_name -> api.CreateServiceContainerRequest.ContainerType
-	40, // 17: api.UpdateServiceContainerRequest.service_labels:type_name -> api.Labels
-	44, // 18: api.Labels.labels:type_name -> api.Labels.LabelsEntry
-	43, // 19: api.ListServiceContainersResponse.messages:type_name -> api.MachineServiceContainers
-	45, // 20: api.MachineServiceContainers.metadata:type_name -> api.Metadata
-	38, // 21: api.MachineServiceContainers.containers:type_name -> api.ServiceContainer
-	38, // 22: api.MachineServiceContainers.hook_containers:type_name -> api.ServiceContainer
-	1,  // 23: api.Docker.CreateContainer:input_type -> api.CreateContainerRequest
-	3,  // 24: api.Docker.InspectContainer:input_type -> api.InspectContainerRequest
-	5,  // 25: api.Docker.StartContainer:input_type -> api.StartContainerRequest
-	6,  // 26: api.Docker.StopContainer:input_type -> api.StopContainerRequest
-	7,  // 27: api.Docker.ListContainers:input_type -> api.ListContainersRequest
-	10, // 28: api.Docker.RemoveContainer:input_type -> api.RemoveContainerRequest
-	11, // 29: api.Docker.ExecContainer:input_type -> api.ExecContainerRequest
-	46, // 30: api.Docker.ContainerLogs:input_type -> api.LogsRequest
-	15, // 31: api.Docker.PullImage:input_type -> api.PullImageRequest
-	17, // 32: api.Docker.InspectImage:input_type -> api.InspectImageRequest
-	20, // 33: api.Docker.InspectRemoteImage:input_type -> api.InspectRemoteImageRequest
-	23, // 34: api.Docker.ListImages:input_type -> api.ListImagesRequest
-	24, // 35: api.Docker.RemoveImage:input_type -> api.RemoveImageRequest
-	31, // 36: api.Docker.CreateVolume:input_type -> api.CreateVolumeRequest
-	33, // 37: api.Docker.ListVolumes:input_type -> api.ListVolumesRequest
-	36, // 38: api.Docker.RemoveVolume:input_type -> api.RemoveVolumeRequest
-	37, // 39: api.Docker.CreateServiceContainer:input_type -> api.CreateServiceContainerRequest
-	3,  // 40: api.Docker.InspectServiceContainer:input_type -> api.InspectContainerRequest
-	39, // 41: api.Docker.UpdateServiceContainer:input_type -> api.UpdateServiceContainerRequest
-	41, // 42: api.Docker.ListServiceContainers:input_type -> api.ListServiceContainersRequest
-	10, // 43: api.Docker.RemoveServiceContainer:input_type -> api.RemoveContainerRequest
-	2,  // 44: api.Docker.CreateContainer:output_type -> api.CreateContainerResponse
-	4,  // 45: api.Docker.InspectContainer:output_type -> api.InspectContainerResponse
-	47, // 46: api.Docker.StartContainer:output_type -> google.protobuf.Empty
-	47, // 47: api.Docker.StopContainer:output_type -> google.protobuf.Empty
-	8,  // 48: api.Docker.ListContainers:output_type -> api.ListContainersResponse
-	47, // 49: api.Docker.RemoveContainer:output_type -> google.protobuf.Empty
-	14, // 50: api.Docker.ExecContainer:output_type -> api.ExecContainerResponse
-	48, // 51: api.Docker.ContainerLogs:output_type -> api.LogEntry
-	16, // 52: api.Docker.PullImage:output_type -> api.JSONMessage
-	18, // 53: api.Docker.InspectImage:output_type -> api.InspectImageResponse
-	21, // 54: api.Docker.InspectRemoteImage:output_type -> api.InspectRemoteImageResponse
-	29, // 55: api.Docker.ListImages:output_type -> api.ListImagesResponse
-	26, // 56: api.Docker.RemoveImage:output_type -> api.RemoveImageResponse
-	32, // 57: api.Docker.CreateVolume:output_type -> api.CreateVolumeResponse
-	34, // 58: api.Docker.ListVolumes:output_type -> api.ListVolumesResponse
-	47, // 59: api.Docker.RemoveVolume:output_type -> google.protobuf.Empty
-	2,  // 60: api.Docker.CreateServiceContainer:output_type -> api.CreateContainerResponse
-	38, // 61: api.Docker.InspectServiceContainer:output_type -> api.ServiceContainer
-	47, // 62: api.Docker.UpdateServiceContainer:output_type -> google.protobuf.Empty
-	42, // 63: api.Docker.ListServiceContainers:output_type -> api.ListServiceContainersResponse
-	47, // 64: api.Docker.RemoveServiceContainer:output_type -> google.protobuf.Empty
-	44, // [44:65] is the sub-list for method output_type
-	23, // [23:44] is the sub-list for method input_type
-	23, // [23:23] is the sub-list for extension type_name
-	23, // [23:23] is the sub-list for extension extendee
-	0,  // [0:23] is the sub-list for field type_name
+	41, // 17: api.ListServiceContainersResponse.messages:type_name -> api.MachineServiceContainers
+	42, // 18: api.MachineServiceContainers.metadata:type_name -> api.Metadata
+	38, // 19: api.MachineServiceContainers.containers:type_name -> api.ServiceContainer
+	38, // 20: api.MachineServiceContainers.hook_containers:type_name -> api.ServiceContainer
+	1,  // 21: api.Docker.CreateContainer:input_type -> api.CreateContainerRequest
+	3,  // 22: api.Docker.InspectContainer:input_type -> api.InspectContainerRequest
+	5,  // 23: api.Docker.StartContainer:input_type -> api.StartContainerRequest
+	6,  // 24: api.Docker.StopContainer:input_type -> api.StopContainerRequest
+	7,  // 25: api.Docker.ListContainers:input_type -> api.ListContainersRequest
+	10, // 26: api.Docker.RemoveContainer:input_type -> api.RemoveContainerRequest
+	11, // 27: api.Docker.ExecContainer:input_type -> api.ExecContainerRequest
+	43, // 28: api.Docker.ContainerLogs:input_type -> api.LogsRequest
+	15, // 29: api.Docker.PullImage:input_type -> api.PullImageRequest
+	17, // 30: api.Docker.InspectImage:input_type -> api.InspectImageRequest
+	20, // 31: api.Docker.InspectRemoteImage:input_type -> api.InspectRemoteImageRequest
+	23, // 32: api.Docker.ListImages:input_type -> api.ListImagesRequest
+	24, // 33: api.Docker.RemoveImage:input_type -> api.RemoveImageRequest
+	31, // 34: api.Docker.CreateVolume:input_type -> api.CreateVolumeRequest
+	33, // 35: api.Docker.ListVolumes:input_type -> api.ListVolumesRequest
+	36, // 36: api.Docker.RemoveVolume:input_type -> api.RemoveVolumeRequest
+	37, // 37: api.Docker.CreateServiceContainer:input_type -> api.CreateServiceContainerRequest
+	3,  // 38: api.Docker.InspectServiceContainer:input_type -> api.InspectContainerRequest
+	39, // 39: api.Docker.ListServiceContainers:input_type -> api.ListServiceContainersRequest
+	10, // 40: api.Docker.RemoveServiceContainer:input_type -> api.RemoveContainerRequest
+	2,  // 41: api.Docker.CreateContainer:output_type -> api.CreateContainerResponse
+	4,  // 42: api.Docker.InspectContainer:output_type -> api.InspectContainerResponse
+	44, // 43: api.Docker.StartContainer:output_type -> google.protobuf.Empty
+	44, // 44: api.Docker.StopContainer:output_type -> google.protobuf.Empty
+	8,  // 45: api.Docker.ListContainers:output_type -> api.ListContainersResponse
+	44, // 46: api.Docker.RemoveContainer:output_type -> google.protobuf.Empty
+	14, // 47: api.Docker.ExecContainer:output_type -> api.ExecContainerResponse
+	45, // 48: api.Docker.ContainerLogs:output_type -> api.LogEntry
+	16, // 49: api.Docker.PullImage:output_type -> api.JSONMessage
+	18, // 50: api.Docker.InspectImage:output_type -> api.InspectImageResponse
+	21, // 51: api.Docker.InspectRemoteImage:output_type -> api.InspectRemoteImageResponse
+	29, // 52: api.Docker.ListImages:output_type -> api.ListImagesResponse
+	26, // 53: api.Docker.RemoveImage:output_type -> api.RemoveImageResponse
+	32, // 54: api.Docker.CreateVolume:output_type -> api.CreateVolumeResponse
+	34, // 55: api.Docker.ListVolumes:output_type -> api.ListVolumesResponse
+	44, // 56: api.Docker.RemoveVolume:output_type -> google.protobuf.Empty
+	2,  // 57: api.Docker.CreateServiceContainer:output_type -> api.CreateContainerResponse
+	38, // 58: api.Docker.InspectServiceContainer:output_type -> api.ServiceContainer
+	40, // 59: api.Docker.ListServiceContainers:output_type -> api.ListServiceContainersResponse
+	44, // 60: api.Docker.RemoveServiceContainer:output_type -> google.protobuf.Empty
+	41, // [41:61] is the sub-list for method output_type
+	21, // [21:41] is the sub-list for method input_type
+	21, // [21:21] is the sub-list for extension type_name
+	21, // [21:21] is the sub-list for extension extendee
+	0,  // [0:21] is the sub-list for field type_name
 }
 
 func init() { file_api_pb_docker_proto_init() }
@@ -3520,30 +3354,6 @@ func file_api_pb_docker_proto_init() {
 			}
 		}
 		file_api_pb_docker_proto_msgTypes[38].Exporter = func(v any, i int) any {
-			switch v := v.(*UpdateServiceContainerRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_docker_proto_msgTypes[39].Exporter = func(v any, i int) any {
-			switch v := v.(*Labels); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_api_pb_docker_proto_msgTypes[40].Exporter = func(v any, i int) any {
 			switch v := v.(*ListServiceContainersRequest); i {
 			case 0:
 				return &v.state
@@ -3555,7 +3365,7 @@ func file_api_pb_docker_proto_init() {
 				return nil
 			}
 		}
-		file_api_pb_docker_proto_msgTypes[41].Exporter = func(v any, i int) any {
+		file_api_pb_docker_proto_msgTypes[39].Exporter = func(v any, i int) any {
 			switch v := v.(*ListServiceContainersResponse); i {
 			case 0:
 				return &v.state
@@ -3567,7 +3377,7 @@ func file_api_pb_docker_proto_init() {
 				return nil
 			}
 		}
-		file_api_pb_docker_proto_msgTypes[42].Exporter = func(v any, i int) any {
+		file_api_pb_docker_proto_msgTypes[40].Exporter = func(v any, i int) any {
 			switch v := v.(*MachineServiceContainers); i {
 			case 0:
 				return &v.state
@@ -3591,14 +3401,13 @@ func file_api_pb_docker_proto_init() {
 		(*ExecContainerResponse_Stderr)(nil),
 		(*ExecContainerResponse_ExitCode)(nil),
 	}
-	file_api_pb_docker_proto_msgTypes[38].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_api_pb_docker_proto_rawDesc,
 			NumEnums:      1,
-			NumMessages:   44,
+			NumMessages:   41,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

api/pb/docker.proto

@@ -32,8 +32,6 @@ service Docker {
 
   rpc CreateServiceContainer(CreateServiceContainerRequest) returns (CreateContainerResponse);
   rpc InspectServiceContainer(InspectContainerRequest) returns (ServiceContainer);
-  // UpdateServiceContainer updates the requested properties of a service container in place without recreating it.
-  rpc UpdateServiceContainer(UpdateServiceContainerRequest) returns (google.protobuf.Empty);
   rpc ListServiceContainers(ListServiceContainersRequest) returns (ListServiceContainersResponse);
   rpc RemoveServiceContainer(RemoveContainerRequest) returns (google.protobuf.Empty);
 }
@@ -283,23 +281,6 @@ message ServiceContainer {
   bytes service_spec = 2;
 }
 
-message UpdateServiceContainerRequest {
-  string id = 1;
-  // Fields that are not set are left unchanged. CPU and memory limits can be changed but not removed.
-  // CPU limit in nanocores.
-  optional int64 cpu = 2;
-  // Memory limit in bytes.
-  optional int64 memory = 3;
-  // Memory reservation in bytes.
-  optional int64 memory_reservation = 4;
-  // Service labels that replace all current service labels.
-  Labels service_labels = 5;
-}
-
-message Labels {
-  map<string, string> labels = 1;
-}
-
 message ListServiceContainersRequest {
   string service_id = 1;
   // JSON serialised container.ListOptions.

api/pb/docker_grpc.pb.go

@@ -38,7 +38,6 @@ const (
 	Docker_RemoveVolume_FullMethodName            = "/api.Docker/RemoveVolume"
 	Docker_CreateServiceContainer_FullMethodName  = "/api.Docker/CreateServiceContainer"
 	Docker_InspectServiceContainer_FullMethodName = "/api.Docker/InspectServiceContainer"
-	Docker_UpdateServiceContainer_FullMethodName  = "/api.Docker/UpdateServiceContainer"
 	Docker_ListServiceContainers_FullMethodName   = "/api.Docker/ListServiceContainers"
 	Docker_RemoveServiceContainer_FullMethodName  = "/api.Docker/RemoveServiceContainer"
 )
@@ -67,8 +66,6 @@ type DockerClient interface {
 	RemoveVolume(ctx context.Context, in *RemoveVolumeRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	CreateServiceContainer(ctx context.Context, in *CreateServiceContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error)
 	InspectServiceContainer(ctx context.Context, in *InspectContainerRequest, opts ...grpc.CallOption) (*ServiceContainer, error)
-	// UpdateServiceContainer updates the requested properties of a service container in place without recreating it.
-	UpdateServiceContainer(ctx context.Context, in *UpdateServiceContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	ListServiceContainers(ctx context.Context, in *ListServiceContainersRequest, opts ...grpc.CallOption) (*ListServiceContainersResponse, error)
 	RemoveServiceContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 }
@@ -282,16 +279,6 @@ func (c *dockerClient) InspectServiceContainer(ctx context.Context, in *InspectC
 	return out, nil
 }
 
-func (c *dockerClient) UpdateServiceContainer(ctx context.Context, in *UpdateServiceContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(emptypb.Empty)
-	err := c.cc.Invoke(ctx, Docker_UpdateServiceContainer_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 func (c *dockerClient) ListServiceContainers(ctx context.Context, in *ListServiceContainersRequest, opts ...grpc.CallOption) (*ListServiceContainersResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(ListServiceContainersResponse)
@@ -336,8 +323,6 @@ type DockerServer interface {
 	RemoveVolume(context.Context, *RemoveVolumeRequest) (*emptypb.Empty, error)
 	CreateServiceContainer(context.Context, *CreateServiceContainerRequest) (*CreateContainerResponse, error)
 	InspectServiceContainer(context.Context, *InspectContainerRequest) (*ServiceContainer, error)
-	// UpdateServiceContainer updates the requested properties of a service container in place without recreating it.
-	UpdateServiceContainer(context.Context, *UpdateServiceContainerRequest) (*emptypb.Empty, error)
 	ListServiceContainers(context.Context, *ListServiceContainersRequest) (*ListServiceContainersResponse, error)
 	RemoveServiceContainer(context.Context, *RemoveContainerRequest) (*emptypb.Empty, error)
 	mustEmbedUnimplementedDockerServer()
@@ -404,9 +389,6 @@ func (UnimplementedDockerServer) CreateServiceContainer(context.Context, *Create
 func (UnimplementedDockerServer) InspectServiceContainer(context.Context, *InspectContainerRequest) (*ServiceContainer, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method InspectServiceContainer not implemented")
 }
-func (UnimplementedDockerServer) UpdateServiceContainer(context.Context, *UpdateServiceContainerRequest) (*emptypb.Empty, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method UpdateServiceContainer not implemented")
-}
 func (UnimplementedDockerServer) ListServiceContainers(context.Context, *ListServiceContainersRequest) (*ListServiceContainersResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListServiceContainers not implemented")
 }
@@ -733,24 +715,6 @@ func _Docker_InspectServiceContainer_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Docker_UpdateServiceContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(UpdateServiceContainerRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(DockerServer).UpdateServiceContainer(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: Docker_UpdateServiceContainer_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(DockerServer).UpdateServiceContainer(ctx, req.(*UpdateServiceContainerRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 func _Docker_ListServiceContainers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(ListServiceContainersRequest)
 	if err := dec(in); err != nil {
@@ -854,10 +818,6 @@ var Docker_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "InspectServiceContainer",
 			Handler:    _Docker_InspectServiceContainer_Handler,
 		},
-		{
-			MethodName: "UpdateServiceContainer",
-			Handler:    _Docker_UpdateServiceContainer_Handler,
-		},
 		{
 			MethodName: "ListServiceContainers",
 			Handler:    _Docker_ListServiceContainers_Handler,

cmd/uc/context/show.go

@@ -22,6 +22,15 @@ func NewShowCommand() *cobra.Command {
 }
 
 func show(uncli *cli.CLI) error {
-	fmt.Println(uncli.ContextOverrideOrCurrent())
+	// discard errors, only show the current context, otherwise nothing
+	if uncli.Config == nil {
+		return nil
+	}
+
+	if len(uncli.Config.Contexts) == 0 {
+		return nil
+	}
+	fmt.Println(uncli.Config.CurrentContext)
+
 	return nil
 }

cmd/uc/image/ls.go

@@ -91,14 +91,9 @@ func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
 
 	machines := cli.ExpandCommaSeparatedValues(opts.machines)
 
-	var clusterImages []api.MachineImages
-	err = tui.RunSpinner(ctx, "Listing images...", func(ctx context.Context) error {
-		var err error
-		clusterImages, err = clusterClient.ListImages(ctx, api.ImageFilter{
-			Machines: machines,
-			Name:     opts.nameFilter,
-		})
-		return err
+	clusterImages, err := clusterClient.ListImages(ctx, api.ImageFilter{
+		Machines: machines,
+		Name:     opts.nameFilter,
 	})
 	if err != nil {
 		return fmt.Errorf("list images: %w", err)

cmd/uc/image/rm.go

@@ -1,137 +0,0 @@
-package image
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-
-	"charm.land/lipgloss/v2"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/spf13/cobra"
-)
-
-type removeOptions struct {
-	machines []string
-	yes      bool
-}
-
-func NewRemoveCommand() *cobra.Command {
-	opts := removeOptions{}
-	cmd := &cobra.Command{
-		Use:     "rm IMAGE [IMAGE...]",
-		Aliases: []string{"remove", "delete"},
-		Short:   "Remove images from machines in the cluster.",
-		Long: `Remove images from all or selected machines in the cluster.
-
-An image name without a tag selects all its tags. Specify a tag, such as myapp:latest, to remove
-only that tag.
-
-Wildcard patterns are supported for image names and tags and should be quoted to prevent your
-shell from expanding them. Removing by image ID attempts to remove each name for that image
-independently.
-
-Images used by running or stopped containers cannot be removed. Unused tags can be removed even
-when the same image is used under another tag. Failed removals do not prevent other removals.`,
-		Example: `  # Remove a tag from all machines after confirming the plan.
-  uc image rm myapp:old
-
-  # Remove all tags for an image name from all machines.
-  uc image rm myapp
-
-  # Remove matching tags from two machines without confirmation.
-  uc image rm 'myapp:1.*' 'otherapp:*' -m machine1,machine2 --yes
-
-  # Remove all names for an image by ID from all machines.
-  uc image rm ee8fed0e9618`,
-		Args: cobra.MinimumNArgs(1),
-		PreRun: func(cmd *cobra.Command, args []string) {
-			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
-		},
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return remove(cmd.Context(), uncli, args, opts)
-		},
-	}
-
-	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
-		"Machine names or IDs to remove images from. Can be specified multiple times or as a comma-separated list.\n"+
-			"If not specified, the matching images will be removed from all machines.")
-	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
-		"Auto-confirm the removal plan. Should be explicitly set when running non-interactively,\n"+
-			"e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")
-
-	completion.MachinesFlag(cmd)
-
-	return cmd
-}
-
-func remove(ctx context.Context, uncli *cli.CLI, images []string, opts removeOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	plan, err := planImageRemoval(ctx, clusterClient, images, cli.ExpandCommaSeparatedValues(opts.machines))
-	if err != nil {
-		return fmt.Errorf("plan image removal: %w", err)
-	}
-	directConn := uncli.DirectConnection()
-	contextName := uncli.ContextOverrideOrCurrent()
-	cluster := ""
-	if directConn != "" {
-		cluster = directConn
-		lipgloss.Println(tui.Faint.Render("connection: ") + tui.NameStyle.Render(directConn))
-		lipgloss.Println()
-	} else if contextName != "" && len(uncli.Config.Contexts) > 1 {
-		// Only show context if there's more than one to avoid unnecessary clutter.
-		cluster = contextName
-		lipgloss.Println(tui.Faint.Render("context: ") + tui.NameStyle.Render(contextName))
-		lipgloss.Println()
-	}
-
-	lipgloss.Println(plan.Format())
-
-	if !opts.yes {
-		if !tui.IsTerminalAvailable() {
-			return errors.New("cannot ask to confirm image removal in non-interactive mode, " +
-				"use --yes flag or set UNCLOUD_AUTO_CONFIRM=true to auto-confirm")
-		}
-
-		title := "Proceed with image removal?"
-		if cluster != "" {
-			isDark := lipgloss.HasDarkBackground(os.Stdin, os.Stdout)
-			confirmStyle := tui.ThemeConfirm().Theme(isDark).Focused.Title
-			title = "Proceed with image removal on " + tui.NameStyle.Render(cluster) + confirmStyle.Render("?")
-		}
-
-		confirmed, err := tui.Confirm(title)
-		if err != nil {
-			return fmt.Errorf("confirm image removal: %w", err)
-		}
-		if !confirmed {
-			return cli.Cancelled("Image removal cancelled. No images were removed.")
-		}
-	}
-
-	untagged := make(map[string]bool)
-	var errs []error
-	for i, group := range plan.GroupPlans {
-		if i > 0 {
-			fmt.Println()
-		}
-
-		err := progress.RunWithTitle(ctx, func(ctx context.Context) error {
-			return group.Execute(ctx, clusterClient, untagged)
-		}, uncli.ProgressOut(), "Removing image "+group.Image)
-		if err != nil {
-			errs = append(errs, err)
-		}
-	}
-
-	return errors.Join(errs...)
-}

