chore: upgrade unregistry 0.3.1 -> 0.4.1 with a fix for pushing big images

* feat: Add `uc service start/stop` commands

* Add nolint:dupl for service start/stop commands

Co-authored-by: Pasha Sviderski <me@psviderski.name>

* Add --signal and --timeout options to uc service stop

* Check whether service stop --timeout flag was used to set options properly

---------

Co-authored-by: Pasha Sviderski <me@psviderski.name>

.github/workflows/go-tests.yml

@@ -40,7 +40,7 @@ jobs:
         run: |
           make ucind-image
           make test
-    timeout-minutes: 10
+    timeout-minutes: 15
 
   check-protobuf:
     runs-on: ${{ matrix.os }}

.goreleaser.yaml

@@ -16,7 +16,8 @@ builds:
     main: ./cmd/uncloud
     binary: uncloud
     env:
-      - CGO_ENABLED=0
+      # Use CGO to be able to build fsevent required by compose on macOS.
+      - CGO_ENABLED={{ if eq .Os "darwin" }}1{{ else }}0{{ end }}
     goos:
       - darwin
       - linux

AI.md

@@ -28,7 +28,7 @@ This document provides comprehensive information about the Uncloud project for A
 - **Docker Compose compatibility**: Uses familiar Docker Compose format
 - **Zero-downtime deployments**: Rolling updates without service interruption
 - **Automatic HTTPS**: Caddy reverse proxy with Let's Encrypt integration
-- **Managed DNS**: Free `*.cluster.uncloud.run` subdomains via Uncloud DNS service
+- **Managed DNS**: Free `*.xxxxxx.uncld.dev` subdomains via Uncloud DNS service
 - **Cross-machine scaling**: Run containers across multiple machines
 
 ### 🔧 Developer Experience

Dockerfile

@@ -13,7 +13,7 @@ COPY go.mod go.sum ./
 RUN go mod download && go mod verify
 
 COPY . .
-RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd cmd/uncloudd/main.go
+RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd ./cmd/uncloudd
 
 
 FROM alpine:${ALPINE_VERSION} AS corrosion-download

README.md

@@ -1,7 +1,7 @@
 <div align="center">
-  <img src="./website/landing/images/logo.svg" height="100" width="100" alt="Uncloud logo"/>
+  <img src="./website/landing/images/logo-title.svg#gh-light-mode-only" alt="Uncloud logo"/>
-  <h1>Uncloud</h1>
+  <img src="./website/landing/images/logo-title-dark.svg#gh-dark-mode-only" alt="Uncloud logo"/>
-  <p><strong>Docker simplicity. Multi-machine power.</strong></p>
+  <p><strong>▸ Docker simplicity. Multi-machine power ◂</strong></p>
 
   <p>
     <a href="https://uncloud.run/docs"><img src="https://img.shields.io/badge/Docs-blue.svg?style=for-the-badge&logo=gitbook&logoColor=white" alt="Documentation"></a>
@@ -25,12 +25,14 @@ complexity of Kubernetes.
 
 ## ✨ Features
 
-* **Deploy anywhere**: Combine cloud VMs, dedicated servers, and bare metal into a unified computing environment —
+* **Deploy anywhere**: Combine cloud VMs, dedicated servers, and bare metal into a unified computing environment,
   regardless of location or provider.
 * **Docker Compose**: Familiar [Docker Compose](https://compose-spec.io/) format for defining services and volumes. No
   need to learn a new bespoke DSL.
 * **Zero-downtime deployments**: Rolling updates without service interruption. Automatic rollback on failure is coming
   soon.
+* **[Unregistry](https://github.com/psviderski/unregistry) integration**: Build and push your Docker images directly to
+  your machines without an external registry. It will transfer only the missing layers, making it fast and efficient.
 * **Service discovery**: Built-in DNS server resolves service names to container IPs.
 * **Persistent storage**: Run stateful services with Docker volumes managed across machines.
 * **Zero-config private network**: Automatic WireGuard mesh with peer discovery and NAT traversal. Containers get unique
@@ -38,18 +40,13 @@ complexity of Kubernetes.
 * **No control plane**: Fully decentralised design eliminates single points of failure and reduces operational overhead.
 * **Imperative over declarative**: Favoring imperative operations over state reconciliation simplifies both the mental
   model and troubleshooting.
-* **Managed DNS**: Automatic DNS records `*.<id>.cluster.uncloud.run` for services with public access via managed
+* **Managed DNS**: Automatic DNS records `*.xxxxxx.uncld.dev` for services with public access via managed
   [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service.
 * **Automatic HTTPS**: Built-in Caddy reverse proxy handles TLS certificate provisioning and renewal using Let's
   Encrypt.
 * **Docker-like CLI**: Familiar commands for managing both infrastructure and applications.
 * **Remote management**: Control your entire infrastructure through SSH access to any single machine in the cluster.
 
-### 🚀 Coming soon
-
-* **[Unregistry](https://github.com/psviderski/unregistry) integration**: Push your Docker images directly to your
-  machines without an external registry. It will transfer only the missing layers, making it fast and efficient.
-
 ## 🎬 Quick demo
 
 The screenshot below demonstrates how I use Uncloud to deploy https://uncloud.run website to 2 remote machines from
@@ -67,6 +64,12 @@ on-premises in just a couple minutes.
 <img src="https://embed-ssl.wistia.com/deliveries/3cf7014a48b93afc556444bed3e39a8c.jpg?image_crop_resized=900x526&image_play_button_rounded=true&image_play_button_size=2x&image_play_button_color=18181Be0" alt="Uncloud demo" width="450" height="263" />
 </a>
 
+<br>
+<br>
+
+> **📚 Want more examples?** Check out the [**uncloud-recipes**](https://github.com/psviderski/uncloud-recipes)
+> repository for community recipes and templates for deploying popular services on Uncloud.
+
 ## 💫 Why Uncloud?
 
 Modern cloud platforms like Heroku and Render offer amazing developer experiences but at a premium price. Traditional
@@ -334,6 +337,10 @@ These companies and projects are helping Uncloud with their generous sponsorship
 
 ## ❤️ Contributors
 
+<a href="https://trendshift.io/repositories/14069">
+    <img alt="Trendshift" src="https://trendshift.io/api/badge/repositories/14069" />
+</a>
+
 Thank you [@cedws](https://github.com/cedws) for being the first contributor to Uncloud! 🎉
 
 <a href="https://github.com/psviderski/uncloud/graphs/contributors">

cmd/uncloud/build.go

@@ -10,68 +10,102 @@ import (
 	"github.com/spf13/cobra"
 )
 
-// NewBuildCommand creates a new command to build services from a Compose file.
+type buildOptions struct {
+	cli.BuildServicesOptions
+	files    []string
+	profiles []string
+}
+
+// NewBuildCommand creates a new command to build images for services from a Compose file.
 func NewBuildCommand() *cobra.Command {
-	opts := cli.BuildOptions{}
+	opts := buildOptions{}
 	cmd := &cobra.Command{
 		Use:   "build [FLAGS] [SERVICE...]",
 		Short: "Build services from a Compose file.",
+		Long: `Build images for services from a Compose file using local Docker.
+
+By default, built images remain on the local Docker host. Use --push to upload them
+to cluster machines or --push-registry to upload them to external registries.`,
+		Example: `  # Build all services that have a build section in compose.yaml.
+  uc build
+
+  # Build specific services that have a build section.
+  uc build web api
+
+  # Build services and push images to all cluster machines or service x-machines if specified.
+  uc build --push
+
+  # Build services and push images to specific machines.
+  uc build --push -m machine1,machine2
+
+  # Build services and push images to external registries (e.g., Docker Hub).
+  uc build --push-registry
+
+  # Build services with build arguments, pull newer base images before building, and don't use cache.
+  uc build --build-arg NODE_VERSION=24 --build-arg ENV=production --no-cache --pull`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			if len(args) > 0 {
 			opts.Services = args
-			}
 
 			return runBuild(cmd.Context(), uncli, opts)
 		},
+		GroupID: "service",
 	}
 
-	cmd.Flags().StringSliceVarP(&opts.Files, "file", "f", nil,
+	cmd.Flags().StringArrayVar(&opts.BuildArgs, "build-arg", nil,
-		"One or more Compose files to build (default compose.yaml)")
+		"Set a build-time variable for services. Used in Dockerfiles that declare the variable with ARG.\n"+
-	cmd.Flags().StringSliceVarP(&opts.Profiles, "profile", "p", nil,
+			"Can be specified multiple times. Format: --build-arg VAR=VALUE")
+	cmd.Flags().BoolVar(&opts.Check, "check", false,
+		"Check the build configuration for services without building them.")
+	cmd.Flags().BoolVar(&opts.Deps, "deps", false,
+		"Also build services declared as dependencies of the selected services.")
+	cmd.Flags().StringSliceVarP(&opts.files, "file", "f", nil,
+		"One or more Compose files to build. (default compose.yaml)")
+	cmd.Flags().StringSliceVarP(&opts.Machines, "machine", "m", nil,
+		"Machine names or IDs to push the built images to (requires --push).\n"+
+			"Can be specified multiple times or as a comma-separated list. (default is all machines or x-machines)")
+	cmd.Flags().BoolVar(&opts.NoCache, "no-cache", false,
+		"Do not use cache when building images.")
+	cmd.Flags().StringSliceVarP(&opts.profiles, "profile", "p", nil,
 		"One or more Compose profiles to enable.")
-	cmd.Flags().BoolVarP(&opts.Push, "push", "P", false,
+	cmd.Flags().BoolVar(&opts.Pull, "pull", false,
-		"Push built images to the registry after building. (default false)")
+		"Always attempt to pull newer versions of base images before building.")
-	cmd.Flags().BoolVarP(&opts.NoCache, "no-cache", "n", false,
+	cmd.Flags().BoolVar(&opts.PushCluster, "push", false,
-		"Do not use cache when building images. (default false)")
+		"Upload the built images to cluster machines after building.\n"+
+			"Use --machine to specify which machines. (default is all machines)")
+	cmd.Flags().BoolVar(&opts.PushRegistry, "push-registry", false,
+		"Upload the built images to external registries (e.g., Docker Hub) after building.")
 
 	return cmd
 }
 
-// TODO: deduplicate with a similar functino for deploy options
+// runBuild parses the Compose file(s) and builds the images for selected services.
-// projectOpts returns the project options for the Compose file(s).
+func runBuild(ctx context.Context, uncli *cli.CLI, opts buildOptions) error {
-func projectOptsFromBuildOpts(opts cli.BuildOptions) []composecli.ProjectOptionsFn {
+	// Validate push flags.
-	projectOpts := []composecli.ProjectOptionsFn{}
+	if opts.PushCluster && opts.PushRegistry {
-
+		return fmt.Errorf("cannot specify both --push and --push-registry: choose one push target")
-	if len(opts.Profiles) > 0 {
-		projectOpts = append(projectOpts, composecli.WithDefaultProfiles(opts.Profiles...))
 	}
 
-	return projectOpts
+	machines := cli.ExpandCommaSeparatedValues(opts.Machines)
-}
+	// Special handling for an explicit "all" keyword to push to all machines.
+	if len(machines) == 1 && machines[0] == "all" {
+		machines = nil
+	}
+	opts.Machines = machines
 
-// runBuild parses the Compose file(s), builds the services, and pushes them if requested.
+	project, err := compose.LoadProject(ctx, opts.files, composecli.WithDefaultProfiles(opts.profiles...))
-func runBuild(ctx context.Context, uncli *cli.CLI, opts cli.BuildOptions) error {
-	projectOpts := projectOptsFromBuildOpts(opts)
-	project, err := compose.LoadProject(ctx, opts.Files, projectOpts...)
 	if err != nil {
 		return fmt.Errorf("load compose file(s): %w", err)
 	}
 
-	if len(opts.Services) > 0 {
+	servicesToBuild, err := cli.ServicesThatNeedBuild(project, opts.Services, opts.Deps)
-		project, err = project.WithSelectedServices(opts.Services)
 	if err != nil {
-			return fmt.Errorf("select services: %w", err)
+		return fmt.Errorf("determine services to build: %w", err)
 	}
-	}
-
-	servicesToBuild := cli.GetServicesThatNeedBuild(project)
-
 	if len(servicesToBuild) == 0 {
 		fmt.Println("No services to build.")
 		return nil
 	}
 
-	return cli.BuildServices(ctx, servicesToBuild, opts)
+	return uncli.BuildServices(ctx, project, opts.BuildServicesOptions)
 }

cmd/uncloud/caddy/config.go

@@ -7,14 +7,12 @@ import (
 
 	"github.com/alecthomas/chroma/v2/quick"
 	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/spf13/cobra"
 )
 
 type configOptions struct {
 	machine string
 	noColor bool
-	context string
 }
 
 func NewConfigCommand() *cobra.Command {
@@ -34,16 +32,12 @@ func NewConfigCommand() *cobra.Command {
 		"Name or ID of the machine to get the configuration from. (default is connected machine)")
 	cmd.Flags().BoolVar(&opts.noColor, "no-color", false,
 		"Disable syntax highlighting for the output.")
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
 
 	return cmd
 }
 
 func runConfig(ctx context.Context, uncli *cli.CLI, opts configOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	clusterClient, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -51,7 +45,7 @@ func runConfig(ctx context.Context, uncli *cli.CLI, opts configOptions) error {
 
 	if opts.machine != "" {
 		// If a specific machine is requested, use it to get the Caddy configuration.
-		ctx, _, err = api.ProxyMachinesContext(ctx, clusterClient, []string{opts.machine})
+		ctx, _, err = clusterClient.ProxyMachinesContext(ctx, []string{opts.machine})
 		if err != nil {
 			return err
 		}

cmd/uncloud/caddy/deploy.go

@@ -22,7 +22,6 @@ type deployOptions struct {
 	caddyfile string
 	image     string
 	machines  []string
-	context   string
 }
 
 func NewDeployCommand() *cobra.Command {
@@ -44,12 +43,8 @@ func NewDeployCommand() *cobra.Command {
 	cmd.Flags().StringVar(&opts.image, "image", "",
 		"Caddy Docker image to deploy. (default caddy:LATEST_VERSION)")
 	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
-		"Machine names to deploy to. Can be specified multiple times or as a comma-separated "+
+		"Machine names or IDs to deploy to. Can be specified multiple times or as a comma-separated "+
-			"list of machine names. (default is all machines)")
+			"list. (default is all machines)")
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context to deploy to. (default is the current context)",
-	)
 
 	return cmd
 }
@@ -64,7 +59,7 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 		caddyfile = strings.TrimSpace(string(data))
 	}
 
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	clusterClient, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/context/connection.go

