feat: enable passive health checks and upstream retries in Caddy

* test: Add an e2e test for build&push

* test: Add image cleanup

* test: Switch to assert.NoError

.github/workflows/go-tests.yml

@@ -0,0 +1,36 @@
+name: Go Tests
+
+on:
+  push:
+    branches:
+      - "main"
+      - "test/**"
+      - "release/**"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/**"
+      - "**.go"
+      - "go.*"
+      - "Makefile"
+      - "scripts/**"
+      - "test/**"
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: "1.23.2"
+
+      - name: Install dependencies
+        run: go mod tidy
+
+      - name: Run tests
+        run: make test
+    timeout-minutes: 10

.gitignore

@@ -30,6 +30,7 @@ go.work.sum
 /data/
 /dist/
 /uc
+/tmp
 
 # Web
 node_modules/

Dockerfile

@@ -17,13 +17,22 @@ RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd cmd/uncloudd/main
 
 
 FROM alpine:${ALPINE_VERSION} AS corrosion-download
-RUN wget -q -O /tmp/corrosion.tar.gz \
-      https://github.com/psviderski/corrosion/releases/latest/download/corrosion-aarch64-unknown-linux-gnu.tar.gz \
+ARG TARGETARCH
+
+RUN CORROSION_ARCH=$(case "${TARGETARCH}" in \
+      "amd64") echo "x86_64" ;; \
+      "arm64") echo "aarch64" ;; \
+      *) echo "Architecture '${TARGETARCH}' not supported" >&2 && exit 1 ;; \
+    esac) \
+    && wget -q -O /tmp/corrosion.tar.gz \
+      "https://github.com/psviderski/corrosion/releases/latest/download/corrosion-${CORROSION_ARCH}-unknown-linux-gnu.tar.gz" \
     && tar -xzf /tmp/corrosion.tar.gz -C /tmp \
     && install /tmp/corrosion /usr/local/bin/corrosion \
     && rm /tmp/corrosion.tar.gz /tmp/corrosion
 
-FROM chainguard/wolfi-base:latest AS corrosion
+# Beware that more modern images like chainguard/wolfi-base build glibc with flags that require newer CPU features,
+# e.g. x86-64-v2. So such image may fail with "Fatal glibc error: CPU does not support x86-64-v2" on older CPUs.
+FROM gcr.io/distroless/cc-debian12:latest AS corrosion
 COPY --from=corrosion-download /usr/local/bin/corrosion /usr/local/bin/corrosion
 CMD ["corrosion", "agent"]
 

Makefile

@@ -1,5 +1,6 @@
 CORROSION_IMAGE ?= ghcr.io/psviderski/corrosion:latest
 UCIND_IMAGE ?= ghcr.io/psviderski/ucind:latest
+DOCS_IMAGE ?= ghcr.io/psviderski/uncloud-docs:latest
 
 update-dev:
 	GOOS=linux GOARCH=amd64 go build -o uncloudd-linux-amd64 ./cmd/uncloudd && \
@@ -49,14 +50,51 @@ proto:
 corrosion-image:
 	docker build -t "$(CORROSION_IMAGE)" --target corrosion .
 
-.PHONY: corrosion-image-push
-corrosion-image-push: corrosion-image
-	docker push "$(CORROSION_IMAGE)"
+.PHONY: corrosion-multiarch-image-push
+corrosion-multiarch-image-push:
+	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(CORROSION_IMAGE)" --target corrosion .
 
 .PHONY: ucind-image
 ucind-image:
 	docker build -t "$(UCIND_IMAGE)" --target ucind .
 
-.PHONY: ucind-image-push
-ucind-image-push: ucind-image
-	docker push "$(UCIND_IMAGE)"
+.PHONY: ucind-multiarch-image-push
+ucind-multiarch-image-push:
+	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(UCIND_IMAGE)" --target ucind .
+
+.PHONY: test
+test:
+ifeq ($(TEST_NAME),)
+	go test -count=1 -v ./...
+else
+	go test -count=1 -v -run ^$(TEST_NAME)$$ ./...
+endif
+
+.PHONY: test-clean
+test-clean:
+	@CONTAINERS=$$(docker ps --filter "name=ucind-test" -q); \
+	if [ -n "$$CONTAINERS" ]; then \
+		echo "Killing containers..."; \
+		docker kill $$CONTAINERS; \
+	fi; \
+	CONTAINERS_STOPPED=$$(docker ps -a --filter "name=ucind-test" -q); \
+	if [ -n "$$CONTAINERS_STOPPED" ]; then \
+		echo "Removing stopped containers..."; \
+		docker rm $$CONTAINERS_STOPPED; \
+	else \
+		echo "Nothing to clean."; \
+	fi
+
+.PHONY: vet
+vet:
+	go vet ./...
+
+.PHONY: docs-image-push
+docs-image:
+	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(DOCS_IMAGE)" ./docs
+
+.PHONY: install-dev
+install-dev:
+	go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.34.2
+	go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
+# TODO: install a pinned protoc version

README.md

@@ -4,6 +4,7 @@
   <p><strong>Docker simplicity. Multi-machine power.</strong></p>
 
   <p>
+    <a href="https://docs.uncloud.run"><img src="https://img.shields.io/badge/Docs-blue.svg?style=for-the-badge&logo=gitbook&logoColor=white" alt="Documentation"></a>
     <a href="https://discord.gg/eR35KQJhPu"><img src="https://img.shields.io/badge/discord-5865F2.svg?style=for-the-badge&logo=discord&logoColor=white" alt="Join Discord"></a>
     <a href="https://x.com/psviderski"><img src="https://img.shields.io/badge/follow-black?style=for-the-badge&logo=X&logoColor=while" alt="Follow on X"></a>
   </p>
@@ -45,7 +46,16 @@ complexity of Kubernetes.
 
 ## 🎬 Quick demo
 
-Deploy a highly available web app with automatic HTTPS across multiple regions and on-premises in just a couple minutes.
+The screenshot below demonstrates how I use Uncloud to deploy the [Uncloud Documentation](https://docs.uncloud.run)
+website to 2 remote machines (why not?) from the [`compose.yaml`](docs/compose.yaml) file on my local machine.
+
+It exposes the container port `8000/tcp` as HTTPS on the domain `docs.uncloud.run`, served by the Caddy reverse proxy on
+the remote machines. All managed by Uncloud.
+
+![Uncloud compose deployment demo](.github/images/compose-deploy.jpg)
+
+Here is a more advanced use case. Deploy a highly available web app with automatic HTTPS across multiple regions and
+on-premises in just a couple minutes.
 
 <a href="https://uncloud.wistia.com/medias/k47uwt9uau?wvideo=k47uwt9uau">
 <img src="https://embed-ssl.wistia.com/deliveries/3cf7014a48b93afc556444bed3e39a8c.jpg?image_crop_resized=900x526&image_play_button_rounded=true&image_play_button_size=2x&image_play_button_color=18181Be0" alt="Uncloud demo" width="450" height="263" />
@@ -112,7 +122,7 @@ platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bar
    uncloud-uninstall
    ```
 
-View the [user guide](docs/user_guide.md) for more information.
+View the [Documentation](https://docs.uncloud.run) for more information.
 
 ## ⚙️ How it works
 
@@ -268,9 +278,32 @@ and there may be breaking changes between releases.
 We'd love your input! Here's how you can contribute:
 
 * 🐛 Found a bug? [Open an issue](https://github.com/psviderski/uncloud/issues)
-* 💡 Have ideas or need help? [Join our Discord community](https://discord.gg/eR35KQJhPu) where we discuss features, 
+* 💡 Have ideas or need help? [Join our Discord community](https://discord.gg/eR35KQJhPu) where we discuss features,
   roadmap, implementation details, and help each other out.
 
+## 🙏 Inspiration & Acknowledgements
+
+I'm grateful to the following projects that inspired Uncloud's design and implementation:
+
+* [Kamal](https://kamal-deploy.org/) — for proving that even in the declarative era of Kubernetes there is a place for
+  simple deployment tools that use imperative commands without complex orchestration. Kamal powers the multi-billion
+  dollar company [37signals](https://37signals.com/) where it was created, and that's truly inspiring!
+* [Fly.io](https://fly.io/) — for inspiring my vision for what self-hosted infrastructure should feel like, proving that
+  developer experience and powerful infrastructure can coexist beautifully.
+* [Tailscale](https://tailscale.com/) — for pioneering the vision of decentralised flat mesh networking with an amazing
+  user experience that feels like magic.
+* [Talos Linux](https://github.com/siderolabs/talos)
+  and [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/) — for the machine API design using
+  [grpc-proxy](https://github.com/siderolabs/grpc-proxy) and for its elegant approach to secure WireGuard-based overlay
+  networking with zero configuration.
+* [Docker Swarm Classic](https://github.com/docker-archive/classicswarm) and
+  [Rancher 1.x](http://rancher-com-website-main-elb-elb-1798790864.us-west-2.elb.amazonaws.com/docs/rancher/v1.6/en/)
+  — for showing the power of simplicity and pragmatism in container orchestration and that not every problem needs the
+  complexity of Kubernetes.
+
+Special thanks to the [Corrosion](https://github.com/superfly/corrosion) project by Fly.io for providing the distributed
+SQLite database used to share Uncloud's cluster state.
+
 ## 📫 Stay updated
 
 * Join our [Discord server](https://discord.gg/eR35KQJhPu) for real-time discussions, support, and updates.

cmd/uncloud/build.go

@@ -0,0 +1,77 @@
+package main
+
+import (
+	"context"
+	"fmt"
+
+	composecli "github.com/compose-spec/compose-go/v2/cli"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/client/compose"
+	"github.com/spf13/cobra"
+)
+
+// NewBuildCommand creates a new command to build services from a Compose file.
+func NewBuildCommand() *cobra.Command {
+	opts := cli.BuildOptions{}
+	cmd := &cobra.Command{
+		Use:   "build [FLAGS] [SERVICE...]",
+		Short: "Build services from a Compose file.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			if len(args) > 0 {
+				opts.Services = args
+			}
+
+			return runBuild(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringSliceVarP(&opts.Files, "file", "f", nil,
+		"One or more Compose files to build (default compose.yaml)")
+	cmd.Flags().StringSliceVarP(&opts.Profiles, "profile", "p", nil,
+		"One or more Compose profiles to enable.")
+	cmd.Flags().BoolVarP(&opts.Push, "push", "P", false,
+		"Push built images to the registry after building. (default false)")
+	cmd.Flags().BoolVarP(&opts.NoCache, "no-cache", "n", false,
+		"Do not use cache when building images. (default false)")
+
+	return cmd
+}
+
+// TODO: deduplicate with a similar functino for deploy options
+// projectOpts returns the project options for the Compose file(s).
+func projectOptsFromBuildOpts(opts cli.BuildOptions) []composecli.ProjectOptionsFn {
+	projectOpts := []composecli.ProjectOptionsFn{}
+
+	if len(opts.Profiles) > 0 {
+		projectOpts = append(projectOpts, composecli.WithDefaultProfiles(opts.Profiles...))
+	}
+
+	return projectOpts
+}
+
+// runBuild parses the Compose file(s), builds the services, and pushes them if requested.
+func runBuild(ctx context.Context, uncli *cli.CLI, opts cli.BuildOptions) error {
+	projectOpts := projectOptsFromBuildOpts(opts)
+	project, err := compose.LoadProject(ctx, opts.Files, projectOpts...)
+	if err != nil {
+		return fmt.Errorf("load compose file(s): %w", err)
+	}
+
+	if len(opts.Services) > 0 {
+		project, err = project.WithSelectedServices(opts.Services)
+		if err != nil {
+			return fmt.Errorf("select services: %w", err)
+		}
+	}
+
+	servicesToBuild := cli.GetServicesThatNeedBuild(project)
+
+	if len(servicesToBuild) == 0 {
+		fmt.Println("No services to build.")
+		return nil
+	}
+
+	return cli.BuildServices(ctx, servicesToBuild, opts)
+}

cmd/uncloud/deploy.go

@@ -20,6 +20,7 @@ type deployOptions struct {
 	files    []string
 	profiles []string
 	services []string
+	noBuild  bool
 
 	context string
 }
@@ -47,6 +48,9 @@ func NewDeployCommand() *cobra.Command {
 		"One or more Compose profiles to enable.")
 	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
 		"Name of the cluster context to deploy to (default is the current context)")
+	cmd.Flags().BoolVarP(&opts.noBuild, "no-build", "n", false,
+		"Do not build images before deploying services. (default false)")
+
 	// TODO: Consider adding a filter flag to specify which machines to deploy to but keep the rest running.
 	//  Could be useful to test a new version on a subset of machines before rolling out to all.
 