cmd/uc/image/rm_plan.go

@@ -1,426 +0,0 @@
-package image
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"path"
-	"regexp"
-	"slices"
-	"strings"
-
-	"charm.land/lipgloss/v2"
-	"github.com/distribution/reference"
-	"github.com/docker/docker/api/types/image"
-	"github.com/docker/docker/pkg/stringid"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/api"
-)
-
-var imageIDRegex = regexp.MustCompile(`^(sha256:)?[a-f0-9]{4,64}$`)
-
-// imageRemovalPlan contains all image removal operations grouped by the user-supplied image name, ID, or pattern.
-type imageRemovalPlan struct {
-	GroupPlans []*removeImageGroupPlan
-}
-
-func (p *imageRemovalPlan) IsEmpty() bool { return len(p.GroupPlans) == 0 }
-
-func (p *imageRemovalPlan) Format() string {
-	var out strings.Builder
-	machines := make(map[string]struct{})
-	removeCount := 0
-	for _, group := range p.GroupPlans {
-		out.WriteString(group.Format())
-		for _, op := range group.Operations {
-			machines[op.MachineName] = struct{}{}
-			removeCount++
-		}
-	}
-
-	summary := fmt.Sprintf("%s remove %s across %s %s",
-		tui.BoldRed.Render(fmt.Sprint(removeCount)),
-		tui.Faint.Render("·"),
-		tui.Bold.Render(fmt.Sprint(len(machines))),
-		pluralMachines(len(machines)),
-	)
-	out.WriteString("\n" + tui.Faint.Render(strings.Repeat("─", lipgloss.Width(summary))) + "\n" + summary + "\n")
-
-	return out.String()
-}
-
-func pluralMachines(count int) string {
-	if count == 1 {
-		return "machine"
-	}
-	return "machines"
-}
-
-// Execute applies the frozen plan, collecting failures without discovering new targets.
-func (p *imageRemovalPlan) Execute(ctx context.Context, cli api.ImageClient) error {
-	untagged := make(map[string]bool)
-	var errs []error
-	for _, group := range p.GroupPlans {
-		if err := group.Execute(ctx, cli, untagged); err != nil {
-			errs = append(errs, err)
-		}
-	}
-	return errors.Join(errs...)
-}
-
-// removeImageGroupPlan groups removals for one image name, ID, or pattern supplied by the user.
-type removeImageGroupPlan struct {
-	// Image is the image name, ID, or pattern supplied by the user.
-	Image      string
-	Operations []*removeImageOperation
-}
-
-func (o *removeImageGroupPlan) Execute(ctx context.Context, cli api.ImageClient, untagged map[string]bool) error {
-	var errs []error
-	for _, op := range o.Operations {
-		if err := ctx.Err(); err != nil {
-			return errors.Join(append(errs, err)...)
-		}
-		if err := op.Execute(ctx, cli, untagged); err != nil {
-			errs = append(errs, err)
-		}
-	}
-	return errors.Join(errs...)
-}
-
-func (o *removeImageGroupPlan) Format() string {
-	var out strings.Builder
-	out.WriteString(tui.BoldRed.Render("-") + " remove image " + tui.NameStyle.Render(o.Image) + "\n")
-	for i, op := range o.Operations {
-		branch := "  ├── "
-		if i == len(o.Operations)-1 {
-			branch = "  ╰── "
-		}
-		out.WriteString(tui.Faint.Render(branch) + op.Format() + "\n")
-	}
-	return out.String()
-}
-
-func (o *removeImageGroupPlan) String() string {
-	return fmt.Sprintf("removeImageGroupPlan[image=%s]", o.Image)
-}
-
-// removeImageOperation removes an image name or an unnamed image by ID on a machine.
-type removeImageOperation struct {
-	MachineName string
-	ImageID     string
-	// Image is the exact image name or ID sent to Docker.
-	Image string
-}
-
-func (o *removeImageOperation) Execute(ctx context.Context, cli api.ImageClient, untagged map[string]bool) error {
-	if untagged[o.MachineName+"\x00"+o.Image] {
-		return nil
-	}
-	results, err := cli.RemoveImage(ctx, o.Image, api.RemoveImageOptions{Machines: []string{o.MachineName}})
-	// A removal may also untag other planned names. Track actual results across all groups, per machine.
-	for _, result := range results {
-		for _, removal := range result.Results {
-			if removal.Untagged != "" {
-				untagged[result.Metadata.MachineName+"\x00"+removal.Untagged] = true
-			}
-		}
-	}
-	if errors.Is(err, api.ErrNotFound) {
-		return nil
-	}
-	if err != nil {
-		return fmt.Errorf("remove image '%s': %w", o.Image, err)
-	}
-	return nil
-}
-
-func (o *removeImageOperation) Format() string {
-	return tui.BoldRed.Render("-") + " " + tui.FormatImage(o.Image, tui.NoStyle) +
-		tui.Faint.Render(" ("+stringid.TruncateID(o.ImageID)+") on ") + o.MachineName
-}
-
-func (o *removeImageOperation) String() string {
-	return fmt.Sprintf("removeImageOperation[machine_name=%s image=%s]", o.MachineName, o.Image)
-}
-
-type machineImageInventory struct {
-	machineName string
-	images      []image.Summary
-}
-
-// planImageRemoval builds a removal plan grouped by input argument from images on the selected machines.
-// An empty machines list selects all machines.
-//
-// Arguments expand as follows:
-//   - Name: without a tag or digest, select all stored names in that exact repository across image IDs.
-//     An explicit tag selects only that tag. Familiar names are normalised.
-//   - ID: select all RepoTags for the matching image, or its full ID if unnamed. A prefix must identify
-//     one unique full ID across the selected machines.
-//   - Pattern: match RepoTags only. A matching digest also selects that image's names in the same repository.
-//   - Digest: resolve through RepoTags, RepoDigests, or the image ID, then select that image's names in
-//     the same repository. If none exist but RepoDigests contains the reference, select the digest itself.
-//
-// Selecting all tags for a repository/image on a machine also adds its stored digest references after
-// the tags, even if those digests did not match an argument. Stored names are kept as is, and overlapping
-// selections produce only one operation per machine and name.
-//
-// Failed image listings produce warnings and exclude those machines from the plan. If no machine can
-// be queried, planning fails. Every argument must match on a successfully queried machine. Unmatched
-// or invalid arguments and ambiguous ID prefixes reject the whole plan before any removal.
-//
-// Planning does not check container usage. The backend checks each removal during execution, and failures
-// do not stop other operations. Tag removal may implicitly untag a used digest. Execution skips names
-// already untagged by earlier operations and tolerates names that disappeared after planning.
-func planImageRemoval(ctx context.Context, cli api.ImageClient, images, machines []string) (*imageRemovalPlan, error) {
-	if len(images) == 0 {
-		return nil, errors.New("at least one image is required")
-	}
-
-	var clusterImages []api.MachineImages
-	err := tui.RunSpinner(ctx, "Finding images to remove...", func(ctx context.Context) error {
-		var err error
-		clusterImages, err = cli.ListImages(ctx, api.ImageFilter{Machines: machines})
-		return err
-	})
-	if err != nil {
-		return nil, fmt.Errorf("list images: %w", err)
-	}
-
-	var inventory []*machineImageInventory
-	for _, machineImages := range clusterImages {
-		if err := machineImages.Metadata.Err(); err != nil {
-			tui.PrintWarning(fmt.Sprintf("failed to list images on machine '%s': %s",
-				machineImages.Metadata.MachineName, err))
-			continue
-		}
-		machine := &machineImageInventory{
-			machineName: machineImages.Metadata.MachineName,
-			images:      machineImages.Images,
-		}
-		inventory = append(inventory, machine)
-	}
-	if len(inventory) == 0 {
-		return nil, errors.New("failed to list images on any machine")
-	}
-
-	return planImageRemovalFromInventory(images, inventory)
-}
-
-func planImageRemovalFromInventory(images []string, inventory []*machineImageInventory) (*imageRemovalPlan, error) {
-	plan := &imageRemovalPlan{}
-	seen := make(map[string]bool)
-	var errs []error
-	for _, imageArg := range images {
-		group := &removeImageGroupPlan{Image: imageArg}
-		isID := imageIDRegex.MatchString(imageArg)
-		isPattern := strings.ContainsAny(imageArg, "*?[")
-		var namedRef reference.Named
-		if isPattern {
-			if _, err := path.Match(imageArg, ""); err != nil {
-				return nil, fmt.Errorf("invalid image pattern '%s': %w", imageArg, err)
-			}
-		} else if !isID {
-			var err error
-			namedRef, err = reference.ParseNormalizedNamed(imageArg)
-			if err != nil {
-				return nil, fmt.Errorf("invalid image '%s': %w", imageArg, err)
-			}
-		}
-		if isID {
-			matches := make(map[string]bool)
-			for _, machine := range inventory {
-				for _, img := range machine.images {
-					if imageIDMatches(img.ID, imageArg) {
-						matches[img.ID] = true
-					}
-				}
-			}
-			if len(matches) > 1 {
-				var candidates []string
-				for id := range matches {
-					candidates = append(candidates, id)
-				}
-				slices.Sort(candidates)
-				errs = append(errs,
-					fmt.Errorf("image ID '%s' is ambiguous: %s", imageArg, strings.Join(candidates, ", ")))
-				continue
-			}
-		}
-
-		matched := false
-		for _, machine := range inventory {
-			for _, img := range machine.images {
-				var imagesToRemove []string
-				switch {
-				case isID:
-					if !imageIDMatches(img.ID, imageArg) {
-						continue
-					}
-					matched = true
-					// Expand only stored names, matching uc image ls. RepoDigests remains available for digest lookup.
-					imagesToRemove = img.RepoTags
-					if len(imagesToRemove) == 0 {
-						imagesToRemove = []string{img.ID}
-					}
-				case isPattern:
-					for _, ref := range img.RepoTags {
-						if ok, _ := path.Match(imageArg, ref); ok {
-							named, _ := reference.ParseDockerRef(ref)
-							if _, digest := named.(reference.Canonical); digest {
-								imagesToRemove = append(imagesToRemove,
-									imageRepositoryReferences(img.RepoTags, named.Name())...)
-							} else {
-								imagesToRemove = append(imagesToRemove, ref)
-							}
-						}
-					}
-				case reference.IsNameOnly(namedRef):
-					imagesToRemove = imageRepositoryReferences(img.RepoTags, namedRef.Name())
-				default:
-					if canonical, digest := namedRef.(reference.Canonical); digest {
-						ref := reference.FamiliarString(namedRef)
-						if canonical.Digest().String() != img.ID && !slices.Contains(img.RepoTags, ref) &&
-							!slices.Contains(img.RepoDigests, ref) {
-							continue
-						}
-						imagesToRemove = imageRepositoryReferences(img.RepoTags, namedRef.Name())
-						if len(imagesToRemove) == 0 && slices.Contains(img.RepoDigests, ref) {
-							// An explicitly requested digest can resolve even when no stored name is listed.
-							imagesToRemove = []string{ref}
-						}
-					} else if slices.Contains(img.RepoTags, reference.FamiliarString(namedRef)) {
-						imagesToRemove = []string{reference.FamiliarString(namedRef)}
-					}
-				}
-				for _, ref := range imagesToRemove {
-					matched = true
-					key := machine.machineName + "\x00" + ref
-					if !seen[key] {
-						seen[key] = true
-						group.Operations = append(group.Operations, &removeImageOperation{
-							MachineName: machine.machineName, ImageID: img.ID, Image: ref,
-						})
-					}
-				}
-			}
-		}
-		if !matched {
-			errs = append(errs, fmt.Errorf("image '%s' not found on any machine", imageArg))
-		}
-		slices.SortFunc(group.Operations, compareImageRemovalOperations)
-		if len(group.Operations) > 0 {
-			plan.GroupPlans = append(plan.GroupPlans, group)
-		}
-	}
-
-	planDigestRemovals(plan, inventory)
-	if err := errors.Join(errs...); err != nil {
-		return nil, err
-	}
-	return plan, nil
-}
-
-func imageRepositoryReferences(refs []string, repository string) []string {
-	var matches []string
-	for _, ref := range refs {
-		if named, err := reference.ParseDockerRef(ref); err == nil && named.Name() == repository {
-			matches = append(matches, ref)
-		}
-	}
-	return matches
-}
-
-// planDigestRemovals includes stored digests with the group removing their last repository tag.
-// RepoDigests also contains synthesised references, so only digest names stored in RepoTags get operations here.
-func planDigestRemovals(plan *imageRemovalPlan, inventory []*machineImageInventory) {
-	type repository struct {
-		remainingTags int
-		digests       []string
-	}
-	repositories := make(map[string]*repository)
-	for _, machine := range inventory {
-		for _, img := range machine.images {
-			names := slices.Clone(img.RepoTags)
-			slices.Sort(names)
-			for _, ref := range slices.Compact(names) {
-				named, err := reference.ParseDockerRef(ref)
-				if err != nil {
-					continue
-				}
-				key := machine.machineName + "\x00" + img.ID + "\x00" + named.Name()
-				repo := repositories[key]
-				if repo == nil {
-					repo = &repository{}
-					repositories[key] = repo
-				}
-				if _, tagged := named.(reference.Tagged); tagged {
-					repo.remainingTags++
-				} else if _, digest := named.(reference.Canonical); digest {
-					repo.digests = append(repo.digests, ref)
-				}
-			}
-		}
-	}
-	emitted := make(map[string]bool)
-	var groups []*removeImageGroupPlan
-	for _, group := range plan.GroupPlans {
-		var operations []*removeImageOperation
-		for _, op := range group.Operations {
-			key := op.MachineName + "\x00" + op.Image
-			if emitted[key] {
-				continue
-			}
-			emitted[key] = true
-			operations = append(operations, op)
-			named, err := reference.ParseDockerRef(op.Image)
-			if err != nil {
-				continue
-			}
-			if _, tagged := named.(reference.Tagged); !tagged {
-				continue
-			}
-			repo := repositories[op.MachineName+"\x00"+op.ImageID+"\x00"+named.Name()]
-			if repo == nil {
-				continue
-			}
-			repo.remainingTags--
-			if repo.remainingTags != 0 {
-				continue
-			}
-			for _, digest := range repo.digests {
-				key := op.MachineName + "\x00" + digest
-				if !emitted[key] {
-					emitted[key] = true
-					operations = append(operations, &removeImageOperation{
-						MachineName: op.MachineName, ImageID: op.ImageID, Image: digest,
-					})
-				}
-			}
-		}
-		group.Operations = operations
-		slices.SortFunc(group.Operations, compareImageRemovalOperations)
-		if len(group.Operations) > 0 {
-			groups = append(groups, group)
-		}
-	}
-	plan.GroupPlans = groups
-}
-
-func compareImageRemovalOperations(a, b *removeImageOperation) int {
-	aDigest, bDigest := strings.Contains(a.Image, "@"), strings.Contains(b.Image, "@")
-	if aDigest != bDigest {
-		if aDigest {
-			return 1
-		}
-		return -1
-	}
-	if c := strings.Compare(a.Image, b.Image); c != 0 {
-		return c
-	}
-	return strings.Compare(a.MachineName, b.MachineName)
-}
-
-func imageIDMatches(id, prefix string) bool {
-	return strings.HasPrefix(strings.TrimPrefix(id, "sha256:"), strings.TrimPrefix(prefix, "sha256:"))
-}

cmd/uc/image/rm_plan_test.go

@@ -1,405 +0,0 @@
-package image
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/docker/docker/api/types/image"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestPlanImageRemovalFromInventory_Selectors(t *testing.T) {
-	idA, idB := testImageID("a"), testImageID("b")
-	digestRef := "myapp@" + testImageID("c")
-	tests := []struct {
-		name      string
-		selector  string
-		inventory []*machineImageInventory
-		want      []removeImageOperation
-	}{
-		{
-			name: "repository selects all stored names across images and machines", selector: "myapp",
-			inventory: []*machineImageInventory{
-				testMachineInventory("dev1", []image.Summary{
-					testImage(idA, "myapp:old", "other:keep"),
-					testImage(idB, "myapp:latest"),
-					testImage(testImageID("c"), digestRef),
-					testImage(testImageID("d"), "myapp-extra:latest", "team/myapp:latest", "myapp/worker:latest"),
-				}),
-				testMachineInventory("machine2", []image.Summary{testImage(idB, "myapp:test")}),
-			},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idB, Image: "myapp:latest"},
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:old"},
-				{MachineName: "machine2", ImageID: idB, Image: "myapp:test"},
-				{MachineName: "dev1", ImageID: testImageID("c"), Image: digestRef},
-			},
-		},
-		{
-			name: "repository without latest includes its tags and stored digest", selector: "myapp",
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-				testImage(idA, "myapp:old", digestRef, "other:keep"),
-			})},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:old"},
-				{MachineName: "dev1", ImageID: idA, Image: digestRef},
-			},
-		},
-		{
-			name: "explicit latest selects only that tag", selector: "myapp:latest",
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-				testImage(idA, "myapp:old", "myapp:latest", digestRef),
-			})},
-			want: []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: "myapp:latest"}},
-		},
-		{
-			name: "qualified repository selects familiar names", selector: "docker.io/library/myapp",
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-				testImage(idA, "myapp:old", "myapp:latest", "other:keep"),
-			})},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:latest"},
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:old"},
-			},
-		},
-		{
-			name: "registry port does not count as an explicit tag", selector: "registry.example.com:5000/team/myapp",
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-				testImage(idA, "registry.example.com:5000/team/myapp:old", "registry.example.com:5000/team/myapp:new",
-					"registry.example.com:5001/team/myapp:keep", "registry.example.com:5000/team/myapp/worker:keep"),
-			})},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idA, Image: "registry.example.com:5000/team/myapp:new"},
-				{MachineName: "dev1", ImageID: idA, Image: "registry.example.com:5000/team/myapp:old"},
-			},
-		},
-		{
-			name: "explicit tag with registry port stays exact", selector: "registry.example.com:5000/team/myapp:old",
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-				testImage(idA, "registry.example.com:5000/team/myapp:old", "registry.example.com:5000/team/myapp:new"),
-			})},
-			want: []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: "registry.example.com:5000/team/myapp:old"}},
-		},
-		{
-			name: "tag uses each machines local image and allows missing copies", selector: "myapp:old",
-			inventory: []*machineImageInventory{
-				testMachineInventory("machine2", []image.Summary{testImage(idB, "myapp:old")}),
-				testMachineInventory("empty", nil),
-				testMachineInventory("dev1", []image.Summary{testImage(idA, "myapp:old")}),
-			},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:old"},
-				{MachineName: "machine2", ImageID: idB, Image: "myapp:old"},
-			},
-		},
-		{
-			name: "qualified names use familiar references", selector: "docker.io/library/myapp:old",
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-				testImage(idA, "myapp:old"),
-			})},
-			want: []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: "myapp:old"}},
-		},
-		{
-			name: "full ID expands all repositories and deduplicates references per machine", selector: idA,
-			inventory: []*machineImageInventory{
-				testMachineInventory("dev1", []image.Summary{
-					{
-						ID:       idA,
-						RepoTags: []string{"other:keep", "myapp:old", "myapp:old", digestRef, "other@" + testImageID("c")},
-						RepoDigests: []string{
-							digestRef, "other@" + testImageID("c"), "other@" + testImageID("c"), testImageID("c"),
-						},
-					},
-					testImage(idB, "unrelated:keep"),
-				}),
-				testMachineInventory("machine2", []image.Summary{{
-					ID: idA, RepoTags: []string{"myapp:old", digestRef}, RepoDigests: []string{digestRef},
-				}}),
-			},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:old"},
-				{MachineName: "machine2", ImageID: idA, Image: "myapp:old"},
-				{MachineName: "dev1", ImageID: idA, Image: "other:keep"},
-				{MachineName: "dev1", ImageID: idA, Image: digestRef},
-				{MachineName: "machine2", ImageID: idA, Image: digestRef},
-				{MachineName: "dev1", ImageID: idA, Image: "other@" + testImageID("c")},
-			},
-		},
-		{
-			name: "same full ID on multiple machines is unambiguous", selector: "aaaaaaaa",
-			inventory: []*machineImageInventory{
-				testMachineInventory("dev1", []image.Summary{testImage(idA, "myapp:old")}),
-				testMachineInventory("dev1", []image.Summary{testImage(idB, "myapp:latest")}),
-				testMachineInventory("machine2", []image.Summary{testImage(idA, "other:test")}),
-			},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:old"},
-				{MachineName: "machine2", ImageID: idA, Image: "other:test"},
-			},
-		},
-		{
-			name: "short ID with algorithm prefix", selector: "sha256:aaaaaaaa",
-			inventory: []*machineImageInventory{testMachineInventory("dev1",
-				[]image.Summary{testImage(idA, "myapp:old")})},
-			want: []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: "myapp:old"}},
-		},
-		{
-			name: "unnamed image is removed by its full ID", selector: idA,
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{{ID: idA}})},
-			want:      []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: idA}},
-		},
-		{
-			name: "ID expands only stored names", selector: idA,
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{{
-				ID: idA, RepoTags: []string{"myapp:latest"},
-				RepoDigests: []string{"myapp@" + idA, "other@" + idA},
-			}})},
-			want: []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: "myapp:latest"}},
-		},
-		{
-			name: "ID removes an untagged image by ID even if RepoDigests is populated", selector: idA,
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{{
-				ID: idA, RepoDigests: []string{digestRef},
-			}})},
-			want: []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: idA}},
-		},
-		{
-			name: "synthesized digest selects repository tags without a digest row", selector: digestRef,
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{{
-				ID: idA, RepoTags: []string{"myapp:old", "other:keep", "myapp:latest"},
-				RepoDigests: []string{digestRef, "other@" + testImageID("c")},
-			}})},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:latest"},
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:old"},
-			},
-		},
-		{
-			name: "explicit digest lookup works without stored names", selector: digestRef,
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{{
-				ID: idA, RepoDigests: []string{digestRef},
-			}})},
-			want: []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: digestRef}},
-		},
-		{
-			name: "synthesized digest resolves by target and repository even if not listed", selector: "myapp@" + idA,
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{{
-				ID: idA, RepoTags: []string{"myapp:old", "other:keep"}, RepoDigests: []string{"other@" + idA},
-			}})},
-			want: []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: "myapp:old"}},
-		},
-		{
-			name: "stored digest follows its repository tags", selector: digestRef,
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-				testImage(idA, "myapp:old", "myapp:latest", digestRef, "other:keep"),
-				testImage(idB, "myapp@"+idB),
-			})},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:latest"},
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:old"},
-				{MachineName: "dev1", ImageID: idA, Image: digestRef},
-			},
-		},
-		{
-			name: "digest pattern also expands matching repository tags", selector: "myapp@sha256:c*",
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-				testImage(idA, "myapp:old", "myapp:latest", digestRef, "other:keep"),
-				testImage(idB, "myapp@"+idB),
-			})},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:latest"},
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:old"},
-				{MachineName: "dev1", ImageID: idA, Image: digestRef},
-			},
-		},
-		{
-			name: "digest pattern matches stored names and ignores derived names", selector: "myapp@sha256:*",
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-				testImage(idA, "myapp:old", digestRef),
-				{ID: idB, RepoTags: []string{"myapp:latest"}, RepoDigests: []string{"myapp@" + idB}},
-			})},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:old"},
-				{MachineName: "dev1", ImageID: idA, Image: digestRef},
-			},
-		},
-		{
-			name: "last repository tag includes its stored digest", selector: "myapp:old",
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-				testImage(idA, "myapp:old", digestRef, "other:keep"),
-			})},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:old"},
-				{MachineName: "dev1", ImageID: idA, Image: digestRef},
-			},
-		},
-		{
-			name: "last tag does not add a synthesized digest row", selector: "myapp:old",
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{{
-				ID: idA, RepoTags: []string{"myapp:old", "other:keep"}, RepoDigests: []string{digestRef},
-			}})},
-			want: []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: "myapp:old"}},
-		},
-		{
-			name: "remaining repository tag preserves its stored digest", selector: "myapp:old",
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-				testImage(idA, "myapp:old", "myapp:latest", digestRef),
-			})},
-			want: []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: "myapp:old"}},
-		},
-		{
-			name: "digest without repository tags remains executable", selector: digestRef,
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-				testImage(idA, digestRef, "other:keep"),
-			})},
-			want: []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: digestRef}},
-		},
-		{
-			name: "digest-only image keeps its named reference", selector: idA,
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{{
-				ID: idA, RepoTags: []string{digestRef}, RepoDigests: []string{digestRef, testImageID("c")},
-			}})},
-			want: []removeImageOperation{{MachineName: "dev1", ImageID: idA, Image: digestRef}},
-		},
-		{
-			name: "tag pattern selects only matching tags", selector: "myapp:1.[12]",
-			inventory: []*machineImageInventory{testMachineInventory("dev1", []image.Summary{{
-				ID: idA, RepoTags: []string{"myapp:1.3", "myapp:1.2", "myapp:1.1"}, RepoDigests: []string{digestRef},
-			}})},
-			want: []removeImageOperation{
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:1.1"},
-				{MachineName: "dev1", ImageID: idA, Image: "myapp:1.2"},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			plan, err := planImageRemovalFromInventory([]string{tt.selector}, tt.inventory)
-			require.NoError(t, err)
-
-			require.Len(t, plan.GroupPlans, 1)
-			assert.Equal(t, tt.selector, plan.GroupPlans[0].Image)
-
-			var got []removeImageOperation
-			for _, op := range plan.GroupPlans[0].Operations {
-				got = append(got, *op)
-			}
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}
-
-func TestPlanImageRemovalFromInventory_OverlappingSelectors(t *testing.T) {
-	inventory := []*machineImageInventory{
-		testMachineInventory("dev1", []image.Summary{testImage(testImageID("a"), "myapp:old", "myapp:latest")}),
-		testMachineInventory("machine2", []image.Summary{testImage(testImageID("b"), "myapp:test", "myapp:old")}),
-	}
-
-	plan, err := planImageRemovalFromInventory([]string{"myapp:old", "myapp", "myapp:*", testImageID("a"), "myapp:old"},
-		inventory)
-	require.NoError(t, err)
-
-	assert.Equal(t, &imageRemovalPlan{GroupPlans: []*removeImageGroupPlan{
-		{Image: "myapp:old", Operations: []*removeImageOperation{
-			{MachineName: "dev1", ImageID: testImageID("a"), Image: "myapp:old"},
-			{MachineName: "machine2", ImageID: testImageID("b"), Image: "myapp:old"},
-		}},
-		{Image: "myapp", Operations: []*removeImageOperation{
-			{MachineName: "dev1", ImageID: testImageID("a"), Image: "myapp:latest"},
-			{MachineName: "machine2", ImageID: testImageID("b"), Image: "myapp:test"},
-		}},
-	}}, plan, "the first selector owns each removal and empty groups are omitted")
-}
-
-func TestPlanImageRemovalFromInventory_DigestFollowsLastTagAcrossSelectors(t *testing.T) {
-	imageID := testImageID("a")
-	digestRef := "myapp@" + imageID
-	inventory := []*machineImageInventory{testMachineInventory("dev1", []image.Summary{
-		testImage(imageID, "myapp:old", "myapp:latest", "myapp:old", digestRef, digestRef, "other:keep"),
-	})}
-
-	plan, err := planImageRemovalFromInventory([]string{"myapp:old", "myapp:latest", digestRef}, inventory)
-	require.NoError(t, err)
-
-	assert.Equal(t, &imageRemovalPlan{GroupPlans: []*removeImageGroupPlan{
-		{Image: "myapp:old", Operations: []*removeImageOperation{
-			{MachineName: "dev1", ImageID: imageID, Image: "myapp:old"},
-		}},
-		{Image: "myapp:latest", Operations: []*removeImageOperation{
-			{MachineName: "dev1", ImageID: imageID, Image: "myapp:latest"},
-			{MachineName: "dev1", ImageID: imageID, Image: digestRef},
-		}},
-	}}, plan, "digest cleanup belongs to the last tag removal, so the later digest selector has no extra operation")
-}
-
-func TestPlanImageRemovalFromInventory_RejectsInvalidOrMissingSelectors(t *testing.T) {
-	idA := "sha256:abcdef" + strings.Repeat("a", 58)
-	idB := "sha256:abcdef" + strings.Repeat("b", 58)
-	inventory := []*machineImageInventory{
-		testMachineInventory("dev1", []image.Summary{{
-			ID: idA, RepoTags: []string{"myapp:old"}, RepoDigests: []string{"myapp@" + idA, "derived@" + idA},
-		}}),
-		testMachineInventory("machine2", []image.Summary{{ID: idB, RepoTags: []string{"myapp:old"}}}),
-	}
-
-	tests := []struct {
-		name   string
-		images []string
-		err    string
-	}{
-		{"missing repository", []string{"missing"}, "not found"},
-		{"repository only has a derived digest", []string{"derived"}, "not found"},
-		{"missing tag", []string{"myapp:missing"}, "not found"},
-		{"missing pattern", []string{"other:*"}, "not found"},
-		{"pattern only matches a derived digest", []string{"myapp@sha256:*"}, "not found"},
-		{"missing ID", []string{testImageID("c")}, "not found"},
-		{"ambiguous ID prefix", []string{"abcdef"}, "ambiguous"},
-		{"invalid name", []string{"MyApp:old"}, "invalid image"},
-		{"invalid pattern", []string{"myapp:["}, "invalid image pattern"},
-		{"one missing selector rejects the whole plan", []string{"myapp:old", "myapp:missing"}, "not found"},
-		{"one invalid selector rejects the whole plan", []string{"myapp:old", "myapp:["}, "invalid image pattern"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			plan, err := planImageRemovalFromInventory(tt.images, inventory)
-			require.ErrorContains(t, err, tt.err)
-			assert.Nil(t, plan, "a failed selector must not return a partial plan")
-		})
-	}
-
-	t.Run("ID prefix resolves within the supplied machines", func(t *testing.T) {
-		plan, err := planImageRemovalFromInventory([]string{"abcdef"}, inventory[:1])
-		require.NoError(t, err)
-		require.Len(t, plan.GroupPlans, 1)
-		require.Len(t, plan.GroupPlans[0].Operations, 1)
-		assert.Equal(t, idA, plan.GroupPlans[0].Operations[0].ImageID)
-	})
-}
-
-func TestPlanImageRemovalFromInventory_InUseImagesAreStillPlanned(t *testing.T) {
-	img := testImage(testImageID("a"), "myapp:old", "myapp:current")
-	img.Containers = 1
-
-	for _, selector := range []string{"myapp", "myapp:current", img.ID, "myapp:*"} {
-		t.Run(selector, func(t *testing.T) {
-			plan, err := planImageRemovalFromInventory([]string{selector}, []*machineImageInventory{
-				testMachineInventory("dev1", []image.Summary{img}),
-			})
-			require.NoError(t, err)
-			assert.False(t, plan.IsEmpty(), "usage protection belongs to the backend at execution time")
-		})
-	}
-}
-
-func testImageID(char string) string { return "sha256:" + strings.Repeat(char, 64) }
-
-func testImage(imageID string, tags ...string) image.Summary {
-	return image.Summary{ID: imageID, RepoTags: tags}
-}
-
-func testMachineInventory(name string, images []image.Summary) *machineImageInventory {
-	return &machineImageInventory{machineName: name, images: images}
-}

cmd/uc/image/root.go

@@ -13,7 +13,6 @@ func NewRootCommand() *cobra.Command {
 	cmd.AddCommand(
 		NewListCommand(),
 		NewPushCommand(),
-		NewRemoveCommand(),
 	)
 
 	return cmd

cmd/uc/service/inspect.go

@@ -3,7 +3,6 @@ package service
 import (
 	"context"
 	"fmt"
-	"maps"
 	"slices"
 	"time"
 
@@ -59,16 +58,6 @@ func inspect(ctx context.Context, uncli *cli.CLI, opts inspectOptions) error {
 	fmt.Printf("Service ID: %s\n", svc.ID)
 	fmt.Printf("Name:       %s\n", svc.Name)
 	fmt.Printf("Mode:       %s\n", svc.Mode)
-
-	spec := svc.Spec()
-	if len(spec.Labels) > 0 {
-		fmt.Println("Labels:")
-		printLabels(spec.Labels)
-	}
-	if len(spec.Container.Labels) > 0 {
-		fmt.Println("Container labels:")
-		printLabels(spec.Container.Labels)
-	}
 	fmt.Println()
 
 	// Combine regular and hook containers.
@@ -141,10 +130,3 @@ func inspect(ctx context.Context, uncli *cli.CLI, opts inspectOptions) error {
 	lipgloss.Println(t)
 	return nil
 }
-
-// printLabels prints the labels sorted by key followed by a blank line.
-func printLabels(labels map[string]string) {
-	for _, key := range slices.Sorted(maps.Keys(labels)) {
-		lipgloss.Println("  " + key + tui.Faint.Render("=") + labels[key])
-	}
-}

cmd/uc/service/root.go

@@ -20,7 +20,6 @@ func NewRootCommand() *cobra.Command {
 		NewScaleCommand(""),
 		NewStartCommand(""),
 		NewStopCommand(""),
-		NewUpdateCommand(),
 	)
 	return cmd
 }

cmd/uc/service/run.go

@@ -21,16 +21,13 @@ import (
 type runOptions struct {
 	caddyfile         string
 	command           []string
-	containerLabels   []string
 	cpu               dockeropts.NanoCPUs
 	entrypoint        string
 	entrypointChanged bool
 	env               []string
 	image             string
-	labels            []string
 	machines          []string
 	memory            dockeropts.MemBytes
-	memoryReservation dockeropts.MemBytes
 	mode              string
 	shmSize           dockeropts.MemBytes
 	name              string
@@ -67,9 +64,6 @@ func NewRunCommand(groupID string) *cobra.Command {
 	cmd.Flags().StringVar(&opts.caddyfile, "caddyfile", "",
 		"Path to a custom Caddy config (Caddyfile) for the service. "+
 			"Cannot be used together with non-@host published ports.")
-	cmd.Flags().StringArrayVar(&opts.containerLabels, "container-label", nil,
-		"Set a Docker label on service containers. Can be specified multiple times.\n"+
-			"Format: key=value or just key for an empty value.")
 	cmd.Flags().VarP(&opts.cpu, "cpu", "",
 		"Maximum number of CPU cores a service container can use. Fractional values are allowed: "+
 			"0.5 for half a core or 2.25 for two and a quarter cores.")
@@ -78,9 +72,6 @@ func NewRunCommand(groupID string) *cobra.Command {
 	cmd.Flags().StringSliceVarP(&opts.env, "env", "e", nil,
 		"Set an environment variable for service containers. Can be specified multiple times.\n"+
 			"Format: VAR=value or just VAR to use the value from the local environment.")
-	cmd.Flags().StringArrayVarP(&opts.labels, "label", "l", nil,
-		"Set a service label. Service labels aren't applied to Docker containers, use --container-label for that.\n"+
-			"Can be specified multiple times. Format: key=value or just key for an empty value.")
 	cmd.Flags().StringVar(&opts.mode, "mode", api.ServiceModeReplicated,
 		fmt.Sprintf("Replication mode of the service: either '%s' (a specified number of containers across "+
 			"the machines) or '%s' (one container on every machine).",
@@ -92,9 +83,6 @@ func NewRunCommand(groupID string) *cobra.Command {
 		"Maximum amount of memory a service container can use. Value is a positive integer with optional unit suffix (b, k, m, g).\n"+
 			"Default unit is bytes if no suffix specified.\n"+
 			"Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)")
-	cmd.Flags().Var(&opts.memoryReservation, "memory-reservation",
-		"Minimum amount of memory reserved for a service container. Value is a positive integer with optional unit suffix (b, k, m, g).\n"+
-			"Default unit is bytes if no suffix specified.")
 	cmd.Flags().VarP(&opts.shmSize, "shm-size", "",
 		"Maximum amount of shared memory (mounted at /dev/shm) a service container can use. Value is a positive integer\n"+
 			"with optional unit suffix (b, k, m, g). Default unit is bytes if no suffix specified.\n"+
@@ -204,15 +192,6 @@ func prepareServiceSpec(opts runOptions) (api.ServiceSpec, error) {
 		return spec, err
 	}
 