@@ -0,0 +1,78 @@
+package context
+
+import (
+	"fmt"
+
+	"github.com/charmbracelet/huh"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/spf13/cobra"
+)
+
+func NewConnectionCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "connection",
+		Short: "Choose a new default connection for the current context.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return selectConnection(uncli)
+		},
+	}
+	return cmd
+}
+
+func selectConnection(uncli *cli.CLI) error {
+	if uncli.Config == nil {
+		return fmt.Errorf("connection management is not available: Uncloud configuration file is not being used")
+	}
+	if len(uncli.Config.Contexts) == 0 {
+		return fmt.Errorf("no contexts found in Uncloud config (%s)", uncli.Config.Path())
+	}
+
+	currentCtxName := uncli.Config.CurrentContext
+	currentCtx, ok := uncli.Config.Contexts[currentCtxName]
+	if !ok {
+		return fmt.Errorf("current context '%s' not found", currentCtxName)
+	}
+
+	if len(currentCtx.Connections) == 0 {
+		return fmt.Errorf("no connections found in context '%s'", currentCtxName)
+	}
+
+	var selectedConnection int
+	form := huh.NewForm(
+		huh.NewGroup(
+			huh.NewSelect[int]().
+				Title("Select a default connection").
+				Options(buildConnectionOptions(currentCtx.Connections)...).
+				Value(&selectedConnection),
+		),
+	)
+	if err := form.Run(); err != nil {
+		return fmt.Errorf("select connection: %w", err)
+	}
+
+	currentCtx.SetDefaultConnection(selectedConnection)
+	selected := currentCtx.Connections[0]
+
+	if err := uncli.Config.Save(); err != nil {
+		return fmt.Errorf("save config: %w", err)
+	}
+
+	fmt.Printf("Default connection for context '%s' is now '%s'.\n", currentCtxName, selected)
+	return nil
+}
+
+func buildConnectionOptions(connections []config.MachineConnection) []huh.Option[int] {
+	options := make([]huh.Option[int], len(connections))
+	for i, conn := range connections {
+		key := conn.String()
+		opt := huh.NewOption(key, i)
+		if i == 0 {
+			opt.Key += " (default)"
+			opt = opt.Selected(true)
+		}
+		options[i] = opt
+	}
+	return options
+}

cmd/uncloud/context/root.go

@@ -19,6 +19,7 @@ func NewRootCommand() *cobra.Command {
 	cmd.AddCommand(
 		NewListCommand(),
 		NewUseCommand(),
+		NewConnectionCommand(),
 	)
 
 	return cmd

cmd/uncloud/deploy.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/charmbracelet/lipgloss"
 	composecli "github.com/compose-spec/compose-go/v2/cli"
 	"github.com/docker/compose/v2/pkg/progress"
 	"github.com/psviderski/uncloud/internal/cli"
@@ -17,14 +18,14 @@ import (
 )
 
 type deployOptions struct {
+	cli.BuildServicesOptions
+
 	files    []string
 	profiles []string
 	services []string
 	noBuild  bool
 	recreate bool
 	yes      bool
-
-	context string
 }
 
 // NewDeployCommand creates a new command to deploy services from a Compose file.
@@ -37,21 +38,24 @@ func NewDeployCommand() *cobra.Command {
 			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
 
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			if len(args) > 0 {
 			opts.services = args
-			}
 
 			return runDeploy(cmd.Context(), uncli, opts)
 		},
+		GroupID: "service",
 	}
 
-	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+	cmd.Flags().StringArrayVar(&opts.BuildServicesOptions.BuildArgs, "build-arg", nil,
-		"Name of the cluster context to deploy to (default is the current context)")
+		"Set a build-time variable for services. Used in Dockerfiles that declare the variable with ARG.\n"+
+			"Can be specified multiple times. Format: --build-arg VAR=VALUE")
+	cmd.Flags().BoolVar(&opts.BuildServicesOptions.Pull, "build-pull", false,
+		"Always attempt to pull newer versions of base images before building service images.")
 	cmd.Flags().StringSliceVarP(&opts.files, "file", "f", nil,
 		"One or more Compose files to deploy services from. (default compose.yaml)")
-	cmd.Flags().BoolVarP(&opts.noBuild, "no-build", "n", false,
+	cmd.Flags().BoolVar(&opts.noBuild, "no-build", false,
-		"Do not build images before deploying services. (default false)")
+		"Do not build new images before deploying services.")
+	cmd.Flags().BoolVar(&opts.BuildServicesOptions.NoCache, "no-cache", false,
+		"Do not use cache when building images.")
 	cmd.Flags().StringSliceVarP(&opts.profiles, "profile", "p", nil,
 		"One or more Compose profiles to enable.")
 	cmd.Flags().BoolVar(&opts.recreate, "recreate", false,
@@ -66,22 +70,9 @@ func NewDeployCommand() *cobra.Command {
 	return cmd
 }
 
-// projectOpts returns the project options for the Compose file(s).
-func projectOpts(opts deployOptions) []composecli.ProjectOptionsFn {
-	projectOpts := []composecli.ProjectOptionsFn{}
-
-	if len(opts.profiles) > 0 {
-		projectOpts = append(projectOpts, composecli.WithDefaultProfiles(opts.profiles...))
-	}
-
-	return projectOpts
-}
-
 // runDeploy parses the Compose file(s) and deploys the services.
 func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
-	projectOpts := projectOpts(opts)
+	project, err := compose.LoadProject(ctx, opts.files, composecli.WithDefaultProfiles(opts.profiles...))
-
-	project, err := compose.LoadProject(ctx, opts.files, projectOpts...)
 	if err != nil {
 		return fmt.Errorf("load compose file(s): %w", err)
 	}
@@ -94,29 +85,69 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 		}
 	}
 
-	servicesToBuild := cli.GetServicesThatNeedBuild(project)
+	servicesToBuild, err := cli.ServicesThatNeedBuild(project, opts.services, false)
+	if err != nil {
+		return fmt.Errorf("determine services to build: %w", err)
+	}
 
 	if len(servicesToBuild) > 0 {
 		if opts.noBuild {
 			fmt.Println("Not building services as requested.")
 		} else {
-			buildOpts := cli.BuildOptions{
+			// Build service images without pushing them to cluster yet to not connect to the cluster twice.
-				Push:    true,
+			opts.BuildServicesOptions.Deps = true // build dependencies as deploy includes them by default
-				NoCache: false,
+			opts.BuildServicesOptions.Services = opts.services
-			}
 
-			if err := cli.BuildServices(ctx, servicesToBuild, buildOpts); err != nil {
+			if err = uncli.BuildServices(ctx, project, opts.BuildServicesOptions); err != nil {
 				return fmt.Errorf("build services: %w", err)
 			}
 		}
+		fmt.Println()
 	}
 
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	clusterClient, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
 	defer clusterClient.Close()
 
+	if len(servicesToBuild) > 0 && !opts.noBuild {
+		// Push built service images to cluster machines one at a time.
+		var errs []error
+		for _, s := range servicesToBuild {
+			if s.Image == "" {
+				// Skip services without an image name (shouldn't happen for services with build config).
+				continue
+			}
+
+			// Push to the specified x-machines or to *all* cluster machines if not specified.
+			var pushOpts client.PushImageOptions
+			if machines, ok := s.Extensions[compose.MachinesExtensionKey].(compose.MachinesSource); ok {
+				pushOpts.Machines = machines
+			}
+			if len(pushOpts.Machines) == 0 {
+				pushOpts.AllMachines = true
+			}
+
+			boldStyle := lipgloss.NewStyle().Bold(true)
+			err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+				if err = clusterClient.PushImage(ctx, s.Image, pushOpts); err != nil {
+					return fmt.Errorf("push image '%s' for service '%s': %w", s.Image, s.Name, err)
+				}
+				return nil
+			}, uncli.ProgressOut(), fmt.Sprintf("Pushing image %s to cluster", boldStyle.Render(s.Image)))
+			// Collect errors to try pushing all images.
+			if err != nil {
+				errs = append(errs, err)
+			}
+		}
+
+		if err = errors.Join(errs...); err != nil {
+			return err
+		}
+		fmt.Println()
+	}
+
 	var strategy deploy.Strategy
 	if opts.recreate {
 		strategy = &deploy.RollingStrategy{ForceRecreate: true}
@@ -136,7 +167,7 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 		return nil
 	}
 
-	fmt.Println("Deployment plan:")
+	fmt.Println(lipgloss.NewStyle().Bold(true).Render("Deployment plan"))
 	if err = printPlan(ctx, clusterClient, plan); err != nil {
 		return fmt.Errorf("print deployment plan: %w", err)
 	}

cmd/uncloud/dns/release.go

@@ -12,32 +12,21 @@ import (
 	"google.golang.org/protobuf/types/known/emptypb"
 )
 
-type releaseOptions struct {
-	context string
-}
-
 func NewReleaseCommand() *cobra.Command {
-	opts := releaseOptions{}
-
 	cmd := &cobra.Command{
 		Use:   "release",
 		Short: "Release the reserved cluster domain.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return release(cmd.Context(), uncli, opts)
+			return release(cmd.Context(), uncli)
 		},
 	}
 
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
-
 	return cmd
 }
 
-func release(ctx context.Context, uncli *cli.CLI, opts releaseOptions) error {
+func release(ctx context.Context, uncli *cli.CLI) error {
-	client, err := uncli.ConnectCluster(ctx, opts.context)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/dns/reserve.go

@@ -19,7 +19,6 @@ const DefaultUncloudDNSAPIEndpoint = "https://dns.uncloud.run/v1"
 
 type reserveOptions struct {
 	endpoint string
-	context  string
 }
 
 func NewReserveCommand() *cobra.Command {
@@ -36,16 +35,12 @@ func NewReserveCommand() *cobra.Command {
 
 	cmd.Flags().StringVar(&opts.endpoint, "endpoint", DefaultUncloudDNSAPIEndpoint,
 		"API endpoint for the Uncloud DNS service.")
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
 
 	return cmd
 }
 
 func reserve(ctx context.Context, uncli *cli.CLI, opts reserveOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	clusterClient, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/dns/root.go

@@ -9,7 +9,7 @@ func NewRootCommand() *cobra.Command {
 		Use:   "dns",
 		Short: "Manage cluster domain in Uncloud DNS.",
 		Long: "Manage cluster domain in Uncloud DNS.\n" +
-			"DNS commands allow you to reserve or release a unique '<id>.cluster.uncloud.run' domain for your " +
+			"DNS commands allow you to reserve or release a unique 'xxxxxx.uncld.dev' domain for your " +
 			"cluster. When reserved, Caddy service deployments will automatically update DNS records to route " +
 			"traffic to the services in the cluster.",
 	}

cmd/uncloud/dns/show.go

@@ -10,32 +10,21 @@ import (
 	"github.com/spf13/cobra"
 )
 
-type showOptions struct {
-	context string
-}
-
 func NewShowCommand() *cobra.Command {
-	opts := showOptions{}
-
 	cmd := &cobra.Command{
 		Use:   "show",
 		Short: "Print the cluster domain name.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return show(cmd.Context(), uncli, opts)
+			return show(cmd.Context(), uncli)
 		},
 	}
 
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
-
 	return cmd
 }
 
-func show(ctx context.Context, uncli *cli.CLI, opts showOptions) error {
+func show(ctx context.Context, uncli *cli.CLI) error {
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	clusterClient, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/image/ls.go

@@ -22,7 +22,6 @@ import (
 type listOptions struct {
 	machines   []string
 	nameFilter string
-	context    string
 }
 
 func NewListCommand() *cobra.Command {
@@ -60,10 +59,6 @@ func NewListCommand() *cobra.Command {
 	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
 		"Filter images by machine name or ID. Can be specified multiple times or as a comma-separated list. "+
 			"(default is include all machines)")
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
 
 	return cmd
 }
@@ -82,7 +77,7 @@ type imageRow struct {
 }
 
 func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	clusterClient, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/image/push.go

@@ -14,7 +14,6 @@ import (
 type pushOptions struct {
 	image    string
 	machines []string
-	context  string
 	platform string
 }
 
@@ -25,8 +24,8 @@ func NewPushCommand() *cobra.Command {
 		Use:   "push IMAGE",
 		Short: "Upload a local Docker image to the cluster.",
 		Long: `Upload a local Docker image to the cluster transferring only the missing layers.
-The image is uploaded to the machine which CLI is connected to (default) or the specified machine(s).`,
+The image is uploaded to all cluster machines (default) or the specified machine(s).`,
-		Example: `  # Push image to the machine the CLI is connected to.
+		Example: `  # Push image to all machines in the cluster.
   uc image push myapp:latest
 
   # Push image to specific machine.
@@ -35,9 +34,6 @@ The image is uploaded to the machine which CLI is connected to (default) or the
   # Push image to multiple machines.
   uc image push myapp:latest -m machine1,machine2,machine3
 
-  # Push image to all machines in the cluster.
-  uc image push myapp:latest -m all
-
   # Push a specific platform of a multi-platform image.
   uc image push myapp:latest --platform linux/amd64`,
 		Args: cobra.ExactArgs(1),
@@ -50,24 +46,19 @@ The image is uploaded to the machine which CLI is connected to (default) or the
 	}
 
 	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
-		"Machine names to push the image to. Can be specified multiple times or as a comma-separated "+
+		"Machine names or IDs to push the image to. Can be specified multiple times or as a comma-separated list. "+
-			"list of machine names.\n"+
+			"(default is all machines)")
-			"Use 'all' to push to all machines. (default is connected machine)")
 	cmd.Flags().StringVar(
 		&opts.platform, "platform", "",
 		"Push a specific platform of a multi-platform image (e.g., linux/amd64, linux/arm64).\n"+
 			"Local Docker must be configured to use containerd image store to support multi-platform images.",
 	)
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
 
 	return cmd
 }
 
 func push(ctx context.Context, uncli *cli.CLI, opts pushOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	clusterClient, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -76,11 +67,14 @@ func push(ctx context.Context, uncli *cli.CLI, opts pushOptions) error {
 	machines := cli.ExpandCommaSeparatedValues(opts.machines)
 	pushOpts := client.PushImageOptions{}
 
-	// Special handling for "all" keyword to push to all machines.
+	// Special handling for an explicit "all" keyword to push to all machines.
 	if len(machines) == 1 && machines[0] == "all" {
 		pushOpts.AllMachines = true
-	} else {
+	} else if len(machines) > 0 {
 		pushOpts.Machines = machines
+	} else {
+		// Default is to push to all machines in the cluster.
+		pushOpts.AllMachines = true
 	}
 
 	if opts.platform != "" {

cmd/uncloud/machine/add.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"net/netip"
+	"strings"
 	"time"
 