@@ -81,6 +85,23 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 		}
 	}
 
+	servicesToBuild := cli.GetServicesThatNeedBuild(project)
+
+	if len(servicesToBuild) > 0 {
+		if opts.noBuild {
+			fmt.Println("Not building services as requested.")
+		} else {
+			buildOpts := cli.BuildOptions{
+				Push:    true,
+				NoCache: false,
+			}
+
+			if err := cli.BuildServices(ctx, servicesToBuild, buildOpts); err != nil {
+				return fmt.Errorf("build services: %w", err)
+			}
+		}
+	}
+
 	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)

cmd/uncloud/machine/add.go

@@ -62,8 +62,8 @@ func NewAddCommand() *cobra.Command {
 			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
 	)
 	cmd.Flags().StringVarP(
-		&opts.sshKey, "ssh-key", "i", "",
-		"path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
+		&opts.sshKey, "ssh-key", "i", "~/.ssh/id_ed25519",
+		"Path to SSH private key for remote login (if not already added to SSH agent).",
 	)
 	cmd.Flags().StringVar(
 		&opts.version, "version", "latest",
@@ -92,7 +92,7 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, o
 		publicIP = &ip
 	}
 
-	machineClient, err := uncli.AddMachine(ctx, cli.AddMachineOptions{
+	clusterClient, machineClient, err := uncli.AddMachine(ctx, cli.AddMachineOptions{
 		Context:       opts.context,
 		MachineName:   opts.name,
 		PublicIP:      publicIP,
@@ -102,6 +102,7 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, o
 	if err != nil {
 		return err
 	}
+	defer clusterClient.Close()
 	defer machineClient.Close()
 
 	if opts.noCaddy {
@@ -117,8 +118,11 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, o
 
 	// Deploy a Caddy service container to the added machine. If caddy service is already deployed on other machines,
 	// use the deployed image version. Otherwise, use the latest version.
+	// NOTE: We use the cluster client to inspect and scale the Caddy service because the newly added machine may have
+	// issues accessing the Machine API of existing machines in the cluster.
+	// See the issue for more details: https://github.com/psviderski/uncloud/issues/65.
 	caddyImage := ""
-	caddySvc, err := machineClient.InspectService(ctx, client.CaddyServiceName)
+	caddySvc, err := clusterClient.InspectService(ctx, client.CaddyServiceName)
 	if err != nil {
 		if !errors.Is(err, api.ErrNotFound) {
 			return fmt.Errorf("inspect caddy service: %w", err)
@@ -141,7 +145,7 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, o
 
 	// TODO: scale the existing Caddy service to the new machine instead of running a new deployment
 	//  that may cause a small downtime.
-	d, err := machineClient.NewCaddyDeployment(caddyImage, api.Placement{})
+	d, err := clusterClient.NewCaddyDeployment(caddyImage, api.Placement{})
 	if err != nil {
 		return fmt.Errorf("create caddy deployment: %w", err)
 	}

cmd/uncloud/machine/init.go

@@ -80,8 +80,8 @@ func NewInitCommand() *cobra.Command {
 			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
 	)
 	cmd.Flags().StringVarP(
-		&opts.sshKey, "ssh-key", "i", "",
-		"Path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
+		&opts.sshKey, "ssh-key", "i", "~/.ssh/id_ed25519",
+		"Path to SSH private key for remote login (if not already added to SSH agent).",
 	)
 	cmd.Flags().StringVar(
 		&opts.version, "version", "latest",
@@ -114,7 +114,6 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 		}
 		publicIP = &ip
 	}
-	
 	client, err := uncli.InitCluster(ctx, cli.InitClusterOptions{
 		Context:       opts.context,
 		MachineName:   opts.name,

cmd/uncloud/machine/root.go

@@ -6,8 +6,9 @@ import (
 
 func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "machine",
-		Short: "Manage machines in an Uncloud cluster.",
+		Use:     "machine",
+		Aliases: []string{"m"},
+		Short:   "Manage machines in an Uncloud cluster.",
 	}
 	cmd.AddCommand(
 		NewAddCommand(),

cmd/uncloud/main.go

@@ -75,6 +75,7 @@ func main() {
 
 	cmd.AddCommand(
 		NewDeployCommand(),
+		NewBuildCommand(),
 		caddy.NewRootCommand(),
 		cmdcontext.NewRootCommand(),
 		dns.NewRootCommand(),

cmd/uncloud/service/run.go

@@ -86,9 +86,10 @@ func NewRunCommand() *cobra.Command {
 			"Supported protocols: tcp, udp, http, https (default is tcp). If a hostname for http(s) port is not specified\n"+
 			"and a cluster domain is reserved, service-name.cluster-domain will be used as the hostname.\n"+
 			"Examples:\n"+
-			"  -p 8080/https                  Publish port 8080 as HTTPS via load balancer with default service-name.cluster-domain hostname\n"+
-			"  -p app.example.com:8080/https  Publish port 8080 as HTTPS via load balancer with custom hostname\n"+
-			"  -p 9000:8080                   Publish port 8080 as TCP port 9000 via load balancer\n"+
+			"  -p 8080/https                  Publish port 8080 as HTTPS via reverse proxy with default service-name.cluster-domain hostname\n"+
+			"  -p app.example.com:8080/https  Publish port 8080 as HTTPS via reverse proxy with custom hostname\n"+
+			// TODO: add support for publishing L4 tcp/udp ports.
+			//"  -p 9000:8080                   Publish port 8080 as TCP port 9000 via reverse proxy\n"+
 			"  -p 53:5353/udp@host            Bind UDP port 5353 to host port 53")
 	cmd.Flags().StringVar(&opts.pull, "pull", api.PullPolicyMissing,
 		fmt.Sprintf("Pull image from the registry before running service containers ('%s', '%s', '%s').",

docs/.dockerignore

@@ -0,0 +1,14 @@
+# Ignore everything and use an allowlist of what is allowed to not package any secrets by accident.
+*
+
+# Allow files and directories.
+!docs/
+!src/
+!static/
+!pkg/
+!Caddyfile
+!*.js
+!*.json
+
+# Ignore unnecessary files inside allowed directories.
+**/.DS_Store

docs/Caddyfile

@@ -0,0 +1,9 @@
+{
+    admin off
+}
+
+:8000 {
+    root * /usr/share/caddy
+    file_server
+    try_files {path} /index.html
+}

docs/Dockerfile

@@ -0,0 +1,27 @@
+# Stage 1: Base image.
+## Start with a base image containing NodeJS so we can build Docusaurus.
+FROM node:lts-alpine AS base
+## Disable colour output from yarn to make logs easier to read.
+ENV FORCE_COLOR=0
+## Enable corepack.
+RUN corepack enable
+## Set the working directory to `/opt/docusaurus`.
+WORKDIR /opt/docusaurus
+
+# Stage 2: Production build.
+FROM base AS prod
+## Set the working directory to `/opt/docusaurus`.
+WORKDIR /opt/docusaurus
+## Copy over the source code.
+COPY . /opt/docusaurus/
+## Install dependencies with `--immutable` to ensure reproducibility.
+RUN npm ci
+## Build the static site.
+RUN npm run build
+
+# Stage 3: Serve static site with Caddy.
+FROM caddy:2.10.0-alpine AS caddy
+## Copy the Caddyfile.
+COPY ./Caddyfile /etc/caddy/Caddyfile
+## Copy the Docusaurus build output.
+COPY --from=prod /opt/docusaurus/build /usr/share/caddy

docs/compose.yaml

@@ -0,0 +1,8 @@
+services:
+  uncloud-docs:
+    image: ghcr.io/psviderski/uncloud-docs:latest
+    pull_policy: always
+    user: nobody
+    x-ports:
+      - docs.uncloud.run:8000/https
+    scale: 2

docs/docs/1-overview.md

@@ -0,0 +1,115 @@
+---
+slug: /
+---
+
+# Overview
+
+Uncloud makes **self-hosting web applications** across multiple machines in production dead simple.
+
+You can connect any machines — from cloud VMs to bare metal servers (no matter where they're located) — into a secure
+private network. Then run and scale multi-service and multi-container web apps and databases across your machines using
+simple Docker-like commands and [Docker Compose](https://docs.docker.com/reference/compose-file/) files.
+
+Uncloud covers all the essentials for operating apps in production without overwhelming you with the complexity of
+traditional container orchestrators like Kubernetes or Swarm:
+
+* Initial machine and network setup
+* Zero-downtime rolling deployments
+* Health checks and automatic restarts
+* Automatic HTTPS and reverse proxy configuration
+* Scaling services across multiple machines
+* Cross-machine service communication without exposing ports to the internet
+* DNS-based service discovery
+* Load balancing
+* Persistent storage
+
+## Use cases
+
+Some of the common use cases Uncloud is a great fit for:
+
+- **Self-hosting and Homelabs**: Run your self-hosted apps on your own hardware. Start with a single machine and add
+  more as your needs grow.
+- **Outgrowing Docker Compose**: Level up your Docker Compose setup with zero-downtime deployments, replicas across
+  multiple machines for improved reliability, cross-machine service communication, automated reverse proxy management,
+  and more using the same Compose file.
+- **Small to medium web applications**: Deploy your SaaS product, websites, or personal projects with redundancy across
+  multiple machines for better reliability and your peace of mind.
+- **Hybrid setups (cloud + on-prem)**: Combine cloud VMs with on-premise for cost savings and data sovereignty — all
+  managed through the same interface.
+- **Agencies and freelancers**: Host multiple client projects with proper isolation on shared infrastructure, optimising
+  costs and resources.
+- **Edge computing**: Deploy applications closer to your users for lower latency and better performance.
+- **Dev/staging environments**: Spin up additional environments for development and testing that mirror production
+  reusing the same Compose configuration.
+
+## What makes Uncloud different
+
+Here are the design decisions that make Uncloud stand out:
+
+### Decentralised design
+
+You can think of an Uncloud cluster as a **network of Docker hosts** (machines) that are all aware of each other. All
+machines in the cluster are equal. You can connect to any of them to manage containers on any other machine in the
+cluster. If a machine or part of the network goes down, the rest of the cluster keeps running.
+
+There is no centralised control plane, so no need to worry about maintaining a quorum of machines for it. The time saved
+can be better spent developing and deploying your apps instead.
+
+### Zero-config overlay network
+
+Uncloud automatically configures and maintains a secure **WireGuard mesh network** across your machines. It handles key
+management, peer discovery, and NAT traversal without any manual configuration. This makes it easy to connect machines
+from different networks and locations, such as cloud VMs, on-premise servers, or your Raspberry Pi at home.
+
+Docker containers running on different machines get **unique IP addresses** from the cluster network so they can
+**communicate directly** as if they were on a single machine without opening up any host ports to the internet.
+
+The design and implementation were highly inspired by
+Talos [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/).
+
+### Managed DNS service
+
+Uncloud can provide **managed DNS records** like `<service-name>.<cluster-id>.cluster.uncloud.run` for your public
+services through free [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service. You can deploy a service and
+instantly access it from anywhere with a proper DNS name and HTTPS without any manual DNS configuration. This makes
+self-hosting much more accessible and simplifies the process of adding your own domain later.
+
+### No complex orchestration
+
+Uncloud operations are done using **imperative CLI commands** that have the taste of Docker and Docker Compose. The
+deployment and scaling commands can output an execution plan that describes what exactly will be changed on your cluster
+once you approve it. For example, what containers and volumes will be created or removed, and on which machines.
+
+This gives you full visibility and control over every change with **immediate feedback** when something goes wrong.
+
+### Minimal resource footprint
+
+The Uncloud daemon consists of a couple Go and Rust binaries running alongside the Docker daemon on each machine. It
+needs no more than **150 MB of RAM** and a few percent of a CPU core in small setups. This minimal overhead maximises
+the system resources available for your apps.
+
+You can run Uncloud on machines with as little as 512 MB of RAM, assuming you also need some RAM for the OS and Docker,
+as well as the apps you want to run.
+
+### Troubleshooting-friendly
+
+When something goes wrong, you can dive straight into standard Docker containers without layers of abstraction in your
+way. You can also SSH into any machine and use the regular Linux troubleshooting tools. For example, `ping` service
+containers by their service names, `curl` service endpoints, or analyse traffic between containers using `wireshark`.
+
+## Getting started
+
+Install Uncloud CLI and deploy your first app in minutes:
+
+* [Install Uncloud CLI](./2-getting-started/1-install-cli.md)
+* [Deploy demo app](./2-getting-started/2-deploy-demo-app.md)
+
+## Getting help
+
+* **Discord community**: Join our [Discord server](https://discord.gg/eR35KQJhPu) for real-time discussions, support,
+  and updates.
+* **GitHub issues**: Report bugs or request features on our [GitHub repository](https://github.com/psviderski/uncloud).
+* **Documentation**: Browse the full documentation (this website you're on) for detailed guides and references. Use
+  search to find what you need quickly.
+* **Newsletter**: Subscribe to the [newsletter](https://uncloud.run/#subscribe) for development updates and early
+  insights.