-	labels, err := parseLabels(opts.labels)
-	if err != nil {
-		return spec, err
-	}
-	containerLabels, err := parseLabels(opts.containerLabels)
-	if err != nil {
-		return spec, err
-	}
-
 	switch opts.mode {
 	case api.ServiceModeReplicated, api.ServiceModeGlobal:
 	default:
@@ -253,20 +232,17 @@ func prepareServiceSpec(opts runOptions) (api.ServiceSpec, error) {
 			Command:    opts.command,
 			Env:        env,
 			Image:      opts.image,
-			Labels:     containerLabels,
 			Privileged: opts.privileged,
 			PullPolicy: opts.pull,
 			Resources: api.ContainerResources{
-				CPU:               opts.cpu.Value(),
-				Memory:            opts.memory.Value(),
-				MemoryReservation: opts.memoryReservation.Value(),
-				SharedMemory:      opts.shmSize.Value(),
-				Ulimits:           ulimits,
+				CPU:          opts.cpu.Value(),
+				Memory:       opts.memory.Value(),
+				SharedMemory: opts.shmSize.Value(),
+				Ulimits:      ulimits,
 			},
 			User:         opts.user,
 			VolumeMounts: mounts,
 		},
-		Labels:    labels,
 		Mode:      opts.mode,
 		Name:      opts.name,
 		Placement: placement,
@@ -325,24 +301,6 @@ func parseEnv(env []string) (api.EnvVars, error) {
 	return envVars, nil
 }
 
-// parseLabels parses labels from the command line arguments in the format "key=value" or just "key" for an empty value.
-func parseLabels(labels []string) (map[string]string, error) {
-	if len(labels) == 0 {
-		return nil, nil
-	}
-
-	result := make(map[string]string, len(labels))
-	for _, label := range labels {
-		key, value, _ := strings.Cut(label, "=")
-		if strings.TrimSpace(key) == "" {
-			return nil, fmt.Errorf("invalid label '%s': key must not be empty", label)
-		}
-		result[key] = value
-	}
-
-	return result, nil
-}
-
 // parseVolumeFlags parses volume flag values in Docker CLI format and returns VolumeSpecs and VolumeMounts.
 // It handles both named volumes (volume_name:/container/path[:ro|volume-nocopy])
 // and bind mounts (/host/path:/container/path[:ro]).

cmd/uc/service/run_test.go

@@ -1,423 +0,0 @@
-package service
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/docker/go-units"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// validRunOptions returns the minimal options that produce a valid service spec.
-func validRunOptions() runOptions {
-	return runOptions{
-		image:    "nginx:1.27",
-		name:     "web",
-		mode:     api.ServiceModeReplicated,
-		pull:     api.PullPolicyMissing,
-		replicas: 1,
-	}
-}
-
-func TestParseLabels(t *testing.T) {
-	t.Parallel()
-
-	labels, err := parseLabels(nil)
-	require.NoError(t, err)
-	assert.Nil(t, labels)
-
-	labels, err = parseLabels([]string{"tier=frontend", "empty", "list=a,b", "expr=a=b", "tier=backend"})
-	require.NoError(t, err)
-	assert.Equal(t, map[string]string{
-		"tier":  "backend",
-		"empty": "",
-		"list":  "a,b",
-		"expr":  "a=b",
-	}, labels)
-
-	_, err = parseLabels([]string{"=value"})
-	require.ErrorContains(t, err, "key must not be empty")
-
-	_, err = parseLabels([]string{" \t =value"})
-	require.ErrorContains(t, err, "key must not be empty")
-
-	labels, err = parseLabels([]string{"key=value with spaces"})
-	require.NoError(t, err)
-	assert.Equal(t, map[string]string{"key": "value with spaces"}, labels)
-}
-
-func TestPrepareServiceSpec(t *testing.T) {
-	t.Parallel()
-
-	t.Run("minimal options", func(t *testing.T) {
-		t.Parallel()
-
-		spec, err := prepareServiceSpec(validRunOptions())
-		require.NoError(t, err)
-
-		assert.Equal(t, "web", spec.Name)
-		assert.Equal(t, api.ServiceModeReplicated, spec.Mode)
-		assert.EqualValues(t, 1, spec.Replicas)
-		assert.Equal(t, "nginx:1.27", spec.Container.Image)
-		assert.Equal(t, api.PullPolicyMissing, spec.Container.PullPolicy)
-		assert.Nil(t, spec.Caddy)
-		assert.Nil(t, spec.Labels)
-		assert.Nil(t, spec.Container.Labels)
-		assert.Nil(t, spec.Container.Entrypoint)
-		assert.Nil(t, spec.Container.Resources.Ulimits)
-		assert.Nil(t, spec.Placement.Machines)
-		assert.Empty(t, spec.Container.Env)
-		assert.Empty(t, spec.Ports)
-		assert.Empty(t, spec.Volumes)
-		assert.Empty(t, spec.Container.VolumeMounts)
-	})
-
-	t.Run("all options", func(t *testing.T) {
-		t.Parallel()
-
-		opts := validRunOptions()
-		opts.command = []string{"nginx", "-g", "daemon off;"}
-		opts.env = []string{"FOO=bar", "EMPTY=", "EXPR=a=b"}
-		opts.labels = []string{"tier=frontend"}
-		opts.containerLabels = []string{"logging=enabled"}
-		opts.machines = []string{"m1,m2", "m3"}
-		opts.privileged = true
-		opts.pull = api.PullPolicyAlways
-		opts.publish = []string{"app.example.com:8080/https", "53:5353/udp@host"}
-		opts.replicas = 3
-		opts.ulimits = []string{"nofile=1024:2048", "nproc=65535"}
-		opts.user = "1000:1000"
-		opts.volumes = []string{"data:/var/lib/data:ro"}
-		require.NoError(t, opts.cpu.Set("0.5"))
-		require.NoError(t, opts.memory.Set("128m"))
-		require.NoError(t, opts.memoryReservation.Set("32m"))
-		require.NoError(t, opts.shmSize.Set("64m"))
-
-		spec, err := prepareServiceSpec(opts)
-		require.NoError(t, err)
-
-		assert.Equal(t, api.ServiceSpec{
-			Container: api.ContainerSpec{
-				Command:    []string{"nginx", "-g", "daemon off;"},
-				Env:        api.EnvVars{"FOO": "bar", "EMPTY": "", "EXPR": "a=b"},
-				Image:      "nginx:1.27",
-				Labels:     map[string]string{"logging": "enabled"},
-				Privileged: true,
-				PullPolicy: api.PullPolicyAlways,
-				Resources: api.ContainerResources{
-					CPU:               500 * api.MilliCore,
-					Memory:            128 * units.MiB,
-					MemoryReservation: 32 * units.MiB,
-					SharedMemory:      64 * units.MiB,
-					Ulimits: map[string]api.Ulimit{
-						"nofile": {Soft: 1024, Hard: 2048},
-						"nproc":  {Soft: 65535, Hard: 65535},
-					},
-				},
-				User: "1000:1000",
-				VolumeMounts: []api.VolumeMount{
-					{VolumeName: "data", ContainerPath: "/var/lib/data", ReadOnly: true},
-				},
-			},
-			Labels:    map[string]string{"tier": "frontend"},
-			Mode:      api.ServiceModeReplicated,
-			Name:      "web",
-			Placement: api.Placement{Machines: []string{"m1", "m2", "m3"}},
-			Ports: []api.PortSpec{
-				{
-					Hostname:      "app.example.com",
-					ContainerPort: 8080,
-					Protocol:      api.ProtocolHTTPS,
-					Mode:          api.PortModeIngress,
-				},
-				{
-					PublishedPort: 53,
-					ContainerPort: 5353,
-					Protocol:      api.ProtocolUDP,
-					Mode:          api.PortModeHost,
-				},
-			},
-			Replicas: 3,
-			Volumes: []api.VolumeSpec{
-				{
-					Name:          "data",
-					Type:          api.VolumeTypeVolume,
-					VolumeOptions: &api.VolumeOptions{Name: "data"},
-				},
-			},
-		}, spec)
-	})
-
-	t.Run("generates a name when not specified", func(t *testing.T) {
-		t.Parallel()
-
-		opts := validRunOptions()
-		opts.name = ""
-		opts.image = "bitnami/nginx:latest"
-
-		spec, err := prepareServiceSpec(opts)
-		require.NoError(t, err)
-		assert.Regexp(t, `^nginx-[a-z0-9]{4}$`, spec.Name)
-	})
-
-	t.Run("keeps the specified name", func(t *testing.T) {
-		t.Parallel()
-
-		opts := validRunOptions()
-		opts.name = "custom"
-
-		spec, err := prepareServiceSpec(opts)
-		require.NoError(t, err)
-		assert.Equal(t, "custom", spec.Name)
-	})
-
-	t.Run("global mode", func(t *testing.T) {
-		t.Parallel()
-
-		opts := validRunOptions()
-		opts.mode = api.ServiceModeGlobal
-
-		spec, err := prepareServiceSpec(opts)
-		require.NoError(t, err)
-		assert.Equal(t, api.ServiceModeGlobal, spec.Mode)
-	})
-
-	t.Run("entrypoint", func(t *testing.T) {
-		t.Parallel()
-
-		opts := validRunOptions()
-		opts.entrypoint = "/bin/sh"
-		opts.entrypointChanged = true
-		spec, err := prepareServiceSpec(opts)
-		require.NoError(t, err)
-		assert.Equal(t, []string{"/bin/sh"}, spec.Container.Entrypoint)
-
-		// An explicitly empty entrypoint resets the one from the image.
-		opts = validRunOptions()
-		opts.entrypointChanged = true
-		spec, err = prepareServiceSpec(opts)
-		require.NoError(t, err)
-		assert.Equal(t, []string{""}, spec.Container.Entrypoint)
-	})
-
-	t.Run("env without a value is omitted when not set locally", func(t *testing.T) {
-		t.Parallel()
-
-		opts := validRunOptions()
-		opts.env = []string{"UNCLOUD_TEST_ENV_THAT_IS_NOT_SET"}
-
-		spec, err := prepareServiceSpec(opts)
-		require.NoError(t, err)
-		assert.NotContains(t, spec.Container.Env, "UNCLOUD_TEST_ENV_THAT_IS_NOT_SET")
-	})
-
-	t.Run("bind mount", func(t *testing.T) {
-		t.Parallel()
-
-		opts := validRunOptions()
-		opts.volumes = []string{"/data/uploads:/app/uploads"}
-
-		spec, err := prepareServiceSpec(opts)
-		require.NoError(t, err)
-
-		require.Len(t, spec.Volumes, 1)
-		assert.Regexp(t, `^bind-[a-z0-9]{4}$`, spec.Volumes[0].Name)
-		assert.Equal(t, api.VolumeTypeBind, spec.Volumes[0].Type)
-		require.NotNil(t, spec.Volumes[0].BindOptions)
-		assert.Equal(t, "/data/uploads", spec.Volumes[0].BindOptions.HostPath)
-		assert.True(t, spec.Volumes[0].BindOptions.CreateHostPath)
-
-		require.Len(t, spec.Container.VolumeMounts, 1)
-		assert.Equal(t, spec.Volumes[0].Name, spec.Container.VolumeMounts[0].VolumeName)
-		assert.Equal(t, "/app/uploads", spec.Container.VolumeMounts[0].ContainerPath)
-	})
-
-	t.Run("named volume mounted twice creates one volume", func(t *testing.T) {
-		t.Parallel()
-
-		opts := validRunOptions()
-		opts.volumes = []string{"data:/a", "data:/b"}
-
-		spec, err := prepareServiceSpec(opts)
-		require.NoError(t, err)
-		assert.Len(t, spec.Volumes, 1)
-		assert.Len(t, spec.Container.VolumeMounts, 2)
-	})
-
-	t.Run("caddyfile content is trimmed", func(t *testing.T) {
-		t.Parallel()
-
-		path := filepath.Join(t.TempDir(), "Caddyfile")
-		require.NoError(t, os.WriteFile(path, []byte("\nexample.com {\n}\n\n"), 0o600))
-
-		opts := validRunOptions()
-		opts.caddyfile = path
-
-		spec, err := prepareServiceSpec(opts)
-		require.NoError(t, err)
-		require.NotNil(t, spec.Caddy)
-		assert.Equal(t, "example.com {\n}", spec.Caddy.Config)
-	})
-
-	t.Run("empty caddyfile is ignored", func(t *testing.T) {
-		t.Parallel()
-
-		path := filepath.Join(t.TempDir(), "Caddyfile")
-		require.NoError(t, os.WriteFile(path, []byte(" \n"), 0o600))
-
-		opts := validRunOptions()
-		opts.caddyfile = path
-
-		spec, err := prepareServiceSpec(opts)
-		require.NoError(t, err)
-		assert.Nil(t, spec.Caddy)
-	})
-
-	t.Run("caddyfile can be used with host ports", func(t *testing.T) {
-		t.Parallel()
-
-		path := filepath.Join(t.TempDir(), "Caddyfile")
-		require.NoError(t, os.WriteFile(path, []byte("example.com {\n}"), 0o600))
-
-		opts := validRunOptions()
-		opts.caddyfile = path
-		opts.publish = []string{"53:5353/udp@host"}
-
-		_, err := prepareServiceSpec(opts)
-		require.NoError(t, err)
-	})
-}
-
-func TestPrepareServiceSpec_LocalEnv(t *testing.T) {
-	// Not parallel because t.Setenv changes the environment of the whole process.
-	t.Setenv("UNCLOUD_TEST_LOCAL_ENV", "from-local")
-
-	opts := validRunOptions()
-	opts.env = []string{"UNCLOUD_TEST_LOCAL_ENV"}
-
-	spec, err := prepareServiceSpec(opts)
-	require.NoError(t, err)
-	assert.Equal(t, "from-local", spec.Container.Env["UNCLOUD_TEST_LOCAL_ENV"])
-}
-
-func TestPrepareServiceSpec_Invalid(t *testing.T) {
-	t.Parallel()
-
-	caddyfile := filepath.Join(t.TempDir(), "Caddyfile")
-	require.NoError(t, os.WriteFile(caddyfile, []byte("example.com {\n}"), 0o600))
-
-	tests := []struct {
-		name    string
-		modify  func(opts *runOptions)
-		wantErr string
-	}{
-		{
-			name:    "invalid image",
-			modify:  func(opts *runOptions) { opts.image = "INVALID IMAGE" },
-			wantErr: "invalid image",
-		},
-		{
-			name:    "invalid name",
-			modify:  func(opts *runOptions) { opts.name = "Not_Valid" },
-			wantErr: "invalid service name",
-		},
-		{
-			name:    "invalid mode",
-			modify:  func(opts *runOptions) { opts.mode = "unknown" },
-			wantErr: "invalid replication mode: 'unknown'",
-		},
-		{
-			name:    "invalid pull policy",
-			modify:  func(opts *runOptions) { opts.pull = "sometimes" },
-			wantErr: "invalid pull policy: 'sometimes'",
-		},
-		{
-			name:    "invalid env",
-			modify:  func(opts *runOptions) { opts.env = []string{"=value"} },
-			wantErr: "invalid environment variable: '=value'",
-		},
-		{
-			name:    "invalid port",
-			modify:  func(opts *runOptions) { opts.publish = []string{"not-a-port"} },
-			wantErr: "invalid service port 'not-a-port'",
-		},
-		{
-			name:    "invalid ulimit",
-			modify:  func(opts *runOptions) { opts.ulimits = []string{"nofile"} },
-			wantErr: "invalid ulimit 'nofile'",
-		},
-		{
-			name:    "volume without a container path",
-			modify:  func(opts *runOptions) { opts.volumes = []string{"data"} },
-			wantErr: "invalid volume mount 'data'",
-		},
-		{
-			name:    "volume with a relative container path",
-			modify:  func(opts *runOptions) { opts.volumes = []string{"data:relative"} },
-			wantErr: "must be absolute path",
-		},
-		{
-			name:    "volume with an unknown option",
-			modify:  func(opts *runOptions) { opts.volumes = []string{"data:/data:unknown"} },
-			wantErr: "invalid option: 'unknown'",
-		},
-		{
-			name:    "missing caddyfile",
-			modify:  func(opts *runOptions) { opts.caddyfile = filepath.Join(os.TempDir(), "uncloud-test-no-such-file") },
-			wantErr: "read Caddyfile",
-		},
-		{
-			name: "caddyfile with an ingress port",
-			modify: func(opts *runOptions) {
-				opts.caddyfile = caddyfile
-				opts.publish = []string{"app.example.com:8080/https"}
-			},
-			wantErr: "cannot be specified simultaneously",
-		},
-		{
-			name:    "service label without a key",
-			modify:  func(opts *runOptions) { opts.labels = []string{"=value"} },
-			wantErr: "key must not be empty",
-		},
-		{
-			name:    "container label without a key",
-			modify:  func(opts *runOptions) { opts.containerLabels = []string{"=value"} },
-			wantErr: "key must not be empty",
-		},
-		{
-			name:    "service label with whitespace",
-			modify:  func(opts *runOptions) { opts.labels = []string{"my label=value"} },
-			wantErr: "invalid service labels: label 'my label' must not contain whitespace",
-		},
-		{
-			name:    "container label with whitespace",
-			modify:  func(opts *runOptions) { opts.containerLabels = []string{"my label=value"} },
-			wantErr: "invalid container labels: label 'my label' must not contain whitespace",
-		},
-		{
-			name:    "reserved service label",
-			modify:  func(opts *runOptions) { opts.labels = []string{api.LabelManaged + "=true"} },
-			wantErr: "invalid service labels",
-		},
-		{
-			name:    "reserved container label",
-			modify:  func(opts *runOptions) { opts.containerLabels = []string{api.LabelManaged + "=true"} },
-			wantErr: "invalid container labels",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			opts := validRunOptions()
-			tt.modify(&opts)
-
-			_, err := prepareServiceSpec(opts)
-			require.ErrorContains(t, err, tt.wantErr)
-		})
-	}
-}

cmd/uc/service/update.go

@@ -1,183 +0,0 @@
-package service
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"maps"
-	"slices"
-
-	dockeropts "github.com/docker/cli/opts"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/docker/docker/pkg/stringid"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/completion"
-	"github.com/psviderski/uncloud/internal/cli/tui"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/psviderski/uncloud/pkg/client/deploy"
-	"github.com/spf13/cobra"
-)
-
-type updateOptions struct {
-	service string
-
-	cpu                dockeropts.NanoCPUs
-	cpuChanged         bool
-	memory             dockeropts.MemBytes
-	memoryChanged      bool
-	memoryReservation  dockeropts.MemBytes
-	reservationChanged bool
-	labelAdd           []string
-	labelRm            []string
-}
-
-func NewUpdateCommand() *cobra.Command {
-	opts := updateOptions{}
-	cmd := &cobra.Command{
-		Use:   "update SERVICE",
-		Short: "Update a service in place without recreating its containers.",
-		Long: `Update service configuration in place without recreating its containers.
-
-A CPU or memory limit can be changed but not removed. To remove a limit or change anything else,
-redeploy the service with 'uc deploy'`,
-		Example: `  # Change the CPU and memory limits.
-  uc service update web --cpu 0.5 --memory 512m
-
-  # Add or change a service label and remove another one.
-  uc service update web --label-add tier=frontend --label-rm legacy`,
-		Args: cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			opts.service = args[0]
-			opts.cpuChanged = cmd.Flag("cpu").Changed
-			opts.memoryChanged = cmd.Flag("memory").Changed
-			opts.reservationChanged = cmd.Flag("memory-reservation").Changed
-
-			return update(cmd.Context(), uncli, opts)
-		},
-		ValidArgsFunction: func(
-			cmd *cobra.Command, args []string, toComplete string,
-		) ([]cobra.Completion, cobra.ShellCompDirective) {
-			if len(args) > 0 {
-				return nil, cobra.ShellCompDirectiveNoFileComp
-			}
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return completion.Services(cmd.Context(), uncli, args, toComplete)
-		},
-	}
-
-	cmd.Flags().Var(&opts.cpu, "cpu",
-		"Maximum number of CPU cores a service container can use.\n"+
-			"Fractional values are allowed: 0.5 for half a core or 2.25 for two and a quarter cores.")
-	cmd.Flags().Var(&opts.memory, "memory",
-		"Maximum amount of memory a service container can use. Value is a positive integer with\n"+
-			"optional unit suffix (b, k, m, g). Default unit is bytes if no suffix specified.\n"+
-			"Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)")
-	cmd.Flags().Var(&opts.memoryReservation, "memory-reservation",
-		"Minimum amount of memory reserved for a service container. Value is a positive integer with\n"+
-			"optional unit suffix (b, k, m, g). Default unit is bytes if no suffix specified.")
-	cmd.Flags().StringArrayVar(&opts.labelAdd, "label-add", nil,
-		"Add or change a service label. Can be specified multiple times.\n"+
-			"Format: key=value or just key for an empty value.")
-	cmd.Flags().StringArrayVar(&opts.labelRm, "label-rm", nil,
-		"Remove a service label by its key. Can be specified multiple times.")
-
-	return cmd
-}
-
-func update(ctx context.Context, uncli *cli.CLI, opts updateOptions) error {
-	if !opts.cpuChanged && !opts.memoryChanged && !opts.reservationChanged &&
-		len(opts.labelAdd) == 0 && len(opts.labelRm) == 0 {
-		return errors.New("no changes specified, set at least one of the flags: " +
-			"--cpu, --memory, --memory-reservation, --label-add, --label-rm")
-	}
-
-	labelAdd, err := parseLabels(opts.labelAdd)
-	if err != nil {
-		return err
-	}
-	if err = api.ValidateLabels(labelAdd); err != nil {
-		return fmt.Errorf("invalid service labels: %w", err)
-	}
-	for _, key := range opts.labelRm {
-		if _, ok := labelAdd[key]; ok {
-			return fmt.Errorf("label '%s' cannot be both added and removed", key)
-		}
-	}
-
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	svc, err := clusterClient.InspectService(ctx, opts.service)
-	if err != nil {
-		return fmt.Errorf("inspect service '%s': %w", opts.service, err)
-	}
-
-	// Check all containers before changing any of them to avoid a partially updated service when a limit can't be
-	// changed in place. Containers may have different specs after a failed deployment so each one is updated from
-	// its own spec.
-	updates := make(map[string]api.UpdateContainerOptions, len(svc.Containers))
-	for _, mc := range svc.Containers {
-		spec := applyServiceUpdate(mc.Container.ServiceSpec, opts, labelAdd)
-
-		resources := mc.Container.AppliedResources()
-		if err = resources.ValidateUpdateInPlace(spec.Container.Resources); err != nil {
-			return fmt.Errorf("container '%s' on machine '%s' can't be updated without recreating it: %w",
-				stringid.TruncateID(mc.Container.ID), mc.MachineName, err)
-		}
-
-		containerOpts := deploy.ContainerUpdateOptions(mc.Container, spec)
-		if containerOpts != (api.UpdateContainerOptions{}) {
-			updates[mc.Container.ID] = containerOpts
-		}
-	}
-
-	if len(updates) == 0 {
-		fmt.Printf("Service %s is already up to date. No changes required.\n", tui.NameStyle.Render(svc.Name))
-		return nil
-	}
-
-	return progress.RunWithTitle(ctx, func(ctx context.Context) error {
-		// Keep updating the remaining containers if one fails, for example, because its machine is down.
-		// Running the command again only updates the containers that still differ.
-		var errs []error
-		for id, containerOpts := range updates {
-			if err := clusterClient.UpdateContainer(ctx, svc.ID, id, containerOpts); err != nil {
-				errs = append(errs, fmt.Errorf("update container '%s': %w", stringid.TruncateID(id), err))
-			}
-		}
-		return errors.Join(errs...)
-	}, uncli.ProgressOut(), "Updating service "+tui.NameStyle.Render(svc.Name))
-}
-
-// applyServiceUpdate returns a copy of the spec with the requested changes applied.
-func applyServiceUpdate(spec api.ServiceSpec, opts updateOptions, labelAdd map[string]string) api.ServiceSpec {
-	updated := spec.Clone()
-
-	if opts.cpuChanged {
-		updated.Container.Resources.CPU = opts.cpu.Value()
-	}
-	if opts.memoryChanged {
-		updated.Container.Resources.Memory = opts.memory.Value()
-	}
-	if opts.reservationChanged {
-		updated.Container.Resources.MemoryReservation = opts.memoryReservation.Value()
-	}
-
-	if len(labelAdd) > 0 && updated.Labels == nil {
-		updated.Labels = make(map[string]string, len(labelAdd))
-	}
-	maps.Copy(updated.Labels, labelAdd)
-
-	for key := range updated.Labels {
-		if slices.Contains(opts.labelRm, key) {
-			delete(updated.Labels, key)
-		}
-	}
-
-	return updated
-}

cmd/uc/service/update_test.go

@@ -1,106 +0,0 @@
-package service
-
-import (
-	"testing"
-
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/psviderski/uncloud/pkg/client/deploy"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestApplyServiceUpdate(t *testing.T) {
-	t.Parallel()
-
-	newSpec := func() api.ServiceSpec {
-		return api.ServiceSpec{
-			Name: "web",
-			Container: api.ContainerSpec{
-				Image:  "nginx",
-				Labels: map[string]string{"container": "keep"},
-				Resources: api.ContainerResources{
-					CPU:               100 * api.MilliCore,
-					Memory:            1024,
-					MemoryReservation: 512,
-				},
-			},
-			Labels: map[string]string{"tier": "frontend", "legacy": "true"},
-		}
-	}
-
-	t.Run("adds, changes and removes labels", func(t *testing.T) {
-		t.Parallel()
-
-		spec := newSpec()
-		updated := applyServiceUpdate(spec, updateOptions{labelRm: []string{"legacy", "missing"}},
-			map[string]string{"tier": "backend", "team": "core"})
-
-		assert.Equal(t, map[string]string{"tier": "backend", "team": "core"}, updated.Labels)
-		assert.Equal(t, map[string]string{"container": "keep"}, updated.Container.Labels)
-		assert.Equal(t, spec.Container.Resources, updated.Container.Resources)
-		assert.Equal(t, map[string]string{"tier": "frontend", "legacy": "true"}, spec.Labels,
-			"Expected the original spec to stay unchanged")
-	})
-
-	t.Run("adds labels to a spec without labels", func(t *testing.T) {
-		t.Parallel()
-
-		spec := newSpec()
-		spec.Labels = nil
-		updated := applyServiceUpdate(spec, updateOptions{}, map[string]string{"tier": "backend"})
-
-		assert.Equal(t, map[string]string{"tier": "backend"}, updated.Labels)
-	})
-
-	t.Run("changes only requested limits", func(t *testing.T) {
-		t.Parallel()
-
-		opts := updateOptions{cpuChanged: true}
-		require.NoError(t, opts.cpu.Set("0.5"))
-
-		updated := applyServiceUpdate(newSpec(), opts, nil)
-
-		assert.EqualValues(t, 500*api.MilliCore, updated.Container.Resources.CPU)
-		assert.EqualValues(t, 1024, updated.Container.Resources.Memory)
-		assert.EqualValues(t, 512, updated.Container.Resources.MemoryReservation)
-	})
-
-	t.Run("sends only changed fields to the container", func(t *testing.T) {
-		t.Parallel()
-
-		opts := updateOptions{memoryChanged: true}
-		require.NoError(t, opts.memory.Set("2048"))
-
-		ctr := api.ServiceContainer{ServiceSpec: newSpec()}
-		containerOpts := deploy.ContainerUpdateOptions(ctr, applyServiceUpdate(ctr.ServiceSpec, opts, nil))
-
-		require.NotNil(t, containerOpts.Memory)
-		assert.EqualValues(t, 2048, *containerOpts.Memory)
-		assert.Nil(t, containerOpts.CPU)
-		assert.Nil(t, containerOpts.MemoryReservation)
-		assert.Nil(t, containerOpts.ServiceLabels)
-	})
-
-	t.Run("removing the last label clears service labels", func(t *testing.T) {
-		t.Parallel()
-
-		ctr := api.ServiceContainer{ServiceSpec: newSpec()}
-		containerOpts := deploy.ContainerUpdateOptions(ctr, applyServiceUpdate(
-			ctr.ServiceSpec, updateOptions{labelRm: []string{"tier", "legacy"}}, nil,
-		))
-
-		require.NotNil(t, containerOpts.ServiceLabels)
-		assert.Empty(t, *containerOpts.ServiceLabels)
-	})
-
-	t.Run("no changes produce empty container options", func(t *testing.T) {
-		t.Parallel()
-
-		ctr := api.ServiceContainer{ServiceSpec: newSpec()}
-		containerOpts := deploy.ContainerUpdateOptions(ctr, applyServiceUpdate(
-			ctr.ServiceSpec, updateOptions{}, map[string]string{"tier": "frontend"},
-		))
-
-		assert.Equal(t, api.UpdateContainerOptions{}, containerOpts)
-	})
-}

internal/cli/progress/event.go

@@ -9,7 +9,7 @@ import (
 
 type eventIDKey struct{}
 
-// WithEventID returns a context that overrides the event ID already set in the context.
+// WithEventID returns a context that overrides the default event ID used by client methods.
 func WithEventID(ctx context.Context, eventID string) context.Context {
 	return context.WithValue(ctx, eventIDKey{}, eventID)
 }
@@ -48,7 +48,7 @@ func OldPreDeployHookEventID(serviceName, containerID, machineName string) strin
 		tui.Faint.Render(" on ") + machineName
 }
 