 	"github.com/cenkalti/backoff/v4"
@@ -25,7 +26,6 @@ type addOptions struct {
 	noInstall bool
 	publicIP  string
 	sshKey    string
-	context   string
 	version   string
 }
 
@@ -34,11 +34,22 @@ func NewAddCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "add [USER@]HOST[:PORT]",
 		Short: "Add a remote machine to a cluster.",
+		Long: `Add a new machine to an existing Uncloud cluster.
+
+Connection methods:
+  ssh://user@host       - Use built-in SSH library (default, no prefix required)
+  ssh+cli://user@host   - Use system SSH command (supports ProxyJump, SSH config)`,
 		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
 
-			user, host, port, err := config.SSHDestination(args[0]).Parse()
+			// Determine if SSH CLI needs to be used and strip scheme
+			destination := args[0]
+			useSSHCLI := strings.HasPrefix(destination, "ssh+cli://")
+			destination = strings.TrimPrefix(destination, "ssh+cli://")
+			destination = strings.TrimPrefix(destination, "ssh://")
+
+			user, host, port, err := config.SSHDestination(destination).Parse()
 			if err != nil {
 				return fmt.Errorf("parse remote machine: %w", err)
 			}
@@ -47,6 +58,7 @@ func NewAddCommand() *cobra.Command {
 				Host:      host,
 				Port:      port,
 				KeyPath:   opts.sshKey,
+				UseSSHCLI: useSSHCLI,
 			}
 
 			return add(cmd.Context(), uncli, remoteMachine, opts)
@@ -76,10 +88,6 @@ func NewAddCommand() *cobra.Command {
 		&opts.version, "version", "latest",
 		"Version of the Uncloud daemon to install on the machine.",
 	)
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context to add the machine to. (default is the current context)",
-	)
 
 	return cmd
 }
@@ -100,7 +108,6 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 	}
 
 	clusterClient, machineClient, err := uncli.AddMachine(ctx, cli.AddMachineOptions{
-		Context:       opts.context,
 		MachineName:   opts.name,
 		PublicIP:      publicIP,
 		RemoteMachine: remoteMachine,

cmd/uncloud/machine/init.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net/netip"
+	"strings"
 
 	"github.com/docker/compose/v2/pkg/progress"
 	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
@@ -32,10 +33,14 @@ type initOptions struct {
 func NewInitCommand() *cobra.Command {
 	opts := initOptions{}
 	cmd := &cobra.Command{
-		Use:   "init [USER@HOST:PORT]",
+		Use:   "init [schema://]USER@HOST[:PORT]",
 		Short: "Initialise a new cluster with a remote machine as the first member.",
-		Long: "Initialise a new cluster by setting up a remote machine as the first member.\n" +
+		Long: `Initialise a new cluster by setting up a remote machine as the first member.
-			"This command creates a new context in your Uncloud config to manage the cluster.",
+This command creates a new context in your Uncloud config to manage the cluster.
+
+Connection methods:
+  ssh://user@host       - Use built-in SSH library (default, no prefix required)
+  ssh+cli://user@host   - Use system SSH command (supports ProxyJump, SSH config)`,
 		Example: `  # Initialise a new cluster with default settings.
   uc machine init root@<your-server-ip>
 
@@ -45,7 +50,7 @@ func NewInitCommand() *cobra.Command {
   # Initialise with a non-root user and custom SSH port and key.
   uc machine init ubuntu@<your-server-ip>:2222 -i ~/.ssh/mykey
 
-  # Initialise without Caddy (no reverse proxy) and without an automatically managed domain name (xxxxxx.cluster.uncloud.run).
+  # Initialise without Caddy (no reverse proxy) and without an automatically managed domain name (xxxxxx.uncld.dev).
   # You can deploy Caddy with 'uc caddy deploy' and reserve a domain with 'uc dns reserve' later.
   uc machine init root@<your-server-ip> --no-caddy --no-dns`,
 		// TODO: support initialising a cluster on the local machine.
@@ -55,7 +60,13 @@ func NewInitCommand() *cobra.Command {
 
 			var remoteMachine *cli.RemoteMachine
 			if len(args) > 0 {
-				user, host, port, err := config.SSHDestination(args[0]).Parse()
+				// Determine if SSH CLI is requested and strip scheme
+				destination := args[0]
+				useSSHCLI := strings.HasPrefix(destination, "ssh+cli://")
+				destination = strings.TrimPrefix(destination, "ssh+cli://")
+				destination = strings.TrimPrefix(destination, "ssh://")
+
+				user, host, port, err := config.SSHDestination(destination).Parse()
 				if err != nil {
 					return fmt.Errorf("parse remote machine: %w", err)
 				}
@@ -64,6 +75,7 @@ func NewInitCommand() *cobra.Command {
 					Host:      host,
 					Port:      port,
 					KeyPath:   opts.sshKey,
+					UseSSHCLI: useSSHCLI,
 				}
 			}
 
@@ -116,6 +128,11 @@ func NewInitCommand() *cobra.Command {
 }
 
 func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine, opts initOptions) error {
+	if uncli.Config == nil {
+		// Config is nil when connecting directly to a remote machine (--connect) without using Uncloud config.
+		return fmt.Errorf("do not specify --connect when initialising a new cluster")
+	}
+
 	netPrefix, err := netip.ParsePrefix(opts.network)
 	if err != nil {
 		return fmt.Errorf("parse network CIDR: %w", err)

cmd/uncloud/machine/ls.go

@@ -14,25 +14,20 @@ import (
 )
 
 func NewListCommand() *cobra.Command {
-	var contextName string
 	cmd := &cobra.Command{
 		Use:     "ls",
 		Aliases: []string{"list"},
 		Short:   "List machines in a cluster.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli, contextName)
+			return list(cmd.Context(), uncli)
 		},
 	}
-	cmd.Flags().StringVarP(
-		&contextName, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
 	return cmd
 }
 
-func list(ctx context.Context, uncli *cli.CLI, clusterName string) error {
+func list(ctx context.Context, uncli *cli.CLI) error {
-	client, err := uncli.ConnectCluster(ctx, clusterName)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/machine/rename.go

@@ -9,7 +9,6 @@ import (
 )
 
 func NewRenameCommand() *cobra.Command {
-	var contextName string
 	cmd := &cobra.Command{
 		Use:   "rename OLD_NAME NEW_NAME",
 		Short: "Rename a machine in the cluster.",
@@ -20,18 +19,14 @@ configuration including network settings, public IP, and cluster membership.`,
 		Args: cobra.ExactArgs(2),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return rename(cmd.Context(), uncli, contextName, args[0], args[1])
+			return rename(cmd.Context(), uncli, args[0], args[1])
 		},
 	}
-	cmd.Flags().StringVarP(
-		&contextName, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
 	return cmd
 }
 
-func rename(ctx context.Context, uncli *cli.CLI, contextName, oldName, newName string) error {
+func rename(ctx context.Context, uncli *cli.CLI, oldName, newName string) error {
-	client, err := uncli.ConnectCluster(ctx, contextName)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return err
 	}

cmd/uncloud/machine/rm.go

@@ -22,7 +22,6 @@ import (
 type removeOptions struct {
 	noReset bool
 	yes     bool
-	context string
 }
 
 func NewRmCommand() *cobra.Command {
@@ -39,8 +38,6 @@ func NewRmCommand() *cobra.Command {
 		},
 	}
 
-	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)")
 	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
 		"Do not prompt for confirmation before removing the machine.")
 	cmd.Flags().BoolVar(&opts.noReset, "no-reset", false,
@@ -51,14 +48,14 @@ func NewRmCommand() *cobra.Command {
 
 func remove(ctx context.Context, uncli *cli.CLI, nameOrID string, opts removeOptions) error {
 	// TODO: automatically choose a connection to the machine that is not being removed.
-	client, err := uncli.ConnectCluster(ctx, opts.context)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
 	defer client.Close()
 
 	// Verify the machine exists and list all service containers on it including stopped ones.
-	mctx, machines, err := api.ProxyMachinesContext(ctx, client, []string{nameOrID})
+	mctx, machines, err := client.ProxyMachinesContext(ctx, []string{nameOrID})
 	if err != nil {
 		return err
 	}
@@ -155,8 +152,21 @@ func remove(ctx context.Context, uncli *cli.CLI, nameOrID string, opts removeOpt
 		}
 	}
 
-	// TODO: remove the connection to the machine from the uncloud config if it exists. We need a way to associate
+	// Remove the connection to the machine from the uncloud config if it exists.
-	//  the machine with its connection in the config, e.g. by storing the machine name in the connection metadata.
+	if uncli.Config != nil {
+		contextName := uncli.GetContextOverrideOrCurrent()
+		if context, ok := uncli.Config.Contexts[contextName]; ok {
+			for i, c := range context.Connections {
+				if c.MachineID == m.Id {
+					context.Connections = slices.Delete(context.Connections, i, i+1)
+					break
+				}
+			}
+			if err := uncli.Config.Save(); err != nil {
+				return fmt.Errorf("save config: %w", err)
+			}
+		}
+	}
 
 	// TODO: If Caddy was running on this machine and a cluster domain is reserved,
 	//  let the user know that the DNS records should be updated.

cmd/uncloud/machine/root.go

@@ -8,7 +8,7 @@ func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "machine",
 		Aliases: []string{"m"},
-		Short:   "Manage machines in an Uncloud cluster.",
+		Short:   "Manage machines in the cluster.",
 	}
 	cmd.AddCommand(
 		NewAddCommand(),

cmd/uncloud/machine/update.go

@@ -13,7 +13,6 @@ import (
 type updateOptions struct {
 	name     string
 	publicIP string
-	context  string
 }
 
 func NewUpdateCommand() *cobra.Command {
@@ -43,10 +42,6 @@ At least one flag must be specified to perform an update operation.`,
 		&opts.publicIP, "public-ip", "",
 		fmt.Sprintf("Public IP address of the machine for ingress configuration. Use '%s' or '' to remove the public IP.", PublicIPNone),
 	)
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
 
 	return cmd
 }
@@ -57,7 +52,7 @@ func update(ctx context.Context, uncli *cli.CLI, cmd *cobra.Command, opts update
 		return fmt.Errorf("at least one update flag must be specified (--name, --public-ip)")
 	}
 
-	client, err := uncli.ConnectCluster(ctx, opts.context)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return err
 	}

cmd/uncloud/main.go

@@ -6,6 +6,7 @@ import (
 	"net/netip"
 	"strings"
 
+	"github.com/charmbracelet/lipgloss"
 	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
 	cmdcontext "github.com/psviderski/uncloud/cmd/uncloud/context"
 	"github.com/psviderski/uncloud/cmd/uncloud/dns"
@@ -16,6 +17,7 @@ import (
 	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/psviderski/uncloud/internal/cli/config"
 	"github.com/psviderski/uncloud/internal/fs"
+	"github.com/psviderski/uncloud/internal/log"
 	"github.com/psviderski/uncloud/internal/version"
 	"github.com/spf13/cobra"
 )
@@ -23,9 +25,12 @@ import (
 type globalOptions struct {
 	configPath string
 	connect    string
+	context    string
 }
 
 func main() {
+	log.InitLoggerFromEnv()
+
 	opts := globalOptions{}
 	cmd := &cobra.Command{
 		Use:           "uc",
@@ -35,6 +40,7 @@ func main() {
 		SilenceErrors: true,
 		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
 			cli.BindEnvToFlag(cmd, "connect", "UNCLOUD_CONNECT")
+			cli.BindEnvToFlag(cmd, "context", "UNCLOUD_CONTEXT")
 			cli.BindEnvToFlag(cmd, "uncloud-config", "UNCLOUD_CONFIG")
 
 			var conn *config.MachineConnection
@@ -47,11 +53,17 @@ func main() {
 					conn = &config.MachineConnection{
 						TCP: &addrPort,
 					}
-				} else {
+				} else if strings.HasPrefix(opts.connect, "ssh+cli://") {
-					dest := opts.connect
+					dest := opts.connect[len("ssh+cli://"):]
-					if strings.HasPrefix(dest, "ssh://") {
+					conn = &config.MachineConnection{
-						dest = dest[len("ssh://"):]
+						SSHCLI: config.SSHDestination(dest),
 					}
+				} else if strings.HasPrefix(opts.connect, "unix://") {
+					conn = &config.MachineConnection{
+						Unix: opts.connect[len("unix://"):],
+					}
+				} else {
+					dest := strings.TrimPrefix(opts.connect, "ssh://")
 					conn = &config.MachineConnection{
 						SSH: config.SSHDestination(dest),
 					}
@@ -59,7 +71,7 @@ func main() {
 			}
 
 			configPath := fs.ExpandHomeDir(opts.configPath)
-			uncli, err := cli.New(configPath, conn)
+			uncli, err := cli.New(configPath, conn, opts.context)
 			if err != nil {
 				return fmt.Errorf("initialise CLI: %w", err)
 			}
@@ -70,28 +82,57 @@ func main() {
 
 	cmd.PersistentFlags().StringVar(&opts.connect, "connect", "",
 		"Connect to a remote cluster machine without using the Uncloud configuration file. [$UNCLOUD_CONNECT]\n"+
-			"Format: [ssh://]user@host[:port] or tcp://host:port")
+			"Format: [ssh://]user@host[:port], ssh+cli://user@host[:port], tcp://host:port, or unix:///path/to/uncloud.sock")
 	cmd.PersistentFlags().StringVar(&opts.configPath, "uncloud-config", "~/.config/uncloud/config.yaml",
 		"Path to the Uncloud configuration file. [$UNCLOUD_CONFIG]")
 	_ = cmd.MarkPersistentFlagFilename("uncloud-config", "yaml", "yml")
-	// TODO: make --context a global flag and pass it as a value of the command context.
+	cmd.PersistentFlags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context to use (default is the current context). [$UNCLOUD_CONTEXT]")
+
+	// Set custom help function to show links to docs and Discord only for the root 'uc' command.
+	defaultHelpFunc := cmd.HelpFunc()
+	cmd.SetHelpFunc(func(c *cobra.Command, args []string) {
+		defaultHelpFunc(c, args)
+		// Only show links for the root 'uc' command.
+		if c.Name() == "uc" {
+			urlStyle := lipgloss.NewStyle().
+				Underline(true).
+				Foreground(lipgloss.Color("12")) // light blue
+
+			fmt.Fprintln(c.OutOrStdout())
+			fmt.Fprintf(c.OutOrStdout(), "Learn more about Uncloud:       %s\n",
+				urlStyle.Render("https://uncloud.run/docs"))
+			fmt.Fprintf(c.OutOrStdout(), "Join our Discord community:     %s\n",
+				urlStyle.Render("https://uncloud.run/discord"))
+		}
+	})
+
+	cmd.AddGroup(&cobra.Group{
+		ID:    "service",
+		Title: "Deploy and manage services:",
+	})
 