docs/docs/2-getting-started/1-install-cli.md

@@ -0,0 +1,104 @@
+# Install CLI
+
+Install the Uncloud command-line utility to manage your machines and deploy apps using `uc` commands. You will run `uc`
+locally so choose the appropriate installation method for your operating system.
+
+:::info NOTE
+
+Windows is not natively supported yet, but you can install and run `uc` in a
+[WSL](https://learn.microsoft.com/en-us/windows/wsl/) terminal by following the instructions for Linux.
+:::
+
+## Homebrew (macOS, Linux)
+
+If you have [Homebrew](https://brew.sh/) package manager installed, this is the recommended installation method on macOS
+and Linux:
+
+```shell
+brew install psviderski/tap/uncloud
+```
+
+To upgrade to the latest version:
+
+```shell
+brew upgrade uncloud
+```
+
+## Install script (macOS, Linux)
+
+For a quick automated installation, use the install script:
+
+```shell
+curl -fsS https://get.uncloud.run/install.sh | sh
+```
+
+The script will:
+
+- Detect your operating system and architecture
+- Download the appropriate latest binary from [GitHub releases](https://github.com/psviderski/uncloud/releases)
+- Install it to `/usr/local/bin/uncloud` using `sudo` (you may need to enter your user password)
+- Create a shortcut `uc` in `/usr/local/bin` for convenience
+
+Don't like `curl | sh`? You can download and review the [install script](https://get.uncloud.run/install.sh) first and
+then run it:
+
+```shell
+curl -fsSO https://get.uncloud.run/install.sh
+cat install.sh
+sh install.sh
+```
+
+## GitHub download (macOS, Linux)
+
+You can manually download and use a pre-built binary from the
+[latest release](https://github.com/psviderski/uncloud/releases/latest) on GitHub.
+
+<Tabs>
+  <TabItem value="macOS (Apple Silicon)">
+    ```shell
+    curl -L https://github.com/psviderski/uncloud/releases/latest/download/uncloud_macos_arm64.tar.gz | tar xz
+    mv uncloud uc
+    ```
+  </TabItem>
+  <TabItem value="macOS (Intel)">
+    ```shell
+    curl -L https://github.com/psviderski/uncloud/releases/latest/download/uncloud_macos_amd64.tar.gz | tar xz
+    mv uncloud uc
+    ```
+  </TabItem>
+  <TabItem value="Linux (AMD 64-bit)">
+    ```shell
+    curl -L https://github.com/psviderski/uncloud/releases/latest/download/uncloud_linux_amd64.tar.gz | tar xz
+    mv uncloud uc
+    ```
+  </TabItem>
+  <TabItem value="Linux (ARM 64-bit)">
+    ```shell
+    curl -L https://github.com/psviderski/uncloud/releases/latest/download/uncloud_linux_arm64.tar.gz | tar xz
+    mv uncloud uc
+    ```
+  </TabItem>
+</Tabs>
+
+You can use the `./uc` binary directly from the current directory, or move it to a directory in your system's `PATH`
+to run it as `uc` from any location.
+
+For example, move it to `/usr/local/bin` which is a common location for user-installed binaries:
+
+```shell
+sudo mv ./uc /usr/local/bin
+```
+
+## Verify installation
+
+After installation, verify that `uc` command is working:
+
+```shell
+uc --version
+```
+
+## Next steps
+
+Now that you have `uc` installed, you're ready to:
+
+- [Deploy demo app](./2-deploy-demo-app.md)

docs/docs/2-getting-started/2-deploy-demo-app.md

@@ -0,0 +1,315 @@
+# Deploy demo app
+
+In this guide, we'll deploy [Excalidraw](https://excalidraw.com) — a popular sketching and diagramming tool — to your
+Linux server. You'll learn the **basics of Uncloud** and see how simple it is to **run web apps** on your own
+infrastructure with secure internet access.
+
+## Prerequisites
+
+Before you begin, you'll need:
+
+- **Uncloud CLI** [installed](1-install-cli.md) on your local machine
+- A **Ubuntu or Debian server** with **public IP address** and **SSH access** (as `root` or a user with `sudo`
+  privileges) using a **private key**.
+
+:::tip Need a server?
+
+A small Virtual Private Server (VPS) or dedicated server from providers like [Hetzner](https://www.hetzner.com) or
+[DigitalOcean](https://www.digitalocean.com) is a great choice for learning Uncloud and running lightweight services. We
+recommend using a freshly installed server as existing services on ports 80 and 443 can cause conflicts.
+
+**Minimum requirements:** 1 vCPU, 512 MB RAM, Ubuntu 22.04 or Debian 11, AMD64 (recommended) or ARM64 architecture.
+Other Linux distributions may work, but haven't been tested yet.
+
+:::
+
+## Set up your server
+
+First, let's turn your server into an Uncloud **machine**. This simply means setting it up so you can deploy and manage
+services on it using `uc`.
+
+```shell
+uc machine init root@<your-server-ip>
+```
+
+If the SSH key to access your server isn't added to your [SSH agent](https://www.ssh.com/academy/ssh/agent), specify it
+with the `-i` flag:
+
+```shell
+uc machine init root@<your-server-ip> -i ~/.ssh/id_xxx
+```
+
+This command will:
+
+- Install the latest stable Docker version on your server if it's not already installed
+- Install the Uncloud daemon on your server
+- Create a Docker network for Uncloud-managed containers
+- Deploy [Caddy](https://caddyserver.com/) as your reverse proxy listening on host ports 80 and 443
+- Reserve a free `xxxxxx.cluster.uncloud.run` subdomain via the Uncloud managed DNS service and point it to your
+  server's IP
+
+All in about a minute!
+
+<details>
+<summary>💡 Expand to see example output</summary>
+
+```
+$ uc machine init root@157.180.72.195
+Downloading Uncloud install script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/install.sh
+⏳ Running Uncloud install script...
+⏳ Installing Docker...
+# Executing docker install script, commit: 53a22f61c0628e58e1d6680b49e82993d304b449
++ sh -c apt-get -qq update >/dev/null
++ sh -c DEBIAN_FRONTEND=noninteractive apt-get -y -qq install ca-certificates curl >/dev/null
++ sh -c install -m 0755 -d /etc/apt/keyrings
++ sh -c curl -fsSL "https://download.docker.com/linux/ubuntu/gpg" -o /etc/apt/keyrings/docker.asc
++ sh -c chmod a+r /etc/apt/keyrings/docker.asc
++ sh -c echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu noble stable" > /etc/apt/sources.list.d/docker.list
++ sh -c apt-get -qq update >/dev/null
++ sh -c DEBIAN_FRONTEND=noninteractive apt-get -y -qq install docker-ce docker-ce-cli containerd.io docker-compose-plugin docker-ce-rootless-extras docker-buildx-plugin >/dev/null
+
+Running kernel seems to be up-to-date.
+
+No services need to be restarted.
+
+No containers need to be restarted.
+
+No user sessions are running outdated binaries.
+
+No VM guests are running outdated hypervisor (qemu) binaries on this host.
++ sh -c docker version
+Client: Docker Engine - Community
+ Version:           28.2.1
+ API version:       1.50
+ Go version:        go1.24.3
+ Git commit:        879ac3f
+ Built:             Wed May 28 19:25:01 2025
+ OS/Arch:           linux/amd64
+ Context:           default
+
+Server: Docker Engine - Community
+ Engine:
+  Version:          28.2.1
+  API version:      1.50 (minimum version 1.24)
+  Go version:       go1.24.3
+  Git commit:       0e2cc22
+  Built:            Wed May 28 19:25:01 2025
+  OS/Arch:          linux/amd64
+  Experimental:     false
+ containerd:
+  Version:          1.7.27
+  GitCommit:        05044ec0a9a75232cad458027ca83437aae3f4da
+ runc:
+  Version:          1.2.5
+  GitCommit:        v1.2.5-0-g59923ef
+ docker-init:
+  Version:          0.19.0
+  GitCommit:        de40ad0
+
+================================================================================
+
+To run Docker as a non-privileged user, consider setting up the
+Docker daemon in rootless mode for your user:
+
+    dockerd-rootless-setuptool.sh install
+
+Visit https://docs.docker.com/go/rootless/ to learn about rootless mode.
+
+
+To run the Docker daemon as a fully privileged service, but granting non-root
+users access, refer to https://docs.docker.com/go/daemon-access/
+
+WARNING: Access to the remote API on a privileged Docker daemon is equivalent
+         to root access on the host. Refer to the 'Docker daemon attack surface'
+         documentation for details: https://docs.docker.com/go/attack-surface/
+
+================================================================================
+
+✓ Docker installed successfully.
+✓ Linux user and group 'uncloud' created.
+⏳ Installing Uncloud binaries...
+⏳ Downloading uncloudd binary: https://github.com/psviderski/uncloud/releases/latest/download/uncloudd_linux_amd64.tar.gz
+✓ uncloudd binary installed: /usr/local/bin/uncloudd
+⏳ Downloading uninstall script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/uninstall.sh
+✓ uncloud-uninstall script installed: /usr/local/bin/uncloud-uninstall
+✓ Systemd unit file created: /etc/systemd/system/uncloud.service
+Created symlink /etc/systemd/system/multi-user.target.wants/uncloud.service → /etc/systemd/system/uncloud.service.
+⏳ Downloading uncloud-corrosion binary: https://github.com/psviderski/corrosion/releases/latest/download/corrosion-x86_64-unknown-linux-gnu.tar.gz
+✓ uncloud-corrosion binary installed: /usr/local/bin/uncloud-corrosion
+✓ Systemd unit file created: /etc/systemd/system/uncloud-corrosion.service
+⏳ Starting Uncloud machine daemon (uncloud.service)...
+✓ Uncloud machine daemon started.
+✓ Uncloud installed on the machine successfully! 🎉
+Cluster initialised with machine 'machine-dc3c' and saved as context 'default' in your local config (/Users/spy/.config/uncloud/config.yaml)
+Current cluster context is now 'default'.
+Waiting for the machine to be ready...
+
+Reserved cluster domain: 7za6s7.cluster.uncloud.run
+[+] Deploying service caddy 7/2
+ ✔ Container caddy-d7uk on machine-dc3c     Started                                            6.1s
+   ✔ Image caddy:2.10.0 on machine-dc3c       Pulled                                           3.7s
+
+Updating cluster domain records in Uncloud DNS to point to machines running caddy service...
+[+] Verifying internet access to caddy service 1/1
+ ✔ Machine machine-dc3c (157.180.72.195)  Reachable                                            0.7s
+
+DNS records updated to use only the internet-reachable machines running caddy service:
+  *.7za6s7.cluster.uncloud.run  A → 157.180.72.195
+```
+
+</details>
+
+## Deploy Excalidraw
+
+Now that your machine is set up, let's deploy `excalidraw` service from the
+[official Docker image](https://hub.docker.com/r/excalidraw/excalidraw). The service will publish the container port 80
+as HTTPS endpoint on the previously reserved domain via Caddy.
+
+```shell
+uc run --name excalidraw --publish 80/https excalidraw/excalidraw
+```
+
+You'll the progress of the deployment and the public URL where you can access the service:
+
+```
+[+] Running service excalidraw (replicated mode) 2/2
+ ✔ Container excalidraw-azpc on machine-dc3c  Started                       8.9s
+   ✔ Image excalidraw/excalidraw on machine-dc3c  Pulled                    4.7s
+
+excalidraw endpoints:
+ • https://excalidraw.7za6s7.cluster.uncloud.run → :80
+```
+
+## Verify your deployment
+
+After the service is deployed, use the `uc inspect` command to check its status and details:
+
+```shell
+uc inspect excalidraw
+```
+
+```
+ID:    4d2de1600b6ada221a03896cd388836c
+Name:  excalidraw
+Mode:  replicated
+
+CONTAINER ID   IMAGE                   CREATED              STATUS                        MACHINE
+fde7ac7f11ad   excalidraw/excalidraw   About a minute ago   Up About a minute (healthy)   machine-dc3c
+```
+
+In this example, the service has one container running on the machine `machine-dc3c` (our server). The container is up
+and healthy.
+
+You can also list all deployed services and their public endpoints using the `uc ls` command:
+
+```shell
+uc ls
+```
+
+```
+NAME         MODE         REPLICAS   ENDPOINTS
+caddy        global       1
+excalidraw   replicated   1          https://excalidraw.7za6s7.cluster.uncloud.run → :80
+```
+
+You can see `caddy` service listed here. That's your reverse proxy, running as a regular Uncloud service.
+
+## It's live! Start drawing! ✨
+
+Open your browser and navigate to the URL shown in the endpoints. It may take a moment for Caddy to obtain a TLS
+certificate from Let's Encrypt. If it doesn't load immediately, wait a few seconds and try again.
+
+![Excalidraw running on Uncloud](./img/excalidraw-browser.png)
+
+You now have:
+
+- Your **own Excalidraw instance** running on your server
+- A **public URL** with **automatic HTTPS** you can share with your team and friends
+- **Full control over your data** — no analytics or tracking
+
+## Convert to Docker Compose format
+
+Uncloud supports the [Compose file format](https://docs.docker.com/reference/compose-file/) for defining services. This
+allows you to version control your deployments, share configurations with your team, and deploy complex multi-service
+applications with a single command.
+
+Let's create a `compose.yaml` file in your current directory for the `excalidraw` service we just deployed.
+
+```yaml title="compose.yaml"
+services:
+  excalidraw:
+    image: excalidraw/excalidraw
+    x-ports:
+      - 80/https
+```
+
+:::info note
+
+The `x-ports` key is an Uncloud-specific extension to the Compose file format. It allows you to specify ports that
+should be published as HTTP(S) endpoints. Uncloud automatically configures the reverse proxy (Caddy) to route traffic to
+these ports.
+
+:::
+
+Now deploy it:
+
+```shell
+uc deploy
+```
+
+```
+Services are up to date.
+```
+
+Since `excalidraw` service is already running with the same configuration, Uncloud recognises there's nothing to change.
+We've successfully converted our deployment created with `uc run` to a Compose file.
+
+## Use your own domain
+
+Want to use your own domain, for example, `excalidraw.example.com` instead of `excalidraw.7za6s7.cluster.uncloud.run`?
+
+Add a CNAME record `excalidraw.example.com` in your DNS provider (Cloudflare, Namecheap, etc.) pointing to
+`excalidraw.7za6s7.cluster.uncloud.run`. Alternatively, you can add an A record pointing to your server's IP.
+
+Then update the published port `80/https` in `compose.yaml` to use your domain:
+
+```yaml title="compose.yaml"
+...
+x-ports:
+  - excalidraw.example.com:80/https
+```
+
+Finally, deploy the changes:
+
+```shell
+uc deploy
+```
+
+```
+Deployment plan:
+- Deploy service [name=excalidraw]
+  - machine-dc3c: Run container [image=excalidraw/excalidraw]
+  - machine-dc3c: Remove container [name=excalidraw-azpc]
+
+Do you want to continue?
+
+Choose [y/N]: y
+Chose: Yes!
+
+[+] Deploying services 2/2
+ ✔ Container excalidraw-0z12 on machine-dc3c  Started                       3.5s 
+ ✔ Container excalidraw-azpc on machine-dc3c  Removed                       3.4s 
+```
+
+Notice how Uncloud performed a **zero-downtime deployment** — it started the new container with the updated
+configuration before removing the old one. Your service stayed available throughout the update.
+
+Give it a moment for Caddy to obtain a TLS certificate, then visit https://excalidraw.example.com.
+
+## Clean up
+
+TBD
+
+## Next steps
+
+TBD