-// ImageEventID returns a progress event ID for image operations on a machine.
+// ImageEventID returns a progress event ID for image pull operations.
 func ImageEventID(image, machineName string) string {
 	return tui.Faint.Render("Image ") + image +
 		tui.Faint.Render(" on ") + machineName

internal/machine/docker/controller.go

@@ -129,11 +129,6 @@ func (c *Controller) WatchAndSyncContainers(ctx context.Context) error {
 				"container_name", e.Actor.Attributes["name"],
 				"action", e.Action)
 
-			if err := c.syncContainersToStore(ctx); err != nil {
-				return fmt.Errorf("sync containers to cluster store: %w", err)
-			}
-		case <-c.service.ContainersChanged():
-			slog.Debug("Syncing containers to cluster store triggered by a container change in machine database.")
 			if err := c.syncContainersToStore(ctx); err != nil {
 				return fmt.Errorf("sync containers to cluster store: %w", err)
 			}

internal/machine/docker/server.go

@@ -594,26 +594,21 @@ func (s *Server) CreateServiceContainer(
 		}
 	}
 
-	// Apply user-defined labels first so that the system labels always take precedence.
-	labels := maps.Clone(spec.Container.Labels)
-	if labels == nil {
-		labels = make(map[string]string)
-	}
-	labels[api.LabelServiceID] = req.ServiceId
-	labels[api.LabelServiceName] = spec.Name
-	labels[api.LabelServiceMode] = spec.Mode
-	labels[api.LabelManaged] = ""
-
 	config := &container.Config{
 		Cmd:        spec.Container.Command,
 		Env:        envVars.ToSlice(),
 		Entrypoint: spec.Container.Entrypoint,
 		Hostname:   containerName,
 		Image:      spec.Container.Image,
-		Labels:     labels,
-		User:       spec.Container.User,
-		Tty:        spec.Container.Tty,
-		OpenStdin:  spec.Container.OpenStdin,
+		Labels: map[string]string{
+			api.LabelServiceID:   req.ServiceId,
+			api.LabelServiceName: spec.Name,
+			api.LabelServiceMode: spec.Mode,
+			api.LabelManaged:     "",
+		},
+		User:      spec.Container.User,
+		Tty:       spec.Container.Tty,
+		OpenStdin: spec.Container.OpenStdin,
 	}
 	if spec.Mode == "" {
 		config.Labels[api.LabelServiceMode] = api.ServiceModeReplicated
@@ -734,10 +729,12 @@ func (s *Server) CreateServiceContainer(
 
 	// Strip the container configuration that doesn't make sense for the pre-deploy hook and apply its overrides.
 	if spec.PreDeploy != nil && req.ContainerType == pb.CreateServiceContainerRequest_PRE_DEPLOY {
-		// Keep the user-defined labels but replace the service mode and ports labels with the hook label.
-		delete(config.Labels, api.LabelServiceMode)
-		delete(config.Labels, api.LabelServicePorts)
-		config.Labels[api.LabelHook] = api.LabelHookPreDeploy
+		config.Labels = map[string]string{
+			api.LabelServiceID:   req.ServiceId,
+			api.LabelServiceName: spec.Name,
+			api.LabelHook:        api.LabelHookPreDeploy,
+			api.LabelManaged:     "",
+		}
 		config.Healthcheck = &container.HealthConfig{
 			Test: []string{"NONE"},
 		}
@@ -1182,36 +1179,6 @@ func (s *Server) RemoveServiceContainer(ctx context.Context, req *pb.RemoveConta
 	return resp, nil
 }
 
-// UpdateServiceContainer updates the requested properties of a service container in place without recreating it.
-func (s *Server) UpdateServiceContainer(
-	ctx context.Context, req *pb.UpdateServiceContainerRequest,
-) (*emptypb.Empty, error) {
-	opts := api.UpdateContainerOptions{
-		CPU:               req.Cpu,
-		Memory:            req.Memory,
-		MemoryReservation: req.MemoryReservation,
-	}
-	if req.ServiceLabels != nil {
-		labels := req.ServiceLabels.Labels
-		opts.ServiceLabels = &labels
-	}
-
-	if err := s.service.UpdateServiceContainer(ctx, req.Id, opts); err != nil {
-		switch {
-		case errdefs.IsNotFound(err):
-			return nil, status.Error(codes.NotFound, err.Error())
-		case errdefs.IsInvalidArgument(err):
-			return nil, status.Error(codes.InvalidArgument, err.Error())
-		case errdefs.IsFailedPrecondition(err):
-			return nil, status.Error(codes.FailedPrecondition, err.Error())
-		default:
-			return nil, status.Error(codes.Internal, err.Error())
-		}
-	}
-
-	return &emptypb.Empty{}, nil
-}
-
 // logsHeartbeatInterval is the interval at which heartbeat entries are sent when there are no logs to stream.
 const logsHeartbeatInterval = 200 * time.Millisecond
 

internal/machine/docker/service.go

@@ -15,7 +15,6 @@ import (
 	"time"
 
 	"github.com/cenkalti/backoff/v4"
-	"github.com/containerd/errdefs"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/events"
 	"github.com/docker/docker/api/types/filters"
@@ -35,9 +34,6 @@ type Service struct {
 	Client client.APIClient
 	// db is a connection to the machine database.
 	db *sqlx.DB
-	// containersChanged signals that service containers changed in the machine database without a corresponding
-	// Docker event, for example, when a container spec is updated in place.
-	containersChanged chan struct{}
 }
 
 // NewService creates a new Docker service instance.
@@ -45,26 +41,9 @@ func NewService(client client.APIClient, db *sqlx.DB) *Service {
 	return &Service{
 		Client: client,
 		db:     db,
-		// Buffering as a pending signal is enough for the consumer to pick up all changes made before it reacts.
-		containersChanged: make(chan struct{}, 1),
 	}
 }
 
-// NotifyContainersChanged signals that service containers changed in the machine database. It doesn't block
-// if a signal is already pending.
-func (s *Service) NotifyContainersChanged() {
-	select {
-	case s.containersChanged <- struct{}{}:
-	default:
-	}
-}
-
-// ContainersChanged returns a channel that receives a signal when service containers change in the machine database
-// without a corresponding Docker event.
-func (s *Service) ContainersChanged() <-chan struct{} {
-	return s.containersChanged
-}
-
 // WatchDaemonRestart watches the Docker engine and signals on the returned channel whenever the daemon
 // becomes reachable again after a disconnect, which typically indicates a restart.
 func (s *Service) WatchDaemonRestart(ctx context.Context) <-chan struct{} {
@@ -162,90 +141,6 @@ func (s *Service) InspectServiceContainer(ctx context.Context, nameOrID string)
 	return serviceCtr, nil
 }
 
-// UpdateServiceContainer updates the requested properties of a service container in place without recreating it.
-// It applies the CPU and memory limits to the container and updates the service spec stored for the container.
-func (s *Service) UpdateServiceContainer(ctx context.Context, id string, opts api.UpdateContainerOptions) error {
-	if opts.ServiceLabels != nil {
-		if err := api.ValidateLabels(*opts.ServiceLabels); err != nil {
-			return errdefs.ErrInvalidArgument.WithMessage(fmt.Sprintf("invalid service labels: %v", err))
-		}
-	}
-
-	ctr, err := s.InspectServiceContainer(ctx, id)
-	if err != nil {
-		return err
-	}
-	spec := ctr.ServiceSpec
-
-	resources := spec.Container.Resources
-	if opts.CPU != nil {
-		resources.CPU = *opts.CPU
-	}
-	if opts.Memory != nil {
-		resources.Memory = *opts.Memory
-	}
-	if opts.MemoryReservation != nil {
-		resources.MemoryReservation = *opts.MemoryReservation
-	}
-	if resources.CPU < 0 || resources.Memory < 0 || resources.MemoryReservation < 0 {
-		return errdefs.ErrInvalidArgument.WithMessage("CPU and memory limits must not be negative")
-	}
-	// Compare with the limits Docker applies to the container rather than the stored spec. They may differ if
-	// a previous update applied the limits but failed to store the spec, or the container was updated outside
-	// of Uncloud.
-	applied := ctr.AppliedResources()
-	if err = applied.ValidateUpdateInPlace(resources); err != nil {
-		return errdefs.ErrFailedPrecondition.WithMessage(
-			fmt.Sprintf("container '%s' can't be updated without recreating it: %v", ctr.ID, err))
-	}
-
-	// Only CPU and memory limits can differ after the in-place update check above.
-	if !applied.Equals(resources) {
-		updateResources := container.Resources{
-			NanoCPUs:          resources.CPU,
-			Memory:            resources.Memory,
-			MemoryReservation: resources.MemoryReservation,
-		}
-		// Docker defaults the swap limit to twice the memory limit when creating a container and rejects raising
-		// the memory limit above the current swap limit, so update both to keep the same semantics.
-		if resources.Memory > 0 {
-			updateResources.MemorySwap = 2 * resources.Memory
-		}
-		if _, err = s.Client.ContainerUpdate(ctx, ctr.ID, container.UpdateConfig{
-			Resources: updateResources,
-		}); err != nil {
-			return fmt.Errorf("update container resources: %w", err)
-		}
-	}
-	spec.Container.Resources = resources
-
-	if opts.ServiceLabels != nil {
-		spec.Labels = nil
-		if len(*opts.ServiceLabels) > 0 {
-			spec.Labels = *opts.ServiceLabels
-		}
-	}
-
-	specBytes, err := json.Marshal(spec)
-	if err != nil {
-		return fmt.Errorf("marshal service spec: %w", err)
-	}
-	res, err := s.db.ExecContext(ctx,
-		`UPDATE containers SET service_spec = $1, updated_at = datetime('subsecond') WHERE id = $2`,
-		string(specBytes), ctr.ID)
-	if err != nil {
-		return fmt.Errorf("update container in database: %w", err)
-	}
-	if n, err := res.RowsAffected(); err == nil && n == 0 {
-		return errdefs.ErrNotFound.WithMessage(fmt.Sprintf("container '%s' not found in machine database", ctr.ID))
-	}
-
-	// Propagate the updated spec to the cluster store without waiting for the next regular sync.
-	s.NotifyContainersChanged()
-
-	return nil
-}
-
 // ListServiceContainersResult holds the result of listing service containers, split into regular
 // service containers and one-off hook containers.
 type ListServiceContainersResult struct {

mise.lock

@@ -1,58 +1,47 @@
 # @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html
 
-lockfile_version = 3
-
 [[tools."aqua:vektra/mockery"]]
 version = "3.8.1"
 backend = "aqua:vektra/mockery"
-specifiers = ["3.8.1"]
 
 [tools."aqua:vektra/mockery"."platforms.linux-arm64"]
 checksum = "sha256:d1f481f3a6e9868dd3ad65da265238ee109ab3a5dd7508958d5811953696f452"
-checksum_source = "mise-versions"
 url = "https://github.com/vektra/mockery/releases/download/v3.8.1/mockery_3.8.1_Linux_arm64.tar.gz"
 url_api = "https://api.github.com/repos/vektra/mockery/releases/assets/632915757"
 
 [tools."aqua:vektra/mockery"."platforms.linux-arm64-musl"]
 checksum = "sha256:d1f481f3a6e9868dd3ad65da265238ee109ab3a5dd7508958d5811953696f452"
-checksum_source = "mise-versions"
 url = "https://github.com/vektra/mockery/releases/download/v3.8.1/mockery_3.8.1_Linux_arm64.tar.gz"
 url_api = "https://api.github.com/repos/vektra/mockery/releases/assets/632915757"
 
 [tools."aqua:vektra/mockery"."platforms.linux-x64"]
 checksum = "sha256:953c7d38b58dd6398b1c595f27caf8bbf27e9b733b49c404d2e124e86d2ae72a"
-checksum_source = "mise-versions"
 url = "https://github.com/vektra/mockery/releases/download/v3.8.1/mockery_3.8.1_Linux_x86_64.tar.gz"
 url_api = "https://api.github.com/repos/vektra/mockery/releases/assets/632915756"
 
 [tools."aqua:vektra/mockery"."platforms.linux-x64-musl"]
 checksum = "sha256:953c7d38b58dd6398b1c595f27caf8bbf27e9b733b49c404d2e124e86d2ae72a"
-checksum_source = "mise-versions"
 url = "https://github.com/vektra/mockery/releases/download/v3.8.1/mockery_3.8.1_Linux_x86_64.tar.gz"
 url_api = "https://api.github.com/repos/vektra/mockery/releases/assets/632915756"
 
 [tools."aqua:vektra/mockery"."platforms.macos-arm64"]
 checksum = "sha256:303a794484243906b37da0c37056f974bf94278c2e10d7b1372e6bd53a2d5034"
-checksum_source = "mise-versions"
 url = "https://github.com/vektra/mockery/releases/download/v3.8.1/mockery_3.8.1_Darwin_arm64.tar.gz"
 url_api = "https://api.github.com/repos/vektra/mockery/releases/assets/632915806"
 
 [tools."aqua:vektra/mockery"."platforms.macos-x64"]
 checksum = "sha256:6882331344e946268b304dce042b01371a0213a896536413be8abe49d532ca6f"
-checksum_source = "mise-versions"
 url = "https://github.com/vektra/mockery/releases/download/v3.8.1/mockery_3.8.1_Darwin_x86_64.tar.gz"
 url_api = "https://api.github.com/repos/vektra/mockery/releases/assets/632915746"
 
 [tools."aqua:vektra/mockery"."platforms.windows-x64"]
 checksum = "sha256:7a7458756e9d7bce5f9936b7a63394000f3affa751b9740e65350c4bdcb627dc"
-checksum_source = "mise-versions"
 url = "https://github.com/vektra/mockery/releases/download/v3.8.1/mockery_3.8.1_Windows_x86_64.tar.gz"
 url_api = "https://api.github.com/repos/vektra/mockery/releases/assets/632915759"
 
 [[tools.go]]
 version = "1.26.1"
 backend = "core:go"
-specifiers = ["1.26.1"]
 
 [tools.go."platforms.linux-arm64"]
 checksum = "sha256:a290581cfe4fe28ddd737dde3095f3dbeb7f2e4065cab4eae44dfc53b760c2f7"
@@ -85,7 +74,6 @@ url = "https://dl.google.com/go/go1.26.1.windows-amd64.zip"
 [[tools.golangci-lint]]
 version = "2.11.2"
 backend = "aqua:golangci/golangci-lint"
-specifiers = ["2.11.2"]
 
 [tools.golangci-lint."platforms.linux-arm64"]
 checksum = "sha256:c3c83c7ed003e881991af21361c487151abd37969927ed9062cd0b48f3cd1d8d"
@@ -132,7 +120,6 @@ provenance = "github-attestations"
 [[tools.goreleaser]]
 version = "2.15.2"
 backend = "aqua:goreleaser/goreleaser"
-specifiers = ["2.15.2"]
 
 [tools.goreleaser."platforms.linux-arm64"]
 checksum = "sha256:5db66761a98f6693161e49e1a95d28d2673a892ba60cb4a5e16736cafd41c4c9"
@@ -179,7 +166,6 @@ provenance = "github-attestations"
 [[tools.node]]
 version = "22.20.0"
 backend = "core:node"
-specifiers = ["22.20.0"]
 
 [tools.node."platforms.linux-arm64"]
 checksum = "sha256:4181609e03dcb9880e7e5bf956061ecc0503c77a480c6631d868cb1f65a2c7dd"
@@ -213,119 +199,98 @@ url = "https://nodejs.org/dist/v22.20.0/node-v22.20.0-win-x64.zip"
 [[tools.protoc]]
 version = "27.3"
 backend = "aqua:protocolbuffers/protobuf/protoc"
-specifiers = ["27.3"]
 
 [tools.protoc."platforms.linux-arm64"]
-checksum = "sha256:bdad36f3ad7472281d90568c4956ea2e203c216e0de005c6bd486f1920f2751c"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v27.3/protoc-27.3-linux-aarch_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/183006374"
 
 [tools.protoc."platforms.linux-arm64-musl"]
-checksum = "sha256:bdad36f3ad7472281d90568c4956ea2e203c216e0de005c6bd486f1920f2751c"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v27.3/protoc-27.3-linux-aarch_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/183006374"
 
 [tools.protoc."platforms.linux-x64"]
-checksum = "sha256:6dab2adab83f915126cab53540d48957c40e9e9023969c3e84d44bfb936c7741"
+checksum = "blake3:8c2938accf7061164ea3968529a47ced1db4824ca553857f6903c68ae4347739"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v27.3/protoc-27.3-linux-x86_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/183006380"
 
 [tools.protoc."platforms.linux-x64-musl"]
-checksum = "sha256:6dab2adab83f915126cab53540d48957c40e9e9023969c3e84d44bfb936c7741"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v27.3/protoc-27.3-linux-x86_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/183006380"
 
 [tools.protoc."platforms.macos-arm64"]
-checksum = "sha256:b22116bd97cdbd7ea25346abe635a9df268515fe5ef5afa93cd9a68fc2513f84"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v27.3/protoc-27.3-osx-aarch_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/183006383"
 
 [tools.protoc."platforms.macos-x64"]
-checksum = "sha256:ce282648fed0e7fbd6237d606dc9ec168dd2c1863889b04efa0b19c47da65d1b"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v27.3/protoc-27.3-osx-x86_64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/183006381"
 
 [tools.protoc."platforms.windows-x64"]
-checksum = "sha256:bdccd341a0c25ff4f65d8530f170c78ce5681e42920aa5d892f27ac06cc3bba0"
 url = "https://github.com/protocolbuffers/protobuf/releases/download/v27.3/protoc-27.3-win64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf/releases/assets/183006385"
 
 [[tools.protoc-gen-go]]
 version = "1.34.2"
 backend = "aqua:protocolbuffers/protobuf-go/protoc-gen-go"
-specifiers = ["1.34.2"]
 
 [tools.protoc-gen-go."platforms.linux-arm64"]
-checksum = "sha256:63d400167e75ab9f6690688f6fdc6a9455aa20bc1faa71e32149dbd322f7f198"
 url = "https://github.com/protocolbuffers/protobuf-go/releases/download/v1.34.2/protoc-gen-go.v1.34.2.linux.arm64.tar.gz"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf-go/releases/assets/173109690"
 
 [tools.protoc-gen-go."platforms.linux-arm64-musl"]
-checksum = "sha256:63d400167e75ab9f6690688f6fdc6a9455aa20bc1faa71e32149dbd322f7f198"
 url = "https://github.com/protocolbuffers/protobuf-go/releases/download/v1.34.2/protoc-gen-go.v1.34.2.linux.arm64.tar.gz"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf-go/releases/assets/173109690"
 
 [tools.protoc-gen-go."platforms.linux-x64"]
-checksum = "sha256:b87bc134dee55576a842141bf0ed27761c635d746780fce5dee038c6dd16554f"
+checksum = "blake3:f765e393e0f0b25070c13848d88f5e6303e66090132afa1b753e981507a4174e"
 url = "https://github.com/protocolbuffers/protobuf-go/releases/download/v1.34.2/protoc-gen-go.v1.34.2.linux.amd64.tar.gz"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf-go/releases/assets/173109692"
 
 [tools.protoc-gen-go."platforms.linux-x64-musl"]
-checksum = "sha256:b87bc134dee55576a842141bf0ed27761c635d746780fce5dee038c6dd16554f"
 url = "https://github.com/protocolbuffers/protobuf-go/releases/download/v1.34.2/protoc-gen-go.v1.34.2.linux.amd64.tar.gz"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf-go/releases/assets/173109692"
 
 [tools.protoc-gen-go."platforms.macos-arm64"]
-checksum = "sha256:17aca7f948dbb624049030cf841e35895cf34183ba006e721247fdeb95ff2780"
 url = "https://github.com/protocolbuffers/protobuf-go/releases/download/v1.34.2/protoc-gen-go.v1.34.2.darwin.arm64.tar.gz"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf-go/releases/assets/173109697"
 
 [tools.protoc-gen-go."platforms.macos-x64"]
-checksum = "sha256:9b48d8f90add02e8e94e14962fed74e7ce2b2d6bda4dd42f1f4fbccf0f766f1a"
 url = "https://github.com/protocolbuffers/protobuf-go/releases/download/v1.34.2/protoc-gen-go.v1.34.2.darwin.amd64.tar.gz"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf-go/releases/assets/173109698"
 
 [tools.protoc-gen-go."platforms.windows-x64"]
-checksum = "sha256:abafd39612177dd4e9a65207cadd5374a9352d8611e8e040f8462fcfa3010daf"
 url = "https://github.com/protocolbuffers/protobuf-go/releases/download/v1.34.2/protoc-gen-go.v1.34.2.windows.amd64.zip"
 url_api = "https://api.github.com/repos/protocolbuffers/protobuf-go/releases/assets/173109685"
 
 [[tools.protoc-gen-go-grpc]]
 version = "1.5.1"
 backend = "aqua:grpc/grpc-go/protoc-gen-go-grpc"
-specifiers = ["1.5.1"]
 
 [tools.protoc-gen-go-grpc."platforms.linux-arm64"]
-checksum = "sha256:370a7cfa5786e61e6fdc5aa8f689e35c2d27d036a49caac7aa25f962c89a01e8"
 url = "https://github.com/grpc/grpc-go/releases/download/cmd/protoc-gen-go-grpc/v1.5.1/protoc-gen-go-grpc.v1.5.1.linux.arm64.tar.gz"
 url_api = "https://api.github.com/repos/grpc/grpc-go/releases/assets/182572238"
 
 [tools.protoc-gen-go-grpc."platforms.linux-arm64-musl"]
-checksum = "sha256:370a7cfa5786e61e6fdc5aa8f689e35c2d27d036a49caac7aa25f962c89a01e8"
 url = "https://github.com/grpc/grpc-go/releases/download/cmd/protoc-gen-go-grpc/v1.5.1/protoc-gen-go-grpc.v1.5.1.linux.arm64.tar.gz"
 url_api = "https://api.github.com/repos/grpc/grpc-go/releases/assets/182572238"
 
 [tools.protoc-gen-go-grpc."platforms.linux-x64"]
-checksum = "sha256:a6cac4ea731e54aea304ad44d704a69d1cdc82997084b33637e21a89dc9229d6"
+checksum = "blake3:197739132f0408f017d0c83773ac1ace85c0572473fdd658ec6e4ccbf20e0552"
 url = "https://github.com/grpc/grpc-go/releases/download/cmd/protoc-gen-go-grpc/v1.5.1/protoc-gen-go-grpc.v1.5.1.linux.amd64.tar.gz"
 url_api = "https://api.github.com/repos/grpc/grpc-go/releases/assets/182572229"
 
 [tools.protoc-gen-go-grpc."platforms.linux-x64-musl"]
-checksum = "sha256:a6cac4ea731e54aea304ad44d704a69d1cdc82997084b33637e21a89dc9229d6"
 url = "https://github.com/grpc/grpc-go/releases/download/cmd/protoc-gen-go-grpc/v1.5.1/protoc-gen-go-grpc.v1.5.1.linux.amd64.tar.gz"
 url_api = "https://api.github.com/repos/grpc/grpc-go/releases/assets/182572229"
 
 [tools.protoc-gen-go-grpc."platforms.macos-arm64"]
-checksum = "sha256:d6083feb51dcfe59f26793e99ef01ef5eac68b64294ec2546711f614ac5878f3"
 url = "https://github.com/grpc/grpc-go/releases/download/cmd/protoc-gen-go-grpc/v1.5.1/protoc-gen-go-grpc.v1.5.1.darwin.arm64.tar.gz"
 url_api = "https://api.github.com/repos/grpc/grpc-go/releases/assets/182572243"
 
 [tools.protoc-gen-go-grpc."platforms.macos-x64"]
-checksum = "sha256:c12c259d59c8b451f24b6abdad6d055fd0884c5268b7247fd7e5ec9d2432d1f1"
 url = "https://github.com/grpc/grpc-go/releases/download/cmd/protoc-gen-go-grpc/v1.5.1/protoc-gen-go-grpc.v1.5.1.darwin.amd64.tar.gz"
 url_api = "https://api.github.com/repos/grpc/grpc-go/releases/assets/182572208"
 
 [tools.protoc-gen-go-grpc."platforms.windows-x64"]
-checksum = "sha256:c2ad1460c9e34b5b37759826da61220be6ee0a8a11431723d205512a69319991"
 url = "https://github.com/grpc/grpc-go/releases/download/cmd/protoc-gen-go-grpc/v1.5.1/protoc-gen-go-grpc.v1.5.1.windows.amd64.tar.gz"
 url_api = "https://api.github.com/repos/grpc/grpc-go/releases/assets/182572216"

mise.toml

@@ -1,6 +1,5 @@
 [settings]
 experimental = true
-lockfile = true
 
 [tools]
 "aqua:vektra/mockery" = "3.8.1"
@@ -37,33 +36,9 @@ GOOS=linux GOARCH=arm64 go build -ldflags "-X github.com/psviderski/uncloud/inte
 """
 outputs = ["uncloudd-linux-arm64"]
 
-[tasks."docs:cli"]
-description = "Regenerate the CLI reference docs"
-run = "go run ./cmd/uc docs"
-
-[tasks."docs:dev"]
-description = "Run the documentation website locally"
-dir = "website"
-run = "npm start --"
-
-[tasks.fmt]
-description = "Format Go code and imports"
-alias = "format"
-env.GOOS = "linux"
-run = "golangci-lint fmt"
-
-[tasks.lint]
-description = "Check Go code and formatting"
-# Explicitly set OS to Linux to not skip *_linux.go files when running on macOS.
-# Uncloud daemon won't likely support OS other than Linux anytime soon, so for now we can rely on that.
-env.GOOS = "linux"
-run = "golangci-lint run"
-
-[tasks."lint:fix"]
-description = "Format Go code and apply available lint fixes"
-alias = "lint-and-fix"
-env.GOOS = "linux"
-run = "golangci-lint run --fix"
+[tasks."mise:lock"]
+description = "Update mise.lock with hashes for all platforms"
+run = "mise lock --platform linux-x64,macos-arm64"
 
 [tasks.mocks]
 description = "Regenerate Go test mocks"
@@ -78,12 +53,10 @@ protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=p
 
 [tasks.uc]
 description = "Run the Uncloud CLI"
-raw_args = true
 run = "go run ./cmd/uc"
 
 [tasks.ucind]
 description = "Run ucind CLI for managing local Docker-based clusters"
-raw_args = true
 run = "go run ./cmd/ucind"
 
 [tasks."ucind:image"]

pkg/api/client.go

@@ -30,7 +30,6 @@ type ContainerClient interface {
 	StartContainer(ctx context.Context, serviceNameOrID, containerNameOrID string) error
 	StopContainer(ctx context.Context, serviceNameOrID, containerNameOrID string, opts container.StopOptions) error
 	RemoveContainer(ctx context.Context, serviceNameOrID, containerNameOrID string, opts container.RemoveOptions) error
-	UpdateContainer(ctx context.Context, serviceNameOrID, containerNameOrID string, opts UpdateContainerOptions) error
 	WaitContainerHealthy(
 		ctx context.Context, serviceNameOrID, containerNameOrID string, opts WaitContainerHealthyOptions,
 	) error

pkg/api/container.go

@@ -19,11 +19,6 @@ const (
 	// in internal/machine/docker/manager.go.
 	DockerNetworkName = "uncloud"
 
-	// LabelReservedPrefix is the prefix of labels reserved for Uncloud that users can't set on services and containers.
-	LabelReservedPrefix = "uncloud."
-	// LabelDaemonReservedPrefix is the prefix of labels reserved for the Uncloud daemon system containers.
-	LabelDaemonReservedPrefix = "uncloudd."
-
 	// LabelDaemonManaged marks system containers as managed by the Uncloud daemon.
 	LabelDaemonManaged = "uncloudd.managed"
 
@@ -180,19 +175,6 @@ type CreateContainerResponse struct {
 	Name string
 }
 
-// UpdateContainerOptions defines the properties of a service container to update in place without recreating it.
-// Nil fields are left unchanged.
-type UpdateContainerOptions struct {
-	// CPU is the new CPU limit in nanocores. The limit can be changed but not removed.
-	CPU *int64
-	// Memory is the new memory limit in bytes. The limit can be changed but not removed.
-	Memory *int64
-	// MemoryReservation is the new memory reservation in bytes. The reservation can be changed but not removed.
-	MemoryReservation *int64
-	// ServiceLabels replaces all service labels. A pointer to an empty map removes all service labels.
-	ServiceLabels *map[string]string
-}
-
 type ServiceContainer struct {
 	Container
 	ServiceSpec ServiceSpec
@@ -213,21 +195,6 @@ func (c *ServiceContainer) ServiceName() string {
 	return c.Config.Labels[LabelServiceName]
 }
 
-// AppliedResources returns the resources from the service spec with the CPU and memory limits that Docker currently
-// applies to the container. The applied limits may differ from the spec if an in-place update was interrupted or
-// the container was updated outside of Uncloud.
-func (c *ServiceContainer) AppliedResources() ContainerResources {
-	resources := c.ServiceSpec.Container.Resources
-	if c.ContainerJSONBase == nil || c.HostConfig == nil {
-		return resources
-	}
-
-	resources.CPU = c.HostConfig.NanoCPUs
-	resources.Memory = c.HostConfig.Memory
-	resources.MemoryReservation = c.HostConfig.MemoryReservation
-	return resources
-}
-
 // ServiceMode returns the replication mode of the service this container belongs to.
 func (c *ServiceContainer) ServiceMode() string {
 	return c.ServiceSpec.Mode

pkg/api/resources.go

@@ -1,11 +1,7 @@
 package api
 
 import (
-	"errors"
-
 	"github.com/docker/docker/api/types/container"
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
 )
 
 const (
@@ -31,35 +27,6 @@ type ContainerResources struct {
 	Ulimits map[string]Ulimit
 }
 