 	cmd.AddCommand(
+		NewBuildCommand(),
 		NewDeployCommand(),
 		NewDocsCommand(),
-		NewBuildCommand(),
 		NewImagesCommand(),
+		NewPsCommand(),
 		caddy.NewRootCommand(),
 		cmdcontext.NewRootCommand(),
 		dns.NewRootCommand(),
 		image.NewRootCommand(),
 		machine.NewRootCommand(),
 		service.NewRootCommand(),
-		service.NewInspectCommand(),
+		service.NewExecCommand("service"),
-		service.NewListCommand(),
+		service.NewInspectCommand("service"),
-		service.NewRmCommand(),
+		service.NewListCommand("service"),
-		service.NewRunCommand(),
+		service.NewLogsCommand("service"),
-		service.NewScaleCommand(),
+		service.NewRmCommand("service"),
+		service.NewRunCommand("service"),
+		service.NewScaleCommand("service"),
+		service.NewStartCommand("service"),
+		service.NewStopCommand("service"),
 		volume.NewRootCommand(),
 	)
 	cobra.CheckErr(cmd.Execute())

cmd/uncloud/ps.go

@@ -0,0 +1,284 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"time"
+
+	"github.com/charmbracelet/huh/spinner"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/lipgloss/table"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/go-units"
+	"github.com/spf13/cobra"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/client"
+)
+
+const (
+	sortByService = "service"
+	sortByMachine = "machine"
+	sortByHealth  = "health"
+)
+
+type containerHighlight int
+
+const (
+	highlightDanger containerHighlight = iota
+	highlightWarning
+	highlightSuccess
+	highlightNormal
+)
+
+type psOptions struct {
+	sortBy string
+}
+
+func NewPsCommand() *cobra.Command {
+	opts := psOptions{}
+	cmd := &cobra.Command{
+		Use:   "ps",
+		Short: "List all service containers.",
+		Long: `List all service containers across all machines in the cluster.
+
+This command provides a comprehensive overview of all running containers that are part of a service,
+making it easy to see the distribution and status of containers across the cluster.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			if opts.sortBy != sortByService && opts.sortBy != sortByMachine && opts.sortBy != sortByHealth {
+				return fmt.Errorf("invalid value for --sort: %q, must be one of '%s', '%s' or '%s'", opts.sortBy,
+					sortByService, sortByMachine, sortByHealth)
+			}
+
+			return runPs(cmd.Context(), uncli, opts)
+		},
+		GroupID: "service",
+	}
+	cmd.Flags().StringVarP(&opts.sortBy, "sort", "s", sortByService,
+		"Sort containers by 'service', 'machine', or 'health'.")
+	return cmd
+}
+
+type containerInfo struct {
+	serviceName string
+	machineName string
+	id          string
+	name        string
+	image       string
+	status      string
+	highlight   containerHighlight
+	created     time.Time
+	ip          string
+}
+
+func runPs(ctx context.Context, uncli *cli.CLI, opts psOptions) error {
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	var containers []containerInfo
+	err = spinner.New().
+		Title(" Collecting container info...").
+		Type(spinner.MiniDot).
+		Style(lipgloss.NewStyle().Foreground(lipgloss.Color("3"))).
+		ActionWithErr(func(ctx context.Context) error {
+			containers, err = collectContainers(ctx, clusterClient)
+			return err
+		}).
+		Run()
+	if err != nil {
+		return fmt.Errorf("collect containers: %w", err)
+	}
+
+	// Sort the containers based on the sorting option.
+	sort.SliceStable(containers, func(i, j int) bool {
+		a, b := containers[i], containers[j]
+		switch opts.sortBy {
+		case sortByHealth:
+			if a.highlight != b.highlight {
+				return a.highlight < b.highlight
+			}
+			if a.serviceName != b.serviceName {
+				return a.serviceName < b.serviceName
+			}
+		case sortByMachine:
+			if a.machineName != b.machineName {
+				return a.machineName < b.machineName
+			}
+			if a.serviceName != b.serviceName {
+				return a.serviceName < b.serviceName
+			}
+		default: // sortByService
+			if a.serviceName != b.serviceName {
+				return a.serviceName < b.serviceName
+			}
+		}
+		// Fallback to creation time (newest first).
+		return a.created.After(b.created)
+	})
+
+	return printContainers(containers)
+}
+
+func printContainers(containers []containerInfo) error {
+	t := table.New().
+		// Remove the default border.
+		Border(lipgloss.Border{}).
+		BorderTop(false).
+		BorderBottom(false).
+		BorderLeft(false).
+		BorderRight(false).
+		BorderHeader(false).
+		BorderColumn(false).
+		StyleFunc(func(row, col int) lipgloss.Style {
+			if row == table.HeaderRow {
+				return lipgloss.NewStyle().Bold(true).PaddingRight(3)
+			}
+			// Regular style for data rows with padding.
+			return lipgloss.NewStyle().PaddingRight(3)
+		})
+
+	t.Headers("SERVICE", "CONTAINER ID", "CONTAINER NAME", "IMAGE", "CREATED", "STATUS", "IP ADDRESS", "MACHINE")
+
+	for _, ctr := range containers {
+		id := ctr.id
+		if len(id) > 12 {
+			id = id[:12]
+		}
+
+		created := units.HumanDuration(time.Now().UTC().Sub(ctr.created)) + " ago"
+
+		var statusStyle lipgloss.Style
+		switch ctr.highlight {
+		case highlightSuccess:
+			statusStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("2")) // Green
+		case highlightDanger:
+			statusStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("1")) // Red
+		case highlightWarning:
+			statusStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("3")) // Yellow
+		default:
+			statusStyle = lipgloss.NewStyle() // Default
+		}
+
+		t.Row(
+			ctr.serviceName,
+			id,
+			ctr.name,
+			ctr.image,
+			created,
+			statusStyle.Render(ctr.status),
+			ctr.ip,
+			ctr.machineName,
+		)
+	}
+
+	fmt.Println(t)
+	return nil
+}
+
+func collectContainers(ctx context.Context, cli *client.Client) ([]containerInfo, error) {
+	listCtx, machines, err := cli.ProxyMachinesContext(ctx, nil)
+	if err != nil {
+		return nil, fmt.Errorf("proxy machines context: %w", err)
+	}
+
+	// Create a map of IP to machine name for resolving response metadata
+	machinesNamesByIP := make(map[string]string)
+	for _, m := range machines {
+		if addr, err := m.Machine.Network.ManagementIp.ToAddr(); err == nil {
+			machinesNamesByIP[addr.String()] = m.Machine.Name
+		}
+	}
+
+	// List all service containers across all machines in the cluster.
+	machineContainers, err := cli.Docker.ListServiceContainers(
+		listCtx, "", container.ListOptions{All: true},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("list service containers: %w", err)
+	}
+
+	var containers []containerInfo
+	for _, msc := range machineContainers {
+		machineName := "unknown"
+
+		// Metadata can be nil if the request was broadcasted to only one machine.
+		if msc.Metadata == nil && len(machineContainers) > 1 {
+			return nil, fmt.Errorf("something went wrong with gRPC proxy: metadata is missing for a machine response")
+		}
+		if msc.Metadata != nil && msc.Metadata.Error != "" {
+			client.PrintWarning(fmt.Sprintf("failed to list containers on machine %s: %s", machineName,
+				msc.Metadata.Error))
+			continue
+		}
+
+		if msc.Metadata != nil {
+			var ok bool
+			machineName, ok = machinesNamesByIP[msc.Metadata.Machine]
+			if !ok {
+				// Fallback to machine's IP as name.
+				machineName = msc.Metadata.Machine
+			}
+		} else {
+			// Fallback to the first available machine name.
+			if len(machines) > 0 {
+				machineName = machines[0].Machine.Name
+			}
+		}
+
+		for _, ctr := range msc.Containers {
+			if ctr.Container.State == nil || ctr.Container.Config == nil {
+				continue
+			}
+
+			status, err := ctr.Container.HumanState()
+			if err != nil {
+				return nil, fmt.Errorf("get human state for container %s: %w", ctr.Container.ID, err)
+			}
+
+			var highlight containerHighlight
+			healthStatus := ""
+			if ctr.Container.State.Health != nil {
+				healthStatus = ctr.Container.State.Health.Status
+			}
+
+			if healthStatus == container.Unhealthy || ctr.Container.State.Status == "dead" || ctr.Container.State.OOMKilled || ctr.Container.State.Dead {
+				highlight = highlightDanger
+			} else if healthStatus == container.Healthy {
+				highlight = highlightSuccess
+			} else if ctr.Container.State.Status == "running" {
+				highlight = highlightNormal
+			} else { // Other non-critical but noteworthy states
+				highlight = highlightWarning
+			}
+
+			created, _ := time.Parse(time.RFC3339Nano, ctr.Container.Created)
+
+			ip := ctr.Container.UncloudNetworkIP()
+			ipStr := ""
+			// The container might not have an IP if it's not running or uses the host network.
+			if ip.IsValid() {
+				ipStr = ip.String()
+			}
+
+			info := containerInfo{
+				serviceName: ctr.ServiceName(),
+				machineName: machineName,
+				id:          ctr.Container.ID,
+				name:        ctr.Container.Name,
+				image:       ctr.Container.Config.Image,
+				status:      status,
+				highlight:   highlight,
+				created:     created,
+				ip:          ipStr,
+			}
+			containers = append(containers, info)
+		}
+	}
+	return containers, nil
+}