docs/docs/2-getting-started/_category_.yaml

@@ -0,0 +1,4 @@
+label: Getting started
+collapsed: false # keep the category open by default
+link:
+  type: generated-index

docs/docs/overview.md

@@ -1,9 +0,0 @@
----
-slug: /
----
-
-# Overview
-
-Uncloud is lightweight tool for creating a cluster of machines running Docker and deploying web applications across
-them. It is designed to be simple and easy to use, while still providing the essential features to manage and scale
-your apps in production.

docs/docusaurus.config.js

@@ -144,8 +144,8 @@ const config = {
         ]
       },
       prism: {
-        theme: prismThemes.github,
-        darkTheme: prismThemes.dracula,
+        theme: prismThemes.palenight,
+        //darkTheme: prismThemes.dracula,
       },
     }),
 };

docs/sidebars.js

@@ -16,7 +16,7 @@
  */
 const sidebars = {
   // By default, Docusaurus generates a sidebar from the docs folder structure
-  tutorialSidebar: [{type: 'autogenerated', dirName: '.'}],
+  sidebar: [{type: 'autogenerated', dirName: '.'}],
 
   // But you can create a sidebar manually
   /*

docs/src/css/custom.css

@@ -11,26 +11,26 @@
   --ifm-font-family-base: 'Inter', sans-serif;
   --ifm-heading-font-family: 'Inter', sans-serif;
 
-  --ifm-color-primary: #2e8555;
-  --ifm-color-primary-dark: #29784c;
-  --ifm-color-primary-darker: #277148;
-  --ifm-color-primary-darkest: #205d3b;
-  --ifm-color-primary-light: #33925d;
-  --ifm-color-primary-lighter: #359962;
-  --ifm-color-primary-lightest: #3cad6e;
+  --ifm-color-primary: #006be6;
+  --ifm-color-primary-dark: #0060cf;
+  --ifm-color-primary-darker: #005bc4;
+  --ifm-color-primary-darkest: #004ba1;
+  --ifm-color-primary-light: #0076fd;
+  --ifm-color-primary-lighter: #0a7cff;
+  --ifm-color-primary-lightest: #2c8eff;
   --ifm-code-font-size: 95%;
   --docusaurus-highlighted-code-line-bg: rgba(0, 0, 0, 0.1);
 }
 
 /* For readability concerns, you should choose a lighter palette in dark mode. */
 [data-theme='dark'] {
-  --ifm-color-primary: #25c2a0;
-  --ifm-color-primary-dark: #21af90;
-  --ifm-color-primary-darker: #1fa588;
-  --ifm-color-primary-darkest: #1a8870;
-  --ifm-color-primary-light: #29d5b0;
-  --ifm-color-primary-lighter: #32d8b4;
-  --ifm-color-primary-lightest: #4fddbf;
+  --ifm-color-primary: #3391ee;
+  --ifm-color-primary-dark: #1883ec;
+  --ifm-color-primary-darker: #137be3;
+  --ifm-color-primary-darkest: #1066bb;
+  --ifm-color-primary-light: #4e9ff0;
+  --ifm-color-primary-lighter: #5ba7f1;
+  --ifm-color-primary-lightest: #83bcf5;
   --docusaurus-highlighted-code-line-bg: rgba(0, 0, 0, 0.3);
 }
 

docs/src/theme/MDXComponents.js

@@ -0,0 +1,13 @@
+import React from 'react';
+// Import the original mapper
+import MDXComponents from '@theme-original/MDXComponents';
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
+export default {
+    // Re-use the default mapping
+    ...MDXComponents,
+    // Global import the <Tabs> and <TabItem> components
+    Tabs,
+    TabItem,
+};

go.mod

@@ -213,6 +213,8 @@ require (
 	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
+	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect

