fix: Improve wording for containerd warning

internal/proxy/proxy.go

@@ -81,10 +81,11 @@ func (p *Proxy) handleConnection(ctx context.Context, localConn net.Conn) {
 	defer p.activeConns.Done()
 	defer localConn.Close()
 
-	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	// Use a separate context with timeout for dialing the remote address.
+	dialCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
 
-	remoteConn, err := p.DialContext(ctx, "tcp", p.RemoteAddr)
+	remoteConn, err := p.DialContext(dialCtx, "tcp", p.RemoteAddr)
 	if err != nil {
 		if p.OnError != nil {
 			p.OnError(fmt.Errorf("connect remote address '%s': %w", p.RemoteAddr, err))

pkg/client/compose/project.go

@@ -16,7 +16,10 @@ func LoadProject(ctx context.Context, paths []string, opts ...composecli.Project
 		composecli.WithName(FakeProjectName),
 		// First apply os.Environment, always wins.
 		composecli.WithOsEnv,
-		// Read dot env file to populate project environment.
+		// Set the local .env file to be loaded by WithDotEnv. COMPOSE_DISABLE_ENV_FILE can disable it.
+		composecli.WithEnvFiles(),
+		// Read environment variables from .env files set by WithEnvFiles (.env by default) to make available
+		// for interpolation.
 		composecli.WithDotEnv,
 		// Get compose file path set by COMPOSE_FILE.
 		composecli.WithConfigFileEnv,