cmd/uncloud/ps_test.go

@@ -0,0 +1,442 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/netip"
+	"testing"
+
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/internal/machine/docker"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/types/known/emptypb"
+)
+
+// mockDockerClient implements pb.DockerClient
+type mockDockerClient struct {
+	pb.DockerClient // Embed to avoid implementing all methods
+	listResp        *pb.ListServiceContainersResponse
+	listErr         error
+}
+
+func (m *mockDockerClient) ListServiceContainers(ctx context.Context, in *pb.ListServiceContainersRequest, opts ...grpc.CallOption) (*pb.ListServiceContainersResponse, error) {
+	return m.listResp, m.listErr
+}
+
+// mockClusterClient implements pb.ClusterClient
+type mockClusterClient struct {
+	pb.ClusterClient // Embed to avoid implementing all methods
+	machinesResp     *pb.ListMachinesResponse
+	machinesErr      error
+}
+
+func (m *mockClusterClient) ListMachines(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*pb.ListMachinesResponse, error) {
+	return m.machinesResp, m.machinesErr
+}
+
+func TestCollectContainers_NilMetadata(t *testing.T) {
+	// Setup container data
+	containerData := map[string]interface{}{
+		"Id":   "container1",
+		"Name": "test-container",
+		"Config": map[string]interface{}{
+			"Image": "test-image",
+		},
+		"State": map[string]interface{}{
+			"Status":     "running",
+			"StartedAt":  "2023-01-01T12:00:00Z",
+			"FinishedAt": "0001-01-01T00:00:00Z",
+		},
+		"NetworkSettings": map[string]interface{}{
+			"Networks": map[string]interface{}{},
+		},
+	}
+	containerJSON, err := json.Marshal(containerData)
+	require.NoError(t, err)
+
+	serviceSpecJSON, err := json.Marshal(map[string]interface{}{})
+	require.NoError(t, err)
+
+	// Setup mocks
+	mockDocker := &mockDockerClient{
+		listResp: &pb.ListServiceContainersResponse{
+			Messages: []*pb.MachineServiceContainers{
+				{
+					Metadata: nil, // Simulating the issue: nil metadata
+					Containers: []*pb.ServiceContainer{
+						{
+							Container:   containerJSON,
+							ServiceSpec: serviceSpecJSON,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	machineIP := "10.0.0.1"
+	mockCluster := &mockClusterClient{
+		machinesResp: &pb.ListMachinesResponse{
+			Machines: []*pb.MachineMember{
+				{
+					Machine: &pb.MachineInfo{
+						Name: "machine-1",
+						Network: &pb.NetworkConfig{
+							ManagementIp: pb.NewIP(netip.MustParseAddr(machineIP)),
+						},
+					},
+					State: pb.MachineMember_UP,
+				},
+			},
+		},
+	}
+
+	// Construct client with mocks
+	cli := &client.Client{
+		Docker: &docker.Client{
+			GRPCClient: mockDocker,
+		},
+		ClusterClient: mockCluster,
+	}
+
+	// Execute
+	containers, err := collectContainers(context.Background(), cli)
+	require.NoError(t, err)
+
+	// Verify
+	assert.Len(t, containers, 1)
+	if len(containers) > 0 {
+		c := containers[0]
+		assert.Equal(t, "container1", c.id)
+		assert.Equal(t, "test-container", c.name)
+		assert.Equal(t, "machine-1", c.machineName, "Should fall back to the single machine name when metadata is nil")
+	}
+}
+
+func TestCollectContainers_NilMetadata_MultipleMachines_Error(t *testing.T) {
+	// If we have multiple machines but receive nil metadata, it should return an error as it is ambiguous
+
+	// Setup container data
+	containerData1 := map[string]interface{}{
+		"Id": "container1",
+	}
+	containerJSON1, _ := json.Marshal(containerData1)
+
+	containerData2 := map[string]interface{}{
+		"Id": "container2",
+		"Config": map[string]interface{}{
+			"Image": "test-image",
+		},
+		"State": map[string]interface{}{
+			"Status":     "running",
+			"StartedAt":  "2023-01-01T12:00:00Z",
+			"FinishedAt": "0001-01-01T00:00:00Z",
+		},
+		"NetworkSettings": map[string]interface{}{
+			"Networks": map[string]interface{}{},
+		},
+	}
+	containerJSON2, _ := json.Marshal(containerData2)
+
+	serviceSpecJSON, _ := json.Marshal(map[string]interface{}{})
+
+	// Setup mocks
+	mockDocker := &mockDockerClient{
+		listResp: &pb.ListServiceContainersResponse{
+			Messages: []*pb.MachineServiceContainers{
+				{
+					Metadata: nil, // Nil metadata
+					Containers: []*pb.ServiceContainer{
+						{
+							Container:   containerJSON1,
+							ServiceSpec: serviceSpecJSON,
+						},
+					},
+				},
+				{
+					Metadata: &pb.Metadata{Machine: "10.0.0.2"},
+					Containers: []*pb.ServiceContainer{
+						{
+							Container:   containerJSON2,
+							ServiceSpec: serviceSpecJSON,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	mockCluster := &mockClusterClient{
+		machinesResp: &pb.ListMachinesResponse{
+			Machines: []*pb.MachineMember{
+				{
+					Machine: &pb.MachineInfo{
+						Name: "machine-1",
+						Network: &pb.NetworkConfig{
+							ManagementIp: pb.NewIP(netip.MustParseAddr("10.0.0.1")),
+						},
+					},
+				},
+				{
+					Machine: &pb.MachineInfo{
+						Name: "machine-2",
+						Network: &pb.NetworkConfig{
+							ManagementIp: pb.NewIP(netip.MustParseAddr("10.0.0.2")),
+						},
+					},
+				},
+			},
+		},
+	}
+
+	// Construct client with mocks
+	cli := &client.Client{
+		Docker: &docker.Client{
+			GRPCClient: mockDocker,
+		},
+		ClusterClient: mockCluster,
+	}
+
+	// Execute
+	_, err := collectContainers(context.Background(), cli)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "metadata is missing for a machine response")
+}
+
+func TestCollectContainers_MetadataPresent_MultipleMachines(t *testing.T) {
+	// Verify correct mapping of containers to machines when metadata is present
+
+	// Setup container data
+	containerData1 := map[string]interface{}{
+		"Id":   "container1",
+		"Name": "container-1",
+		"Config": map[string]interface{}{
+			"Image": "image-1",
+		},
+		"State": map[string]interface{}{
+			"Status":     "running",
+			"StartedAt":  "2023-01-01T12:00:00Z",
+			"FinishedAt": "0001-01-01T00:00:00Z",
+		},
+		"NetworkSettings": map[string]interface{}{
+			"Networks": map[string]interface{}{},
+		},
+	}
+	containerJSON1, _ := json.Marshal(containerData1)
+
+	containerData2 := map[string]interface{}{
+		"Id":   "container2",
+		"Name": "container-2",
+		"Config": map[string]interface{}{
+			"Image": "image-2",
+		},
+		"State": map[string]interface{}{
+			"Status":     "running",
+			"StartedAt":  "2023-01-01T12:00:00Z",
+			"FinishedAt": "0001-01-01T00:00:00Z",
+		},
+		"NetworkSettings": map[string]interface{}{
+			"Networks": map[string]interface{}{},
+		},
+	}
+	containerJSON2, _ := json.Marshal(containerData2)
+
+	serviceSpecJSON, _ := json.Marshal(map[string]interface{}{})
+
+	// Setup mocks
+	mockDocker := &mockDockerClient{
+		listResp: &pb.ListServiceContainersResponse{
+			Messages: []*pb.MachineServiceContainers{
+				{
+					Metadata: &pb.Metadata{Machine: "10.0.0.1"},
+					Containers: []*pb.ServiceContainer{
+						{
+							Container:   containerJSON1,
+							ServiceSpec: serviceSpecJSON,
+						},
+					},
+				},
+				{
+					Metadata: &pb.Metadata{Machine: "10.0.0.2"},
+					Containers: []*pb.ServiceContainer{
+						{
+							Container:   containerJSON2,
+							ServiceSpec: serviceSpecJSON,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	mockCluster := &mockClusterClient{
+		machinesResp: &pb.ListMachinesResponse{
+			Machines: []*pb.MachineMember{
+				{
+					Machine: &pb.MachineInfo{
+						Name: "machine-1",
+						Network: &pb.NetworkConfig{
+							ManagementIp: pb.NewIP(netip.MustParseAddr("10.0.0.1")),
+						},
+					},
+				},
+				{
+					Machine: &pb.MachineInfo{
+						Name: "machine-2",
+						Network: &pb.NetworkConfig{
+							ManagementIp: pb.NewIP(netip.MustParseAddr("10.0.0.2")),
+						},
+					},
+				},
+			},
+		},
+	}
+
+	cli := &client.Client{
+		Docker:        &docker.Client{GRPCClient: mockDocker},
+		ClusterClient: mockCluster,
+	}
+
+	containers, err := collectContainers(context.Background(), cli)
+	require.NoError(t, err)
+
+	assert.Len(t, containers, 2)
+	// Order is not guaranteed by the map iteration in logic or parallel fetch (though here it's mocked sequential),
+	// but collectContainers just appends.
+	// We'll find them by ID.
+	for _, c := range containers {
+		if c.id == "container1" {
+			assert.Equal(t, "machine-1", c.machineName)
+		} else if c.id == "container2" {
+			assert.Equal(t, "machine-2", c.machineName)
+		} else {
+			t.Errorf("unexpected container id: %s", c.id)
+		}
+	}
+}
+
+func TestCollectContainers_NilMetadata_NoMachines(t *testing.T) {
+	// Case: 1 msc with nil metadata but no machines at all
+
+	containerData := map[string]interface{}{
+		"Id": "container1",
+		"Config": map[string]interface{}{
+			"Image": "test-image",
+		},
+		"State": map[string]interface{}{
+			"Status":     "running",
+			"StartedAt":  "2023-01-01T12:00:00Z",
+			"FinishedAt": "0001-01-01T00:00:00Z",
+		},
+		"NetworkSettings": map[string]interface{}{
+			"Networks": map[string]interface{}{},
+		},
+	}
+	containerJSON, _ := json.Marshal(containerData)
+	serviceSpecJSON, _ := json.Marshal(map[string]interface{}{})
+
+	mockDocker := &mockDockerClient{
+		listResp: &pb.ListServiceContainersResponse{
+			Messages: []*pb.MachineServiceContainers{
+				{
+					Metadata: nil,
+					Containers: []*pb.ServiceContainer{
+						{
+							Container:   containerJSON,
+							ServiceSpec: serviceSpecJSON,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	// No machines in cluster response
+	mockCluster := &mockClusterClient{
+		machinesResp: &pb.ListMachinesResponse{
+			Machines: []*pb.MachineMember{},
+		},
+	}
+
+	cli := &client.Client{
+		Docker:        &docker.Client{GRPCClient: mockDocker},
+		ClusterClient: mockCluster,
+	}
+
+	containers, err := collectContainers(context.Background(), cli)
+	require.NoError(t, err)
+
+	assert.Len(t, containers, 1)
+	if len(containers) > 0 {
+		assert.Equal(t, "unknown", containers[0].machineName)
+	}
+}
+
+func TestCollectContainers_MetadataPresent_NotInMapping(t *testing.T) {
+	// Case: msc with metadata that is not in the IP-to-name mapping
+
+	containerData := map[string]interface{}{
+		"Id": "container1",
+		"Config": map[string]interface{}{
+			"Image": "test-image",
+		},
+		"State": map[string]interface{}{
+			"Status":     "running",
+			"StartedAt":  "2023-01-01T12:00:00Z",
+			"FinishedAt": "0001-01-01T00:00:00Z",
+		},
+		"NetworkSettings": map[string]interface{}{
+			"Networks": map[string]interface{}{},
+		},
+	}
+	containerJSON, _ := json.Marshal(containerData)
+	serviceSpecJSON, _ := json.Marshal(map[string]interface{}{})
+
+	mockDocker := &mockDockerClient{
+		listResp: &pb.ListServiceContainersResponse{
+			Messages: []*pb.MachineServiceContainers{
+				{
+					Metadata: &pb.Metadata{Machine: "10.0.0.99"}, // Unknown IP
+					Containers: []*pb.ServiceContainer{
+						{
+							Container:   containerJSON,
+							ServiceSpec: serviceSpecJSON,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	mockCluster := &mockClusterClient{
+		machinesResp: &pb.ListMachinesResponse{
+			Machines: []*pb.MachineMember{
+				{
+					Machine: &pb.MachineInfo{
+						Name: "machine-1",
+						Network: &pb.NetworkConfig{
+							ManagementIp: pb.NewIP(netip.MustParseAddr("10.0.0.1")),
+						},
+					},
+				},
+			},
+		},
+	}
+
+	cli := &client.Client{
+		Docker:        &docker.Client{GRPCClient: mockDocker},
+		ClusterClient: mockCluster,
+	}
+
+	containers, err := collectContainers(context.Background(), cli)
+	require.NoError(t, err)
+
+	assert.Len(t, containers, 1)
+	if len(containers) > 0 {
+		// Should fallback to the IP/string in metadata
+		assert.Equal(t, "10.0.0.99", containers[0].machineName)
+	}
+}

cmd/uncloud/service/exec.go

@@ -0,0 +1,128 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/docker/cli/cli/streams"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type execCliOptions struct {
+	detach      bool
+	interactive bool
+	noTty       bool
+	containerId string
+}
+
+var DEFAULT_COMMAND = []string{"sh", "-c", "command -v bash >/dev/null 2>&1 && exec bash || exec sh"}
+
+func NewExecCommand(groupID string) *cobra.Command {
+	opts := execCliOptions{}
+
+	execCmd := &cobra.Command{
+		Use:   "exec [OPTIONS] SERVICE [COMMAND ARGS...]",
+		Short: "Execute a command in a running service container.",
+		Long: `Execute a command (interactive shell by default) in a running container within a service.
+If the service has multiple replicas and no container ID is specified, the command will be executed in a random container.
+	`,
+		Example: `
+  # Start an interactive shell ("bash" or "sh" will be tried by default)
+  uc exec web-service
+
+  # Start an interactive shell with explicit command
+  uc exec web-service /bin/zsh
+
+  # List files in the specific container of the service; --container accepts full ID or a (unique) prefix
+  uc exec --container d792e web-service ls -la
+
+  # Pipe input to a command inside the service container
+  cat backup.sql | uc exec -T db-service psql -U postgres mydb
+
+  # Run a task in the background (detached mode)
+  uc exec -d web-service /scripts/cleanup.sh`,
+		Args: cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			serviceName := args[0]
+			command := args[1:]
+			if len(command) == 0 {
+				command = DEFAULT_COMMAND
+			}
+			return runExec(cmd.Context(), uncli, serviceName, command, opts)
+		},
+		GroupID: groupID,
+	}
+
+	execCmd.Flags().BoolVarP(&opts.detach, "detach", "d", false, "Detached mode: run command in the background")
+
+	execCmd.Flags().BoolVarP(&opts.noTty, "no-tty", "T", !cli.IsStdoutTerminal(),
+		"Disable pseudo-TTY allocation. By default 'uc exec' allocates a TTY when connected to a terminal.")
+
+	// Keep "-i" and "-t" flags hidden for compatibility with docker exec
+	execCmd.Flags().BoolVarP(&opts.interactive, "interactive", "i", true, "Keep STDIN open even if not attached")
+	execCmd.Flags().MarkHidden("interactive")
+
+	execCmd.Flags().BoolP("tty", "t", false, "Allocate a pseudo-TTY")
+	execCmd.Flags().MarkHidden("tty")
+
+	// Common flags
+	execCmd.Flags().StringVar(&opts.containerId, "container", "",
+		"ID of the container to exec into. Accepts full ID or a unique prefix "+
+			"(default is the random container of the service)")
+
+	// This tells Cobra that all flags must come before positional arguments, so that
+	// commands with their own flags can be handled correctly.
+	execCmd.Flags().SetInterspersed(false)
+
+	return execCmd
+}
+
+func runExec(ctx context.Context, uncli *cli.CLI, serviceName string, command []string, opts execCliOptions) error {
+	if !opts.detach {
+		// Check if we're trying to attach to a TTY from a non-TTY client, e.g.
+		// when doing an 'cmd | uc exec ...'
+		stdin := streams.NewIn(os.Stdin)
+		// TODO: this logic/behavior mirrors docker-compose, but we can be smarter about it and detect TTY dynamically
+		if err := stdin.CheckTty(opts.interactive, !opts.noTty); err != nil {
+			return fmt.Errorf("check TTY: %w; use -T option to disable TTY allocation", err)
+		}
+	}
+
+	client, err := uncli.ConnectClusterWithOptions(ctx, cli.ConnectOptions{
+		ShowProgress: false,
+	})
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	execConfig := api.ExecOptions{
+		Command:     command,
+		AttachStdin: opts.interactive,
+		Tty:         !opts.noTty,
+		Detach:      opts.detach,
+	}
+
+	if !opts.detach {
+		execConfig.AttachStdout = true
+		execConfig.AttachStderr = true
+	}
+
+	exitCode, err := client.ExecContainer(ctx, serviceName, opts.containerId, execConfig)
+	if err != nil {
+		return fmt.Errorf("exec container: %w", err)
+	}
+
+	// For non-detached mode, exit with the same code as the executed command
+	if !opts.detach {
+		if exitCode != 0 {
+			os.Exit(exitCode)
+		}
+	}
+
+	return nil
+}

cmd/uncloud/service/inspect.go

@@ -4,21 +4,22 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"slices"
 	"text/tabwriter"
 	"time"
 
 	"github.com/docker/docker/pkg/stringid"
 	"github.com/docker/go-units"
 	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/spf13/cobra"
 )
 
 type inspectOptions struct {
 	service string
-	context string
 }
 
-func NewInspectCommand() *cobra.Command {
+func NewInspectCommand(groupID string) *cobra.Command {
 	opts := inspectOptions{}
 	cmd := &cobra.Command{
 		Use:   "inspect SERVICE",
@@ -29,16 +30,13 @@ func NewInspectCommand() *cobra.Command {
 			opts.service = args[0]
 			return inspect(cmd.Context(), uncli, opts)
 		},
+		GroupID: groupID,
 	}
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
 	return cmd
 }
 
 func inspect(ctx context.Context, uncli *cli.CLI, opts inspectOptions) error {
-	client, err := uncli.ConnectCluster(ctx, opts.context)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -58,23 +56,31 @@ func inspect(ctx context.Context, uncli *cli.CLI, opts inspectOptions) error {
 		machinesNamesByID[m.Machine.Id] = m.Machine.Name
 	}
 
-	fmt.Printf("ID:    %s\n", svc.ID)
+	fmt.Printf("Service ID: %s\n", svc.ID)
 	fmt.Printf("Name:       %s\n", svc.Name)
 	fmt.Printf("Mode:       %s\n", svc.Mode)
 	fmt.Println()
 
+	// Parse created times for sorting and display.
+	createdTimes := make(map[string]time.Time, len(svc.Containers))
+	for _, ctr := range svc.Containers {
+		createdTimes[ctr.Container.ID], _ = time.Parse(time.RFC3339Nano, ctr.Container.Created)
+	}
+
+	// Sort containers by created time (newest first).
+	slices.SortFunc(svc.Containers, func(a, b api.MachineServiceContainer) int {
+		return createdTimes[b.Container.ID].Compare(createdTimes[a.Container.ID])
+	})
+
 	// Print the list of containers in a table format.
 	tw := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
-	if _, err = fmt.Fprintln(tw, "CONTAINER ID\tIMAGE\tCREATED\tSTATUS\tMACHINE"); err != nil {
+	if _, err = fmt.Fprintln(tw, "CONTAINER ID\tIMAGE\tCREATED\tSTATUS\tIP ADDRESS\tMACHINE"); err != nil {
 		return fmt.Errorf("write header: %w", err)
 	}
 