internal/cli/build.go

@@ -0,0 +1,197 @@
+package cli
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+
+	composetypes "github.com/compose-spec/compose-go/v2/types"
+	"github.com/distribution/reference"
+	"github.com/docker/cli/cli/config"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/image"
+	dockerclient "github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/archive"
+	"github.com/docker/docker/registry"
+)
+
+type BuildOptions struct {
+	Files    []string
+	Profiles []string
+	Services []string
+	Push     bool
+	NoCache  bool
+}
+
+// GetServicesThatNeedBuild returns a map of services that require building
+func GetServicesThatNeedBuild(project *composetypes.Project) map[string]composetypes.ServiceConfig {
+	servicesToBuild := make(map[string]composetypes.ServiceConfig, len(project.Services))
+	for serviceName, service := range project.Services {
+		if service.Build == nil {
+			continue
+		}
+		servicesToBuild[serviceName] = service
+	}
+	return servicesToBuild
+}
+
+// BuildServices builds the services defined in the provided map.
+func BuildServices(ctx context.Context, servicesToBuild map[string]composetypes.ServiceConfig, opts BuildOptions) error {
+	fmt.Println("Building services...")
+
+	// Init docker client (can be local or remote, depending on DOCKER_HOST environment variable)
+	dockerCli, err := dockerclient.NewClientWithOpts(dockerclient.FromEnv, dockerclient.WithAPIVersionNegotiation())
+	if err != nil {
+		return err
+	}
+	defer dockerCli.Close()
+
+	serviceImages := make(map[string]string, len(servicesToBuild))
+
+	// Build the services using the local docker client and compose libraries
+	for _, service := range servicesToBuild {
+		fmt.Printf("Building service: %s\n", service.Name)
+		imageName, err := buildSingleService(ctx, dockerCli, service, opts)
+		if err != nil {
+			return fmt.Errorf("build service %s: %w", service.Name, err)
+		}
+		serviceImages[service.Name] = imageName
+	}
+	fmt.Printf("Service images are built.\n")
+
+	if opts.Push {
+		err = pushServiceImages(ctx, dockerCli, serviceImages)
+	}
+
+	return err
+}
+
+// buildSingleService builds a single service using the Docker client and Compose libraries.
+func buildSingleService(ctx context.Context, dockerCli *dockerclient.Client, service composetypes.ServiceConfig, opts BuildOptions) (string, error) {
+	if service.Build == nil {
+		return "", fmt.Errorf("service %s has no build configuration", service.Name)
+	}
+	if service.Image == "" {
+		return "", fmt.Errorf("service %s has no image specified; building services without image is not supported yet", service.Name)
+	}
+
+	buildContextPath := service.Build.Context
+	imageName := service.Image
+
+	// Create a tar archive of the build context
+	buildContext, err := archive.TarWithOptions(buildContextPath, &archive.TarOptions{})
+	if err != nil {
+		return "", fmt.Errorf("failed to create build context for service %s: %w", service.Name, err)
+	}
+
+	buildOptions := types.ImageBuildOptions{
+		// TODO: Support Dockerfiles outside the build context
+		// See https://github.com/docker/compose/blob/cf89fd1aa1328d5af77658ccc5a1e1b29981ae80/pkg/compose/build_classic.go#L92
+		Dockerfile: service.Build.Dockerfile,
+		Tags:       []string{imageName},
+		Remove:     true, // Remove intermediate containers
+		NoCache:    opts.NoCache,
+	}
+
+	buildResponse, err := dockerCli.ImageBuild(ctx, buildContext, buildOptions)
+	if err != nil {
+		return "", fmt.Errorf("failed to build image for service %s: %w", service.Name, err)
+	}
+	defer buildResponse.Body.Close()
+
+	// Print the build output
+	decoder := json.NewDecoder(buildResponse.Body)
+	for {
+		var message map[string]interface{}
+		if err := decoder.Decode(&message); err == io.EOF {
+			break
+		} else if err != nil {
+			return "", fmt.Errorf("failed to decode build output for service %s: %w", service.Name, err)
+		}
+
+		if stream, ok := message["stream"]; ok {
+			fmt.Print(stream)
+		}
+	}
+
+	return imageName, nil
+}
+
+// pushSingleServiceImage pushes a single service image.
+func pushSingleServiceImage(ctx context.Context, dockerCli *dockerclient.Client, serviceName string, imageName string) error {
+	ref, err := reference.ParseNormalizedNamed(imageName)
+	if err != nil {
+		return err
+	}
+
+	repoInfo, err := registry.ParseRepositoryInfo(ref)
+	if err != nil {
+		return err
+	}
+
+	registryKey := repoInfo.Index.Name
+	if repoInfo.Index.Official {
+		registryKey = registry.IndexServer
+	}
+
+	// Load the Docker config file with auth details, if available
+	configFile := config.LoadDefaultConfigFile(os.Stderr)
+
+	authConfig, err := configFile.GetAuthConfig(registryKey)
+	if err != nil {
+		return err
+	}
+
+	authJSON, err := json.Marshal(authConfig)
+	if err != nil {
+		return fmt.Errorf("failed to marshal auth config for registry %s: %w", registryKey, err)
+	}
+
+	authStr := base64.URLEncoding.EncodeToString(authJSON)
+
+	pushOptions := image.PushOptions{
+		RegistryAuth: authStr,
+	}
+	pushResponse, err := dockerCli.ImagePush(ctx, imageName, pushOptions)
+	if err != nil {
+		return fmt.Errorf("failed to push image %s: %w", imageName, err)
+	}
+	defer pushResponse.Close()
+
+	fmt.Printf("Pushing image %s for service %s\n", imageName, serviceName)
+
+	// Handle output and errors
+	decoder := json.NewDecoder(pushResponse)
+	for {
+		var message map[string]interface{}
+		if err := decoder.Decode(&message); err == io.EOF {
+			break
+		} else if err != nil {
+			return fmt.Errorf("failed to decode push output for image %s: %w", imageName, err)
+		}
+		if stream, ok := message["stream"]; ok {
+			fmt.Print(stream)
+		} else if errorMessage, ok := message["error"]; ok {
+			return fmt.Errorf("error pushing image %s: %s", imageName, errorMessage)
+		} else if status, ok := message["status"]; ok {
+			fmt.Printf("   %s\n", status)
+		}
+	}
+
+	fmt.Printf("Image %s pushed successfully.\n", imageName)
+	return nil
+}
+
+// pushServiceImages pushes all built service images to the registry.
+func pushServiceImages(ctx context.Context, dockerCli *dockerclient.Client, serviceImages map[string]string) error {
+	fmt.Printf("Pushing images...\n")
+	for serviceName, imageName := range serviceImages {
+		if err := pushSingleServiceImage(ctx, dockerCli, serviceName, imageName); err != nil {
+			return fmt.Errorf("push image for service %s: %w", serviceName, err)
+		}
+	}
+	return nil
+}

internal/cli/cli.go

@@ -253,22 +253,28 @@ type AddMachineOptions struct {
 	Version       string
 }
 
-// AddMachine provisions a remote machine and adds it to the cluster. It returns a client to interact with the machine
-// which should be closed after use by the caller.
-func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client.Client, error) {
+// AddMachine provisions a remote machine and adds it to the cluster. It returns a cluster client and a machine client.
+// The cluster client is connected to the existing machine in the cluster. It was used to add the new machine to the
+// cluster. The machine client is connected to the new machine and can be used to interact with it.
+// Both client should be closed after use by the caller.
+func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client.Client, *client.Client, error) {
 	contextName := opts.Context
 	if contextName == "" {
 		contextName = cli.Config.CurrentContext
 	}
 	c, err := cli.ConnectCluster(ctx, contextName)
 	if err != nil {
-		return nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
+		return nil, nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
 	}
-	defer c.Close()
+	defer func() {
+		if err != nil {
+			c.Close()
+		}
+	}()
 
 	machineClient, err := cli.provisionRemoteMachine(ctx, opts.RemoteMachine, opts.Version)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	defer func() {
 		if err != nil {
@@ -279,11 +285,11 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	// Check if the machine is already initialised as a cluster member and prompt the user to reset it first.
 	minfo, err := machineClient.Inspect(ctx, &emptypb.Empty{})
 	if err != nil {
-		return nil, fmt.Errorf("inspect machine: %w", err)
+		return nil, nil, fmt.Errorf("inspect machine: %w", err)
 	}
 	if minfo.Id != "" {
 		if err = cli.promptResetMachine(); err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 	}
 
@@ -292,19 +298,19 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	// TODO(lhf): remove Unimplemented check when v0.9.0 is released.
 	if err != nil {
 		if status.Convert(err).Code() != codes.Unimplemented {
-			return nil, fmt.Errorf("check machine prerequisites: %w", err)
+			return nil, nil, fmt.Errorf("check machine prerequisites: %w", err)
 		}
 	} else if !checkResp.Satisfied {
-		return nil, fmt.Errorf("machine prerequisites not satisfied: %s", checkResp.Error)
+		return nil, nil, fmt.Errorf("machine prerequisites not satisfied: %s", checkResp.Error)
 	}
 
 	tokenResp, err := machineClient.Token(ctx, &emptypb.Empty{})
 	if err != nil {
-		return nil, fmt.Errorf("get remote machine token: %w", err)
+		return nil, nil, fmt.Errorf("get remote machine token: %w", err)
 	}
 	token, err := machine.ParseToken(tokenResp.Token)
 	if err != nil {
-		return nil, fmt.Errorf("parse remote machine token: %w", err)
+		return nil, nil, fmt.Errorf("parse remote machine token: %w", err)
 	}
 
 	// Register the machine in the cluster using its public key and endpoints from the token.
@@ -330,13 +336,13 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 
 	addResp, err := c.AddMachine(ctx, addReq)
 	if err != nil {
-		return nil, fmt.Errorf("add machine to cluster (context '%s'): %w", contextName, err)
+		return nil, nil, fmt.Errorf("add machine to cluster (context '%s'): %w", contextName, err)
 	}
 
 	// List other machines in the cluster to include them in the join request.
 	machines, err := c.ListMachines(ctx, nil)
 	if err != nil {
-		return nil, fmt.Errorf("list cluster machines: %w", err)
+		return nil, nil, fmt.Errorf("list cluster machines: %w", err)
 	}
 	otherMachines := make([]*pb.MachineInfo, 0, len(machines)-1)
 	for _, m := range machines {
@@ -351,7 +357,7 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 		OtherMachines: otherMachines,
 	}
 	if _, err = machineClient.JoinCluster(ctx, joinReq); err != nil {
-		return nil, fmt.Errorf("join cluster: %w", err)
+		return nil, nil, fmt.Errorf("join cluster: %w", err)
 	}
 
 	// TODO: fix empty context name when using the current context (contextName == "").
@@ -367,10 +373,10 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	}
 	cli.Config.Contexts[contextName].Connections = append(cli.Config.Contexts[contextName].Connections, connCfg)
 	if err = cli.Config.Save(); err != nil {
-		return nil, fmt.Errorf("save config: %w", err)
+		return nil, nil, fmt.Errorf("save config: %w", err)
 	}
 
-	return machineClient, nil
+	return c, machineClient, nil
 }
 
 // provisionRemoteMachine installs the Uncloud daemon and dependencies on the remote machine over SSH and returns

internal/machine/caddyconfig/config.go

@@ -1,4 +1,4 @@
-package caddyfile
+package caddyconfig
 
 import (
 	"encoding/json"
@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"slices"
 	"strconv"
+	"time"
 
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
@@ -64,6 +65,8 @@ func GenerateConfig(containers []api.ServiceContainer, verifyResponse string) (*
 	servers := make(map[string]*caddyhttp.Server)
 	servers["http"] = &caddyhttp.Server{
 		Listen: []string{fmt.Sprintf(":%d", caddyhttp.DefaultHTTPPort)},
+		// All http requests to this server are logged to the default logger.
+		Logs: &caddyhttp.ServerLogConfig{},
 		Routes: append(
 			hostUpstreamsToRoutes(httpHostUpstreams, &warnings),
 			// Add a route to respond with a static verification response at the /.uncloud-verify path.
@@ -72,6 +75,8 @@ func GenerateConfig(containers []api.ServiceContainer, verifyResponse string) (*
 	}
 	servers["https"] = &caddyhttp.Server{
 		Listen: []string{fmt.Sprintf(":%d", caddyhttp.DefaultHTTPSPort)},
+		// All https requests to this server are logged to the default logger.
+		Logs:   &caddyhttp.ServerLogConfig{},
 		Routes: hostUpstreamsToRoutes(httpsHostUpstreams, &warnings),
 	}
 
@@ -112,6 +117,16 @@ func hostUpstreamsToRoutes(hostUpstreams map[string][]string, warnings *[]caddyc
 			}
 		}
 		handler := &reverseproxy.Handler{
+			HealthChecks: &reverseproxy.HealthChecks{
+				// Enable passive health checks to automatically detect unhealthy upstreams.
+				Passive: &reverseproxy.PassiveHealthChecks{
+					FailDuration: caddy.Duration(30 * time.Second),
+				},
+			},
+			LoadBalancing: &reverseproxy.LoadBalancing{
+				// Retry failed requests to skip over temporarily unavailable upstreams.
+				Retries: 3,
+			},
 			Upstreams: upstreamPool,
 		}
 

internal/machine/caddyconfig/config_test.go

@@ -1,4 +1,4 @@
-package caddyfile
+package caddyconfig
 
 import (
 	"strings"
@@ -25,10 +25,12 @@ func TestGenerateConfig(t *testing.T) {
 						"handler": "static_response",
 						"status_code": 200
 					}]
-				}]
+				}],
+				"logs": {}
 			},
 			"https": {
-				"listen": [":443"]
+				"listen": [":443"],
+				"logs": {}
 			}
 		}
 	}`
@@ -60,6 +62,14 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [{"dial": "10.210.0.2:8080"}]
                                 }]
                             },
@@ -71,10 +81,12 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     },
                     "https": {
-                        "listen": [":443"]
+                        "listen": [":443"],
+						"logs": {}
                     }
                 }
             }`,
@@ -95,6 +107,14 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [
                                         {"dial": "10.210.0.2:8080"},
                                         {"dial": "10.210.0.3:8080"}
@@ -109,10 +129,12 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     },
                     "https": {
-                        "listen": [":443"]
+                        "listen": [":443"],
+						"logs": {}
                     }
                 }
             }`,
@@ -136,7 +158,8 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     },
                     "https": {
                         "listen": [":443"],
@@ -145,10 +168,19 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["secure.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [{"dial": "10.210.0.2:8000"}]
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     }
                 }
             }`,
@@ -180,6 +212,14 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [
 										{"dial": "10.210.0.2:8080"},
 										{"dial": "10.210.0.3:8080"},
@@ -191,6 +231,14 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["web.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [
 										{"dial": "10.210.0.2:8000"},
 										{"dial": "10.210.0.4:8000"},
@@ -206,7 +254,8 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     },
                     "https": {
                         "listen": [":443"],
@@ -215,6 +264,14 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["secure.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [
 										{"dial": "10.210.0.3:8888"},
 										{"dial": "10.210.0.4:8888"},
@@ -222,7 +279,8 @@ func TestGenerateConfig(t *testing.T) {
 									]
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     }
                 }
             }`,
@@ -286,6 +344,14 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [{"dial": "10.210.0.2:8080"}]
                                 }]
                             },
@@ -297,10 +363,12 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     },
                     "https": {
-                        "listen": [":443"]
+                        "listen": [":443"],
+						"logs": {}
                     }
                 }
             }`,

internal/machine/caddyconfig/controller.go

@@ -1,4 +1,4 @@
-package caddyfile
+package caddyconfig
 
 import (
 	"context"
@@ -19,7 +19,7 @@ const (
 )
 