pkg/client/compose/project_test.go

@@ -0,0 +1,188 @@
+package compose
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestLoadProject_EnvFileInterpolation tests that environment variables from .env files
+// are properly loaded and available for interpolation in compose files.
+func TestLoadProject_EnvFileInterpolation(t *testing.T) {
+	tests := []struct {
+		name        string
+		composeYAML string
+		envFile     string
+		verify      func(t *testing.T, projectDir string)
+	}{
+		// This is a regression test for https://github.com/psviderski/uncloud/issues/144.
+		{
+			name: "simple variable interpolation",
+			envFile: `KEY1=value1
+KEY2=value2
+`,
+			composeYAML: `services:
+  web:
+    image: nginx
+    command: ["echo", "${KEY1}", "${KEY2}"]
+`,
+			verify: func(t *testing.T, projectDir string) {
+				project, err := LoadProject(context.Background(), []string{filepath.Join(projectDir, "compose.yaml")})
+				require.NoError(t, err)
+				require.NotNil(t, project)
+				require.Len(t, project.Services, 1)
+
+				webService := project.Services["web"]
+				require.NotNil(t, webService)
+				require.Len(t, webService.Command, 3)
+				assert.Equal(t, "echo", webService.Command[0])
+				assert.Equal(t, "value1", webService.Command[1], "KEY1 should be interpolated from .env file")
+				assert.Equal(t, "value2", webService.Command[2], "KEY2 should be interpolated from .env file")
+			},
+		},
+		{
+			name: "environment variable interpolation in service environment",
+			envFile: `DATABASE_URL=postgres://localhost:5432/mydb
+REDIS_URL=redis://localhost:6379
+`,
+			composeYAML: `services:
+  app:
+    image: myapp:latest
+    environment:
+      - DB_CONNECTION=${DATABASE_URL}
+      - CACHE_URL=${REDIS_URL}
+`,
+			verify: func(t *testing.T, projectDir string) {
+				project, err := LoadProject(context.Background(), []string{filepath.Join(projectDir, "compose.yaml")})
+				require.NoError(t, err)
+				require.NotNil(t, project)
+				require.Len(t, project.Services, 1)
+
+				appService := project.Services["app"]
+				require.NotNil(t, appService)
+				require.NotNil(t, appService.Environment)
+
+				assert.Equal(t, "postgres://localhost:5432/mydb", *appService.Environment["DB_CONNECTION"],
+					"DATABASE_URL should be interpolated from .env file")
+				assert.Equal(t, "redis://localhost:6379", *appService.Environment["CACHE_URL"],
+					"REDIS_URL should be interpolated from .env file")
+			},
+		},
+		{
+			name: "variable with default value when not in env file",
+			envFile: `EXISTING_VAR=exists
+`,
+			composeYAML: `services:
+  test:
+    image: busybox
+    environment:
+      - VAR1=${EXISTING_VAR}
+      - VAR2=${MISSING_VAR:-default_value}
+`,
+			verify: func(t *testing.T, projectDir string) {
+				project, err := LoadProject(context.Background(), []string{filepath.Join(projectDir, "compose.yaml")})
+				require.NoError(t, err)
+				require.NotNil(t, project)
+
+				testService := project.Services["test"]
+				require.NotNil(t, testService)
+
+				assert.Equal(t, "exists", *testService.Environment["VAR1"],
+					"EXISTING_VAR should be interpolated from .env file")
+				assert.Equal(t, "default_value", *testService.Environment["VAR2"],
+					"MISSING_VAR should use default value")
+			},
+		},
+		{
+			name: "os environment overrides .env file",
+			envFile: `MY_VAR=from_env_file
+`,
+			composeYAML: `services:
+  override:
+    image: alpine
+    environment:
+      - TEST_VAR=${MY_VAR}
+`,
+			verify: func(t *testing.T, projectDir string) {
+				t.Setenv("MY_VAR", "from_os_env")
+
+				project, err := LoadProject(context.Background(), []string{filepath.Join(projectDir, "compose.yaml")})
+				require.NoError(t, err)
+				require.NotNil(t, project)
+
+				overrideService := project.Services["override"]
+				require.NotNil(t, overrideService)
+
+				// OS environment should win over .env file (WithOsEnv comes before WithDotEnv).
+				assert.Equal(t, "from_os_env", *overrideService.Environment["TEST_VAR"],
+					"OS environment should override .env file")
+			},
+		},
+		{
+			name:    "no .env file - missing variables get empty string",
+			envFile: "",
+			composeYAML: `services:
+  missing:
+    image: ubuntu
+    command: ["echo", "${UNDEFINED_VAR}"]
+`,
+			verify: func(t *testing.T, projectDir string) {
+				os.Remove(filepath.Join(projectDir, ".env"))
+
+				project, err := LoadProject(context.Background(), []string{filepath.Join(projectDir, "compose.yaml")})
+				require.NoError(t, err)
+				require.NotNil(t, project)
+
+				missingService := project.Services["missing"]
+				require.NotNil(t, missingService)
+				require.Len(t, missingService.Command, 2)
+				assert.Equal(t, "", missingService.Command[1], "undefined variable should be empty string")
+			},
+		},
+		{
+			name:    "COMPOSE_DISABLE_ENV_FILE disables .env loading",
+			envFile: `MY_VAR=from_env_file`,
+			composeYAML: `services:
+  web:
+    image: nginx
+    command: ["echo", "${MY_VAR}"]
+`,
+			verify: func(t *testing.T, projectDir string) {
+				t.Setenv("COMPOSE_DISABLE_ENV_FILE", "true")
+
+				project, err := LoadProject(context.Background(), []string{filepath.Join(projectDir, "compose.yaml")})
+				require.NoError(t, err)
+				require.NotNil(t, project)
+
+				webService := project.Services["web"]
+				require.NotNil(t, webService)
+				require.Len(t, webService.Command, 2)
+
+				assert.Equal(t, "", webService.Command[1], "variable should be empty when .env file is disabled")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tempDir := t.TempDir()
+
+			composeFile := filepath.Join(tempDir, "compose.yaml")
+			err := os.WriteFile(composeFile, []byte(tt.composeYAML), 0o644)
+			require.NoError(t, err)
+
+			// Write .env file if provided.
+			if tt.envFile != "" {
+				envFile := filepath.Join(tempDir, ".env")
+				err = os.WriteFile(envFile, []byte(tt.envFile), 0o644)
+				require.NoError(t, err)
+			}
+
+			tt.verify(t, tempDir)
+		})
+	}
+}

pkg/client/image.go

@@ -233,7 +233,8 @@ func (cli *Client) pushImageToMachine(
 		pw.Event(progress.NewEvent(pushEventID, progress.Error, "containerd image store required"))
 		return fmt.Errorf("docker on machine '%s' is not using containerd image store, "+
 			"which is required for pushing images. Follow the instructions to enable it: "+
-			"https://docs.docker.com/engine/storage/containerd/", machine.Name)
+			"https://docs.docker.com/engine/storage/containerd/, and then restart the uncloud daemon "+
+			"via 'systemctl restart uncloud'", machine.Name)
 	}
 
 	machineSubnet, _ := machine.Network.Subnet.ToPrefix()

website/docs/3-concepts/1-ingress/1-overview.md

@@ -9,8 +9,8 @@ with [Let's Encrypt](https://letsencrypt.org/), and route requests to your servi
 