+	now := time.Now().UTC()
 	for _, ctr := range svc.Containers {
-		createdAt, err := time.Parse(time.RFC3339Nano, ctr.Container.Created)
+		created := units.HumanDuration(now.Sub(createdTimes[ctr.Container.ID])) + " ago"
-		if err != nil {
-			return fmt.Errorf("parse created time: %w", err)
-		}
-		created := units.HumanDuration(time.Now().UTC().Sub(createdAt)) + " ago"
 
 		machine := machinesNamesByID[ctr.MachineID]
 		if machine == "" {
@@ -85,13 +91,21 @@ func inspect(ctx context.Context, uncli *cli.CLI, opts inspectOptions) error {
 			return fmt.Errorf("get human state: %w", err)
 		}
 
+		ip := ctr.Container.UncloudNetworkIP()
+		ipStr := ""
+		// The container might not have an IP if it's not running or uses the host network.
+		if ip.IsValid() {
+			ipStr = ip.String()
+		}
+
 		_, err = fmt.Fprintf(
 			tw,
-			"%s\t%s\t%s\t%s\t%s\n",
+			"%s\t%s\t%s\t%s\t%s\t%s\n",
 			stringid.TruncateID(ctr.Container.ID),
 			ctr.Container.Config.Image,
 			created,
 			state,
+			ipStr,
 			machine,
 		)
 		if err != nil {

cmd/uncloud/service/logs.go

@@ -0,0 +1,336 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/charmbracelet/lipgloss"
+	mapset "github.com/deckarep/golang-set/v2"
+	"github.com/docker/docker/pkg/stringid"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/psviderski/uncloud/pkg/client/compose"
+	"github.com/spf13/cobra"
+)
+
+type logsOptions struct {
+	files    []string
+	follow   bool
+	tail     string
+	since    string
+	until    string
+	utc      bool
+	machines []string
+}
+
+func NewLogsCommand(groupID string) *cobra.Command {
+	var options logsOptions
+
+	cmd := &cobra.Command{
+		Use:     "logs [SERVICE...]",
+		Aliases: []string{"log"},
+		Short:   "View service logs.",
+		Long: `View logs from all replicas of the specified service(s) across all machines in the cluster.
+
+If no services are specified, streams logs from all services defined in the Compose file
+(compose.yaml by default or the file(s) specified with --file).`,
+		Example: `  # View recent logs for a service.
+  uc logs web
+
+  # Stream logs in real-time (follow mode).
+  uc logs -f web
+
+  # View logs from multiple services.
+  uc logs web api db
+
+  # View logs from all services in compose.yaml.
+  uc logs
+
+  # Show last 20 lines per replica (default is 100).
+  uc logs -n 20 web
+
+  # Show all logs without line limit.
+  uc logs -n all web
+
+  # View logs from a specific time range.
+  uc logs --since 3h --until 1h30m web
+
+  # View logs only from replicas running on specific machines.
+  uc logs -m machine1,machine2 web api`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return runLogs(cmd.Context(), uncli, args, options)
+		},
+		GroupID: groupID,
+	}
+
+	cmd.Flags().StringSliceVar(&options.files, "file", nil,
+		"One or more Compose files to load service names from when no services are specified. (default compose.yaml)")
+	cmd.Flags().BoolVarP(&options.follow, "follow", "f", false,
+		"Continually stream new logs.")
+	cmd.Flags().StringSliceVarP(&options.machines, "machine", "m", nil,
+		"Filter logs by machine name or ID. Can be specified multiple times or as a comma-separated list.")
+	cmd.Flags().StringVar(&options.since, "since", "",
+		"Show logs generated on or after the given timestamp. Accepts relative duration, RFC 3339 date, or Unix timestamp.\n"+
+			"Examples:\n"+
+			"  --since 2m30s                      Relative duration (2 minutes 30 seconds ago)\n"+
+			"  --since 1h                         Relative duration (1 hour ago)\n"+
+			"  --since 2025-11-24                 RFC 3339 date only (midnight using local timezone)\n"+
+			"  --since 2024-05-14T22:50:00        RFC 3339 date/time using local timezone\n"+
+			"  --since 2024-01-31T10:30:00Z       RFC 3339 date/time in UTC\n"+
+			"  --since 1763953966                 Unix timestamp (seconds since January 1, 1970)")
+	cmd.Flags().StringVarP(&options.tail, "tail", "n", "100",
+		"Show the most recent logs and limit the number of lines shown per replica. Use 'all' to show all logs.")
+	cmd.Flags().StringVar(&options.until, "until", "",
+		"Show logs generated before the given timestamp. Accepts relative duration, RFC 3339 date, or Unix timestamp.\n"+
+			"See --since for examples.")
+	cmd.Flags().BoolVar(&options.utc, "utc", false,
+		"Print timestamps in UTC instead of local timezone.")
+
+	return cmd
+}
+
+func runLogs(ctx context.Context, uncli *cli.CLI, serviceNames []string, opts logsOptions) error {
+	// If no services specified, try to load them from the Compose file(s).
+	if len(serviceNames) == 0 {
+		project, err := compose.LoadProject(ctx, opts.files)
+		if err != nil {
+			return fmt.Errorf("load compose file(s): %w", err)
+		}
+		// View logs for all services, including disabled by inactive profiles.
+		serviceNames = append(project.ServiceNames(), project.DisabledServiceNames()...)
+		if len(serviceNames) == 0 {
+			return errors.New("no services found in compose file(s)")
+		}
+	}
+
+	// Parse tail option.
+	tail := -1
+	if opts.tail != "all" {
+		tailInt, err := strconv.Atoi(opts.tail)
+		if err != nil {
+			return fmt.Errorf("invalid --tail value '%s': %w", opts.tail, err)
+		}
+		tail = tailInt
+	}
+
+	c, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer c.Close()
+
+	logsOpts := api.ServiceLogsOptions{
+		Follow:   opts.follow,
+		Tail:     tail,
+		Since:    opts.since,
+		Until:    opts.until,
+		Machines: cli.ExpandCommaSeparatedValues(opts.machines),
+	}
+
+	// Collect log streams from all services.
+	machineIDsSet := mapset.NewSet[string]()
+	svcStreams := make([]<-chan api.ServiceLogEntry, 0, len(serviceNames))
+	for _, serviceName := range serviceNames {
+		svc, ch, err := c.ServiceLogs(ctx, serviceName, logsOpts)
+		if err != nil {
+			return fmt.Errorf("stream logs for service '%s': %w", serviceName, err)
+		}
+		svcStreams = append(svcStreams, ch)
+
+		machineIDs := svc.MachineIDs()
+		machineIDsSet.Append(machineIDs...)
+	}
+
+	var stream <-chan api.ServiceLogEntry
+	if len(serviceNames) == 1 {
+		stream = svcStreams[0]
+	} else {
+		// Merge all service streams into a single sorted stream without stall detection as its handled per-service.
+		merger := client.NewLogMerger(svcStreams, client.LogMergerOptions{})
+		stream = merger.Stream()
+	}
+
+	// Fetch machine names for all machines (machineIDsSet) service containers are running on.
+	machines, err := c.ListMachines(ctx, &api.MachineFilter{NamesOrIDs: machineIDsSet.ToSlice()})
+	if err != nil {
+		return fmt.Errorf("list machines: %w", err)
+	}
+	machineNames := make([]string, 0, len(machines))
+	for _, m := range machines {
+		machineNames = append(machineNames, m.Machine.Name)
+	}
+
+	formatter := newLogFormatter(machineNames, serviceNames, opts.utc)
+
+	// Print merged logs.
+	for entry := range stream {
+		if entry.Err != nil {
+			formatter.printError(entry)
+			continue
+		}
+		formatter.printEntry(entry)
+	}
+
+	return nil
+}
+
+// Available colors for machine/service differentiation.
+var colorPalette = []lipgloss.Color{
+	lipgloss.Color("10"), // Bright green
+	lipgloss.Color("11"), // Bright yellow
+	lipgloss.Color("12"), // Bright blue
+	lipgloss.Color("13"), // Bright magenta
+	lipgloss.Color("14"), // Bright cyan
+	lipgloss.Color("2"),  // Green
+	lipgloss.Color("3"),  // Yellow
+	lipgloss.Color("4"),  // Blue
+	lipgloss.Color("5"),  // Magenta
+	lipgloss.Color("6"),  // Cyan
+}
+
+// logFormatter handles formatting and printing of log entries with dynamic column alignment.
+type logFormatter struct {
+	machineNames []string
+	serviceNames []string
+
+	maxMachineWidth int
+	maxServiceWidth int
+
+	utc bool
+}
+
+func newLogFormatter(machineNames, serviceNames []string, utc bool) *logFormatter {
+	slices.Sort(machineNames)
+	slices.Sort(serviceNames)
+
+	maxMachineWidth := 0
+	for _, name := range machineNames {
+		if len(name) > maxMachineWidth {
+			maxMachineWidth = len(name)
+		}
+	}
+
+	maxServiceWidth := 0
+	for _, name := range serviceNames {
+		if len(name) > maxServiceWidth {
+			maxServiceWidth = len(name)
+		}
+	}
+
+	return &logFormatter{
+		machineNames:    machineNames,
+		serviceNames:    serviceNames,
+		maxMachineWidth: maxMachineWidth,
+		maxServiceWidth: maxServiceWidth,
+		utc:             utc,
+	}
+}
+
+// formatTimestamp formats timestamp using local timezone or UTC if configured.
+func (f *logFormatter) formatTimestamp(t time.Time) string {
+	if f.utc {
+		t = t.UTC()
+	} else {
+		t = t.In(time.Local)
+	}
+	dimStyle := lipgloss.NewStyle().Faint(true)
+
+	return dimStyle.Render(t.Format(time.StampMilli))
+}
+
+func (f *logFormatter) formatMachine(name string) string {
+	style := lipgloss.NewStyle().Bold(true).PaddingRight(f.maxMachineWidth - len(name))
+
+	if len(f.serviceNames) == 1 {
+		// Machine name is coloured for single-service logs.
+		i := slices.Index(f.machineNames, name)
+		if i == -1 {
+			f.machineNames = append(f.machineNames, name)
+			i = len(f.machineNames) - 1
+		}
+
+		style = style.Foreground(colorPalette[i%len(colorPalette)])
+	}
+
+	return style.Render(name)
+}
+
+func (f *logFormatter) formatServiceContainer(serviceName, containerID string) string {
+	styleService := lipgloss.NewStyle().Bold(true).PaddingRight(f.maxServiceWidth - len(serviceName))
+	styleContainer := lipgloss.NewStyle().Faint(true)
+
+	if len(f.serviceNames) > 1 {
+		// Service name is coloured for multi-service logs.
+		i := slices.Index(f.serviceNames, serviceName)
+		if i == -1 {
+			f.serviceNames = append(f.serviceNames, serviceName)
+			i = len(f.serviceNames) - 1
+		}
+
+		styleService = styleService.Foreground(colorPalette[i%len(colorPalette)])
+	}
+
+	return styleService.Render(serviceName) + styleContainer.Render("["+containerID[:5]+"]")
+}
+
+// printEntry prints a single log entry with proper formatting.
+func (f *logFormatter) printEntry(entry api.ServiceLogEntry) {
+	if entry.Stream != api.LogStreamStdout && entry.Stream != api.LogStreamStderr {
+		return
+	}
+
+	var output strings.Builder
+
+	// Timestamp
+	output.WriteString(f.formatTimestamp(entry.Timestamp))
+	output.WriteString(" ")
+
+	// Machine name
+	output.WriteString(f.formatMachine(entry.Metadata.MachineName))
+	output.WriteString(" ")
+
+	// Service[container_id]
+	output.WriteString(f.formatServiceContainer(entry.Metadata.ServiceName, entry.Metadata.ContainerID))
+	output.WriteString(" ")
+
+	// Message
+	output.Write(entry.Message)
+
+	// Print to appropriate stream.
+	if entry.Stream == api.LogStreamStderr {
+		fmt.Fprint(os.Stderr, output.String())
+	} else {
+		fmt.Print(output.String())
+	}
+}
+
+// printError prints an error entry (e.g., stalled stream warning).
+func (f *logFormatter) printError(entry api.ServiceLogEntry) {
+	if entry.Metadata.ContainerID != "" {
+		msg := fmt.Sprintf("WARNING: log stream from %s[%s] on machine '%s'",
+			entry.Metadata.ServiceName,
+			stringid.TruncateID(entry.Metadata.ContainerID),
+			entry.Metadata.MachineName)
+
+		if errors.Is(entry.Err, api.ErrLogStreamStalled) {
+			msg += " stopped responding"
+		} else {
+			msg += fmt.Sprintf(": %v", entry.Err)
+		}
+
+		style := lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("11")) // Bold bright yellow
+		fmt.Fprintln(os.Stderr, style.Render(msg))
+	} else {
+		msg := fmt.Sprintf("ERROR: %v", entry.Err)
+		style := lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("9")) // Bold bright red
+		fmt.Fprintln(os.Stderr, style.Render(msg))
+	}
+}

cmd/uncloud/service/ls.go

@@ -4,33 +4,31 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"slices"
 	"strings"
 	"text/tabwriter"
 
 	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/spf13/cobra"
 )
 
-func NewListCommand() *cobra.Command {
+func NewListCommand(groupID string) *cobra.Command {
-	var contextName string
 	cmd := &cobra.Command{
 		Use:     "ls",
 		Aliases: []string{"list"},
 		Short:   "List services.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli, contextName)
+			return list(cmd.Context(), uncli)
 		},
+		GroupID: groupID,
 	}
-	cmd.Flags().StringVarP(
-		&contextName, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
 	return cmd
 }
 
-func list(ctx context.Context, uncli *cli.CLI, contextName string) error {
+func list(ctx context.Context, uncli *cli.CLI) error {
-	client, err := uncli.ConnectCluster(ctx, contextName)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -41,15 +39,15 @@ func list(ctx context.Context, uncli *cli.CLI, contextName string) error {
 		return fmt.Errorf("list services: %w", err)
 	}
 
-	serviceNames := make(map[string]struct{}, len(services))
+	// Sort services by name.
 	haveDuplicateNames := false
-	for _, svc := range services {
+	slices.SortFunc(services, func(a, b api.Service) int {
-		if _, exists := serviceNames[svc.Name]; exists {
+		if a.Name == b.Name {
 			haveDuplicateNames = true
-			break
+			return strings.Compare(a.ID, b.ID)
-		}
-		serviceNames[svc.Name] = struct{}{}
 		}
+		return strings.Compare(a.Name, b.Name)
+	})
 