 // Controller monitors container changes in the cluster store and generates a configuration file for Caddy reverse
-// proxy. The generated Caddyfile allows Caddy to route external traffic to service containers across the internal
+// proxy. The generated configuration allows Caddy to route external traffic to service containers across the internal
 // network.
 type Controller struct {
 	store          *store.Store

internal/machine/machine.go

@@ -21,7 +21,7 @@ import (
 	"github.com/psviderski/uncloud/internal/fs"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	apiproxy "github.com/psviderski/uncloud/internal/machine/api/proxy"
-	"github.com/psviderski/uncloud/internal/machine/caddyfile"
+	"github.com/psviderski/uncloud/internal/machine/caddyconfig"
 	"github.com/psviderski/uncloud/internal/machine/cluster"
 	"github.com/psviderski/uncloud/internal/machine/corroservice"
 	"github.com/psviderski/uncloud/internal/machine/dns"
@@ -384,7 +384,7 @@ func (m *Machine) Run(ctx context.Context) error {
 
 					// Create a new Caddyfile controller for managing the Caddy reverse proxy configuration.
 					// It will also serve the current machine ID at /.uncloud-verify to verify Caddy reachability.
-					caddyfileCtrl, err := caddyfile.NewController(m.store, m.config.CaddyConfigPath, m.state.ID)
+					caddyfileCtrl, err := caddyconfig.NewController(m.store, m.config.CaddyConfigPath, m.state.ID)
 					if err != nil {
 						return fmt.Errorf("create Caddyfile controller: %w", err)
 					}

internal/machine/network.go

@@ -14,7 +14,7 @@ import (
 	"github.com/cenkalti/backoff/v4"
 	"github.com/docker/docker/client"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
-	"github.com/psviderski/uncloud/internal/machine/caddyfile"
+	"github.com/psviderski/uncloud/internal/machine/caddyconfig"
 	"github.com/psviderski/uncloud/internal/machine/corroservice"
 	"github.com/psviderski/uncloud/internal/machine/dns"
 	"github.com/psviderski/uncloud/internal/machine/docker"
@@ -39,7 +39,7 @@ type networkController struct {
 	server        *grpc.Server
 	corroService  corroservice.Service
 	dockerCli     *client.Client
-	caddyfileCtrl *caddyfile.Controller
+	caddyfileCtrl *caddyconfig.Controller
 
 	// dnsServer is the embedded internal DNS server for the cluster listening on the machine IP.
 	dnsServer   *dns.Server
@@ -52,7 +52,7 @@ func newNetworkController(
 	server *grpc.Server,
 	corroService corroservice.Service,
 	dockerCli *client.Client,
-	caddyfileCtrl *caddyfile.Controller,
+	caddyfileCtrl *caddyconfig.Controller,
 	dnsServer *dns.Server,
 	dnsResolver *dns.ClusterResolver,
 ) (

internal/sshexec/ssh.go

@@ -7,6 +7,7 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/psviderski/uncloud/internal/fs"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
 )
@@ -63,6 +64,7 @@ func sshAgentAuth() (ssh.AuthMethod, func(), error) {
 }
 
 func privateKeyAuth(path string) (ssh.AuthMethod, error) {
+	path = fs.ExpandHomeDir(path)
 	key, err := os.ReadFile(path)
 	if err != nil {
 		return nil, fmt.Errorf("read private key file %q: %w", path, err)

internal/ucind/cluster.go

@@ -12,6 +12,7 @@ import (
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/api/types/network"
 	dockerclient "github.com/docker/docker/client"
+	"github.com/docker/go-connections/nat"
 	"github.com/psviderski/uncloud/internal/machine"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/machine/cluster"
@@ -30,6 +31,8 @@ type Cluster struct {
 
 type CreateClusterOptions struct {
 	Machines int
+	// Ports to forward from the cluster machines to the host.
+	PortMap nat.PortMap
 }
 
 func (c *Cluster) PopulateMachineIDs(ctx context.Context) error {
@@ -72,7 +75,7 @@ func (p *Provisioner) CreateCluster(ctx context.Context, name string, opts Creat
 			ManagedLabel:     "",
 		},
 	}
-	// Create a Docker network with the same as the cluster name.
+	// Create a Docker network with the same name as the cluster name.
 	if _, err = p.dockerCli.NetworkCreate(ctx, name, netOpts); err != nil {
 		return c, fmt.Errorf("create Docker network '%s': %w", name, err)
 	}
@@ -81,7 +84,8 @@ func (p *Provisioner) CreateCluster(ctx context.Context, name string, opts Creat
 	// Create machines (containers) in the created cluster network.
 	for i := 1; i < opts.Machines+1; i++ {
 		mopts := CreateMachineOptions{
-			Name: fmt.Sprintf("machine-%d", i),
+			Name:    fmt.Sprintf("machine-%d", i),
+			PortMap: opts.PortMap,
 		}
 		m, err := p.CreateMachine(ctx, name, mopts)
 		if err != nil {

internal/ucind/machine.go

@@ -42,6 +42,8 @@ func (m *Machine) Connect(ctx context.Context) (*client.Client, error) {
 type CreateMachineOptions struct {
 	Name  string
 	Image string
+	// Ports to forward from the machine to the host.
+	PortMap nat.PortMap
 }
 
 func (p *Provisioner) CreateMachine(ctx context.Context, clusterName string, opts CreateMachineOptions) (Machine, error) {
@@ -88,6 +90,16 @@ func (p *Provisioner) CreateMachine(ctx context.Context, clusterName string, opt
 			Name: container.RestartPolicyAlways,
 		},
 	}
+	// Forward ports, if requested
+	if opts.PortMap != nil {
+		for port, bindings := range opts.PortMap {
+			if len(bindings) == 0 {
+				continue
+			}
+			config.ExposedPorts[port] = struct{}{}
+			hostConfig.PortBindings[port] = bindings
+		}
+	}
 
 	if _, err := p.createContainerWithImagePull(ctx, containerName, config, hostConfig); err != nil {
 		return m, err
@@ -160,10 +172,7 @@ func (p *Provisioner) waitPortPublished(ctx context.Context, containerID string,
 		}
 
 		binding, ok := c.NetworkSettings.Ports[port]
-		if !ok {
-			return nil, fmt.Errorf("port '%s' not published", port)
-		}
-		if len(binding) > 0 {
+		if ok && len(binding) > 0 {
 			return binding, nil
 		}
 
@@ -196,7 +205,7 @@ func WaitMachineReady(ctx context.Context, m Machine, timeout time.Duration) err
 
 	boff := backoff.WithContext(backoff.NewExponentialBackOff(
 		backoff.WithInitialInterval(100*time.Millisecond),
-		backoff.WithMaxInterval(1*time.Second),
+		backoff.WithMaxInterval(10*time.Second),
 		backoff.WithMaxElapsedTime(timeout),
 	), ctx)
 

pkg/client/dns.go

@@ -7,7 +7,7 @@ import (
 	"github.com/cenkalti/backoff/v4"
 	"github.com/docker/compose/v2/pkg/progress"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
-	"github.com/psviderski/uncloud/internal/machine/caddyfile"
+	"github.com/psviderski/uncloud/internal/machine/caddyconfig"
 	"github.com/psviderski/uncloud/pkg/api"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -110,7 +110,7 @@ func verifyCaddyReachable(ctx context.Context, m *pb.MachineInfo) error {
 	eventID := fmt.Sprintf("Machine %s (%s)", m.Name, publicIP)
 	pw.Event(progress.NewEvent(eventID, progress.Working, "Querying"))
 
-	verifyURL := fmt.Sprintf("http://%s%s", publicIP, caddyfile.VerifyPath)
+	verifyURL := fmt.Sprintf("http://%s%s", publicIP, caddyconfig.VerifyPath)
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, verifyURL, nil)
 	if err != nil {

scripts/docker/entrypoint.sh

@@ -6,7 +6,7 @@ cleanup() {
     echo "Terminating container processes..."
 
     # Terminate the main process if it has been started.
-    if [ -n "$MAIN_PID" ]; then
+    if [ -n "${MAIN_PID:-}" ]; then
         kill "$MAIN_PID" 2>/dev/null || true
     fi
 