 ## How it works
 
-Caddy runs as a global service `caddy` on every machine in your cluster, listening on the host ports 80 (HTTP) and 443
-(HTTPS).
+By default, Caddy runs as a global service `caddy` on every machine in your cluster, listening on the host ports 80
+(HTTP) and 443 (HTTPS).
 
 It's deployed during cluster initialisation (`uc machine init`) unless you use the `--no-caddy` flag.
 See [Managing Caddy](3-managing-caddy.md) for deployment and customisation instructions.

website/docs/3-concepts/1-ingress/3-managing-caddy.md

@@ -1,7 +1,7 @@
 # Managing Caddy
 
-Caddy is automatically deployed as a global service `caddy` when you initialise a cluster with `uc machine init`. It
-runs on every machine to handle incoming HTTP/HTTPS traffic and route it to your services.
+Caddy is automatically deployed as a global service `caddy` when you initialise a cluster with `uc machine init`. By
+default, it runs on every machine to handle incoming HTTP/HTTPS traffic and route it to your services.
 
 ## Checking status
 
@@ -37,6 +37,13 @@ Deploy a specific version or custom image:
 uc caddy deploy --image caddybuilds/caddy-cloudflare:2.10.2
 ```
 
+Deploy only to a specific machine or a subset of machines (comma-separated list):
+
+```shell
+uc caddy deploy --machine machine1
+uc caddy deploy --machine machine2,machine3,machine4
+```
+
 Deploy with custom global configuration:
 
 ```shell
@@ -90,6 +97,10 @@ services:
     x-caddy: Caddyfile
     deploy:
       mode: global
+    # Optional: deploy only to specific machines.
+    # x-machines:
+    #   - machine1
+    #   - machine2
 ```
 
 </TabItem>
@@ -98,26 +109,26 @@ services:
 ```caddyfile
 # Global options.
 {
-    debug
+	debug
 }
 
 # A snippet that can be reused in custom Caddy configs for services (x-caddy).
 (my_snippet) {
-    ...
+	...
 }
 
 # Obtain a wildcard TLS certificate for all subdomains of example.name using DNS challenge with Cloudflare.
 # It will be used for services that publish ports with hostnames under example.name.
 *.example.com {
-    tls {
-            dns cloudflare {env.CLOUDFLARE_API_TOKEN}
-    }
-    respond "No host matched" 404
+	tls {
+		dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+	}
+	respond "No host matched" 404
 }
 
 # Expose an internal service that is not managed by Uncloud.
 internal.example.com {
-    reverse_proxy 192.168.1.100
+	reverse_proxy 192.168.1.100
 }
 ```
 
@@ -139,8 +150,8 @@ uc deploy
 
 ## Verifying config
 
-View the complete generated Caddyfile served by the `caddy` service. This is useful for debugging and verifying
-custom global and service-specific Caddy configs.
+View the complete generated Caddyfile served by the `caddy` service. This is useful for debugging and verifying custom
+global and service-specific Caddy configs.
 
 ```shell
 uc caddy config
@@ -155,26 +166,26 @@ Example output:
 # User-defined global config from service 'caddy'.
 # Global options.
 {
-    debug
+	debug
 }
 
 # A snippet that can be reused in custom Caddy configs for services (x-caddy).
 (my_snippet) {
-    ...
+	...
 }
 
 # Obtain a wildcard TLS certificate for all subdomains of example.name using DNS challenge with Cloudflare.
 # It will be used for services that publish ports with hostnames under example.name.
 *.example.com {
-    tls {
-            dns cloudflare {env.CLOUDFLARE_API_TOKEN}
-    }
-    respond "No host matched" 404
+	tls {
+		dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+	}
+	respond "No host matched" 404
 }
 
 # Expose an internal service that is not managed by Uncloud.
 internal.example.com {
-    reverse_proxy 192.168.1.100
+	reverse_proxy 192.168.1.100
 }
 