 	// Print the list of services in a table format.
 	tw := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
@@ -67,6 +65,15 @@ func list(ctx context.Context, uncli *cli.CLI, contextName string) error {
 		images := strings.Join(s.Images(), ", ")
 		endpoints := strings.Join(s.Endpoints(), ", ")
 
+		// If no endpoints from ports, check if the service uses custom Caddy config.
+		if endpoints == "" {
+			for _, ctr := range s.Containers {
+				if ctr.Container.ServiceSpec.CaddyConfig() != "" {
+					endpoints = "(custom Caddy config)"
+				}
+			}
+		}
+
 		if haveDuplicateNames {
 			if _, err = fmt.Fprintf(tw, "%s\t", s.ID); err != nil {
 				return fmt.Errorf("write row: %w", err)

cmd/uncloud/service/rm.go

@@ -11,31 +11,32 @@ import (
 
 type rmOptions struct {
 	services []string
-	context  string
 }
 
-func NewRmCommand() *cobra.Command {
+func NewRmCommand(groupID string) *cobra.Command {
 	opts := rmOptions{}
 	cmd := &cobra.Command{
 		Use:     "rm SERVICE [SERVICE...]",
 		Aliases: []string{"remove", "delete"},
 		Short:   "Remove one or more services.",
+		Long: `Remove one or more services.
+
+The volumes used by the services are preserved and should be removed separately
+with 'uc volume rm'. Anonymous Docker volumes (automatically created from VOLUME
+directives in image Dockerfiles) are automatically removed with their containers.`,
 		Args: cobra.MinimumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
 			opts.services = args
 			return rm(cmd.Context(), uncli, opts)
 		},
+		GroupID: groupID,
 	}
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
 	return cmd
 }
 
 func rm(ctx context.Context, uncli *cli.CLI, opts rmOptions) error {
-	client, err := uncli.ConnectCluster(ctx, opts.context)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/service/root.go

@@ -8,14 +8,18 @@ func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "service",
 		Aliases: []string{"svc"},
-		Short:   "Manage services in an Uncloud cluster.",
+		Short:   "Manage services in the cluster.",
 	}
 	cmd.AddCommand(
-		NewInspectCommand(),
+		NewExecCommand(""),
-		NewListCommand(),
+		NewInspectCommand(""),
-		NewRmCommand(),
+		NewListCommand(""),
-		NewRunCommand(),
+		NewLogsCommand(""),
-		NewScaleCommand(),
+		NewRmCommand(""),
+		NewRunCommand(""),
+		NewScaleCommand(""),
+		NewStartCommand(""),
+		NewStopCommand(""),
 	)
 	return cmd
 }

cmd/uncloud/service/run.go

@@ -34,11 +34,9 @@ type runOptions struct {
 	replicas          uint
 	user              string
 	volumes           []string
-
-	context string
 }
 
-func NewRunCommand() *cobra.Command {
+func NewRunCommand(groupID string) *cobra.Command {
 	opts := runOptions{}
 
 	cmd := &cobra.Command{
@@ -56,6 +54,7 @@ func NewRunCommand() *cobra.Command {
 
 			return run(cmd.Context(), uncli, opts)
 		},
+		GroupID: groupID,
 	}
 
 	cmd.Flags().StringVar(&opts.caddyfile, "caddyfile", "",
@@ -112,11 +111,6 @@ func NewRunCommand() *cobra.Command {
 			"  -v /data/uploads:/app/uploads         	 Bind mount /data/uploads host directory to /app/uploads in container\n"+
 			"  -v /host/path:/container/path:ro 		 Bind mount a host directory or file as read-only")
 
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context to run the service in. (default is the current context)",
-	)
-
 	return cmd
 }
 
@@ -126,7 +120,7 @@ func run(ctx context.Context, uncli *cli.CLI, opts runOptions) error {
 		return err
 	}
 
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	clusterClient, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/service/scale.go

@@ -15,10 +15,9 @@ import (
 type scaleOptions struct {
 	service  string
 	replicas uint
-	context  string
 }
 
-func NewScaleCommand() *cobra.Command {
+func NewScaleCommand(groupID string) *cobra.Command {
 	opts := scaleOptions{}
 	cmd := &cobra.Command{
 		Use:   "scale SERVICE REPLICAS",
@@ -37,13 +36,9 @@ func NewScaleCommand() *cobra.Command {
 
 			return scale(cmd.Context(), uncli, opts)
 		},
+		GroupID: groupID,
 	}
 
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
-
 	return cmd
 }
 
@@ -57,7 +52,7 @@ func scale(ctx context.Context, uncli *cli.CLI, opts scaleOptions) error {
 		)
 	}
 
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	clusterClient, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/service/start.go

@@ -0,0 +1,54 @@
+//nolint:dupl
+package service
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/spf13/cobra"
+)
+
+type startOptions struct {
+	services []string
+}
+
+func NewStartCommand(groupID string) *cobra.Command {
+	opts := startOptions{}
+	cmd := &cobra.Command{
+		Use:   "start SERVICE [SERVICE...]",
+		Short: "Start one or more services.",
+		Long: `Start one or more previously stopped services.
+
+Starts all containers of the specified service(s) across all machines in the cluster.
+Services can be specified by name or ID.`,
+		Args: cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			opts.services = args
+			return start(cmd.Context(), uncli, opts)
+		},
+		GroupID: groupID,
+	}
+	return cmd
+}
+
+func start(ctx context.Context, uncli *cli.CLI, opts startOptions) error {
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	for _, s := range opts.services {
+		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+			if err = client.StartService(ctx, s); err != nil {
+				return fmt.Errorf("start service '%s': %w", s, err)
+			}
+			return nil
+		}, uncli.ProgressOut(), "Starting service "+s)
+	}
+
+	return err
+}

cmd/uncloud/service/stop.go

@@ -0,0 +1,68 @@
+//nolint:dupl
+package service
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/docker/docker/api/types/container"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/spf13/cobra"
+)
+
+type stopOptions struct {
+	services []string
+	signal   string
+	timeout  int
+}
+
+func NewStopCommand(groupID string) *cobra.Command {
+	opts := stopOptions{}
+	cmd := &cobra.Command{
+		Use:   "stop SERVICE [SERVICE...]",
+		Short: "Stop one or more services.",
+		Long: `Stop one or more running services.
+
+Gracefully stops all containers of the specified service(s) across all machines in the cluster.
+Services can be specified by name or ID. Stopped services can be restarted with 'uc start'.`,
+		Args: cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			opts.services = args
+			return stop(cmd.Context(), uncli, opts)
+		},
+		GroupID: groupID,
+	}
+	cmd.Flags().StringVarP(&opts.signal, "signal", "s", "",
+		"Signal to send to each container's main process.\n"+
+			"Can be a signal name (SIGTERM, SIGINT, SIGHUP, etc.) or a number. (default SIGTERM)")
+	cmd.Flags().IntVarP(&opts.timeout, "timeout", "t", 10,
+		"Seconds to wait for each container to stop gracefully before forcibly killing it with SIGKILL.\n"+
+			"Use -1 to wait indefinitely.")
+	return cmd
+}
+
+func stop(ctx context.Context, uncli *cli.CLI, opts stopOptions) error {
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	stopOpts := container.StopOptions{
+		Signal:  opts.signal,
+		Timeout: &opts.timeout,
+	}
+
+	for _, s := range opts.services {
+		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+			if err = client.StopService(ctx, s, stopOpts); err != nil {
+				return fmt.Errorf("stop service '%s': %w", s, err)
+			}
+			return nil
+		}, uncli.ProgressOut(), "Stopping service "+s)
+	}
+
+	return err
+}

cmd/uncloud/volume/create.go

@@ -19,7 +19,6 @@ type createOptions struct {
 	driverOpts []string
 	labels     []string
 	machine    string
-	context    string
 }
 
 func NewCreateCommand() *cobra.Command {
@@ -50,14 +49,12 @@ func NewCreateCommand() *cobra.Command {
 		"Labels to assign to the volume in the form of 'key=value' pairs. Can be specified multiple times.")
 	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
 		"Name or ID of the machine to create the volume on.")
-	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)")
 
 	return cmd
 }
 
 func create(ctx context.Context, uncli *cli.CLI, name string, opts createOptions) error {
-	client, err := uncli.ConnectCluster(ctx, opts.context)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/volume/inspect.go

@@ -13,7 +13,6 @@ import (
 
 type inspectOptions struct {
 	machine string
-	context string
 }
 
 func NewInspectCommand() *cobra.Command {
@@ -32,14 +31,12 @@ func NewInspectCommand() *cobra.Command {
 	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
 		"Name or ID of the machine where the volume is located. "+
 			"If not specified, the volume will be searched across all machines.")
-	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)")
 
 	return cmd
 }
 
 func inspect(ctx context.Context, uncli *cli.CLI, name string, opts inspectOptions) error {
-	client, err := uncli.ConnectCluster(ctx, opts.context)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/volume/ls.go

@@ -16,7 +16,6 @@ import (
 type listOptions struct {
 	machines []string
 	quiet    bool
-	context  string
 }
 
 func NewListCommand() *cobra.Command {
@@ -38,14 +37,11 @@ func NewListCommand() *cobra.Command {
 	cmd.Flags().BoolVarP(&opts.quiet, "quiet", "q", false,
 		"Only display volume names.")
 
-	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)")
-
 	return cmd
 }
 
 func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
-	client, err := uncli.ConnectCluster(ctx, opts.context)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/volume/rm.go

@@ -14,7 +14,6 @@ type removeOptions struct {
 	force    bool
 	machines []string
 	yes      bool
-	context  string
 }
 
 func NewRemoveCommand() *cobra.Command {
@@ -41,14 +40,11 @@ func NewRemoveCommand() *cobra.Command {
 	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
 		"Do not prompt for confirmation before removing the volume(s).")
 
-	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
-		"Name of the cluster context. (default is the current context)")
-
 	return cmd
 }
 
 func remove(ctx context.Context, uncli *cli.CLI, names []string, opts removeOptions) error {
-	client, err := uncli.ConnectCluster(ctx, opts.context)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/volume/root.go

@@ -7,7 +7,7 @@ import (
 func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "volume",
-		Short: "Manage volumes in an Uncloud cluster.",
+		Short: "Manage volumes in the cluster.",
 	}
 	cmd.AddCommand(
 		NewCreateCommand(),

cmd/uncloudd/dialstdio.go

@@ -0,0 +1,128 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"os"
+
+	"github.com/psviderski/uncloud/internal/machine"
+	"github.com/spf13/cobra"
+)
+
+func newDialStdioCommand() *cobra.Command {
+	var socketPath string
+
+	cmd := &cobra.Command{
+		Use:    "dial-stdio",
+		Short:  "Proxy stdin/stdout to the Uncloud API socket",
+		Hidden: true,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runDialStdio(cmd.Context(), socketPath, os.Stdin, os.Stdout)
+		},
+	}
+
+	cmd.Flags().StringVar(&socketPath, "socket", machine.DefaultUncloudSockPath,
+		"Path to the Uncloud API socket")
+
+	return cmd
+}
+
+// halfReadCloser is the read side of a half-duplex connection.
+type halfReadCloser interface {
+	io.Reader
+	CloseRead() error
+}
+
+// halfWriteCloser is the write side of a half-duplex connection.
+type halfWriteCloser interface {
+	io.Writer
+	CloseWrite() error
+}
+
+// halfReadCloserWrapper wraps an io.ReadCloser to implement halfReadCloser.
+type halfReadCloserWrapper struct {
+	io.ReadCloser
+}
+
+func (x *halfReadCloserWrapper) CloseRead() error {
+	return x.Close()
+}
+
+// halfWriteCloserWrapper wraps an io.WriteCloser to implement halfWriteCloser.
+type halfWriteCloserWrapper struct {
+	io.WriteCloser
+}
+
+func (x *halfWriteCloserWrapper) CloseWrite() error {
+	return x.Close()
+}
+
+func runDialStdio(ctx context.Context, socketPath string, stdin io.Reader, stdout io.Writer) error {
+	// Connect to the unix socket.
+	var dialer net.Dialer
+	conn, err := dialer.DialContext(ctx, "unix", socketPath)
+	if err != nil {
+		return fmt.Errorf("connect to socket %q: %w", socketPath, err)
+	}
+	defer conn.Close()
+
+	// Wrap stdin/stdout to support half-closing.
+	var stdinCloser halfReadCloser
+	if c, ok := stdin.(halfReadCloser); ok {
+		stdinCloser = c
+	} else if c, ok := stdin.(io.ReadCloser); ok {
+		stdinCloser = &halfReadCloserWrapper{c}
+	}
+
+	var stdoutCloser halfWriteCloser
+	if c, ok := stdout.(halfWriteCloser); ok {
+		stdoutCloser = c
+	} else if c, ok := stdout.(io.WriteCloser); ok {
+		stdoutCloser = &halfWriteCloserWrapper{c}
+	}
+
+	// Copy data bidirectionally between stdin/stdout and the socket.
+	stdin2socket := make(chan error, 1)
+	socket2stdout := make(chan error, 1)
+
+	// Copy from stdin to socket.
+	go func() {
+		_, err := io.Copy(conn, stdin)
+		stdin2socket <- err
+		// Close write side of connection after stdin is done.
+		if unixConn, ok := conn.(*net.UnixConn); ok {
+			unixConn.CloseWrite()
+		}
+		if stdinCloser != nil {
+			stdinCloser.CloseRead()
+		}
+	}()
+
+	// Copy from socket to stdout.
+	go func() {
+		_, err := io.Copy(stdout, conn)
+		socket2stdout <- err
+		// Close read side of connection after socket is done sending.
+		if unixConn, ok := conn.(*net.UnixConn); ok {
+			unixConn.CloseRead()
+		}
+		if stdoutCloser != nil {
+			stdoutCloser.CloseWrite()
+		}
+	}()
+
+	select {
+	case err = <-stdin2socket:
+		if err != nil {
+			return err
+		}
+		// wait for stdout
+		err = <-socket2stdout
+	case err = <-socket2stdout:
+		// return immediately, matching Docker's approach
+		// (stdin is never closed when TTY)
+	}
+	return err
+}

cmd/uncloudd/main.go

@@ -42,6 +42,9 @@ func main() {
 		"Directory for storing persistent machine state")
 	_ = cmd.MarkFlagDirname("data-dir")
 