test/e2e/compose_build_test.go

@@ -0,0 +1,163 @@
+package e2e
+
+import (
+	"context"
+	"fmt"
+	"path"
+	"strconv"
+	"testing"
+
+	composecli "github.com/compose-spec/compose-go/v2/cli"
+	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/docker/docker/api/types/image"
+	dockerclient "github.com/docker/docker/client"
+	"github.com/docker/go-connections/nat"
+	"github.com/google/go-containerregistry/pkg/name"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/psviderski/uncloud/internal/cli"
+	cliInternal "github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/ucind"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client/compose"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestComposeBuild(t *testing.T) {
+	t.Parallel()
+
+	clusterName := "ucind-test.compose-build"
+	ctx := context.Background()
+
+	registryInternalPort := "5000/tcp"
+	clusterOpts := ucind.CreateClusterOptions{
+		Machines: 1,
+		PortMap: nat.PortMap{
+			// Forwarding the registry port to the host.
+			nat.Port(registryInternalPort): []nat.PortBinding{
+				{
+					HostIP: "127.0.0.1",
+					// Host port is a random available port.
+				},
+			},
+		},
+	}
+	c, _ := createTestCluster(t, clusterName, clusterOpts, true)
+
+	machine := c.Machines[0]
+	client, err := machine.Connect(ctx)
+	require.NoError(t, err)
+
+	// Get the (random) assigned host port for the future registry service
+	dockerCli, err := dockerclient.NewClientWithOpts(dockerclient.FromEnv, dockerclient.WithAPIVersionNegotiation())
+	require.NoError(t, err)
+	containerInfo, err := dockerCli.ContainerInspect(ctx, machine.ContainerName)
+	require.NoError(t, err)
+	portMap := containerInfo.NetworkSettings.Ports
+	registryHostPortStr := portMap[nat.Port(registryInternalPort)][0].HostPort
+	registryHostPort, err := strconv.Atoi(registryHostPortStr)
+	require.NoError(t, err)
+	assert.True(t, registryHostPort > 0, "Expected host port to be a valid number")
+
+	t.Run("build and push images for a basic project", func(t *testing.T) {
+		t.Parallel()
+
+		registryServiceName := "registry"
+		t.Cleanup(func() {
+			removeServices(t, client, registryServiceName)
+		})
+
+		// Start registry
+		resp, err := client.RunService(ctx, api.ServiceSpec{
+			Name: registryServiceName,
+			Mode: api.ServiceModeReplicated,
+			Container: api.ContainerSpec{
+				Image: "registry:2",
+			},
+			Ports: []api.PortSpec{
+				{
+					ContainerPort: 5000,
+					PublishedPort: 5000,
+					Mode:          api.PortModeHost,
+					Protocol:      api.ProtocolTCP,
+				},
+			},
+		})
+		require.NoError(t, err)
+		assert.NotEmpty(t, resp.ID)
+		assert.Equal(t, "registry", resp.Name)
+
+		project, err := compose.LoadProject(
+			ctx,
+			[]string{"fixtures/compose-build-basic/compose.yaml"},
+			composecli.WithEnv([]string{
+				fmt.Sprintf("TEST_REGISTRY_PORT=%s", registryHostPortStr),
+			}),
+		)
+		require.NoError(t, err)
+		servicesToBuild := cliInternal.GetServicesThatNeedBuild(project)
+		serviceImage1 := fmt.Sprintf("127.0.0.1:%d/service-first", registryHostPort)
+		serviceImage2 := fmt.Sprintf("127.0.0.1:%d/service-second:version2", registryHostPort)
+		t.Cleanup(func() {
+			// Remove the images after the test
+			removeOptions := image.RemoveOptions{Force: true, PruneChildren: true}
+			_, err := dockerCli.ImageRemove(ctx, serviceImage1, removeOptions)
+			assert.NoErrorf(t, err, "failed to remove image %s on test cleanup: %w", serviceImage1, err)
+			_, err = dockerCli.ImageRemove(ctx, serviceImage2, removeOptions)
+			assert.NoErrorf(t, err, "failed to remove image %s on test cleanup: %w", serviceImage2, err)
+		})
+
+		servicesToBuildExpected := map[string]types.ServiceConfig{
+			"service-first": {
+				Name: "service-first",
+				Build: &types.BuildConfig{
+					Context:    path.Join(project.WorkingDir, "service-first-dir"),
+					Dockerfile: "Dockerfile",
+				},
+				Image:       serviceImage1,
+				Environment: types.NewMappingWithEquals([]string{}),
+				Networks: map[string]*types.ServiceNetworkConfig{
+					"default": nil,
+				},
+			},
+			"service-second": {
+				Name: "service-second",
+				Build: &types.BuildConfig{
+					Context:    path.Join(project.WorkingDir, "service-second-dir"),
+					Dockerfile: "Dockerfile.alt",
+				},
+				Image:       serviceImage2,
+				Environment: types.NewMappingWithEquals([]string{}),
+				Networks: map[string]*types.ServiceNetworkConfig{
+					"default": nil,
+				},
+			},
+		}
+		assert.Equal(t, servicesToBuildExpected, servicesToBuild)
+
+		// Build and push the images
+		buildOpts := cli.BuildOptions{
+			Push:    true,
+			NoCache: false,
+		}
+		cli.BuildServices(context.Background(), servicesToBuild, buildOpts)
+
+		// Check the image of the first service
+		ref1, err := name.NewRepository(fmt.Sprintf("127.0.0.1:%d/service-first", registryHostPort))
+		require.NoError(t, err)
+		tags, err := remote.List(ref1)
+		require.NoError(t, err)
+
+		assert.Equal(t, tags, []string{"latest"}, "Tags for service service-first do not match")
+
+		// Check the image of the second service
+		ref2, err := name.NewRepository(fmt.Sprintf("127.0.0.1:%d/service-second", registryHostPort))
+		require.NoError(t, err)
+		tags, err = remote.List(ref2)
+		require.NoError(t, err)
+
+		assert.Equal(t, tags, []string{"version2"}, "Tags for service service-second do not match")
+
+	})
+}

test/e2e/compose_deploy_test.go

@@ -16,7 +16,7 @@ import (
 func TestComposeDeployment(t *testing.T) {
 	t.Parallel()
 
-	clusterName := "ucind-test.compose"
+	clusterName := "ucind-test.compose-deploy"
 	ctx := context.Background()
 	c, _ := createTestCluster(t, clusterName, ucind.CreateClusterOptions{Machines: 3}, true)
 

test/e2e/fixtures/compose-build-basic/compose.yaml

@@ -0,0 +1,14 @@
+services:
+  service-no-build:
+    image: portainer/pause:3.9
+
+  service-first:
+    image: 127.0.0.1:${TEST_REGISTRY_PORT}/service-first
+    build:
+      context: service-first-dir/
+
+  service-second:
+    image: 127.0.0.1:${TEST_REGISTRY_PORT}/service-second:version2
+    build:
+      context: service-second-dir/
+      dockerfile: Dockerfile.alt

test/e2e/fixtures/compose-build-basic/service-first-dir/Dockerfile

@@ -0,0 +1,3 @@
+FROM portainer/pause:3.9
+
+ENV SERVICE_NAME=service-first

test/e2e/fixtures/compose-build-basic/service-second-dir/Dockerfile.alt

@@ -0,0 +1,3 @@
+FROM portainer/pause:3.9
+
+ENV SERVICE_NAME=service-second

website/index.html

@@ -3,9 +3,9 @@
 
 <head>
     <meta charset="utf-8">
-    <title>Deploy and scale Docker apps on your infrastructure without Kubernetes | Uncloud</title>
+    <title>Self-host and scale web apps without Kubernetes complexity | Uncloud</title>
     <meta name="description"
-          content="Uncloud helps you deploy container applications on your infrastructure — from cloud VMs to bare metal. Replace Heroku and Render, no Kubernetes required.">
+          content="Take your Docker Compose apps to production with zero-downtime deployments, automatic HTTPS, and cross-machine scaling. Self-hosting made reliable without the complexity.">
     <meta name="viewport" content="width=device-width,initial-scale=1">
     <link href="./style.css" rel="stylesheet">
     <link rel="apple-touch-icon" href="./images/apple-touch-icon.png" sizes="180x180"/>
@@ -14,11 +14,11 @@
 
     <!-- OpenGraph tags for social media -->
     <meta property="og:title"
-          content="Deploy and scale Docker apps on your infrastructure without Kubernetes | Uncloud"/>
+          content="Self-host and scale web apps without Kubernetes complexity | Uncloud"/>
     <meta property="og:description"
-          content="Uncloud helps you deploy container applications on your infrastructure — from cloud VMs to bare metal. Replace Heroku and Render, no Kubernetes required."/>
+          content="Take your Docker Compose apps to production with zero-downtime deployments, automatic HTTPS, and cross-machine scaling. Self-hosting made reliable without the complexity."/>
     <meta property="og:image" content="https://uncloud.run/images/logo-wide.png"/>
-    <meta property="og:image:alt" content="Uncloud logo - Deploy container apps with ease"/>
+    <meta property="og:image:alt" content="Uncloud logo - Self-host web apps with ease"/>
     <meta property="og:url" content="https://uncloud.run"/>
     <meta property="og:type" content="website"/>
     <meta property="og:site_name" content="Uncloud"/>
@@ -27,11 +27,11 @@
     <meta property="twitter:url" content="https://uncloud.run">
     <meta name="twitter:card" content="summary_large_image">
     <meta name="twitter:title"
-          content="Deploy and scale Docker apps on your infrastructure without Kubernetes | Uncloud">
+          content="Self-host and scale web apps without Kubernetes complexity | Uncloud">
     <meta name="twitter:description"
-          content="Uncloud helps you deploy container applications on your infrastructure — from cloud VMs to bare metal. Replace Heroku and Render, no Kubernetes required.">
+          content="Take your Docker Compose apps to production with zero-downtime deployments, automatic HTTPS, and cross-machine scaling. Self-hosting made reliable without the complexity.">
     <meta name="twitter:image" content="https://uncloud.run/images/logo-wide.png">
-    <meta name="twitter:image:alt" content="Uncloud logo - Deploy container apps with ease">
+    <meta name="twitter:image:alt" content="Uncloud logo - Self-host web apps with ease">
 </head>
 
 <body class="font-inter antialiased bg-white text-zinc-900 tracking-tight">
@@ -54,6 +54,17 @@
                 <!-- Navigation links -->
                 <nav class="flex grow">
                     <ul class="flex grow justify-end flex-wrap items-center">
+                        <li>
+                            <a class="text-sm font-medium text-zinc-500 hover:text-zinc-900 px-3 lg:px-5 py-2 flex items-center transition"
+                               href="https://docs.uncloud.run">
+                                <svg class="w-4 h-4 mr-1 fill-current hidden sm:inline"
+                                     xmlns="http://www.w3.org/2000/svg"
+                                     viewBox="0 0 24 24">
+                                    <path d="M14,2H6A2,2 0 0,0 4,4V20A2,2 0 0,0 6,22H18A2,2 0 0,0 20,20V8L14,2M18,20H6V4H13V9H18V20Z"/>
+                                </svg>
+                                <span class="ml-1">Docs</span>
+                            </a>
+                        </li>
                         <li>
                             <a class="text-sm font-medium text-zinc-500 hover:text-zinc-900 px-3 lg:px-5 py-2 flex items-center transition"
                                href="https://discord.gg/eR35KQJhPu">
@@ -98,18 +109,18 @@
                     <div class="max-w-3xl mx-auto">
                         <div class="text-center pb-12 md:pb-16">
                             <h1 class="font-inter-tight text-4xl md:text-5xl font-bold bg-clip-text text-transparent bg-gradient-to-r from-zinc-500 via-zinc-900 to-zinc-900 pb-4">
-                                Keep your infrastructure simple<br>
-                                Deploy and manage containers with joy
+                                Self-host and scale web apps<br>
+                                without the complexity
                             </h1>
                             <p class="text-lg text-zinc-500 mb-8">
-                                Uncloud is a lightweight Docker clustering tool for running and scaling web apps on your
-                                servers — from cloud VMs to bare metal. No Kubernetes required.
+                                Take your Docker Compose apps to production with zero-downtime deployments, automatic
+                                HTTPS, and cross-machine scaling. No Kubernetes required.
                             </p>
                             <div class="max-w-xs mx-auto sm:max-w-none sm:inline-flex sm:justify-center space-y-4 sm:space-y-0 sm:space-x-4">
                                 <div>
                                     <a class="btn text-zinc-100 bg-zinc-900 hover:bg-zinc-800 w-full shadow"
                                        href="https://github.com/psviderski/uncloud/?tab=readme-ov-file#-quick-start">
-                                        Quick Start
+                                        Deploy in 2 minutes
                                     </a>
                                 </div>
                                 <div>
@@ -634,50 +645,105 @@
     <!-- Site footer -->
     <footer>
         <div class="max-w-6xl mx-auto px-4 sm:px-6">
-            <div class="flex flex-col items-center py-8 md:py-12 border-t border-zinc-200">
-                <div class="text-sm text-zinc-500">
-                    Made with ❤️ by
-                    <a class="underline hover:text-zinc-900" href="https://github.com/psviderski">Pasha Sviderski</a>
-                    in Australia
+            <!-- Top area: Blocks -->
+            <div class="grid sm:grid-cols-12 gap-8 py-8 md:py-12 border-t border-zinc-200">
+                <!-- 1st block - Brand -->
+                <div class="sm:col-span-6 md:col-span-6 lg:col-span-8 max-md:order-1 flex flex-col">
+                    <div class="mb-4">
+                        <!-- Logo -->
+                        <a class="flex items-center" href="index.html">
+                            <img class="w-8 h-8 rounded shadow-sm shadow-zinc-950/20" src="./images/logo.svg"
+                                 alt="Logo">
+                            <span class="ml-2 font-semibold text-lg text-zinc-900">uncloud</span>
+                        </a>
+                    </div>
+                    <div class="grow text-sm text-zinc-500">
+                        Made with ❤️ by
+                        <a class="underline hover:text-zinc-900" href="https://github.com/psviderski">
+                            Pasha Sviderski
+                        </a>
+                        in Australia
+                    </div>
+
+                    <!-- Social links -->
+                    <ul class="flex space-x-4 mt-4 mb-1">
+                        <li>
+                            <a class="flex justify-center items-center text-zinc-700 hover:text-zinc-900 transition"
+                               href="https://discord.gg/eR35KQJhPu" aria-label="Discord">
+                                <svg class="fill-current" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"
+                                     width="20"
+                                     height="20">
+                                    <path d="M20.317 4.3698a19.7913 19.7913 0 00-4.8851-1.5152.0741.0741 0 00-.0785.0371c-.211.3753-.4447.8648-.6083 1.2495-1.8447-.2762-3.68-.2762-5.4868 0-.1636-.3933-.4058-.8742-.6177-1.2495a.077.077 0 00-.0785-.037 19.7363 19.7363 0 00-4.8852 1.515.0699.0699 0 00-.0321.0277C.5334 9.0458-.319 13.5799.0992 18.0578a.0824.0824 0 00.0312.0561c2.0528 1.5076 4.0413 2.4228 5.9929 3.0294a.0777.0777 0 00.0842-.0276c.4616-.6304.8731-1.2952 1.226-1.9942a.076.076 0 00-.0416-.1057c-.6528-.2476-1.2743-.5495-1.8722-.8923a.077.077 0 01-.0076-.1277c.1258-.0943.2517-.1923.3718-.2914a.0743.0743 0 01.0776-.0105c3.9278 1.7933 8.18 1.7933 12.0614 0a.0739.0739 0 01.0785.0095c.1202.099.246.1981.3728.2924a.077.077 0 01-.0066.1276 12.2986 12.2986 0 01-1.873.8914.0766.0766 0 00-.0407.1067c.3604.698.7719 1.3628 1.225 1.9932a.076.076 0 00.0842.0286c1.961-.6067 3.9495-1.5219 6.0023-3.0294a.077.077 0 00.0313-.0552c.5004-5.177-.8382-9.6739-3.5485-13.6604a.061.061 0 00-.0312-.0286zM8.02 15.3312c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9555-2.4189 2.157-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.9555 2.4189-2.1569 2.4189zm7.9748 0c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9554-2.4189 2.1569-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.946 2.4189-2.1568 2.4189Z"/>
+                                </svg>
+                            </a>
+                        </li>
+                        <li>
+                            <a class="flex justify-center items-center text-zinc-700 hover:text-zinc-900 transition"
+                               href="https://x.com/psviderski" aria-label="X/Twitter">
+                                <svg class="fill-current" xmlns="http://www.w3.org/2000/svg" width="20" height="20">
+                                    <path d="m7.063 3 3.495 4.475L14.601 3h2.454l-5.359 5.931L18 17h-4.938l-3.866-4.893L4.771 17H2.316l5.735-6.342L2 3h5.063Zm-.74 1.347H4.866l8.875 11.232h1.36L6.323 4.347Z"/>
+                                </svg>
+                            </a>
+                        </li>
+                        <li>
+                            <a class="flex justify-center items-center text-zinc-700 hover:text-zinc-900 transition"
+                               href="https://t.me/spyyy" aria-label="Telegram">
+                                <svg class="fill-current" xmlns="http://www.w3.org/2000/svg" width="20" height="20">
+                                    <path d="M17.968 3.276a.338.338 0 0 0-.232-.253 1.192 1.192 0 0 0-.63.045S3.087 8.106 2.286 8.664c-.172.121-.23.19-.259.272-.138.4.293.573.293.573l3.613 1.177a.388.388 0 0 0 .183-.011c.822-.519 8.27-5.222 8.7-5.38.068-.02.118 0 .1.049-.172.6-6.606 6.319-6.64 6.354a.138.138 0 0 0-.05.118l-.337 3.528s-.142 1.1.956 0a30.66 30.66 0 0 1 1.9-1.738c1.242.858 2.58 1.806 3.156 2.3a1 1 0 0 0 .732.283.825.825 0 0 0 .7-.622S17.894 5.292 17.98 3.909c.008-.135.021-.217.021-.317a1.177 1.177 0 0 0-.032-.316Z"/>
+                                </svg>
+                            </a>
+                        </li>
+                        <li>
+                            <a class="flex justify-center items-center text-zinc-700 hover:text-zinc-900 transition"
+                               href="https://github.com/psviderski/uncloud" aria-label="GitHub">
+                                <svg class="fill-current" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"
+                                     width="20"
+                                     height="20">
+                                    <path d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"/>
+                                </svg>
+                            </a>
+                        </li>
+                    </ul>
                 </div>
 