 # Health check endpoint to verify Caddy reachability on this machine.
@@ -210,14 +221,14 @@ https://api.example.com {
 
 # User-defined config for service 'web'.
 www.example.com {
-    redir https://example.com{uri} permanent
+	redir https://example.com{uri} permanent
 }
 
 example.com {
-    reverse_proxy 10.210.0.3:8000 {
-        import common_proxy
-    }
-    log
+	reverse_proxy 10.210.0.3:8000 {
+		import common_proxy
+	}
+	log
 }
 
 # Skipped invalid user-defined configs:

website/docs/9-cli-reference/uc.md

@@ -18,6 +18,8 @@ A CLI tool for managing Uncloud resources such as machines, services, and volume
 * [uc ctx](uc_ctx.md)	 - Switch between different cluster contexts. Contains subcommands to manage contexts.
 * [uc deploy](uc_deploy.md)	 - Deploy services from a Compose file.
 * [uc dns](uc_dns.md)	 - Manage cluster domain in Uncloud DNS.
+* [uc image](uc_image.md)	 - Manage images on machines in the cluster.
+* [uc images](uc_images.md)	 - List images on machines in the cluster.
 * [uc inspect](uc_inspect.md)	 - Display detailed information on a service.
 * [uc ls](uc_ls.md)	 - List services.
 * [uc machine](uc_machine.md)	 - Manage machines in an Uncloud cluster.