-// Equals returns true if the resources are equal, treating nil and empty slices and maps as equal.
-func (r ContainerResources) Equals(other ContainerResources) bool {
-	return cmp.Equal(r, other, cmpopts.EquateEmpty())
-}
-
-// ValidateUpdateInPlace returns an error explaining why a container created with these resources can't be updated
-// to the new resources without recreating it. It returns nil if the container can be updated in place.
-// Docker can only change the CPU and memory limits of an existing container and can't remove a limit once it's set.
-func (r ContainerResources) ValidateUpdateInPlace(new ContainerResources) error {
-	// Docker treats zero values as unchanged when updating a container.
-	if r.CPU != 0 && new.CPU == 0 {
-		return errors.New("CPU limit can't be removed")
-	}
-	if r.Memory != 0 && new.Memory == 0 {
-		return errors.New("memory limit can't be removed")
-	}
-	if r.MemoryReservation != 0 && new.MemoryReservation == 0 {
-		return errors.New("memory reservation can't be removed")
-	}
-
-	r.CPU = new.CPU
-	r.Memory = new.Memory
-	r.MemoryReservation = new.MemoryReservation
-	if !r.Equals(new) {
-		return errors.New("only CPU and memory limits can be changed")
-	}
-	return nil
-}
-
 // DeviceMapping represents a device mapping between host and container.
 type DeviceMapping struct {
 	// HostPath is the path to the device on the host.

pkg/api/resources_test.go

@@ -1,72 +0,0 @@
-package api
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestContainerResources_ValidateUpdateInPlace(t *testing.T) {
-	t.Parallel()
-
-	current := ContainerResources{
-		CPU:               Core,
-		Memory:            512 * 1024 * 1024,
-		MemoryReservation: 256 * 1024 * 1024,
-	}
-
-	tests := []struct {
-		name    string
-		new     func(r *ContainerResources)
-		wantErr string
-	}{
-		{
-			name: "same resources",
-			new:  func(*ContainerResources) {},
-		},
-		{
-			name: "change CPU and memory limits",
-			new: func(r *ContainerResources) {
-				r.CPU = 2 * Core
-				r.Memory = 1024 * 1024 * 1024
-				r.MemoryReservation = 128 * 1024 * 1024
-			},
-		},
-		{
-			name:    "remove CPU limit",
-			new:     func(r *ContainerResources) { r.CPU = 0 },
-			wantErr: "CPU limit can't be removed",
-		},
-		{
-			name:    "remove memory limit",
-			new:     func(r *ContainerResources) { r.Memory = 0 },
-			wantErr: "memory limit can't be removed",
-		},
-		{
-			name:    "remove memory reservation",
-			new:     func(r *ContainerResources) { r.MemoryReservation = 0 },
-			wantErr: "memory reservation can't be removed",
-		},
-		{
-			name:    "change shared memory",
-			new:     func(r *ContainerResources) { r.SharedMemory = 64 * 1024 * 1024 },
-			wantErr: "only CPU and memory limits can be changed",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			newResources := current
-			tt.new(&newResources)
-
-			err := current.ValidateUpdateInPlace(newResources)
-			if tt.wantErr == "" {
-				assert.NoError(t, err)
-			} else {
-				assert.EqualError(t, err, tt.wantErr)
-			}
-		})
-	}
-}

pkg/api/service.go

@@ -8,7 +8,6 @@ import (
 	"slices"
 	"strings"
 	"time"
-	"unicode"
 
 	mapset "github.com/deckarep/golang-set/v2"
 	"github.com/distribution/reference"
@@ -78,9 +77,6 @@ type ServiceSpec struct {
 	Configs []ConfigSpec
 	// Container defines the desired state of each container in the service.
 	Container ContainerSpec
-	// Labels are user-defined key-value metadata attached to the service. Unlike container labels, they're not
-	// applied to Docker containers. Keys must not use the reserved "uncloud." prefix.
-	Labels map[string]string
 	// Mode is the replication mode of the service. Default is ServiceModeReplicated if empty.
 	Mode string
 	Name string
@@ -161,9 +157,6 @@ func (s *ServiceSpec) Validate() error {
 	if err := s.Container.Validate(); err != nil {
 		return err
 	}
-	if err := ValidateLabels(s.Labels); err != nil {
-		return fmt.Errorf("invalid service labels: %w", err)
-	}
 
 	switch s.Mode {
 	case "", ServiceModeGlobal, ServiceModeReplicated:
@@ -250,7 +243,6 @@ func (s *ServiceSpec) Clone() ServiceSpec {
 		spec.Caddy = &caddyCopy
 	}
 	spec.Container = s.Container.Clone()
-	spec.Labels = maps.Clone(s.Labels)
 	spec.PreDeploy = s.PreDeploy.Clone()
 
 	if s.Ports != nil {
@@ -287,10 +279,6 @@ type ContainerSpec struct {
 	Image       string
 	// Run a custom init inside the container. If nil, use the daemon's configured settings.
 	Init *bool
-	// Labels are user-defined key-value metadata applied as Docker labels to each container in the service.
-	// Docker labels are immutable so changing them requires recreating the containers.
-	// Keys must not use the reserved "uncloud." prefix.
-	Labels map[string]string
 	// LogDriver overrides the default logging driver for the container. Each Docker daemon can have its own default.
 	LogDriver *LogDriver
 	// PidMode sets the PID namespace mode for the container. Currently only "" or "host" is supported.
@@ -345,9 +333,6 @@ func (s *ContainerSpec) Validate() error {
 	if _, err := reference.ParseDockerRef(s.Image); err != nil {
 		return fmt.Errorf("invalid image '%s': %w", s.Image, err)
 	}
-	if err := ValidateLabels(s.Labels); err != nil {
-		return fmt.Errorf("invalid container labels: %w", err)
-	}
 
 	for _, m := range s.VolumeMounts {
 		if err := m.Validate(); err != nil {
@@ -405,7 +390,6 @@ func (s *ContainerSpec) Clone() ContainerSpec {
 		hc.Test = slices.Clone(s.Healthcheck.Test)
 		spec.Healthcheck = &hc
 	}
-	spec.Labels = maps.Clone(s.Labels)
 	if s.LogDriver != nil {
 		logDriver := *s.LogDriver
 		if s.LogDriver.Options != nil {
@@ -444,24 +428,6 @@ func (s *ContainerSpec) Clone() ContainerSpec {
 	return spec
 }
 
-// ValidateLabels checks that label keys are non-empty, don't contain whitespace, and don't use the reserved Uncloud
-// prefixes.
-func ValidateLabels(labels map[string]string) error {
-	for k := range labels {
-		if strings.TrimSpace(k) == "" {
-			return fmt.Errorf("label key must not be empty")
-		}
-		if strings.ContainsFunc(k, unicode.IsSpace) {
-			return fmt.Errorf("label '%s' must not contain whitespace", k)
-		}
-		if strings.HasPrefix(k, LabelReservedPrefix) || strings.HasPrefix(k, LabelDaemonReservedPrefix) {
-			return fmt.Errorf("label '%s' cannot use the reserved prefix '%s' or '%s'",
-				k, LabelReservedPrefix, LabelDaemonReservedPrefix)
-		}
-	}
-	return nil
-}
-
 type EnvVars map[string]string
 
 // ToSlice converts the environment variables to a slice of strings in the format "key=value".
@@ -600,36 +566,6 @@ func (s *Service) FindContainer(nameOrID string) (MachineServiceContainer, error
 	return MachineServiceContainer{}, ErrNotFound
 }
 
-// Spec returns the service spec derived from its containers.
-// Containers may have different specs, for example, after a failed deployment. The result is the spec of the newest
-// running container, or the newest container if none are running. Replicas is set to the actual number of containers
-// for a replicated service.
-func (s *Service) Spec() ServiceSpec {
-	if len(s.Containers) == 0 {
-		return ServiceSpec{}
-	}
-
-	isRunning := func(c MachineServiceContainer) bool {
-		return c.Container.State.Running && !c.Container.State.Paused
-	}
-	selected := slices.MaxFunc(s.Containers, func(a, b MachineServiceContainer) int {
-		if aRunning, bRunning := isRunning(a), isRunning(b); aRunning != bRunning {
-			if aRunning {
-				return 1
-			}
-			return -1
-		}
-		return a.Container.CreatedTime().Compare(b.Container.CreatedTime())
-	})
-
-	spec := selected.Container.ServiceSpec.Clone()
-	// The replicas stored in a container spec go stale when the service is scaled without recreating the container.
-	if spec.Mode == ServiceModeReplicated {
-		spec.Replicas = uint(len(s.Containers))
-	}
-	return spec
-}
-
 // MachineIDs returns a list of unique machine IDs where the service containers are running.
 func (s *Service) MachineIDs() []string {
 	ids := mapset.NewSet[string]()

pkg/api/service_test.go

@@ -63,54 +63,6 @@ func TestServiceSpec_Validate_Name(t *testing.T) {
 	}
 }
 
-func TestServiceSpec_Validate_Labels(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name    string
-		labels  map[string]string
-		wantErr string
-	}{
-		{name: "nil labels"},
-		{name: "valid labels", labels: map[string]string{"com.example.team": "web", "tier": ""}},
-		{name: "prefix without dot", labels: map[string]string{"uncloudfoo": "bar"}},
-		{name: "whitespace in value", labels: map[string]string{"tier": "value with spaces"}},
-		{name: "empty key", labels: map[string]string{"": "bar"}, wantErr: "must not be empty"},
-		{name: "only whitespace in key", labels: map[string]string{" ": "bar"}, wantErr: "must not be empty"},
-		{name: "space in key", labels: map[string]string{"my label": "bar"}, wantErr: "must not contain whitespace"},
-		{name: "leading space in key", labels: map[string]string{" tier": "bar"}, wantErr: "must not contain whitespace"},
-		{name: "trailing space in key", labels: map[string]string{"tier ": "bar"}, wantErr: "must not contain whitespace"},
-		{name: "tab in key", labels: map[string]string{"my\tlabel": "bar"}, wantErr: "must not contain whitespace"},
-		{name: "newline in key", labels: map[string]string{"my\nlabel": "bar"}, wantErr: "must not contain whitespace"},
-		{name: "reserved prefix", labels: map[string]string{LabelManaged: ""}, wantErr: "reserved prefix"},
-		{name: "reserved daemon prefix", labels: map[string]string{"uncloudd.foo": "bar"}, wantErr: "reserved prefix"},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name+"/service", func(t *testing.T) {
-			t.Parallel()
-			spec := ServiceSpec{Container: ContainerSpec{Image: "nginx:latest"}, Labels: tt.labels}
-			err := spec.Validate()
-			if tt.wantErr != "" {
-				require.ErrorContains(t, err, "invalid service labels")
-				require.ErrorContains(t, err, tt.wantErr)
-			} else {
-				require.NoError(t, err)
-			}
-		})
-		t.Run(tt.name+"/container", func(t *testing.T) {
-			t.Parallel()
-			spec := ServiceSpec{Container: ContainerSpec{Image: "nginx:latest", Labels: tt.labels}}
-			err := spec.Validate()
-			if tt.wantErr != "" {
-				require.ErrorContains(t, err, "invalid container labels")
-				require.ErrorContains(t, err, tt.wantErr)
-			} else {
-				require.NoError(t, err)
-			}
-		})
-	}
-}
-
 func TestServiceSpec_Validate_CaddyAndPorts(t *testing.T) {
 	tests := []struct {
 		name    string
@@ -315,9 +267,8 @@ func TestContainerSpec_Clone(t *testing.T) {
 			"FOO": "bar",
 			"BAZ": "qux",
 		},
-		Image:  "nginx:latest",
-		Init:   new(true),
-		Labels: map[string]string{"com.example.team": "web"},
+		Image: "nginx:latest",
+		Init:  new(true),
 		LogDriver: &LogDriver{
 			Name: "json-file",
 			Options: map[string]string{
@@ -362,7 +313,6 @@ func TestContainerSpec_Clone(t *testing.T) {
 	original.Command[0] = stringModified
 	original.Entrypoint[0] = stringModified
 	original.Env["FOO"] = stringModified
-	original.Labels["com.example.team"] = stringModified
 	original.LogDriver.Options["max-size"] = stringModified
 	original.Volumes[0] = stringModified
 	original.VolumeMounts[0].ContainerPath = stringModified
@@ -378,7 +328,6 @@ func TestContainerSpec_Clone(t *testing.T) {
 	assert.Equal(t, "NET_ADMIN", cloned.CapAdd[0])
 	assert.Equal(t, "ALL", cloned.CapDrop[0])
 	assert.Equal(t, "sh", cloned.Command[0])
-	assert.Equal(t, "web", cloned.Labels["com.example.team"])
 	assert.Equal(t, "/bin/bash", cloned.Entrypoint[0])
 	assert.Equal(t, "bar", cloned.Env["FOO"])
 	assert.Equal(t, "qux", cloned.Env["BAZ"])
@@ -404,110 +353,3 @@ func TestContainerSpec_Clone(t *testing.T) {
 	assert.Equal(t, os.FileMode(0o644), *cloned.ConfigMounts[0].Mode, "Mode should be deep copied")
 	assert.Equal(t, "1", cloned.Sysctls["net.ipv4.ip_forward"])
 }
-
-func TestService_Spec(t *testing.T) {
-	t.Parallel()
-
-	newContainer := func(name, created string, running bool, mode string, replicas uint) MachineServiceContainer {
-		return MachineServiceContainer{Container: ServiceContainer{
-			Container: Container{InspectResponse: container.InspectResponse{
-				ContainerJSONBase: &container.ContainerJSONBase{
-					Created: created,
-					State:   &container.State{Running: running},
-				},
-			}},
-			ServiceSpec: ServiceSpec{
-				Labels:   map[string]string{"from": name},
-				Mode:     mode,
-				Replicas: replicas,
-			},
-		}}
-	}
-	const (
-		older = "2026-01-01T00:00:00Z"
-		newer = "2026-01-02T00:00:00Z"
-	)
-
-	t.Run("no containers", func(t *testing.T) {
-		t.Parallel()
-
-		svc := Service{HookContainers: []MachineServiceContainer{
-			newContainer("hook", newer, true, ServiceModeReplicated, 1),
-		}}
-
-		assert.Equal(t, ServiceSpec{}, svc.Spec())
-	})
-
-	t.Run("newest running container wins", func(t *testing.T) {
-		t.Parallel()
-
-		svc := Service{Containers: []MachineServiceContainer{
-			newContainer("old-running", older, true, ServiceModeReplicated, 1),
-			newContainer("new-running", newer, true, ServiceModeReplicated, 1),
-		}}
-
-		spec := svc.Spec()
-		assert.Equal(t, "new-running", spec.Labels["from"])
-	})
-
-	t.Run("running container wins over newer stopped one", func(t *testing.T) {
-		t.Parallel()
-
-		svc := Service{Containers: []MachineServiceContainer{
-			newContainer("new-stopped", newer, false, ServiceModeReplicated, 1),
-			newContainer("old-running", older, true, ServiceModeReplicated, 1),
-		}}
-
-		spec := svc.Spec()
-		assert.Equal(t, "old-running", spec.Labels["from"])
-	})
-
-	t.Run("newest container wins when none are running", func(t *testing.T) {
-		t.Parallel()
-
-		svc := Service{Containers: []MachineServiceContainer{
-			newContainer("old-stopped", older, false, ServiceModeReplicated, 1),
-			newContainer("new-stopped", newer, false, ServiceModeReplicated, 1),
-		}}
-
-		spec := svc.Spec()
-		assert.Equal(t, "new-stopped", spec.Labels["from"])
-	})
-
-	t.Run("replicas match the number of containers", func(t *testing.T) {
-		t.Parallel()
-
-		svc := Service{Containers: []MachineServiceContainer{
-			newContainer("a", older, true, ServiceModeReplicated, 5),
-			newContainer("b", newer, true, ServiceModeReplicated, 5),
-			newContainer("c", newer, false, ServiceModeReplicated, 5),
-		}}
-
-		spec := svc.Spec()
-		assert.EqualValues(t, 3, spec.Replicas)
-	})
-
-	t.Run("global service has no replicas", func(t *testing.T) {
-		t.Parallel()
-
-		svc := Service{Containers: []MachineServiceContainer{
-			newContainer("a", older, true, ServiceModeGlobal, 0),
-			newContainer("b", newer, true, ServiceModeGlobal, 0),
-		}}
-
-		spec := svc.Spec()
-		assert.Zero(t, spec.Replicas)
-	})
-
-	t.Run("result is independent of the container spec", func(t *testing.T) {
-		t.Parallel()
-
-		svc := Service{Containers: []MachineServiceContainer{
-			newContainer("a", older, true, ServiceModeReplicated, 1),
-		}}
-
-		spec := svc.Spec()
-		spec.Labels["from"] = "changed"
-		assert.Equal(t, "a", svc.Containers[0].Container.ServiceSpec.Labels["from"])
-	})
-}

pkg/client/compose/plan.go

@@ -55,7 +55,7 @@ func (p *Plan) Format() string {
 
 // formatSummary counts all operations across the plan and renders the summary footer.
 func (p *Plan) formatSummary() string {
-	var createCount, startFirstCount, stopFirstCount, updateCount, removeCount int
+	var createCount, startFirstCount, stopFirstCount, removeCount int
 	machines := make(map[string]struct{})
 
 	for _, op := range p.Volumes {
@@ -76,15 +76,12 @@ func (p *Plan) formatSummary() string {
 				} else {
 					startFirstCount++
 				}
-			case *operation.UpdateContainerOperation:
-				machines[o.MachineID] = struct{}{}
-				updateCount++
 			case *operation.RemoveContainerOperation:
 				machines[o.MachineID] = struct{}{}
 				removeCount++
 			case *operation.StopContainerOperation:
-				// Stop operations aren't counted because a later operation in the plan removes the stopped container.
 				machines[o.MachineID] = struct{}{}
+				removeCount++
 			}
 		}
 	}
@@ -102,10 +99,6 @@ func (p *Plan) formatSummary() string {
 		parts = append(parts,
 			tui.BoldYellow.Render(strconv.Itoa(stopFirstCount))+" "+tui.Yellow.Render("replace (stop-first)"))
 	}
-	if updateCount > 0 {
-		parts = append(parts,
-			tui.BoldYellow.Render(strconv.Itoa(updateCount))+" "+tui.Yellow.Render("update (in place)"))
-	}
 	if removeCount > 0 {
 		parts = append(parts,
 			tui.BoldRed.Render(strconv.Itoa(removeCount))+" "+tui.Red.Render("remove"))

pkg/client/compose/plan_test.go

@@ -1,47 +0,0 @@
-package compose
-
-import (
-	"testing"
-
-	"github.com/charmbracelet/x/ansi"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/psviderski/uncloud/pkg/client/deploy"
-	"github.com/psviderski/uncloud/pkg/client/operation"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestPlan_FormatSummary(t *testing.T) {
-	t.Parallel()
-
-	web := &deploy.ServicePlan{}
-	web.Operations = []operation.Operation{
-		&operation.UpdateContainerOperation{MachineID: "m-1"},
-		&operation.RemoveContainerOperation{MachineID: "m-2"},
-	}
-	db := &deploy.ServicePlan{}
-	db.Operations = []operation.Operation{
-		&operation.UpdateContainerOperation{MachineID: "m-2"},
-	}
-	plan := &Plan{
-		Volumes:  []*operation.CreateVolumeOperation{{MachineID: "m-3"}},
-		Services: []*deploy.ServicePlan{web, db},
-	}
-
-	assert.Equal(t, "1 create · 2 update (in place) · 1 remove · across 3 machines", ansi.Strip(plan.formatSummary()))
-}
-
-func TestPlan_FormatSummary_StopOperationsNotCounted(t *testing.T) {
-	t.Parallel()
-
-	svc := &deploy.ServicePlan{}
-	svc.Operations = []operation.Operation{
-		&operation.StopContainerOperation{MachineID: "m-1"},
-		&operation.StopContainerOperation{MachineID: "m-1"},
-		&operation.ReplaceContainerOperation{MachineID: "m-1", Order: api.UpdateOrderStopFirst},
-		&operation.RemoveContainerOperation{MachineID: "m-1"},
-	}
-	plan := &Plan{Services: []*deploy.ServicePlan{svc}}
-
-	// Stop operations aren't counted because a later operation in the plan removes the stopped container.
-	assert.Equal(t, "1 replace (stop-first) · 1 remove · across 1 machine", ansi.Strip(plan.formatSummary()))
-}

pkg/client/compose/project_test.go

@@ -344,6 +344,20 @@ configs:
 			warnCount:    1,
 			warnContains: []string{"container_name"},
 		},
+		{
+			name: "deploy labels",
+			composeYAML: `services:
+  app:
+    image: myapp:latest
+    deploy:
+      mode: replicated
+      labels:
+        - foo
+      replicas: 2
+`,
+			warnCount:    1,
+			warnContains: []string{"deploy labels"},
+		},
 		{
 			name: "deploy restart_policy",
 			composeYAML: `services:

pkg/client/compose/service.go

@@ -66,10 +66,6 @@ func ServiceSpecFromCompose(project *types.Project, serviceName string) (api.Ser
 		Mode: api.ServiceModeReplicated,
 	}
 
-	if labels := mergeLabels(service.Labels, service.CustomLabels); len(labels) > 0 {
-		spec.Container.Labels = labels
-	}
-
 	// Map x-caddy extension to spec.Caddy if specified.
 	if caddy, ok := service.Extensions[CaddyExtensionKey].(Caddy); ok && caddy.Config != "" {
 		spec.Caddy = &api.CaddySpec{
@@ -128,10 +124,6 @@ func ServiceSpecFromCompose(project *types.Project, serviceName string) (api.Ser
 			d := time.Duration(cfg.Monitor)
 			spec.UpdateConfig.MonitorPeriod = &d
 		}
-
-		if len(service.Deploy.Labels) > 0 {
-			spec.Labels = maps.Clone(service.Deploy.Labels)
-		}
 	}
 
 	// TODO: can service.tmpfs be handled as tmpfs volume mounts as well?
@@ -488,6 +480,9 @@ func validateServicesFeatures(project *types.Project) []error {
 		if service.DNSSearch != nil {
 			errs = append(errs, err(service.Name, "dns_search"))
 		}
+		if service.Labels != nil {
+			errs = append(errs, err(service.Name, "labels"))
+		}
 		if service.Links != nil {
 			errs = append(errs, err(service.Name, "links"))
 		}
@@ -522,6 +517,9 @@ func validateServicesFeatures(project *types.Project) []error {
 			if service.Deploy.RollbackConfig != nil {
 				errs = append(errs, err(service.Name, "deploy rollback_config"))
 			}
+			if len(service.Deploy.Labels) != 0 {
+				errs = append(errs, err(service.Name, "deploy labels"))
+			}
 		}
 		// we only allow the 'default' network, nothing else.
 		if x := service.Networks; x != nil {

pkg/client/compose/service_test.go

@@ -875,81 +875,6 @@ services:
 	}
 }
 
-func TestServiceSpecFromCompose_Labels(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name                    string
-		composeYAML             string
-		expectedContainerLabels map[string]string
-		expectedServiceLabels   map[string]string
-	}{
-		{
-			name: "no labels",
-			composeYAML: `
-services:
-  web:
-    image: nginx
-`,
-		},
-		{
-			name: "container labels as list",
-			composeYAML: `
-services:
-  web:
-    image: nginx
-    labels:
-      - com.example.team=web
-      - com.example.empty
-`,
-			expectedContainerLabels: map[string]string{
-				"com.example.team":  "web",
-				"com.example.empty": "",
-			},
-		},
-		{
-			name: "container and service labels as maps",
-			composeYAML: `
-services:
-  web:
-    image: nginx
-    labels:
-      com.example.team: web
-    deploy:
-      labels:
-        tier: frontend
-`,
-			expectedContainerLabels: map[string]string{"com.example.team": "web"},
-			expectedServiceLabels:   map[string]string{"tier": "frontend"},
-		},
-		{
-			name: "service labels only",
-			composeYAML: `
-services:
-  web:
-    image: nginx
-    deploy:
-      labels:
-        - tier=frontend
-`,
-			expectedServiceLabels: map[string]string{"tier": "frontend"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			project, err := LoadProjectFromContent(context.Background(), tt.composeYAML)
-			require.NoError(t, err)
-
-			spec, err := ServiceSpecFromCompose(project, "web")
-			require.NoError(t, err)
-
-			assert.Equal(t, tt.expectedContainerLabels, spec.Container.Labels)
-			assert.Equal(t, tt.expectedServiceLabels, spec.Labels)
-		})
-	}
-}
-
 func TestServiceSpecFromCompose_UpdateConfig(t *testing.T) {
 	t.Parallel()
 

pkg/client/container.go

@@ -343,39 +343,6 @@ func (cli *Client) RemoveContainer(
 	return nil
 }
 
-// UpdateContainer updates the requested properties of the container within the service in place without recreating it.
-func (cli *Client) UpdateContainer(
-	ctx context.Context, serviceNameOrID, containerNameOrID string, opts api.UpdateContainerOptions,
-) error {
-	op, err := cli.resolveContainerOperation(ctx, serviceNameOrID, containerNameOrID)
-	if err != nil {
-		return err
-	}
-
-	req := &pb.UpdateServiceContainerRequest{
-		Id:                op.containerID,
-		Cpu:               opts.CPU,
-		Memory:            opts.Memory,
-		MemoryReservation: opts.MemoryReservation,
-	}
-	if opts.ServiceLabels != nil {
-		req.ServiceLabels = &pb.Labels{Labels: *opts.ServiceLabels}
-	}
-
-	pw := progress.ContextWriter(op.ctx)
-	pw.Event(progress.NewEvent(op.eventID, progress.Working, "Updating"))
-	if _, err = cli.Docker.GRPCClient.UpdateServiceContainer(op.ctx, req); err != nil {
-		pw.Event(progress.ErrorEvent(op.eventID))
-		if status.Code(err) == codes.NotFound {
-			return api.ErrNotFound
-		}
-		return err
-	}
-	pw.Event(progress.NewEvent(op.eventID, progress.Done, "Updated"))
-
-	return nil
-}
-
 // ExecContainer executes a command in a container within the service.
 // If containerNameOrID is empty, the first container in the service will be used.
 func (cli *Client) ExecContainer(

pkg/client/deploy/container.go

@@ -1,7 +1,7 @@
 package deploy
 
 import (
-	"maps"
+	"reflect"
 	"sort"
 
 	"github.com/google/go-cmp/cmp"
@@ -12,8 +12,7 @@ import (
 type ContainerSpecStatus string
 
 const (
-	ContainerUpToDate ContainerSpecStatus = "up-to-date"
-	// ContainerNeedsUpdate means the container can be updated in place without recreating it.
+	ContainerUpToDate      ContainerSpecStatus = "up-to-date"
 	ContainerNeedsUpdate   ContainerSpecStatus = "needs-update"
 	ContainerNeedsRecreate ContainerSpecStatus = "needs-recreate"
 )
@@ -84,7 +83,15 @@ func EvalContainerSpecChange(current api.ServiceSpec, new api.ServiceSpec) Conta
 		}
 	}
 
-	if current.Container.Resources.ValidateUpdateInPlace(newResources) != nil {
+	// Device reservations and mappings are immutable, so we'll need to recreate if any have changed
+	if !reflect.DeepEqual(current.Container.Resources.DeviceReservations, newResources.DeviceReservations) {
+		return ContainerNeedsRecreate
+	}
+	if !reflect.DeepEqual(current.Container.Resources.Devices, newResources.Devices) {
+		return ContainerNeedsRecreate
+	}
+	// Ulimits are immutable, so we'll need to recreate if any have changed.
+	if !reflect.DeepEqual(current.Container.Resources.Ulimits, newResources.Ulimits) {
 		return ContainerNeedsRecreate
 	}
 
@@ -93,10 +100,8 @@ func EvalContainerSpecChange(current api.ServiceSpec, new api.ServiceSpec) Conta
 		return ContainerNeedsRecreate
 	}
 
-	// CPU and memory limits are updated on the running container. Service labels are only stored in the service spec
-	// and not applied to Docker containers.
-	if !current.Container.Resources.Equals(newResources) ||
-		!cmp.Equal(current.Labels, new.Labels, cmpopts.EquateEmpty()) {
+	// Remaining resources are mutable.
+	if !reflect.DeepEqual(current.Container.Resources, newResources) {
 		return ContainerNeedsUpdate
 	}
 