-                <!-- Social links -->
-                <ul class="flex space-x-4 mt-4 mb-1">
-                    <li>
-                        <a class="flex justify-center items-center text-zinc-700 hover:text-zinc-900 transition"
-                           href="https://discord.gg/eR35KQJhPu" aria-label="Discord">
-                            <svg class="fill-current" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="20"
-                                 height="20">
-                                <path d="M20.317 4.3698a19.7913 19.7913 0 00-4.8851-1.5152.0741.0741 0 00-.0785.0371c-.211.3753-.4447.8648-.6083 1.2495-1.8447-.2762-3.68-.2762-5.4868 0-.1636-.3933-.4058-.8742-.6177-1.2495a.077.077 0 00-.0785-.037 19.7363 19.7363 0 00-4.8852 1.515.0699.0699 0 00-.0321.0277C.5334 9.0458-.319 13.5799.0992 18.0578a.0824.0824 0 00.0312.0561c2.0528 1.5076 4.0413 2.4228 5.9929 3.0294a.0777.0777 0 00.0842-.0276c.4616-.6304.8731-1.2952 1.226-1.9942a.076.076 0 00-.0416-.1057c-.6528-.2476-1.2743-.5495-1.8722-.8923a.077.077 0 01-.0076-.1277c.1258-.0943.2517-.1923.3718-.2914a.0743.0743 0 01.0776-.0105c3.9278 1.7933 8.18 1.7933 12.0614 0a.0739.0739 0 01.0785.0095c.1202.099.246.1981.3728.2924a.077.077 0 01-.0066.1276 12.2986 12.2986 0 01-1.873.8914.0766.0766 0 00-.0407.1067c.3604.698.7719 1.3628 1.225 1.9932a.076.076 0 00.0842.0286c1.961-.6067 3.9495-1.5219 6.0023-3.0294a.077.077 0 00.0313-.0552c.5004-5.177-.8382-9.6739-3.5485-13.6604a.061.061 0 00-.0312-.0286zM8.02 15.3312c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9555-2.4189 2.157-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.9555 2.4189-2.1569 2.4189zm7.9748 0c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9554-2.4189 2.1569-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.946 2.4189-2.1568 2.4189Z"/>
-                            </svg>
-                        </a>
-                    </li>
-                    <li>
-                        <a class="flex justify-center items-center text-zinc-700 hover:text-zinc-900 transition"
-                           href="https://x.com/psviderski" aria-label="Twitter">
-                            <svg class="fill-current" xmlns="http://www.w3.org/2000/svg" width="20" height="20">
-                                <path d="m7.063 3 3.495 4.475L14.601 3h2.454l-5.359 5.931L18 17h-4.938l-3.866-4.893L4.771 17H2.316l5.735-6.342L2 3h5.063Zm-.74 1.347H4.866l8.875 11.232h1.36L6.323 4.347Z"/>
-                            </svg>
-                        </a>
-                    </li>
-                    <li>
-                        <a class="flex justify-center items-center text-zinc-700 hover:text-zinc-900 transition"
-                           href="https://t.me/spyyy" aria-label="Telegram">
-                            <svg class="fill-current" xmlns="http://www.w3.org/2000/svg" width="20" height="20">
-                                <path d="M17.968 3.276a.338.338 0 0 0-.232-.253 1.192 1.192 0 0 0-.63.045S3.087 8.106 2.286 8.664c-.172.121-.23.19-.259.272-.138.4.293.573.293.573l3.613 1.177a.388.388 0 0 0 .183-.011c.822-.519 8.27-5.222 8.7-5.38.068-.02.118 0 .1.049-.172.6-6.606 6.319-6.64 6.354a.138.138 0 0 0-.05.118l-.337 3.528s-.142 1.1.956 0a30.66 30.66 0 0 1 1.9-1.738c1.242.858 2.58 1.806 3.156 2.3a1 1 0 0 0 .732.283.825.825 0 0 0 .7-.622S17.894 5.292 17.98 3.909c.008-.135.021-.217.021-.317a1.177 1.177 0 0 0-.032-.316Z"/>
-                            </svg>
-                        </a>
-                    </li>
-                    <li>
-                        <a class="flex justify-center items-center text-zinc-700 hover:text-zinc-900 transition"
-                           href="https://github.com/psviderski/uncloud" aria-label="Telegram">
-                            <svg class="fill-current" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="20"
-                                 height="20">
-                                <path d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"/>
-                            </svg>
-                        </a>
-                    </li>
-                </ul>
+                <!-- 2nd block - Documentation -->
+                <div class="sm:col-span-6 md:col-span-3 lg:col-span-2">
+
+                    <h6 class="text-sm text-zinc-800 font-medium mb-2">Documentation</h6>
+                    <ul class="text-sm space-y-2">
+                        <li>
+                            <a class="text-zinc-500 hover:text-zinc-900 transition"
+                               href="https://docs.uncloud.run/#use-cases">Use cases</a>
+                        </li>
+                        <li>
+                            <a class="text-zinc-500 hover:text-zinc-900 transition"
+                               href="https://docs.uncloud.run/getting-started/quick-start">Quick start</a>
+                        </li>
+                    </ul>
+                </div>
+
+                <!-- 3rd block - Resources -->
+                <div class="sm:col-span-6 md:col-span-3 lg:col-span-2">
+                    <h6 class="text-sm text-zinc-800 font-medium mb-2">Resources</h6>
+                    <ul class="text-sm space-y-2">
+                        <li>
+                            <a class="text-zinc-500 hover:text-zinc-900 transition"
+                               href="https://github.com/psviderski/uncloud">GitHub project</a>
+                        </li>
+                        <li>
+                            <a class="text-zinc-500 hover:text-zinc-900 transition"
+                               href="https://github.com/psviderski/uncloud/releases">Releases</a>
+                        </li>
+                        <li>
+                            <a class="text-zinc-500 hover:text-zinc-900 transition"
+                               href="https://github.com/psviderski/uncloud/blob/main/LICENSE">License</a>
+                        </li>
+                        <li>
+                            <a class="text-zinc-500 hover:text-zinc-900 transition"
+                               href="https://discord.gg/eR35KQJhPu">Community</a>
+                        </li>
+                    </ul>
+                </div>
             </div>
         </div>
     </footer>

website/style.css

@@ -1222,6 +1222,10 @@ input[type="search"]::-webkit-search-results-decoration {
   margin-bottom: 0.25rem;
 }
 
+.mb-2{
+  margin-bottom: 0.5rem;
+}
+
 .mb-4{
   margin-bottom: 1rem;
 }
@@ -2242,7 +2246,17 @@ input[type="search"]::-webkit-search-results-decoration {
   }
 }
 
+@media not all and (min-width: 768px){
+  .max-md\:order-1{
+    order: 1;
+  }
+}
+
 @media (min-width: 640px){
+  .sm\:col-span-6{
+    grid-column: span 6 / span 6;
+  }
+
   .sm\:inline{
     display: inline;
   }
@@ -2255,6 +2269,10 @@ input[type="search"]::-webkit-search-results-decoration {
     max-width: none;
   }
 
+  .sm\:grid-cols-12{
+    grid-template-columns: repeat(12, minmax(0, 1fr));
+  }
+
   .sm\:grid-cols-2{
     grid-template-columns: repeat(2, minmax(0, 1fr));
   }
@@ -2302,6 +2320,14 @@ input[type="search"]::-webkit-search-results-decoration {
     top: 1.5rem;
   }
 
+  .md\:col-span-3{
+    grid-column: span 3 / span 3;
+  }
+
+  .md\:col-span-6{
+    grid-column: span 6 / span 6;
+  }
+
   .md\:mb-0{
     margin-bottom: 0px;
   }
@@ -2354,6 +2380,14 @@ input[type="search"]::-webkit-search-results-decoration {
 }
 
 @media (min-width: 1024px){
+  .lg\:col-span-2{
+    grid-column: span 2 / span 2;
+  }
+
+  .lg\:col-span-8{
+    grid-column: span 8 / span 8;
+  }
+
   .lg\:mt-24{
     margin-top: 6rem;
   }