website/docs/9-cli-reference/uc_deploy.md

@@ -15,8 +15,8 @@ uc deploy [FLAGS] [SERVICE...] [flags]
   -n, --no-build          Do not build images before deploying services. (default false)
   -p, --profile strings   One or more Compose profiles to enable.
       --recreate          Recreate containers even if their configuration and image haven't changed.
-  -y, --yes               Auto-confirm deployment plan. Enabled by default when running non-interactively,
-                          e.g., in CI/CD pipelines.
+  -y, --yes               Auto-confirm deployment plan. Should be explicitly set when running non-interactively,
+                          e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]
 ```
 
 ## Options inherited from parent commands

website/docs/9-cli-reference/uc_image.md

@@ -0,0 +1,24 @@
+# uc image
+
+Manage images on machines in the cluster.
+
+## Options
+
+```
+  -h, --help   help for image
+```
+
+## Options inherited from parent commands
+
+```
+      --connect string          Connect to a remote cluster machine without using the Uncloud configuration file. [$UNCLOUD_CONNECT]
+                                Format: [ssh://]user@host[:port] or tcp://host:port
+      --uncloud-config string   Path to the Uncloud configuration file. [$UNCLOUD_CONFIG] (default "~/.config/uncloud/config.yaml")
+```
+
+## See also
+
+* [uc](uc.md)	 - A CLI tool for managing Uncloud resources such as machines, services, and volumes.
+* [uc image ls](uc_image_ls.md)	 - List images on machines in the cluster.
+* [uc image push](uc_image_push.md)	 - Upload a local Docker image to the cluster.
+

website/docs/9-cli-reference/uc_image_ls.md

@@ -0,0 +1,51 @@
+# uc image ls
+
+List images on machines in the cluster.
+
+## Synopsis
+
+List images on machines in the cluster. By default, on all machines. Optionally filter by image name.
+
+```
+uc image ls [REPO:[TAG]] [flags]
+```
+
+## Examples
+
+```
+  # List all images on all machines.
+  uc image ls
+
+  # List images on specific machine.
+  uc image ls -m machine1
+
+  # List images on multiple machines.
+  uc image ls -m machine1,machine2
+
+  # List images filtered by name (with any tag) on all machines.
+  uc image ls myapp
+
+  # List images filtered by name pattern on specific machine.
+  uc image ls "myapp:1.*" -m machine1
+```
+
+## Options
+
+```
+  -c, --context string    Name of the cluster context. (default is the current context)
+  -h, --help              help for ls
+  -m, --machine strings   Filter images by machine name or ID. Can be specified multiple times or as a comma-separated list. (default is include all machines)
+```
+
+## Options inherited from parent commands
+
+```
+      --connect string          Connect to a remote cluster machine without using the Uncloud configuration file. [$UNCLOUD_CONNECT]
+                                Format: [ssh://]user@host[:port] or tcp://host:port
+      --uncloud-config string   Path to the Uncloud configuration file. [$UNCLOUD_CONFIG] (default "~/.config/uncloud/config.yaml")
+```
+
+## See also
+
+* [uc image](uc_image.md)	 - Manage images on machines in the cluster.
+

website/docs/9-cli-reference/uc_image_push.md

@@ -0,0 +1,55 @@
+# uc image push
+
+Upload a local Docker image to the cluster.
+
+## Synopsis
+
+Upload a local Docker image to the cluster transferring only the missing layers.
+The image is uploaded to the machine which CLI is connected to (default) or the specified machine(s).
+
+```
+uc image push IMAGE [flags]
+```
+
+## Examples
+
+```
+  # Push image to the machine the CLI is connected to.
+  uc image push myapp:latest
+
+  # Push image to specific machine.
+  uc image push myapp:latest -m machine1
+
+  # Push image to multiple machines.
+  uc image push myapp:latest -m machine1,machine2,machine3
+
+  # Push image to all machines in the cluster.
+  uc image push myapp:latest -m all
+
+  # Push a specific platform of a multi-platform image.
+  uc image push myapp:latest --platform linux/amd64
+```
+
+## Options
+
+```
+  -c, --context string    Name of the cluster context. (default is the current context)
+  -h, --help              help for push
+  -m, --machine strings   Machine names to push the image to. Can be specified multiple times or as a comma-separated list of machine names.
+                          Use 'all' to push to all machines. (default is connected machine)
+      --platform string   Push a specific platform of a multi-platform image (e.g., linux/amd64, linux/arm64).
+                          Local Docker must be configured to use containerd image store to support multi-platform images.
+```
+
+## Options inherited from parent commands
+
+```
+      --connect string          Connect to a remote cluster machine without using the Uncloud configuration file. [$UNCLOUD_CONNECT]
+                                Format: [ssh://]user@host[:port] or tcp://host:port
+      --uncloud-config string   Path to the Uncloud configuration file. [$UNCLOUD_CONFIG] (default "~/.config/uncloud/config.yaml")
+```
+
+## See also
+
+* [uc image](uc_image.md)	 - Manage images on machines in the cluster.
+

website/docs/9-cli-reference/uc_images.md

@@ -0,0 +1,51 @@
+# uc images
+
+List images on machines in the cluster.
+
+## Synopsis
+
+List images on machines in the cluster. By default, on all machines. Optionally filter by image name.
+
+```
+uc images [IMAGE] [flags]
+```
+
+## Examples
+
+```
+  # List all images on all machines.
+  uc images
+
+  # List images on specific machine.
+  uc images -m machine1
+
+  # List images on multiple machines.
+  uc images -m machine1,machine2
+
+  # List images filtered by name (with any tag) on all machines.
+  uc images myapp
+
+  # List images filtered by name pattern on specific machine.
+  uc images "myapp:1.*" -m machine1
+```
+
+## Options
+
+```
+  -c, --context string    Name of the cluster context. (default is the current context)
+  -h, --help              help for images
+  -m, --machine strings   Filter images by machine name or ID. Can be specified multiple times or as a comma-separated list. (default is include all machines)
+```
+
+## Options inherited from parent commands
+
+```
+      --connect string          Connect to a remote cluster machine without using the Uncloud configuration file. [$UNCLOUD_CONNECT]
+                                Format: [ssh://]user@host[:port] or tcp://host:port
+      --uncloud-config string   Path to the Uncloud configuration file. [$UNCLOUD_CONFIG] (default "~/.config/uncloud/config.yaml")
+```
+
+## See also
+
+* [uc](uc.md)	 - A CLI tool for managing Uncloud resources such as machines, services, and volumes.
+

website/docs/9-cli-reference/uc_machine_init.md

@@ -31,7 +31,7 @@ uc machine init [USER@HOST:PORT] [flags]
 ## Options
 
 ```
-  -c, --context string        Name of the new context to be created for the initialised cluster in the Uncloud config. (default "default")
+  -c, --context string        Name of the new context to be created in the Uncloud config to manage the cluster. (default "default")
       --dns-endpoint string   API endpoint for the Uncloud DNS service. (default "https://dns.uncloud.run/v1")
   -h, --help                  help for init
   -n, --name string           Assign a name to the machine.