@@ -114,53 +119,3 @@ func sortConfigs(configs []api.ConfigSpec) {
 		return configs[i].Name < configs[j].Name
 	})
 }
-
-// EvalContainerChange evaluates whether the running container matches the new spec, can be updated in place to
-// match it, or needs to be recreated. Unlike EvalContainerSpecChange, it also compares the new spec with the CPU and
-// memory limits that Docker applies to the container, so the container is updated when they drifted from its spec.
-func EvalContainerChange(current api.ServiceContainer, new api.ServiceSpec) ContainerSpecStatus {
-	status := EvalContainerSpecChange(current.ServiceSpec, new)
-	if status == ContainerNeedsRecreate {
-		return status
-	}
-
-	applied := current.AppliedResources()
-	newResources := new.Container.Resources
-	if applied.ValidateUpdateInPlace(newResources) != nil {
-		return ContainerNeedsRecreate
-	}
-	// Only CPU and memory limits can differ after the in-place update check above.
-	if !applied.Equals(newResources) {
-		return ContainerNeedsUpdate
-	}
-	return status
-}
-
-// ContainerUpdateOptions returns the container properties that can be updated in place and differ between the new
-// spec and either the container spec or the limits Docker applies to the container. It should only be used when
-// EvalContainerChange returns ContainerNeedsUpdate.
-func ContainerUpdateOptions(current api.ServiceContainer, new api.ServiceSpec) api.UpdateContainerOptions {
-	var opts api.UpdateContainerOptions
-
-	stored, applied := current.ServiceSpec.Container.Resources, current.AppliedResources()
-	res := new.Container.Resources
-	if res.CPU != stored.CPU || res.CPU != applied.CPU {
-		opts.CPU = &res.CPU
-	}
-	if res.Memory != stored.Memory || res.Memory != applied.Memory {
-		opts.Memory = &res.Memory
-	}
-	if res.MemoryReservation != stored.MemoryReservation || res.MemoryReservation != applied.MemoryReservation {
-		opts.MemoryReservation = &res.MemoryReservation
-	}
-
-	if !cmp.Equal(current.ServiceSpec.Labels, new.Labels, cmpopts.EquateEmpty()) {
-		labels := maps.Clone(new.Labels)
-		if labels == nil {
-			labels = map[string]string{}
-		}
-		opts.ServiceLabels = &labels
-	}
-
-	return opts
-}

pkg/client/deploy/container_test.go

@@ -86,223 +86,6 @@ func TestEvalContainerSpecChange_ContainerTty(t *testing.T) {
 	assert.Equal(t, ContainerNeedsRecreate, EvalContainerSpecChange(newSpec, currentSpec))
 }
 
-func TestEvalContainerSpecChange_ContainerLabels(t *testing.T) {
-	t.Parallel()
-
-	currentSpec := api.ServiceSpec{
-		Container: api.ContainerSpec{
-			Image: "nginx:latest",
-		},
-	}
-	newSpec := api.ServiceSpec{
-		Container: api.ContainerSpec{
-			Image:  "nginx:latest",
-			Labels: map[string]string{"com.example.team": "web"},
-		},
-	}
-	emptySpec := api.ServiceSpec{
-		Container: api.ContainerSpec{
-			Image:  "nginx:latest",
-			Labels: map[string]string{},
-		},
-	}
-
-	assert.Equal(t, ContainerNeedsRecreate, EvalContainerSpecChange(currentSpec, newSpec))
-	assert.Equal(t, ContainerNeedsRecreate, EvalContainerSpecChange(newSpec, currentSpec))
-	assert.Equal(t, ContainerUpToDate, EvalContainerSpecChange(newSpec, newSpec))
-	assert.Equal(t, ContainerUpToDate, EvalContainerSpecChange(currentSpec, emptySpec))
-}
-
-func TestEvalContainerSpecChange_ServiceLabels(t *testing.T) {
-	t.Parallel()
-
-	currentSpec := api.ServiceSpec{
-		Container: api.ContainerSpec{
-			Image: "nginx:latest",
-		},
-	}
-	newSpec := api.ServiceSpec{
-		Container: api.ContainerSpec{
-			Image: "nginx:latest",
-		},
-		Labels: map[string]string{"tier": "frontend"},
-	}
-	emptySpec := api.ServiceSpec{
-		Container: api.ContainerSpec{
-			Image: "nginx:latest",
-		},
-		Labels: map[string]string{},
-	}
-
-	assert.Equal(t, ContainerNeedsUpdate, EvalContainerSpecChange(currentSpec, newSpec))
-	assert.Equal(t, ContainerNeedsUpdate, EvalContainerSpecChange(newSpec, currentSpec))
-	assert.Equal(t, ContainerUpToDate, EvalContainerSpecChange(newSpec, newSpec))
-	assert.Equal(t, ContainerUpToDate, EvalContainerSpecChange(currentSpec, emptySpec))
-
-	// Changes that require recreating the container take precedence over the in-place update.
-	newSpecWithImage := newSpec.Clone()
-	newSpecWithImage.Container.Image = "nginx:alpine"
-	assert.Equal(t, ContainerNeedsRecreate, EvalContainerSpecChange(currentSpec, newSpecWithImage))
-}
-
-func TestEvalContainerChange(t *testing.T) {
-	t.Parallel()
-
-	spec := api.ServiceSpec{
-		Container: api.ContainerSpec{
-			Image:     "nginx:latest",
-			Resources: api.ContainerResources{CPU: api.Core, Memory: 256 * 1024 * 1024},
-		},
-	}
-	appliedSpec := container.Resources{NanoCPUs: api.Core, Memory: 256 * 1024 * 1024}
-
-	tests := []struct {
-		name       string
-		hostConfig *container.HostConfig
-		change     func(spec *api.ServiceSpec)
-		expected   ContainerSpecStatus
-	}{
-		{
-			name:       "applied limits match spec",
-			hostConfig: &container.HostConfig{Resources: appliedSpec},
-			change:     func(*api.ServiceSpec) {},
-			expected:   ContainerUpToDate,
-		},
-		{
-			name:     "unknown host config falls back to spec limits",
-			change:   func(*api.ServiceSpec) {},
-			expected: ContainerUpToDate,
-		},
-		{
-			name:       "applied memory limit drifted from spec",
-			hostConfig: &container.HostConfig{Resources: container.Resources{NanoCPUs: api.Core, Memory: 512 * 1024 * 1024}},
-			change:     func(*api.ServiceSpec) {},
-			expected:   ContainerNeedsUpdate,
-		},
-		{
-			name:       "applied limits already match new spec but stored spec doesn't",
-			hostConfig: &container.HostConfig{Resources: container.Resources{NanoCPUs: api.Core, Memory: 512 * 1024 * 1024}},
-			change:     func(spec *api.ServiceSpec) { spec.Container.Resources.Memory = 512 * 1024 * 1024 },
-			expected:   ContainerNeedsUpdate,
-		},
-		{
-			name: "applied limit not in spec can't be removed in place",
-			hostConfig: &container.HostConfig{Resources: container.Resources{
-				NanoCPUs: api.Core, Memory: 256 * 1024 * 1024, MemoryReservation: 128 * 1024 * 1024,
-			}},
-			change:   func(*api.ServiceSpec) {},
-			expected: ContainerNeedsRecreate,
-		},
-		{
-			name:       "spec change that requires recreating",
-			hostConfig: &container.HostConfig{Resources: appliedSpec},
-			change:     func(spec *api.ServiceSpec) { spec.Container.Image = "nginx:alpine" },
-			expected:   ContainerNeedsRecreate,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			newSpec := spec.Clone()
-			tt.change(&newSpec)
-			assert.Equal(t, tt.expected, EvalContainerChange(serviceContainer(spec, tt.hostConfig), newSpec))
-		})
-	}
-}
-
-func TestContainerUpdateOptions(t *testing.T) {
-	t.Parallel()
-
-	current := api.ServiceSpec{
-		Container: api.ContainerSpec{
-			Image:     "nginx:latest",
-			Resources: api.ContainerResources{CPU: api.Core, Memory: 256 * 1024 * 1024},
-		},
-		Labels: map[string]string{"tier": "frontend"},
-	}
-	applied := &container.HostConfig{Resources: container.Resources{NanoCPUs: api.Core, Memory: 256 * 1024 * 1024}}
-
-	tests := []struct {
-		name       string
-		hostConfig *container.HostConfig
-		change     func(spec *api.ServiceSpec)
-		expected   api.UpdateContainerOptions
-	}{
-		{
-			name:       "no changes",
-			hostConfig: applied,
-			change:     func(*api.ServiceSpec) {},
-		},
-		{
-			name:       "CPU only",
-			hostConfig: applied,
-			change:     func(spec *api.ServiceSpec) { spec.Container.Resources.CPU = 2 * api.Core },
-			expected:   api.UpdateContainerOptions{CPU: new(int64(2 * api.Core))},
-		},
-		{
-			name:       "memory and reservation",
-			hostConfig: applied,
-			change: func(spec *api.ServiceSpec) {
-				spec.Container.Resources.Memory = 512 * 1024 * 1024
-				spec.Container.Resources.MemoryReservation = 128 * 1024 * 1024
-			},
-			expected: api.UpdateContainerOptions{
-				Memory:            new(int64(512 * 1024 * 1024)),
-				MemoryReservation: new(int64(128 * 1024 * 1024)),
-			},
-		},
-		{
-			name: "applied memory limit drifted from spec",
-			hostConfig: &container.HostConfig{Resources: container.Resources{
-				NanoCPUs: api.Core, Memory: 512 * 1024 * 1024,
-			}},
-			change:   func(*api.ServiceSpec) {},
-			expected: api.UpdateContainerOptions{Memory: new(int64(256 * 1024 * 1024))},
-		},
-		{
-			name: "applied memory limit already matches new spec",
-			hostConfig: &container.HostConfig{Resources: container.Resources{
-				NanoCPUs: api.Core, Memory: 512 * 1024 * 1024,
-			}},
-			change:   func(spec *api.ServiceSpec) { spec.Container.Resources.Memory = 512 * 1024 * 1024 },
-			expected: api.UpdateContainerOptions{Memory: new(int64(512 * 1024 * 1024))},
-		},
-		{
-			name:       "change service labels",
-			hostConfig: applied,
-			change:     func(spec *api.ServiceSpec) { spec.Labels = map[string]string{"tier": "backend"} },
-			expected:   api.UpdateContainerOptions{ServiceLabels: &map[string]string{"tier": "backend"}},
-		},
-		{
-			name:       "remove all service labels",
-			hostConfig: applied,
-			change:     func(spec *api.ServiceSpec) { spec.Labels = nil },
-			expected:   api.UpdateContainerOptions{ServiceLabels: &map[string]string{}},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			newSpec := current.Clone()
-			tt.change(&newSpec)
-			assert.Equal(t, tt.expected, ContainerUpdateOptions(serviceContainer(current, tt.hostConfig), newSpec))
-		})
-	}
-}
-
-func serviceContainer(spec api.ServiceSpec, hostConfig *container.HostConfig) api.ServiceContainer {
-	return api.ServiceContainer{
-		Container: api.Container{InspectResponse: container.InspectResponse{
-			ContainerJSONBase: &container.ContainerJSONBase{HostConfig: hostConfig},
-		}},
-		ServiceSpec: spec,
-	}
-}
-
 func TestEvalContainerSpecChange_ContainerResources(t *testing.T) {
 	t.Parallel()
 
@@ -344,7 +127,7 @@ func TestEvalContainerSpecChange_ContainerResources(t *testing.T) {
 				CPU: 1000000000,
 			},
 			new:  api.ContainerResources{},
-			want: ContainerNeedsRecreate,
+			want: ContainerNeedsUpdate,
 		},
 
 		// Memory
@@ -406,33 +189,19 @@ func TestEvalContainerSpecChange_ContainerResources(t *testing.T) {
 			name:    "unset memory",
 			current: api.ContainerResources{Memory: 100 * 1024 * 1024, MemoryReservation: 50 * 1024 * 1024},
 			new:     api.ContainerResources{MemoryReservation: 50 * 1024 * 1024},
-			want:    ContainerNeedsRecreate,
+			want:    ContainerNeedsUpdate,
 		},
 		{
 			name:    "unset reservation",
 			current: api.ContainerResources{Memory: 100 * 1024 * 1024, MemoryReservation: 50 * 1024 * 1024},
 			new:     api.ContainerResources{Memory: 100 * 1024 * 1024},
-			want:    ContainerNeedsRecreate,
+			want:    ContainerNeedsUpdate,
 		},
 		{
 			name:    "unset memory and reservation",
 			current: api.ContainerResources{Memory: 100 * 1024 * 1024, MemoryReservation: 50 * 1024 * 1024},
 			new:     api.ContainerResources{},
-			want:    ContainerNeedsRecreate,
-		},
-
-		// Shared memory
-		{
-			name:    "change shared memory",
-			current: api.ContainerResources{SharedMemory: 64 * 1024 * 1024},
-			new:     api.ContainerResources{SharedMemory: 128 * 1024 * 1024},
-			want:    ContainerNeedsRecreate,
-		},
-		{
-			name:    "change memory and shared memory",
-			current: api.ContainerResources{Memory: 100 * 1024 * 1024},
-			new:     api.ContainerResources{Memory: 200 * 1024 * 1024, SharedMemory: 64 * 1024 * 1024},
-			want:    ContainerNeedsRecreate,
+			want:    ContainerNeedsUpdate,
 		},
 
 		// Memory and CPU

pkg/client/deploy/deploy.go

@@ -1,15 +1,11 @@
 package deploy
 
 import (
-	"cmp"
 	"context"
 	"errors"
 	"fmt"
-	"maps"
-	"slices"
 	"strconv"
 	"strings"
-	"unicode"
 
 	"charm.land/lipgloss/v2"
 	"charm.land/lipgloss/v2/table"
@@ -54,31 +50,25 @@ type ServicePlan struct {
 // Format renders the service plan as a styled block with a spec diff and nested container operations.
 func (sp *ServicePlan) Format() string {
 	// Determine service-level operation type and extract the old spec from container operations.
-	// Containers may have different specs after a failed deployment. The first replaced container determines the old
-	// spec for the diff because a container updated in place already has the new image. Otherwise, fallback to the
-	// first updated container and then the first removed one.
+	// Assume replace operations precede remove operations (rolling strategy) so the first replace operation
+	// (if exists) determines the old spec for the diff. Otherwise, fallback to the first remove operation.
 	var hasRun, hasRemove bool
-	var replacedSpec, updatedSpec, removedSpec *api.ServiceSpec
+	var oldSpec *api.ServiceSpec
 	for _, op := range sp.Operations {
 		switch o := op.(type) {
 		case *operation.RunContainerOperation:
 			hasRun = true
 		case *operation.ReplaceContainerOperation:
-			if replacedSpec == nil {
-				replacedSpec = &o.OldContainer.ServiceSpec
-			}
-		case *operation.UpdateContainerOperation:
-			if updatedSpec == nil {
-				updatedSpec = &o.Container.ServiceSpec
+			if oldSpec == nil {
+				oldSpec = &o.OldContainer.ServiceSpec
 			}
 		case *operation.RemoveContainerOperation:
 			hasRemove = true
-			if removedSpec == nil {
-				removedSpec = &o.Container.ServiceSpec
+			if oldSpec == nil {
+				oldSpec = &o.Container.ServiceSpec
 			}
 		}
 	}
-	oldSpec := cmp.Or(replacedSpec, updatedSpec, removedSpec)
 
 	// Service line modifier and verb.
 	var modifier, verb string
@@ -101,7 +91,7 @@ func (sp *ServicePlan) Format() string {
 	out.WriteString("\n")
 
 	// Build spec diff table: columns are [modifier, attribute, value or change].
-	// TODO: print diff for all changed attributes, not just image, replicas, and labels.
+	// TODO: print diff for all changed attributes, not just image and replicas.
 	//  Consider reusing the logic in EvalContainerSpecChange to return a structured diff.
 	specTable := table.New().
 		Border(lipgloss.Border{}).
@@ -151,23 +141,17 @@ func (sp *ServicePlan) Format() string {
 		}
 	}
 
-	specDiff := specTable.String() + "\n"
-
-	// Render labels as nested blocks outside the table to not widen its attribute column. An existing service without
-	// an old spec only has new containers added to up-to-date ones so its labels didn't change.
-	if sp.IsNewService || oldSpec != nil {
-		var oldLabels, oldContainerLabels map[string]string
-		if oldSpec != nil {
-			oldLabels, oldContainerLabels = oldSpec.Labels, oldSpec.Container.Labels
-		}
-		specDiff += formatLabelsDiff("labels:", oldLabels, sp.Spec.Labels, sp.IsNewService)
-		specDiff += formatLabelsDiff("container labels:", oldContainerLabels, sp.Spec.Container.Labels, sp.IsNewService)
-	}
-
+	// Stack "  │ " tree prefixes vertically, then join horizontally with the table.
+	tableStr := specTable.String()
 	treePrefix := tui.Faint.Render("  │ ")
-	for line := range strings.Lines(specDiff) {
-		out.WriteString(treePrefix + line)
+	treeColRows := make([]string, specTable.GetData().Rows())
+	for i := range treeColRows {
+		treeColRows[i] = treePrefix
 	}
+	treeCol := lipgloss.JoinVertical(lipgloss.Left, treeColRows...)
+
+	out.WriteString(lipgloss.JoinHorizontal(lipgloss.Top, treeCol, tableStr))
+	out.WriteString("\n")
 
 	// Blank separator line before container operations.
 	out.WriteString(tui.Faint.Render("  │"))
@@ -189,7 +173,7 @@ func (sp *ServicePlan) Format() string {
 
 // FormatSummary counts operations in the service plan and renders a styled summary line.
 func (sp *ServicePlan) FormatSummary() string {
-	var createCount, startFirstCount, stopFirstCount, updateCount, removeCount int
+	var createCount, startFirstCount, stopFirstCount, removeCount int
 	machines := make(map[string]struct{})
 
 	for _, op := range sp.Operations {
@@ -204,15 +188,12 @@ func (sp *ServicePlan) FormatSummary() string {
 			} else {
 				startFirstCount++
 			}
-		case *operation.UpdateContainerOperation:
-			machines[o.MachineID] = struct{}{}
-			updateCount++
 		case *operation.RemoveContainerOperation:
 			machines[o.MachineID] = struct{}{}
 			removeCount++
 		case *operation.StopContainerOperation:
-			// Stop operations aren't counted because a later operation in the plan removes the stopped container.
 			machines[o.MachineID] = struct{}{}
+			removeCount++
 		}
 	}
 
@@ -229,10 +210,6 @@ func (sp *ServicePlan) FormatSummary() string {
 		parts = append(parts,
 			tui.BoldYellow.Render(strconv.Itoa(stopFirstCount))+" "+tui.Yellow.Render("replace (stop-first)"))
 	}
-	if updateCount > 0 {
-		parts = append(parts,
-			tui.BoldYellow.Render(strconv.Itoa(updateCount))+" "+tui.Yellow.Render("update (in place)"))
-	}
 	if removeCount > 0 {
 		parts = append(parts,
 			tui.BoldRed.Render(strconv.Itoa(removeCount))+" "+tui.Red.Render("remove"))
@@ -288,68 +265,6 @@ func formatImageDiff(oldImage, newImage string) string {
 		tui.FormatImage(newImage, tui.Green)
 }
 
-// formatLabelsDiff renders a block with the attribute name followed by a nested line for each added, changed, or
-// removed label, sorted by key. It returns an empty string if the labels are the same.
-func formatLabelsDiff(attribute string, oldLabels, newLabels map[string]string, isNewService bool) string {
-	keys := slices.Concat(slices.Collect(maps.Keys(oldLabels)), slices.Collect(maps.Keys(newLabels)))
-	slices.Sort(keys)
-
-	var lines strings.Builder
-	for _, key := range slices.Compact(keys) {
-		oldValue, inOld := oldLabels[key]
-		newValue, inNew := newLabels[key]
-
-		var mod, diff string
-		switch {
-		case !inOld:
-			mod = tui.Green.Render("+")
-			// All attributes of a new service are new so only the green color marks them, without a modifier.
-			if isNewService {
-				mod = " "
-			}
-			diff = tui.Green.Render(key+tui.Faint.Render("=")) + tui.Green.Render(formatLabelValue(newValue))
-		case !inNew:
-			mod = tui.Red.Render("-")
-			diff = tui.Red.Render(key+tui.Faint.Render("=")) + tui.Red.Render(formatLabelValue(oldValue))
-		case oldValue != newValue:
-			mod = tui.Yellow.Render("~")
-			diff = key +
-				tui.Faint.Render("=") +
-				tui.Red.Render(formatLabelValue(oldValue)) + " " +
-				tui.Faint.Render("→") + " " +
-				tui.Green.Render(formatLabelValue(newValue))
-		default:
-			continue
-		}
-
-		lines.WriteString("    " + mod + " " + diff + "\n")
-	}
-	if lines.Len() == 0 {
-		return ""
-	}
-
-	blockMod := tui.Yellow.Render("~")
-	switch {
-	case isNewService:
-		blockMod = " "
-	case len(oldLabels) == 0:
-		blockMod = tui.Green.Render("+")
-	case len(newLabels) == 0:
-		blockMod = tui.Red.Render("-")
-	}
-
-	return blockMod + " " + tui.Faint.Render(attribute) + "\n" + lines.String()
-}
-
-// formatLabelValue returns the label value on a single line. It quotes and escapes empty values and values with
-// non-printable characters such as newlines so that they're visible in the diff. Other values are returned as is.
-func formatLabelValue(value string) string {
-	if value == "" || strings.ContainsFunc(value, func(r rune) bool { return !unicode.IsPrint(r) }) {
-		return strconv.Quote(value)
-	}
-	return value
-}
-
 // NewDeployment creates a new deployment for the given service specification.
 // If strategy is nil, a default RollingStrategy will be used.
 func NewDeployment(cli Client, spec api.ServiceSpec, strategy Strategy) *Deployment {

pkg/client/deploy/deploy_test.go

@@ -1,285 +0,0 @@
-package deploy
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/charmbracelet/x/ansi"
-	"github.com/docker/docker/api/types/container"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/psviderski/uncloud/pkg/client/operation"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestServicePlan_FormatSummary(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name     string
-		ops      []operation.Operation
-		expected string
-	}{
-		{
-			name: "in-place updates only",
-			ops: []operation.Operation{
-				&operation.UpdateContainerOperation{MachineID: "m-1"},
-				&operation.UpdateContainerOperation{MachineID: "m-2"},
-			},
-			expected: "2 update (in place) · across 2 machines",
-		},
-		{
-			name: "stop operations not counted as they are followed by remove",
-			ops: []operation.Operation{
-				&operation.StopContainerOperation{MachineID: "m-1"},
-				&operation.StopContainerOperation{MachineID: "m-1"},
-				&operation.ReplaceContainerOperation{MachineID: "m-1", Order: api.UpdateOrderStopFirst},
-				&operation.RemoveContainerOperation{MachineID: "m-1"},
-			},
-			expected: "1 replace (stop-first) · 1 remove · across 1 machine",
-		},
-		{
-			name: "all operation types",
-			ops: []operation.Operation{
-				&operation.RunContainerOperation{MachineID: "m-1"},
-				&operation.ReplaceContainerOperation{MachineID: "m-1", Order: api.UpdateOrderStartFirst},
-				&operation.ReplaceContainerOperation{MachineID: "m-2", Order: api.UpdateOrderStopFirst},
-				&operation.UpdateContainerOperation{MachineID: "m-2"},
-				&operation.RemoveContainerOperation{MachineID: "m-3"},
-			},
-			expected: "1 create · 1 replace (start-first) · 1 replace (stop-first) · 1 update (in place) · 1 remove · " +
-				"across 3 machines",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			plan := ServicePlan{}
-			plan.Operations = tt.ops
-			assert.Equal(t, tt.expected, ansi.Strip(plan.FormatSummary()))
-		})
-	}
-}
-
-func TestServicePlan_Format(t *testing.T) {
-	t.Parallel()
-
-	newContainer := func(spec api.ServiceSpec) api.ServiceContainer {
-		return api.ServiceContainer{
-			Container: api.Container{InspectResponse: container.InspectResponse{
-				ContainerJSONBase: &container.ContainerJSONBase{ID: "0f6df6593e1b0123456789abcdef"},
-			}},
-			ServiceSpec: spec,
-		}
-	}
-	spec := func(image string, labels, containerLabels map[string]string) api.ServiceSpec {
-		return api.ServiceSpec{
-			Name:      "web",
-			Mode:      api.ServiceModeReplicated,
-			Replicas:  1,
-			Labels:    labels,
-			Container: api.ContainerSpec{Image: image, Labels: containerLabels},
-		}
-	}
-
-	tests := []struct {
-		name         string
-		isNewService bool
-		spec         api.ServiceSpec
-		ops          func(spec api.ServiceSpec) []operation.Operation
-		expected     []string
-	}{
-		{
-			name: "service labels added, changed, and removed in place",
-			spec: spec("nginx:1.25", map[string]string{"env": "prod", "team": "platform", "same": "1"}, nil),
-			ops: func(api.ServiceSpec) []operation.Operation {
-				return []operation.Operation{&operation.UpdateContainerOperation{
-					MachineName: "machine-1",
-					Container: newContainer(spec(
-						"nginx:1.25", map[string]string{"old": "legacy", "team": "backend", "same": "1"}, nil,
-					)),
-				}}
-			},
-			expected: []string{
-				"~ update service web",
-				"  │   image: nginx:1.25",
-				"  │ ~ labels:",
-				"  │     + env=prod",
-				"  │     - old=legacy",
-				"  │     ~ team=backend → platform",
-				"  │",
-				"  ╰── ~   update container web/0f6df6593e1b on machine-1 (in place)",
-			},
-		},
-		{
-			name: "container labels changed with image on replace",
-			spec: spec("nginx:1.26", nil, map[string]string{"proxy": "on"}),
-			ops: func(new api.ServiceSpec) []operation.Operation {
-				return []operation.Operation{&operation.ReplaceContainerOperation{
-					Spec:         new,
-					MachineName:  "machine-1",
-					OldContainer: newContainer(spec("nginx:1.25", nil, map[string]string{"proxy": "off"})),
-				}}
-			},
-			expected: []string{
-				"~ update service web",
-				"  │ ~ image: nginx:1.25 → 1.26",
-				"  │ ~ container labels:",
-				"  │     ~ proxy=off → on",
-				"  │",
-				"  ╰── +/- replace container web/0f6df6593e1b on machine-1",
-			},
-		},
-		{
-			name: "no label blocks when labels are the same",
-			spec: spec("nginx:1.26", map[string]string{}, map[string]string{"proxy": "on"}),
-			ops: func(new api.ServiceSpec) []operation.Operation {
-				return []operation.Operation{&operation.ReplaceContainerOperation{
-					Spec:         new,
-					MachineName:  "machine-1",
-					OldContainer: newContainer(spec("nginx:1.25", nil, map[string]string{"proxy": "on"})),
-				}}
-			},
-			expected: []string{
-				"~ update service web",
-				"  │ ~ image: nginx:1.25 → 1.26",
-				"  │",
-				"  ╰── +/- replace container web/0f6df6593e1b on machine-1",
-			},
-		},
-		{
-			name: "replaced container determines old spec over updated one",
-			spec: spec("nginx:1.26", map[string]string{"team": "platform"}, nil),
-			ops: func(new api.ServiceSpec) []operation.Operation {
-				return []operation.Operation{
-					&operation.UpdateContainerOperation{
-						MachineName: "machine-1",
-						Container:   newContainer(spec("nginx:1.26", map[string]string{"team": "backend"}, nil)),
-					},
-					&operation.ReplaceContainerOperation{
-						Spec:         new,
-						MachineName:  "machine-2",
-						OldContainer: newContainer(spec("nginx:1.25", map[string]string{"team": "backend"}, nil)),
-					},
-				}
-			},
-			expected: []string{
-				"~ update service web",
-				"  │ ~ image: nginx:1.25 → 1.26",
-				"  │ ~ labels:",
-				"  │     ~ team=backend → platform",
-				"  │",
-				"  ├── ~   update container web/0f6df6593e1b on machine-1 (in place)",
-				"  ╰── +/- replace container web/0f6df6593e1b on machine-2",
-			},
-		},
-		{
-			name: "all labels removed",
-			spec: spec("nginx:1.25", map[string]string{}, nil),
-			ops: func(api.ServiceSpec) []operation.Operation {
-				return []operation.Operation{&operation.UpdateContainerOperation{
-					MachineName: "machine-1",
-					Container:   newContainer(spec("nginx:1.25", map[string]string{"a": "1", "b": "2"}, nil)),
-				}}
-			},
-			expected: []string{
-				"~ update service web",
-				"  │   image: nginx:1.25",
-				"  │ - labels:",
-				"  │     - a=1",
-				"  │     - b=2",
-				"  │",
-				"  ╰── ~   update container web/0f6df6593e1b on machine-1 (in place)",
-			},
-		},
-		{
-			name: "first labels added to existing service",
-			spec: spec("nginx:1.25", map[string]string{"a": "1"}, nil),
-			ops: func(api.ServiceSpec) []operation.Operation {
-				return []operation.Operation{&operation.UpdateContainerOperation{
-					MachineName: "machine-1",
-					Container:   newContainer(spec("nginx:1.25", nil, nil)),
-				}}
-			},
-			expected: []string{
-				"~ update service web",
-				"  │   image: nginx:1.25",
-				"  │ + labels:",
-				"  │     + a=1",
-				"  │",
-				"  ╰── ~   update container web/0f6df6593e1b on machine-1 (in place)",
-			},
-		},
-		{
-			name: "empty and non-printable label values are escaped on a single line",
-			spec: spec("nginx:1.25", map[string]string{
-				"added":    "1\n2",
-				"cleared":  "",
-				"json":     `{"a":1}`,
-				"multi":    "a\nb\nc",
-				"tab":      "a\tb",
-				"trailing": "hello\n",
-				"unicode":  "héllo wörld 🚀",
-			}, nil),
-			ops: func(api.ServiceSpec) []operation.Operation {
-				return []operation.Operation{&operation.UpdateContainerOperation{
-					MachineName: "machine-1",
-					Container: newContainer(spec("nginx:1.25", map[string]string{
-						"cleared":  "x",
-						"multi":    "a\nb",
-						"trailing": "hello",
-					}, nil)),
-				}}
-			},
-			expected: []string{
-				"~ update service web",
-				"  │   image: nginx:1.25",
-				"  │ ~ labels:",
-				`  │     + added="1\n2"`,
-				`  │     ~ cleared=x → ""`,
-				`  │     + json={"a":1}`,
-				`  │     ~ multi="a\nb" → "a\nb\nc"`,
-				`  │     + tab="a\tb"`,
-				`  │     ~ trailing=hello → "hello\n"`,
-				"  │     + unicode=héllo wörld 🚀",
-				"  │",
-				"  ╰── ~   update container web/0f6df6593e1b on machine-1 (in place)",
-			},
-		},
-		{
-			name:         "new service with labels",
-			isNewService: true,
-			spec:         spec("nginx:1.25", map[string]string{"team": "platform"}, map[string]string{"proxy": "on"}),
-			ops: func(new api.ServiceSpec) []operation.Operation {
-				return []operation.Operation{&operation.RunContainerOperation{Spec: new, MachineName: "machine-1"}}
-			},
-			expected: []string{
-				"+ create service web",
-				"  │   image: nginx:1.25",
-				"  │   labels:",
-				"  │       team=platform",
-				"  │   container labels:",
-				"  │       proxy=on",
-				"  │",
-				"  ╰── +   run container web on machine-1",
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			plan := ServicePlan{ServiceName: "web", IsNewService: tt.isNewService, Spec: tt.spec}
-			plan.Operations = tt.ops(tt.spec)
-
-			// The table pads cells to the column width so ignore trailing whitespace.
-			var lines []string
-			for line := range strings.Lines(ansi.Strip(plan.Format())) {
-				lines = append(lines, strings.TrimRight(line, " \n"))
-			}
-			assert.Equal(t, tt.expected, lines)
-		})
-	}
-}

pkg/client/deploy/strategy.go

@@ -92,7 +92,7 @@ func (s *RollingStrategy) planReplicated(svc *api.Service, spec api.ServiceSpec)
 
 	// Organise existing containers by machine.
 	containersOnMachine := make(map[string][]api.ServiceContainer)
-	reusableContainersOnMachine := make(map[string]int)
+	upToDateContainersOnMachine := make(map[string]int)
 	containerSpecStatuses := make(map[string]ContainerSpecStatus)
 	if svc != nil {
 		for _, c := range svc.Containers {
@@ -105,50 +105,40 @@ func (s *RollingStrategy) planReplicated(svc *api.Service, spec api.ServiceSpec)
 			if s.ForceRecreate {
 				status = ContainerNeedsRecreate
 			} else {
-				status = EvalContainerChange(c.Container, spec)
+				status = EvalContainerSpecChange(c.Container.ServiceSpec, spec)
 			}
 			containerSpecStatuses[c.Container.ID] = status
 
-			if status != ContainerNeedsRecreate {
-				reusableContainersOnMachine[c.MachineID] += 1
+			if status == ContainerUpToDate {
+				upToDateContainersOnMachine[c.MachineID] += 1
 			}
 		}
 
-		// Sort containers such that running containers with the desired spec or that can be updated in place to
-		// the desired spec are first.
-		// TODO: consider ranking up-to-date containers above ones that need an in-place update (here, when sorting
-		//  machines, and in reconcileGlobalContainer) to avoid updating a container while removing an up-to-date one.
-		isReusable := func(c api.MachineServiceContainer) bool {
-			// Not running containers have no status.
-			status, ok := containerSpecStatuses[c.Container.ID]
-			return ok && status != ContainerNeedsRecreate
-		}
+		// Sort containers such that running containers with the desired spec are first.
 		slices.SortFunc(svc.Containers, func(c1, c2 api.MachineServiceContainer) int {
-			r1, r2 := isReusable(c1), isReusable(c2)
-			switch {
-			case r1 == r2:
-				return 0
-			case r1:
+			if status, ok := containerSpecStatuses[c1.Container.ID]; ok && status == ContainerUpToDate {
 				return -1
-			default:
+			}
+			if status, ok := containerSpecStatuses[c2.Container.ID]; ok && status == ContainerUpToDate {
 				return 1
 			}
+			return 0
 		})
 
 		for _, c := range svc.Containers {
 			containersOnMachine[c.MachineID] = append(containersOnMachine[c.MachineID], c.Container)
 		}
 
-		// Sort machines such that machines with the most containers that are up to date or can be updated in place
-		// are first, followed by machines with existing containers, and finally machines without containers.
+		// Sort machines such that machines with the most up-to-date containers are first, followed by machines with
+		// existing containers, and finally machines without containers.
 		slices.SortFunc(matchedMachines, func(m1, m2 *pb.MachineInfo) int {
-			if reusableContainersOnMachine[m1.Id] > 0 && reusableContainersOnMachine[m2.Id] > 0 {
-				return reusableContainersOnMachine[m2.Id] - reusableContainersOnMachine[m1.Id]
+			if upToDateContainersOnMachine[m1.Id] > 0 && upToDateContainersOnMachine[m2.Id] > 0 {
+				return upToDateContainersOnMachine[m2.Id] - upToDateContainersOnMachine[m1.Id]
 			}
-			if reusableContainersOnMachine[m1.Id] > 0 {
+			if upToDateContainersOnMachine[m1.Id] > 0 {
 				return -1
 			}
-			if reusableContainersOnMachine[m2.Id] > 0 {
+			if upToDateContainersOnMachine[m2.Id] > 0 {
 				return 1
 			}
 			return len(containersOnMachine[m2.Id]) - len(containersOnMachine[m1.Id])
@@ -180,16 +170,7 @@ func (s *RollingStrategy) planReplicated(svc *api.Service, spec api.ServiceSpec)
 			if status == ContainerUpToDate {
 				continue
 			}
-			if status == ContainerNeedsUpdate {
-				plan.Operations = append(plan.Operations, &operation.UpdateContainerOperation{
-					ServiceID:   plan.ServiceID,
-					MachineID:   m.Id,
-					MachineName: m.Name,
-					Container:   ctr,
-					Options:     ContainerUpdateOptions(ctr, spec),
-				})
-				continue
-			}
+			// TODO: handle ContainerNeedsUpdate when update of mutable fields on a container is supported.
 		}
 
 		// Replace the old container with a new one.
@@ -320,7 +301,7 @@ func reconcileGlobalContainer(
 	}
 
 	// Check if there is a container with the same spec already running. If so, remove the rest.
-	reused := false
+	upToDate := false
 	for i, c := range containers {
 		if !c.Container.State.Running || c.Container.State.Paused {
 			// Skip containers that are not running.
@@ -331,21 +312,12 @@ func reconcileGlobalContainer(
 		if forceRecreate {
 			status = ContainerNeedsRecreate
 		} else {
-			status = EvalContainerChange(c.Container, spec)
+			status = EvalContainerSpecChange(c.Container.ServiceSpec, spec)
 		}
 
-		if status != ContainerNeedsRecreate {
-			// The container is already running with the desired spec or can be updated in place to it.
-			reused = true
-			if status == ContainerNeedsUpdate {
-				ops = append(ops, &operation.UpdateContainerOperation{
-					ServiceID:   serviceID,
-					MachineID:   machine.Id,
-					MachineName: machine.Name,
-					Container:   c.Container,
-					Options:     ContainerUpdateOptions(c.Container, spec),
-				})
-			}
+		if status == ContainerUpToDate {
+			// The container is already running with the same spec.
+			upToDate = true
 			for j, old := range containers {
 				if i == j {
 					continue
@@ -359,8 +331,10 @@ func reconcileGlobalContainer(
 			}
 			break
 		}
+		// TODO: handle ContainerNeedsUpdate when update of mutable fields on a container is supported.
+		//  Make sure to update preDeployOperation accordingly.
 	}
-	if reused {
+	if upToDate {
 		return ops, nil
 	}
 
@@ -386,7 +360,6 @@ func reconcileGlobalContainer(
 			if err != nil || len(conflictingPorts) > 0 {
 				ops = append(ops, &operation.StopContainerOperation{
 					ServiceID:       serviceID,
-					ServiceName:     c.Container.ServiceSpec.Name,
 					ContainerID:     c.Container.ID,
 					MachineID:       machine.Id,
 					MachineName:     machine.Name,

pkg/client/deploy/strategy_test.go

@@ -1,8 +1,6 @@
 package deploy
 
 import (
-	"slices"
-	"strings"
 	"testing"
 
 	"github.com/docker/docker/api/types/container"
@@ -13,7 +11,6 @@ import (
 	"github.com/psviderski/uncloud/pkg/client/deploy/scheduler"
 	"github.com/psviderski/uncloud/pkg/client/operation"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestDetermineUpdateOrder(t *testing.T) {
@@ -363,7 +360,6 @@ func TestReconcileGlobalContainer(t *testing.T) {
 			expectedOps: []operation.Operation{
 				&operation.StopContainerOperation{
 					ServiceID:   "service-1",
-					ServiceName: container2WithPort9090.ServiceSpec.Name,
 					ContainerID: "container-2",
 					MachineID:   "machine-1",
 					MachineName: "machine-1",
@@ -428,121 +424,6 @@ func TestReconcileGlobalContainer(t *testing.T) {
 	}
 }
 
-func TestRollingStrategy_Plan_UpdateInPlace(t *testing.T) {
-	t.Parallel()
-
-	state := &scheduler.ClusterState{
-		Machines: []*scheduler.Machine{
-			{Info: &pb.MachineInfo{Id: "m-1", Name: "machine-1"}},
-			{Info: &pb.MachineInfo{Id: "m-2", Name: "machine-2"}},
-		},
-	}
-	newContainer := func(id string, spec api.ServiceSpec) api.ServiceContainer {
-		ctr := newServiceContainer(id, container.State{Running: true, Status: "running"})
-		ctr.ServiceSpec = spec
-		return ctr
-	}
-
-	tests := []struct {
-		name   string
-		change func(spec *api.ServiceSpec)
-		// options are the expected in-place update options. Nil means the containers must be recreated.
-		options *api.UpdateContainerOptions
-	}{
-		{
-			name:    "service labels",
-			change:  func(spec *api.ServiceSpec) { spec.Labels = map[string]string{"tier": "backend"} },
-			options: &api.UpdateContainerOptions{ServiceLabels: &map[string]string{"tier": "backend"}},
-		},
-		{
-			name: "CPU and memory limits",
-			change: func(spec *api.ServiceSpec) {
-				spec.Container.Resources.CPU = 2 * api.Core
-				spec.Container.Resources.Memory = 512 * 1024 * 1024
-			},
-			options: &api.UpdateContainerOptions{
-				CPU:    new(int64(2 * api.Core)),
-				Memory: new(int64(512 * 1024 * 1024)),
-			},
-		},
-		{
-			name:   "remove memory limit",
-			change: func(spec *api.ServiceSpec) { spec.Container.Resources.Memory = 0 },
-		},
-	}
-
-	for _, tt := range tests {
-		for _, mode := range []string{api.ServiceModeReplicated, api.ServiceModeGlobal} {
-			t.Run(tt.name+"/"+mode, func(t *testing.T) {
-				currentSpec := api.ServiceSpec{
-					Name: "app",
-					Mode: mode,
-					Container: api.ContainerSpec{
-						Image: "nginx:latest",
-						Resources: api.ContainerResources{
-							CPU:    api.Core,
-							Memory: 256 * 1024 * 1024,
-						},
-					},
-					Labels:    map[string]string{"tier": "frontend"},
-					PreDeploy: &api.PreDeployHook{Command: []string{"db", "migrate"}},
-				}
-				if mode == api.ServiceModeReplicated {
-					currentSpec.Replicas = 2
-				}
-				newSpec := currentSpec.Clone()
-				tt.change(&newSpec)
-
-				ctr1 := newContainer("container-1", currentSpec)
-				ctr2 := newContainer("container-2", currentSpec)
-				svc := &api.Service{
-					ID:   "svc-1",
-					Name: "app",
-					Mode: mode,
-					Containers: []api.MachineServiceContainer{
-						{MachineID: "m-1", MachineName: "machine-1", Container: ctr1},
-						{MachineID: "m-2", MachineName: "machine-2", Container: ctr2},
-					},
-				}
-
-				plan, err := (&RollingStrategy{}).Plan(state, svc, newSpec)
-				require.NoError(t, err)
-
-				if tt.options == nil {
-					require.NotEmpty(t, plan.Operations)
-					for _, op := range plan.Operations {
-						_, isUpdate := op.(*operation.UpdateContainerOperation)
-						assert.False(t, isUpdate, "Expected containers to be recreated, got %s", op)
-					}
-					return
-				}
-				// The replicated strategy shuffles machines so sort the operations to compare them deterministically.
-				ops := slices.Clone(plan.Operations)
-				slices.SortFunc(ops, func(a, b operation.Operation) int {
-					return strings.Compare(a.String(), b.String())
-				})
-				// The containers are updated in place and the pre-deploy hook is not run.
-				assertOperationsEqual(t, []operation.Operation{
-					&operation.UpdateContainerOperation{
-						ServiceID:   "svc-1",
-						MachineID:   "m-1",
-						MachineName: "machine-1",
-						Container:   ctr1,
-						Options:     *tt.options,
-					},
-					&operation.UpdateContainerOperation{
-						ServiceID:   "svc-1",
-						MachineID:   "m-2",
-						MachineName: "machine-2",
-						Container:   ctr2,
-						Options:     *tt.options,
-					},
-				}, ops)
-			})
-		}
-	}
-}
-
 func TestPreDeployOperations(t *testing.T) {
 	hook := &api.PreDeployHook{
 		Command: []string{"db", "migrate"},
@@ -621,20 +502,6 @@ func TestPreDeployOperations(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "plan has only UpdateContainerOperation",
-			plan: ServicePlan{
-				ServiceID:   "svc-1",
-				ServiceName: "app",
-				Spec:        api.ServiceSpec{PreDeploy: hook},
-				SequenceOperation: operation.SequenceOperation{
-					Operations: []operation.Operation{
-						&operation.UpdateContainerOperation{MachineID: "m-1", MachineName: "machine-1"},
-					},
-				},
-			},
-			expected: nil,
-		},
 		{
 			name: "plan has only RemoveContainerOperation",
 			plan: ServicePlan{
@@ -747,8 +614,7 @@ func TestPreDeployOperations(t *testing.T) {
 			},
 			svc: &api.Service{
 				HookContainers: []api.MachineServiceContainer{
-					{MachineID: "m-1", Container: newServiceContainer("stopped-hook",
-						container.State{Status: "exited"})},
+					{MachineID: "m-1", Container: newServiceContainer("stopped-hook", container.State{Status: "exited"})},
 					{MachineID: "m-1", Container: runningHook1},
 					{MachineID: "m-3", Container: runningHook2},
 				},
@@ -794,7 +660,6 @@ func newServiceContainer(id string, state container.State) api.ServiceContainer
 				ID:    id,
 				State: &state,
 			},
-			Config: &container.Config{},
 		},
 	}}
 }

pkg/client/operation/container.go

@@ -82,9 +82,7 @@ func (o *RunContainerOperation) String() string {
 
 // StopContainerOperation stops a container on a specific machine.
 type StopContainerOperation struct {
-	ServiceID string
-	// ServiceName is used for formatting the operation as part of the deployment plan.
-	ServiceName string
+	ServiceID   string
 	ContainerID string
 	MachineID   string
 	// MachineName is used for formatting the operation as part of the deployment plan.
@@ -100,7 +98,8 @@ func (o *StopContainerOperation) Execute(ctx context.Context, cli Client) error
 }
 
 func (o *StopContainerOperation) Format() string {
-	displayName := o.ServiceName + tui.Faint.Render("/") + stringid.TruncateID(o.ContainerID)
+	// TODO: pass service name to format the display name consistently with other operations.
+	displayName := stringid.TruncateID(o.ContainerID)
 
 	return tui.BoldRed.Render("-") + "   " +
 		tui.Faint.Render("stop container") + " " +
@@ -286,39 +285,6 @@ func (o *ReplaceContainerOperation) String() string {
 		o.MachineID, o.ServiceID, o.OldContainer.ID, o.Order)
 }
 
-// UpdateContainerOperation updates the requested properties of a running container in place without recreating it.
-type UpdateContainerOperation struct {
-	ServiceID string
-	MachineID string
-	// MachineName is used for formatting the operation as part of the deployment plan.
-	MachineName string
-	Container   api.ServiceContainer
-	Options     api.UpdateContainerOptions
-}
-
-func (o *UpdateContainerOperation) Execute(ctx context.Context, cli Client) error {
-	if err := cli.UpdateContainer(ctx, o.ServiceID, o.Container.ID, o.Options); err != nil {
-		return fmt.Errorf("update container: %w", err)
-	}
-	return nil
-}
-
-func (o *UpdateContainerOperation) Format() string {
-	displayName := o.Container.ServiceSpec.Name + tui.Faint.Render("/") + o.Container.ShortID()
-
-	return tui.BoldYellow.Render("~") + "   " +
-		tui.Faint.Render("update container") + " " +
-		displayName + " " +
-		tui.Faint.Render("on") + " " +
-		o.MachineName + " " +
-		tui.Faint.Render("(in place)")
-}
-
-func (o *UpdateContainerOperation) String() string {
-	return fmt.Sprintf("UpdateContainerOperation[machine_id=%s service_id=%s container_id=%s]",
-		o.MachineID, o.ServiceID, o.Container.ID)
-}
-
 // stopOptions converts a stop grace period duration to Docker container stop options.
 func stopOptions(gracePeriod *time.Duration) container.StopOptions {
 	if gracePeriod == nil {

pkg/client/operation/container_test.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/charmbracelet/x/ansi"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/volume"
 	"github.com/psviderski/uncloud/pkg/api"
@@ -13,18 +12,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestStopContainerOperation_Format(t *testing.T) {
-	t.Parallel()
-
-	op := &StopContainerOperation{
-		ServiceName: "app",
-		ContainerID: "0f6df6593e1b0123456789abcdef",
-		MachineName: "machine-1",
-	}
-
-	assert.Equal(t, "-   stop container app/0f6df6593e1b on machine-1", ansi.Strip(op.Format()))
-}
-
 func TestReplaceContainerOperation_StopFirstPreparation(t *testing.T) {
 	t.Parallel()
 
@@ -136,13 +123,6 @@ func (c *recordingClient) RemoveContainer(
 	return nil
 }
 
-func (c *recordingClient) UpdateContainer(
-	_ context.Context, _, containerID string, _ api.UpdateContainerOptions,
-) error {
-	c.calls = append(c.calls, "update:"+containerID)
-	return nil
-}
-
 func (c *recordingClient) CreatePreDeployHookContainer(
 	context.Context, string, api.ServiceSpec, string,
 ) (api.CreateContainerResponse, error) {

test/e2e/assert.go

@@ -39,7 +39,7 @@ func assertServiceMatchesSpec(t *testing.T, svc api.Service, spec api.ServiceSpe
 
 func assertContainerMatchesSpec(t *testing.T, ctr api.ServiceContainer, spec api.ServiceSpec) {
 	desiredSpec := spec.SetDefaults()
-	status := deploy.EvalContainerChange(ctr, desiredSpec)
+	status := deploy.EvalContainerSpecChange(ctr.ServiceSpec, desiredSpec)
 	assert.Equal(t, deploy.ContainerUpToDate, status)
 	spec = renderRuntimeTemplatesForContainer(t, desiredSpec, ctr.Name)
 
@@ -48,9 +48,6 @@ func assertContainerMatchesSpec(t *testing.T, ctr api.ServiceContainer, spec api
 	assert.Equal(t, spec.Name, ctr.Config.Labels[api.LabelServiceName])
 	assert.Equal(t, spec.Mode, ctr.Config.Labels[api.LabelServiceMode])
 	assert.Contains(t, ctr.Config.Labels, api.LabelManaged)
-	for k, v := range spec.Container.Labels {
-		assert.Equal(t, v, ctr.Config.Labels[k], "Expected container label '%s'", k)
-	}
 
 	// Command and Entrypoint can only be compared if they are set in the spec.
 	// Otherwise, the container takes them from the image.

test/e2e/compose_deploy_test.go

@@ -2,9 +2,7 @@ package e2e
 
 import (
 	"context"
-	"fmt"
 	"testing"
-	"time"
 
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/volume"
@@ -12,7 +10,6 @@ import (
 	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/psviderski/uncloud/pkg/client/compose"
 	"github.com/psviderski/uncloud/pkg/client/deploy"
-	"github.com/psviderski/uncloud/pkg/client/operation"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -551,85 +548,6 @@ func TestComposeDeployment(t *testing.T) {
 			"Service containers should be on machines 1 and 3 from comma-separated list")
 	})
 
-	t.Run("labels and in-place update of service labels and resources", func(t *testing.T) {
-		t.Parallel()
-
-		name := "test-compose-labels"
-		t.Cleanup(func() {
-			removeServices(t, cli, name)
-		})
-
-		composeYAML := func(tier, memLimit string) string {
-			return fmt.Sprintf(`
-services:
-  %s:
-    image: portainer/pause:3.9
-    mem_limit: %s
-    labels:
-      com.example.team: web
-    deploy:
-      replicas: 2
-      labels:
-        tier: %s
-`, name, memLimit, tier)
-		}
-
-		project, err := compose.LoadProjectFromContent(ctx, composeYAML("frontend", "64m"))
-		require.NoError(t, err)
-		deployment, err := compose.NewDeployment(ctx, cli, project)
-		require.NoError(t, err)
-		require.NoError(t, deployment.Run(ctx))
-
-		svc, err := cli.InspectService(ctx, name)
-		require.NoError(t, err)
-		expectedSpec := api.ServiceSpec{
-			Name: name,
-			Mode: api.ServiceModeReplicated,
-			Container: api.ContainerSpec{
-				Image:     "portainer/pause:3.9",
-				Labels:    map[string]string{"com.example.team": "web"},
-				Resources: api.ContainerResources{Memory: 64 * 1024 * 1024},
-			},
-			Labels:   map[string]string{"tier": "frontend"},
-			Replicas: 2,
-		}
-		assertServiceMatchesSpec(t, svc, expectedSpec)
-		for _, mc := range svc.Containers {
-			assert.NotContains(t, mc.Container.Config.Labels, "tier",
-				"Service labels must not be applied to containers")
-		}
-		containers := serviceContainerIDs(svc)
-
-		// Changing the service labels and memory limit should update the containers in place.
-		project, err = compose.LoadProjectFromContent(ctx, composeYAML("backend", "128m"))
-		require.NoError(t, err)
-		deployment, err = compose.NewDeployment(ctx, cli, project)
-		require.NoError(t, err)
-
-		plan, err := deployment.Plan(ctx)
-		require.NoError(t, err)
-		require.Len(t, plan.Services, 1)
-		require.Len(t, plan.Services[0].Operations, 2)
-		for _, op := range plan.Services[0].Operations {
-			assert.IsType(t, &operation.UpdateContainerOperation{}, op)
-		}
-		require.NoError(t, deployment.Run(ctx))
-
-		// The updated spec propagates to the cluster store asynchronously.
-		expectedSpec.Labels = map[string]string{"tier": "backend"}
-		expectedSpec.Container.Resources.Memory = 128 * 1024 * 1024
-		assert.EventuallyWithT(t, func(c *assert.CollectT) {
-			svc, err = cli.InspectService(ctx, name)
-			require.NoError(c, err)
-			for _, mc := range svc.Containers {
-				assert.Equal(c, expectedSpec.Labels, mc.Container.ServiceSpec.Labels)
-				assert.Equal(c, expectedSpec.Container.Resources.Memory, mc.Container.HostConfig.Memory)
-			}
-		}, 10*time.Second, 200*time.Millisecond)
-		assertServiceMatchesSpec(t, svc, expectedSpec)
-		assert.Equal(t, containers, serviceContainerIDs(svc), "Expected containers to be updated in place")
-	})
-
 	// Catches regression: https://github.com/psviderski/uncloud/issues/176
 	t.Run("plan new deployment with volumes and recreate strategy", func(t *testing.T) {
 		t.Parallel()

test/e2e/service_test.go

@@ -1761,90 +1761,6 @@ func TestServiceLifecycle(t *testing.T) {
 		require.ErrorIs(t, err, api.ErrNotFound)
 	})
 
-	t.Run("update container in place", func(t *testing.T) {
-		t.Parallel()
-
-		serviceID := newServiceID()
-		spec := api.ServiceSpec{
-			Name: "container-update",
-			Container: api.ContainerSpec{
-				Image: "portainer/pause:latest",
-				Resources: api.ContainerResources{
-					CPU:    100 * api.MilliCore,
-					Memory: 20 * units.MiB,
-				},
-			},
-			Labels: map[string]string{"tier": "frontend"},
-		}
-
-		ctr, err := cli.CreateContainer(ctx, serviceID, spec, c.Machines[0].Name)
-		require.NoError(t, err)
-
-		t.Cleanup(func() {
-			err := cli.RemoveContainer(ctx, serviceID, ctr.ID, container.RemoveOptions{Force: true})
-			if !errors.Is(err, api.ErrNotFound) {
-				require.NoError(t, err)
-			}
-		})
-
-		require.NoError(t, cli.StartContainer(ctx, serviceID, ctr.ID))
-
-		// Update the CPU and memory limits and replace the service labels.
-		err = cli.UpdateContainer(ctx, serviceID, ctr.ID, api.UpdateContainerOptions{
-			CPU:               new(int64(200 * api.MilliCore)),
-			Memory:            new(int64(40 * units.MiB)),
-			MemoryReservation: new(int64(10 * units.MiB)),
-			ServiceLabels:     &map[string]string{"tier": "backend"},
-		})
-		require.NoError(t, err)
-
-		spec.Container.Resources.CPU = 200 * api.MilliCore
-		spec.Container.Resources.Memory = 40 * units.MiB
-		spec.Container.Resources.MemoryReservation = 10 * units.MiB
-		spec.Labels = map[string]string{"tier": "backend"}
-
-		mc, err := cli.InspectContainer(ctx, serviceID, ctr.ID)
-		require.NoError(t, err)
-		assert.Equal(t, ctr.ID, mc.Container.ID, "Expected container to be updated in place")
-		assert.True(t, mc.Container.State.Running, "Expected container to keep running")
-		assertContainerMatchesSpec(t, mc.Container, spec)
-		assert.Equal(t, spec.Labels, mc.Container.ServiceSpec.Labels)
-		assert.EqualValues(t, 80*units.MiB, mc.Container.HostConfig.MemorySwap,
-			"Expected swap limit to be twice the memory limit")
-
-		// Remove all service labels and leave the limits unchanged.
-		err = cli.UpdateContainer(ctx, serviceID, ctr.ID, api.UpdateContainerOptions{
-			ServiceLabels: &map[string]string{},
-		})
-		require.NoError(t, err)
-		spec.Labels = nil
-
-		mc, err = cli.InspectContainer(ctx, serviceID, ctr.ID)
-		require.NoError(t, err)
-		assertContainerMatchesSpec(t, mc.Container, spec)
-		assert.Nil(t, mc.Container.ServiceSpec.Labels)
-
-		// A limit can't be removed without recreating the container.
-		err = cli.UpdateContainer(ctx, serviceID, ctr.ID, api.UpdateContainerOptions{Memory: new(int64(0))})
-		require.ErrorContains(t, err, "memory limit can't be removed")
-
-		mc, err = cli.InspectContainer(ctx, serviceID, ctr.ID)
-		require.NoError(t, err)
-		assertContainerMatchesSpec(t, mc.Container, spec)
-
-		// Reserved service labels are rejected.
-		err = cli.UpdateContainer(ctx, serviceID, ctr.ID, api.UpdateContainerOptions{
-			ServiceLabels: &map[string]string{api.LabelManaged: ""},
-		})
-		require.ErrorContains(t, err, "reserved prefix")
-
-		require.NoError(t, cli.RemoveContainer(ctx, serviceID, ctr.ID, container.RemoveOptions{Force: true}))
-		err = cli.UpdateContainer(ctx, serviceID, ctr.ID, api.UpdateContainerOptions{
-			ServiceLabels: &map[string]string{"tier": "frontend"},
-		})
-		require.ErrorIs(t, err, api.ErrNotFound)
-	})
-
 	t.Run("1 replica", func(t *testing.T) {
 		t.Parallel()
 

website/README.md

@@ -18,22 +18,14 @@ npm run dev
 
 `/docs` and `/blog` are built using [Docusaurus](https://docusaurus.io/), a modern static website generator.
 
-### Local development
+### Local Development
 
-To preview the documentation website, install its dependencies first:
-
-```shell
-npm ci
+```
+npm start
 ```
 
-Then start the local development server:
-
-```shell
-mise run docs:dev
-```
-
-It opens up a browser window at http://localhost:3000/. Most changes are reflected live without having to restart the
-server.
+This command starts a local development server and opens up a browser window. Most changes are reflected live without
+having to restart the server.
 
 ## Deployment
 

website/docs/8-compose-file-reference/1-support-matrix.md

@@ -10,16 +10,16 @@ If you rely on a specific Compose feature that is not supported by Uncloud, plea
 
 :::
 
-| Feature                          | Support Status      | Notes                                                                                                                                      |
-|----------------------------------|---------------------|--------------------------------------------------------------------------------------------------------------------------------------------|
-| **Services**                     |                     |                                                                                                                                            |
+| Feature                          | Support Status     | Notes                                                                                                                                      |
+|----------------------------------|--------------------|--------------------------------------------------------------------------------------------------------------------------------------------|
+| **Services**                     |                    |                                                                                                                                            |
 | `build`                          | ✅ Supported        | Build context and Dockerfile                                                                                                               |
 | `cap_add`                        | ✅ Supported        | Additional kernel [capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html)                                                |
 | `cap_drop`                       | ✅ Supported        | Which kernel [capabilities](https://man7.org/linux/man-pages/man7/capabilities.7.html) to drop                                             |
 | `command`                        | ✅ Supported        | Override container command                                                                                                                 |
 | `configs`                        | ✅ Supported        | File-based and inline configs                                                                                                              |
 | `cpus`                           | ✅ Supported        | CPU limit                                                                                                                                  |
-| `depends_on`                     | ⚠️ Limited          | Deployed in dependency order. Use [pre-deploy hooks](../4-guides/1-deployments/5-pre-deploy-hooks.md) for `service_completed_successfully` |
+| `depends_on`                     | ⚠️ Limited         | Deployed in dependency order. Use [pre-deploy hooks](../4-guides/1-deployments/5-pre-deploy-hooks.md) for `service_completed_successfully` |
 | `devices`                        | ✅ Supported        | Device mappings                                                                                                                            |
 | `dns`                            | ❌ Not supported    | Built-in service discovery                                                                                                                 |
 | `dns_search`                     | ❌ Not supported    | Built-in service discovery                                                                                                                 |
@@ -30,7 +30,7 @@ If you rely on a specific Compose feature that is not supported by Uncloud, plea
 | `healthcheck`                    | ✅ Supported        | Health check configuration                                                                                                                 |
 | `image`                          | ✅ Supported        | Container image specification                                                                                                              |
 | `init`                           | ✅ Supported        | Run init process in container                                                                                                              |
-| `labels`                         | ✅ Supported        | Docker labels on containers                                                                                                                |
+| `labels`                         | ❌ Not supported    |                                                                                                                                            |
 | `links`                          | ❌ Not supported    | Use service names for communication                                                                                                        |
 | `logging`                        | ✅ Supported        | Defaults to [local](https://docs.docker.com/engine/logging/drivers/local/) log driver                                                      |
 | `mem_limit`                      | ✅ Supported        | Memory limit                                                                                                                               |
@@ -39,10 +39,10 @@ If you rely on a specific Compose feature that is not supported by Uncloud, plea
 | `memswap_limit`                  | ❌ Not supported    |                                                                                                                                            |
 | `networks`                       | ❌ Not supported    | All containers share cluster network                                                                                                       |
 | `pid`                            | ✅ Supported        | Set the PID namespace mode, `pid: host` only                                                                                               |
-| `ports`                          | ⚠️ Limited          | `mode: host` only, use [`x-ports`](2-extensions.md#x-ports) for HTTP/HTTPS                                                                 |
+| `ports`                          | ⚠️ Limited         | `mode: host` only, use [`x-ports`](2-extensions.md#x-ports) for HTTP/HTTPS                                                                 |
 | `privileged`                     | ✅ Supported        | Run containers in privileged mode                                                                                                          |
 | `pull_policy`                    | ✅ Supported        | `always`, `missing`, `never`                                                                                                               |
-| `secrets`                        | ⚠️ Limited          | Reference secrets in `environment`, see [Secrets](../3-concepts/8-secrets.md). File mounts not supported                                   |
+| `secrets`                        | ⚠️ Limited         | Reference secrets in `environment`, see [Secrets](../3-concepts/8-secrets.md). File mounts not supported                                   |
 | `security_opt`                   | ❌ Not supported    |                                                                                                                                            |
 | `shm_size`                       | ✅ Supported        | Shared memory size                                                                                                                         |
 | `stdin_open`                     | ✅ Supported        | Allocate standard input and keep it open                                                                                                   |
@@ -53,28 +53,28 @@ If you rely on a specific Compose feature that is not supported by Uncloud, plea
 | `ulimits`                        | ✅ Supported        | Resource limits                                                                                                                            |
 | `user`                           | ✅ Supported        | Set container user                                                                                                                         |
 | `volumes`                        | ✅ Supported        | Named volumes, bind mounts, tmpfs                                                                                                          |
-| **Deploy**                       |                     |                                                                                                                                            |
-| `labels`                         | ✅ Supported        | Service labels, not applied to containers. Use `services.<name>.labels` to set Docker labels on containers                                 |
+| **Deploy**                       |                    |                                                                                                                                            |
+| `labels`                         | ❌ Not supported    |                                                                                                                                            |
 | `mode`                           | ✅ Supported        | Either `global` or `replicated`                                                                                                            |
 | `placement`                      | ❌ Not supported    | Use [`x-machines`](2-extensions.md#x-machines) extension                                                                                   |
 | `replicas`                       | ✅ Supported        | Number of container replicas                                                                                                               |
-| `resources`                      | ⚠️ Limited          | CPU, memory limits and device reservations                                                                                                 |
+| `resources`                      | ⚠️ Limited         | CPU, memory limits and device reservations                                                                                                 |
 | `restart_policy`                 | ❌ Not supported    | Defaults to `unless-stopped`                                                                                                               |
 | `rollback_config`                | ❌ Not supported    | See [#151](https://github.com/psviderski/uncloud/issues/151)                                                                               |
-| `update_config`                  | ⚠️ Limited          | `order` and `monitor` supported. See [rolling deployments](../4-guides/1-deployments/4-rolling-deployments.md)                             |
-| **Volumes**                      |                     |                                                                                                                                            |
+| `update_config`                  | ⚠️ Limited         | `order` and `monitor` supported. See [rolling deployments](../4-guides/1-deployments/4-rolling-deployments.md)                             |
+| **Volumes**                      |                    |                                                                                                                                            |
 | Named volumes                    | ✅ Supported        | Docker volumes                                                                                                                             |
 | Bind mounts                      | ✅ Supported        | Host path binding with optional [runtime templates](../3-concepts/6-services/3-runtime-templates.md)                                       |
 | Tmpfs mounts                     | ✅ Supported        | In-memory filesystems                                                                                                                      |
 | Volume labels                    | ✅ Supported        | Custom labels                                                                                                                              |
 | External volumes                 | ✅ Supported        | Must exist before deployment                                                                                                               |
 | [Volume drivers][volume-drivers] | ✅ Supported        | `local` (supports [NFS][volume-nfs], [CIFS/Samba][volume-cifs]) and manually installed third-party drivers                                 |
-| **Configs**                      |                     |                                                                                                                                            |
+| **Configs**                      |                    |                                                                                                                                            |
 | File-based configs               | ✅ Supported        | Read from file                                                                                                                             |
 | Inline configs                   | ✅ Supported        | Defined in compose file                                                                                                                    |
 | External configs                 | ❌ Not supported    | Not supported                                                                                                                              |
 | Short syntax                     | ❌ Not supported    | Use long syntax only                                                                                                                       |
-| **Extensions**                   |                     |                                                                                                                                            |
+| **Extensions**                   |                    |                                                                                                                                            |
 | `x-context`                      | ✅ Uncloud-specific | Cluster context override                                                                                                                   |
 | `x-caddy`                        | ✅ Uncloud-specific | Custom Caddy configuration                                                                                                                 |
 | `x-machines`                     | ✅ Uncloud-specific | Machine placement constraints                                                                                                              |

website/docs/9-cli-reference/uc_image.md

@@ -22,5 +22,4 @@ Manage images on machines in the cluster.
 * [uc](uc.md)	 - A CLI tool for managing Uncloud resources such as machines, services, and volumes.
 * [uc image ls](uc_image_ls.md)	 - List images on machines in the cluster.
 * [uc image push](uc_image_push.md)	 - Upload a local Docker image to the cluster.
-* [uc image rm](uc_image_rm.md)	 - Remove images from machines in the cluster.
 

website/docs/9-cli-reference/uc_image_rm.md

@@ -1,61 +0,0 @@
-# uc image rm
-
-Remove images from machines in the cluster.
-
-## Synopsis
-
-Remove images from all or selected machines in the cluster.
-
-An image name without a tag selects all its tags. Specify a tag, such as myapp:latest, to remove
-only that tag.
-
-Wildcard patterns are supported for image names and tags and should be quoted to prevent your
-shell from expanding them. Removing by image ID attempts to remove each name for that image
-independently.
-
-Images used by running or stopped containers cannot be removed. Unused tags can be removed even
-when the same image is used under another tag. Failed removals do not prevent other removals.
-
-```
-uc image rm IMAGE [IMAGE...] [flags]
-```
-
-## Examples
-
-```
-  # Remove a tag from all machines after confirming the plan.
-  uc image rm myapp:old
-
-  # Remove all tags for an image name from all machines.
-  uc image rm myapp
-
-  # Remove matching tags from two machines without confirmation.
-  uc image rm 'myapp:1.*' 'otherapp:*' -m machine1,machine2 --yes
-
-  # Remove all names for an image by ID from all machines.
-  uc image rm ee8fed0e9618
-```
-
-## Options
-
-```
-  -h, --help              help for rm
-  -m, --machine strings   Machine names or IDs to remove images from. Can be specified multiple times or as a comma-separated list.
-                          If not specified, the matching images will be removed from all machines.
-  -y, --yes               Auto-confirm the removal plan. Should be explicitly set when running non-interactively,
-                          e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]
-```
-
-## Options inherited from parent commands
-
-```
-      --connect string          Connect to a remote cluster machine without using the Uncloud configuration file. [$UNCLOUD_CONNECT]
-                                Format: [ssh://]user@host[:port], ssh+go://user@host[:port], tcp://host:port, or unix:///path/to/uncloud.sock
-  -c, --context string          Name of the cluster context to use (default is the current context). [$UNCLOUD_CONTEXT]
-      --uncloud-config string   Path to the Uncloud configuration file. [$UNCLOUD_CONFIG] (default "~/.config/uncloud/config.yaml")
-```
-
-## See also
-
-* [uc image](uc_image.md)	 - Manage images on machines in the cluster.
-

website/docs/9-cli-reference/uc_run.md

@@ -9,55 +9,49 @@ uc run IMAGE [COMMAND...] [flags]
 ## Options
 
 ```
-      --caddyfile string              Path to a custom Caddy config (Caddyfile) for the service. Cannot be used together with non-@host published ports.
-      --container-label stringArray   Set a Docker label on service containers. Can be specified multiple times.
-                                      Format: key=value or just key for an empty value.
-      --cpu decimal                   Maximum number of CPU cores a service container can use. Fractional values are allowed: 0.5 for half a core or 2.25 for two and a quarter cores.
-      --entrypoint string             Overwrite the default ENTRYPOINT of the image. Pass an empty string "" to reset it.
-  -e, --env strings                   Set an environment variable for service containers. Can be specified multiple times.
-                                      Format: VAR=value or just VAR to use the value from the local environment.
-  -h, --help                          help for run
-  -l, --label stringArray             Set a service label. Service labels aren't applied to Docker containers, use --container-label for that.
-                                      Can be specified multiple times. Format: key=value or just key for an empty value.
-  -m, --machine strings               Placement constraint by machine names, limiting which machines the service can run on. Can be specified multiple times or as a comma-separated list of machine names. (default is any suitable machine)
-      --memory bytes                  Maximum amount of memory a service container can use. Value is a positive integer with optional unit suffix (b, k, m, g).
-                                      Default unit is bytes if no suffix specified.
-                                      Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)
-      --memory-reservation bytes      Minimum amount of memory reserved for a service container. Value is a positive integer with optional unit suffix (b, k, m, g).
-                                      Default unit is bytes if no suffix specified.
-      --mode string                   Replication mode of the service: either 'replicated' (a specified number of containers across the machines) or 'global' (one container on every machine). (default "replicated")
-  -n, --name string                   Assign a name to the service. A random name is generated if not specified.
-      --privileged                    Give extended privileges to service containers. This is a security risk and should be used with caution.
-  -p, --publish strings               Publish a service port to make it accessible outside the cluster. Can be specified multiple times.
-                                      Format: [hostname:]container_port[/protocol] or [host_ip|host_prefix:]host_port:container_port[/protocol]@host
-                                      Supported protocols: tcp, udp, http, https (default is tcp). If a hostname for http(s) port is not specified
-                                      and a cluster domain is reserved, service-name.cluster-domain will be used as the hostname.
-                                      Examples:
-                                        -p 8080/https                       Publish port 8080 as HTTPS via reverse proxy with default service-name.cluster-domain hostname
-                                        -p app.example.com:8080/https       Publish port 8080 as HTTPS via reverse proxy with custom hostname
-                                        -p 53:5353/udp@host                 Bind UDP port 5353 to host port 53
-                                        -p 192.168.76.0/24:53:5353/udp@host Bind UDP port 5353 to host port 53 on every host IP address
-                                                                            contained in the prefix 192.168.76.0/24
-      --pull string                   Pull image from the registry before running service containers ('always', 'missing', 'never'). (default "missing")
-      --replicas uint                 Number of containers to run for the service. Only valid for a replicated service. (default 1)
-      --shm-size bytes                Maximum amount of shared memory (mounted at /dev/shm) a service container can use. Value is a positive integer
-                                      with optional unit suffix (b, k, m, g). Default unit is bytes if no suffix specified.
-                                      Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)
-      --ulimit strings                Set resource limits for service containers. Can be specified multiple times.
-                                      Format: type=soft_limit[:hard_limit]. If hard limit is not specified, soft limit is used for both.
-                                      Examples:
-                                        --ulimit nofile=1024:2048  Set soft limit to 1024 and hard limit to 2048 for number of open files
-                                        --ulimit nproc=65535       Set both soft and hard limits to 65535 for number of processes
-  -u, --user string                   User name or UID and optionally group name or GID used for running the command inside service containers.
-                                      Format: USER[:GROUP] or UID[:GID]. If not specified, the user is set to the default user of the image.
-  -v, --volume strings                Mount a data volume or host path into service containers. Service containers will be scheduled on the machine(s) where
-                                      the volume is located. Can be specified multiple times.
-                                      Format: volume_name:/container/path[:ro|volume-nocopy] or /host/path:/container/path[:ro]
-                                      Host and container paths support runtime templates such as {{.Container.Name}}.
-                                      Examples:
-                                        -v postgres-data:/var/lib/postgresql/data  Mount volume 'postgres-data' to /var/lib/postgresql/data in container
-                                        -v /data/uploads:/app/uploads         	 Bind mount /data/uploads host directory to /app/uploads in container
-                                        -v /host/path:/container/path:ro 		 Bind mount a host directory or file as read-only
+      --caddyfile string    Path to a custom Caddy config (Caddyfile) for the service. Cannot be used together with non-@host published ports.
+      --cpu decimal         Maximum number of CPU cores a service container can use. Fractional values are allowed: 0.5 for half a core or 2.25 for two and a quarter cores.
+      --entrypoint string   Overwrite the default ENTRYPOINT of the image. Pass an empty string "" to reset it.
+  -e, --env strings         Set an environment variable for service containers. Can be specified multiple times.
+                            Format: VAR=value or just VAR to use the value from the local environment.
+  -h, --help                help for run
+  -m, --machine strings     Placement constraint by machine names, limiting which machines the service can run on. Can be specified multiple times or as a comma-separated list of machine names. (default is any suitable machine)
+      --memory bytes        Maximum amount of memory a service container can use. Value is a positive integer with optional unit suffix (b, k, m, g).
+                            Default unit is bytes if no suffix specified.
+                            Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)
+      --mode string         Replication mode of the service: either 'replicated' (a specified number of containers across the machines) or 'global' (one container on every machine). (default "replicated")
+  -n, --name string         Assign a name to the service. A random name is generated if not specified.
+      --privileged          Give extended privileges to service containers. This is a security risk and should be used with caution.
+  -p, --publish strings     Publish a service port to make it accessible outside the cluster. Can be specified multiple times.
+                            Format: [hostname:]container_port[/protocol] or [host_ip|host_prefix:]host_port:container_port[/protocol]@host
+                            Supported protocols: tcp, udp, http, https (default is tcp). If a hostname for http(s) port is not specified
+                            and a cluster domain is reserved, service-name.cluster-domain will be used as the hostname.
+                            Examples:
+                              -p 8080/https                       Publish port 8080 as HTTPS via reverse proxy with default service-name.cluster-domain hostname
+                              -p app.example.com:8080/https       Publish port 8080 as HTTPS via reverse proxy with custom hostname
+                              -p 53:5353/udp@host                 Bind UDP port 5353 to host port 53
+                              -p 192.168.76.0/24:53:5353/udp@host Bind UDP port 5353 to host port 53 on every host IP address
+                                                                  contained in the prefix 192.168.76.0/24
+      --pull string         Pull image from the registry before running service containers ('always', 'missing', 'never'). (default "missing")
+      --replicas uint       Number of containers to run for the service. Only valid for a replicated service. (default 1)
+      --shm-size bytes      Maximum amount of shared memory (mounted at /dev/shm) a service container can use. Value is a positive integer
+                            with optional unit suffix (b, k, m, g). Default unit is bytes if no suffix specified.
+                            Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)
+      --ulimit strings      Set resource limits for service containers. Can be specified multiple times.
+                            Format: type=soft_limit[:hard_limit]. If hard limit is not specified, soft limit is used for both.
+                            Examples:
+                              --ulimit nofile=1024:2048  Set soft limit to 1024 and hard limit to 2048 for number of open files
+                              --ulimit nproc=65535       Set both soft and hard limits to 65535 for number of processes
+  -u, --user string         User name or UID and optionally group name or GID used for running the command inside service containers.
+                            Format: USER[:GROUP] or UID[:GID]. If not specified, the user is set to the default user of the image.
+  -v, --volume strings      Mount a data volume or host path into service containers. Service containers will be scheduled on the machine(s) where
+                            the volume is located. Can be specified multiple times.
+                            Format: volume_name:/container/path[:ro|volume-nocopy] or /host/path:/container/path[:ro]
+                            Host and container paths support runtime templates such as {{.Container.Name}}.
+                            Examples:
+                              -v postgres-data:/var/lib/postgresql/data  Mount volume 'postgres-data' to /var/lib/postgresql/data in container
+                              -v /data/uploads:/app/uploads         	 Bind mount /data/uploads host directory to /app/uploads in container
+                              -v /host/path:/container/path:ro 		 Bind mount a host directory or file as read-only
 ```
 
 ## Options inherited from parent commands

website/docs/9-cli-reference/uc_service.md

@@ -29,5 +29,4 @@ Manage services in the cluster.
 * [uc service scale](uc_service_scale.md)	 - Scale a replicated service by changing the number of replicas.
 * [uc service start](uc_service_start.md)	 - Start one or more services.
 * [uc service stop](uc_service_stop.md)	 - Stop one or more services.
-* [uc service update](uc_service_update.md)	 - Update a service in place without recreating its containers.
 

website/docs/9-cli-reference/uc_service_run.md

@@ -9,55 +9,49 @@ uc service run IMAGE [COMMAND...] [flags]
 ## Options
 
 ```
-      --caddyfile string              Path to a custom Caddy config (Caddyfile) for the service. Cannot be used together with non-@host published ports.
-      --container-label stringArray   Set a Docker label on service containers. Can be specified multiple times.
-                                      Format: key=value or just key for an empty value.
-      --cpu decimal                   Maximum number of CPU cores a service container can use. Fractional values are allowed: 0.5 for half a core or 2.25 for two and a quarter cores.
-      --entrypoint string             Overwrite the default ENTRYPOINT of the image. Pass an empty string "" to reset it.
-  -e, --env strings                   Set an environment variable for service containers. Can be specified multiple times.
-                                      Format: VAR=value or just VAR to use the value from the local environment.
-  -h, --help                          help for run
-  -l, --label stringArray             Set a service label. Service labels aren't applied to Docker containers, use --container-label for that.
-                                      Can be specified multiple times. Format: key=value or just key for an empty value.
-  -m, --machine strings               Placement constraint by machine names, limiting which machines the service can run on. Can be specified multiple times or as a comma-separated list of machine names. (default is any suitable machine)
-      --memory bytes                  Maximum amount of memory a service container can use. Value is a positive integer with optional unit suffix (b, k, m, g).
-                                      Default unit is bytes if no suffix specified.
-                                      Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)
-      --memory-reservation bytes      Minimum amount of memory reserved for a service container. Value is a positive integer with optional unit suffix (b, k, m, g).
-                                      Default unit is bytes if no suffix specified.
-      --mode string                   Replication mode of the service: either 'replicated' (a specified number of containers across the machines) or 'global' (one container on every machine). (default "replicated")
-  -n, --name string                   Assign a name to the service. A random name is generated if not specified.
-      --privileged                    Give extended privileges to service containers. This is a security risk and should be used with caution.
-  -p, --publish strings               Publish a service port to make it accessible outside the cluster. Can be specified multiple times.
-                                      Format: [hostname:]container_port[/protocol] or [host_ip|host_prefix:]host_port:container_port[/protocol]@host
-                                      Supported protocols: tcp, udp, http, https (default is tcp). If a hostname for http(s) port is not specified
-                                      and a cluster domain is reserved, service-name.cluster-domain will be used as the hostname.
-                                      Examples:
-                                        -p 8080/https                       Publish port 8080 as HTTPS via reverse proxy with default service-name.cluster-domain hostname
-                                        -p app.example.com:8080/https       Publish port 8080 as HTTPS via reverse proxy with custom hostname
-                                        -p 53:5353/udp@host                 Bind UDP port 5353 to host port 53
-                                        -p 192.168.76.0/24:53:5353/udp@host Bind UDP port 5353 to host port 53 on every host IP address
-                                                                            contained in the prefix 192.168.76.0/24
-      --pull string                   Pull image from the registry before running service containers ('always', 'missing', 'never'). (default "missing")
-      --replicas uint                 Number of containers to run for the service. Only valid for a replicated service. (default 1)
-      --shm-size bytes                Maximum amount of shared memory (mounted at /dev/shm) a service container can use. Value is a positive integer
-                                      with optional unit suffix (b, k, m, g). Default unit is bytes if no suffix specified.
-                                      Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)
-      --ulimit strings                Set resource limits for service containers. Can be specified multiple times.
-                                      Format: type=soft_limit[:hard_limit]. If hard limit is not specified, soft limit is used for both.
-                                      Examples:
-                                        --ulimit nofile=1024:2048  Set soft limit to 1024 and hard limit to 2048 for number of open files
-                                        --ulimit nproc=65535       Set both soft and hard limits to 65535 for number of processes
-  -u, --user string                   User name or UID and optionally group name or GID used for running the command inside service containers.
-                                      Format: USER[:GROUP] or UID[:GID]. If not specified, the user is set to the default user of the image.
-  -v, --volume strings                Mount a data volume or host path into service containers. Service containers will be scheduled on the machine(s) where
-                                      the volume is located. Can be specified multiple times.
-                                      Format: volume_name:/container/path[:ro|volume-nocopy] or /host/path:/container/path[:ro]
-                                      Host and container paths support runtime templates such as {{.Container.Name}}.
-                                      Examples:
-                                        -v postgres-data:/var/lib/postgresql/data  Mount volume 'postgres-data' to /var/lib/postgresql/data in container
-                                        -v /data/uploads:/app/uploads         	 Bind mount /data/uploads host directory to /app/uploads in container
-                                        -v /host/path:/container/path:ro 		 Bind mount a host directory or file as read-only
+      --caddyfile string    Path to a custom Caddy config (Caddyfile) for the service. Cannot be used together with non-@host published ports.
+      --cpu decimal         Maximum number of CPU cores a service container can use. Fractional values are allowed: 0.5 for half a core or 2.25 for two and a quarter cores.
+      --entrypoint string   Overwrite the default ENTRYPOINT of the image. Pass an empty string "" to reset it.
+  -e, --env strings         Set an environment variable for service containers. Can be specified multiple times.
+                            Format: VAR=value or just VAR to use the value from the local environment.
+  -h, --help                help for run
+  -m, --machine strings     Placement constraint by machine names, limiting which machines the service can run on. Can be specified multiple times or as a comma-separated list of machine names. (default is any suitable machine)
+      --memory bytes        Maximum amount of memory a service container can use. Value is a positive integer with optional unit suffix (b, k, m, g).
+                            Default unit is bytes if no suffix specified.
+                            Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)
+      --mode string         Replication mode of the service: either 'replicated' (a specified number of containers across the machines) or 'global' (one container on every machine). (default "replicated")
+  -n, --name string         Assign a name to the service. A random name is generated if not specified.
+      --privileged          Give extended privileges to service containers. This is a security risk and should be used with caution.
+  -p, --publish strings     Publish a service port to make it accessible outside the cluster. Can be specified multiple times.
+                            Format: [hostname:]container_port[/protocol] or [host_ip|host_prefix:]host_port:container_port[/protocol]@host
+                            Supported protocols: tcp, udp, http, https (default is tcp). If a hostname for http(s) port is not specified
+                            and a cluster domain is reserved, service-name.cluster-domain will be used as the hostname.
+                            Examples:
+                              -p 8080/https                       Publish port 8080 as HTTPS via reverse proxy with default service-name.cluster-domain hostname
+                              -p app.example.com:8080/https       Publish port 8080 as HTTPS via reverse proxy with custom hostname
+                              -p 53:5353/udp@host                 Bind UDP port 5353 to host port 53
+                              -p 192.168.76.0/24:53:5353/udp@host Bind UDP port 5353 to host port 53 on every host IP address
+                                                                  contained in the prefix 192.168.76.0/24
+      --pull string         Pull image from the registry before running service containers ('always', 'missing', 'never'). (default "missing")
+      --replicas uint       Number of containers to run for the service. Only valid for a replicated service. (default 1)
+      --shm-size bytes      Maximum amount of shared memory (mounted at /dev/shm) a service container can use. Value is a positive integer
+                            with optional unit suffix (b, k, m, g). Default unit is bytes if no suffix specified.
+                            Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)
+      --ulimit strings      Set resource limits for service containers. Can be specified multiple times.
+                            Format: type=soft_limit[:hard_limit]. If hard limit is not specified, soft limit is used for both.
+                            Examples:
+                              --ulimit nofile=1024:2048  Set soft limit to 1024 and hard limit to 2048 for number of open files
+                              --ulimit nproc=65535       Set both soft and hard limits to 65535 for number of processes
+  -u, --user string         User name or UID and optionally group name or GID used for running the command inside service containers.
+                            Format: USER[:GROUP] or UID[:GID]. If not specified, the user is set to the default user of the image.
+  -v, --volume strings      Mount a data volume or host path into service containers. Service containers will be scheduled on the machine(s) where
+                            the volume is located. Can be specified multiple times.
+                            Format: volume_name:/container/path[:ro|volume-nocopy] or /host/path:/container/path[:ro]
+                            Host and container paths support runtime templates such as {{.Container.Name}}.
+                            Examples:
+                              -v postgres-data:/var/lib/postgresql/data  Mount volume 'postgres-data' to /var/lib/postgresql/data in container
+                              -v /data/uploads:/app/uploads         	 Bind mount /data/uploads host directory to /app/uploads in container
+                              -v /host/path:/container/path:ro 		 Bind mount a host directory or file as read-only
 ```
 
 ## Options inherited from parent commands

website/docs/9-cli-reference/uc_service_update.md

@@ -1,54 +0,0 @@
-# uc service update
-
-Update a service in place without recreating its containers.
-
-## Synopsis
-
-Update service configuration in place without recreating its containers.
-
-A CPU or memory limit can be changed but not removed. To remove a limit or change anything else,
-redeploy the service with 'uc deploy'
-
-```
-uc service update SERVICE [flags]
-```
-
-## Examples
-
-```
-  # Change the CPU and memory limits.
-  uc service update web --cpu 0.5 --memory 512m
-
-  # Add or change a service label and remove another one.
-  uc service update web --label-add tier=frontend --label-rm legacy
-```
-
-## Options
-
-```
-      --cpu decimal                Maximum number of CPU cores a service container can use.
-                                   Fractional values are allowed: 0.5 for half a core or 2.25 for two and a quarter cores.
-  -h, --help                       help for update
-      --label-add stringArray      Add or change a service label. Can be specified multiple times.
-                                   Format: key=value or just key for an empty value.
-      --label-rm stringArray       Remove a service label by its key. Can be specified multiple times.
-      --memory bytes               Maximum amount of memory a service container can use. Value is a positive integer with
-                                   optional unit suffix (b, k, m, g). Default unit is bytes if no suffix specified.
-                                   Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)
-      --memory-reservation bytes   Minimum amount of memory reserved for a service container. Value is a positive integer with
-                                   optional unit suffix (b, k, m, g). Default unit is bytes if no suffix specified.
-```
-
-## Options inherited from parent commands
-
-```
-      --connect string          Connect to a remote cluster machine without using the Uncloud configuration file. [$UNCLOUD_CONNECT]
-                                Format: [ssh://]user@host[:port], ssh+go://user@host[:port], tcp://host:port, or unix:///path/to/uncloud.sock
-  -c, --context string          Name of the cluster context to use (default is the current context). [$UNCLOUD_CONTEXT]
-      --uncloud-config string   Path to the Uncloud configuration file. [$UNCLOUD_CONFIG] (default "~/.config/uncloud/config.yaml")
-```
-
-## See also
-
-* [uc service](uc_service.md)	 - Manage services in the cluster.
-