+	// Add dial-stdio subcommand.
+	cmd.AddCommand(newDialStdioCommand())
+
 	// ctx is canceled when the daemon command is interrupted.
 	ctx, cancel := context.WithCancel(context.Background())
 

go.mod

@@ -9,9 +9,10 @@ require (
 	github.com/alecthomas/chroma/v2 v2.20.0
 	github.com/caddyserver/caddy/v2 v2.8.4
 	github.com/cenkalti/backoff/v4 v4.3.0
-	github.com/charmbracelet/bubbles v0.20.0
+	github.com/charmbracelet/bubbles v0.21.0
-	github.com/charmbracelet/bubbletea v1.3.9
+	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/huh v0.6.0
+	github.com/charmbracelet/huh/spinner v0.0.0-20251110114415-25888d17260b
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/compose-spec/compose-go/v2 v2.9.0
 	github.com/containerd/errdefs v1.0.0
@@ -45,7 +46,7 @@ require (
 	github.com/muesli/termenv v0.16.0
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
-	github.com/psviderski/unregistry v0.3.1
+	github.com/psviderski/unregistry v0.4.1
 	github.com/siderolabs/discovery-api v0.1.4
 	github.com/siderolabs/discovery-client v0.1.9
 	github.com/siderolabs/grpc-proxy v0.5.1
@@ -71,19 +72,36 @@ require (
 	cloud.google.com/go/kms v1.19.0 // indirect
 	cloud.google.com/go/longrunning v0.6.0 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/AlecAivazis/survey/v2 v2.3.7 // indirect
 	github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/DefangLabs/secret-detector v0.0.0-20250403165618-22662109213e // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Microsoft/hcsshim v0.13.0 // indirect
+	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
+	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 // indirect
 	github.com/armon/go-metrics v0.4.1 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.30.3 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.27.27 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.27 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 // indirect
+	github.com/aws/smithy-go v1.20.3 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.2.0 // indirect
@@ -112,7 +130,7 @@ require (
 	github.com/containerd/ttrpc v1.2.7 // indirect
 	github.com/containerd/typeurl/v2 v2.2.3 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 // indirect
 	github.com/dgraph-io/badger v1.6.2 // indirect
 	github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
@@ -122,28 +140,37 @@ require (
 	github.com/distribution/distribution/v3 v3.0.0 // indirect
 	github.com/dlclark/regexp2 v1.11.5 // indirect
 	github.com/docker/buildx v0.29.1 // indirect
+	github.com/docker/cli-docs-tool v0.10.0 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
-	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 // indirect
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
-	github.com/fatih/color v1.17.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fsnotify/fsevents v0.2.0 // indirect
 	github.com/fvbommel/sortorder v1.1.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
 	github.com/go-kit/kit v0.13.0 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-sql-driver/mysql v1.8.1 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gofrs/flock v0.12.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
 	github.com/golang/glog v1.2.5 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
@@ -151,13 +178,17 @@ require (
 	github.com/google/btree v1.1.2 // indirect
 	github.com/google/cel-go v0.20.1 // indirect
 	github.com/google/flatbuffers v24.3.25+incompatible // indirect
+	github.com/google/gnostic-models v0.6.8 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-immutable-radix/v2 v2.1.0 // indirect
 	github.com/hashicorp/go-msgpack v0.5.5 // indirect
@@ -175,6 +206,7 @@ require (
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/in-toto/in-toto-golang v0.9.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
 	github.com/ipfs/go-block-format v0.2.0 // indirect
 	github.com/ipfs/go-ipfs-util v0.0.3 // indirect
@@ -192,7 +224,11 @@ require (
 	github.com/jackc/pgtype v1.14.0 // indirect
 	github.com/jackc/pgx/v4 v4.18.3 // indirect
 	github.com/jbenet/goprocess v0.1.4 // indirect
+	github.com/jonboulle/clockwork v0.5.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
 	github.com/josharian/native v1.1.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.9 // indirect
 	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
@@ -203,6 +239,7 @@ require (
 	github.com/libp2p/go-libp2p-pubsub v0.11.0 // indirect
 	github.com/libp2p/go-msgio v0.3.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/manifoldco/promptui v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -214,6 +251,7 @@ require (
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mholt/acmez/v2 v2.0.3 // indirect
+	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/minio/sha256-simd v1.0.1 // indirect
 	github.com/mitchellh/cli v1.1.5 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
@@ -226,12 +264,17 @@ require (
 	github.com/moby/go-archive v0.1.0 // indirect
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/moby/sys/atomicwriter v0.1.0 // indirect
+	github.com/moby/sys/capability v0.4.0 // indirect
 	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
+	github.com/moby/sys/symlink v0.3.0 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
@@ -246,6 +289,7 @@ require (
 	github.com/multiformats/go-multistream v0.5.0 // indirect
 	github.com/multiformats/go-varint v0.0.7 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/onsi/ginkgo/v2 v2.22.0 // indirect
 	github.com/opencontainers/runtime-spec v1.2.1 // indirect
@@ -273,11 +317,13 @@ require (
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
 	github.com/secure-systems-lab/go-securesystemslib v0.6.0 // indirect
+	github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
 	github.com/siderolabs/gen v0.4.8 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/slackhq/nebula v1.6.1 // indirect
 	github.com/smallstep/certificates v0.26.1 // indirect
 	github.com/smallstep/nosql v0.6.1 // indirect
@@ -290,6 +336,8 @@ require (
 	github.com/stoewer/go-strcase v1.2.0 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/tailscale/tscert v0.0.0-20240517230440-bbccfbf48933 // indirect
+	github.com/theupdateframework/notary v0.7.0 // indirect
+	github.com/tilt-dev/fsnotify v1.4.8-0.20220602155310-fff9c274a375 // indirect
 	github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 // indirect
 	github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f // indirect
 	github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect
@@ -298,8 +346,10 @@ require (
 	github.com/urfave/cli v1.22.17 // indirect
 	github.com/vbatts/tar-split v0.12.1 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	github.com/zclconf/go-cty v1.17.0 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
 	go.etcd.io/bbolt v1.4.3 // indirect
 	go.opencensus.io v0.24.0 // indirect
@@ -339,17 +389,31 @@ require (
 	golang.org/x/crypto/x509roots/fallback v0.0.0-20240507223354-67b13616a595 // indirect
 	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
 	golang.org/x/mod v0.27.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/text v0.28.0 // indirect
 	golang.org/x/time v0.11.0 // indirect
 	golang.org/x/tools v0.36.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259 // indirect
 	howett.net/plist v1.0.0 // indirect
+	k8s.io/api v0.32.3 // indirect
+	k8s.io/apimachinery v0.32.3 // indirect
+	k8s.io/client-go v0.32.3 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
+	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
 	lukechampine.com/blake3 v1.3.0 // indirect
 	modernc.org/libc v1.61.13 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.8.2 // indirect
+	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
+	tags.cncf.io/container-device-interface v1.0.1 // indirect
 )

go.sum

@@ -18,6 +18,8 @@ filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ=
+github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo=
 github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 h1:cTp8I5+VIoKjsnZuH8vjyaysT/ses3EvZeaV/1UkF2M=
 github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96/go.mod h1:bOvUY6CB00SOBii9/FifXqc0awNKxLFCL/+pkDPuyl8=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
@@ -26,6 +28,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
 github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
+github.com/DefangLabs/secret-detector v0.0.0-20250403165618-22662109213e h1:rd4bOvKmDIx0WeTv9Qz+hghsgyjikFiPrseXHlKepO0=
+github.com/DefangLabs/secret-detector v0.0.0-20250403165618-22662109213e/go.mod h1:blbwPQh4DTlCZEfk1BLU4oMIhLda2U+A840Uag9DsZw=
 github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
 github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
@@ -46,9 +50,15 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/Microsoft/hcsshim v0.13.0 h1:/BcXOiS6Qi7N9XqUcv27vkIuVOkBEcWstd2pMlWSeaA=
 github.com/Microsoft/hcsshim v0.13.0/go.mod h1:9KWJ/8DgU+QzYGupX4tzMhRQE8h6w90lH6HAaclpEok=
+github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
+github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
+github.com/Shopify/logrus-bugsnag v0.0.0-20170309145241-6dbc35f2c30d h1:hi6J4K6DKrR4/ljxn6SF6nURyu785wKMuQcjt7H3VCQ=
+github.com/Shopify/logrus-bugsnag v0.0.0-20170309145241-6dbc35f2c30d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
+github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=
+github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/chroma/v2 v2.20.0 h1:sfIHpxPyR07/Oylvmcai3X/exDlE8+FA820NTz+9sGw=
@@ -63,6 +73,8 @@ github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092 h1:aM1
 github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092/go.mod h1:rYqSE9HbjzpHTI74vwPvae4ZVYZd1lue2ta6xHPdblA=
 github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
 github.com/antlr4-go/antlr/v4 v4.13.0/go.mod h1:pfChB/xh/Unjila75QW7+VU4TSnWnnk9UTnmpPaOR2g=
+github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
+github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
 github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 h1:7Ip0wMmLHLRJdrloDxZfhMm0xrLXZS8+COSu2bXmEQs=
 github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
@@ -73,6 +85,8 @@ github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b h1:uUXgbcPDK3KpW29o4iy7GtuappbWT0l5NaMo9H9pJDw=
 github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b/go.mod h1:DAHtR1m6lCRdSC2Tm3DSWRPvIPr6xNKyeHdqDQSQT+A=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
@@ -112,6 +126,7 @@ github.com/aymanbagabas/go-udiff v0.2.0/go.mod h1:RE4Ex0qsGkTAJoQdQQCA0uG+nAzJO/
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
 github.com/benbjohnson/clock v1.3.5/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/beorn7/perks v0.0.0-20150223135152-b965b613227f/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -119,6 +134,9 @@ github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6r
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bgentry/speakeasy v0.2.0 h1:tgObeVOf8WAvtuAX6DhJ4xks4CFNwPDZiqzGqIHE51E=
 github.com/bgentry/speakeasy v0.2.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/bitly/go-hostpool v0.1.0/go.mod h1:4gOCgp6+NZnVqlKyZ/iBZFTAJKembaVENUpMkpg42fw=
+github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngEKAMDJEczWVA=
+github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/bsm/ginkgo/v2 v2.7.0/go.mod h1:AiKlXPm7ItEHNc/2+OkrNG4E0ITzojb9/xWzvQ9XZ9w=
 github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
 github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
@@ -127,6 +145,12 @@ github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
 github.com/buger/goterm v1.0.4 h1:Z9YvGmOih81P0FbVtEYTFF6YsSgxSUKEhf/f9bTMXbY=
 github.com/buger/goterm v1.0.4/go.mod h1:HiFWV3xnkolgrBV3mY8m0X0Pumt4zg4QhbdOzQtB8tE=
+github.com/bugsnag/bugsnag-go v1.0.5-0.20150529004307-13fd6b8acda0 h1:s7+5BfS4WFJoVF9pnB8kBk03S7pZXRdKamnV0FOl5Sc=
+github.com/bugsnag/bugsnag-go v1.0.5-0.20150529004307-13fd6b8acda0/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
+github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b h1:otBG+dV+YK+Soembjv71DPz3uX/V/6MMlSyD9JBQ6kQ=
+github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
+github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 h1:nvj0OLI3YqYXer/kZD8Ri1aaunCxIEsOst1BVJswV0o=
+github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
 github.com/caddyserver/caddy/v2 v2.8.4 h1:q3pe0wpBj1OcHFZ3n/1nl4V4bxBrYoSoab7rL9BMYNk=
 github.com/caddyserver/caddy/v2 v2.8.4/go.mod h1:vmDAHp3d05JIvuhc24LmnxVlsZmWnUwbP5WMjzcMPWw=
 github.com/caddyserver/certmagic v0.21.4 h1:e7VobB8rffHv8ZZpSiZtEwnLDHUwLVYLWzWSa1FfKI0=
@@ -144,22 +168,24 @@ github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/bubbles v0.20.0 h1:jSZu6qD8cRQ6k9OMfR1WlM+ruM8fkPWkHvQWD9LIutE=
+github.com/charmbracelet/bubbles v0.21.0 h1:9TdC97SdRVg/1aaXNVWfFH3nnLAwOXr8Fn6u6mfQdFs=
-github.com/charmbracelet/bubbles v0.20.0/go.mod h1:39slydyswPy+uVOHZ5x/GjwVAFkCsV8IIVy+4MhzwwU=
+github.com/charmbracelet/bubbles v0.21.0/go.mod h1:HF+v6QUR4HkEpz62dx7ym2xc71/KBHg+zKwJtMw+qtg=
-github.com/charmbracelet/bubbletea v1.3.9 h1:OBYdfRo6QnlIcXNmcoI2n1NNS65Nk6kI2L2FO1puS/4=
+github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=
-github.com/charmbracelet/bubbletea v1.3.9/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=
+github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4=
 github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
 github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
 github.com/charmbracelet/huh v0.6.0 h1:mZM8VvZGuE0hoDXq6XLxRtgfWyTI3b2jZNKh0xWmax8=
 github.com/charmbracelet/huh v0.6.0/go.mod h1:GGNKeWCeNzKpEOh/OJD8WBwTQjV3prFAtQPpLv+AVwU=
+github.com/charmbracelet/huh/spinner v0.0.0-20251110114415-25888d17260b h1:oefmPctgff7OB4cDz3Ndp+ewwrh7i+fwth70qvZCieI=
+github.com/charmbracelet/huh/spinner v0.0.0-20251110114415-25888d17260b/go.mod h1:OMqKat/mm9a/qOnpuNOPyYO9bPzRNnmzLnRZT5KYltg=
 github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
 github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
 github.com/charmbracelet/x/ansi v0.10.1 h1:rL3Koar5XvX0pHGfovN03f5cxLbCF2YvLeyz7D2jVDQ=
 github.com/charmbracelet/x/ansi v0.10.1/go.mod h1:3RQDQ6lDnROptfpWuUVIUG64bD2g2BgntdxH0Ya5TeE=
 github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0GVL4jeHEwG5YOXDmi86oYw2yuYUGqz6a8sLwg0X8=
 github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
-github.com/charmbracelet/x/exp/golden v0.0.0-20240815200342-61de596daa2b h1:MnAMdlwSltxJyULnrYbkZpp4k58Co7Tah3ciKhSNo0Q=
+github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91 h1:payRxjMjKgx2PaCWLZ4p3ro9y97+TVLZNaRZgJwSVDQ=
-github.com/charmbracelet/x/exp/golden v0.0.0-20240815200342-61de596daa2b/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
+github.com/charmbracelet/x/exp/golden v0.0.0-20241011142426-46044092ad91/go.mod h1:wDlXFlCrmJ8J+swcL/MnGUuYnqgQdW9rhSD61oNMb6U=
 github.com/charmbracelet/x/exp/strings v0.0.0-20240919170804-a4978c8e603a h1:JMdM89Udp/cOl5tC3MuUJXTPE/nAdU1oyt9jRU44qq8=
 github.com/charmbracelet/x/exp/strings v0.0.0-20240919170804-a4978c8e603a/go.mod h1:pBhA0ybfXv6hDjQUZ7hk1lVxBiUbupdw5R31yPUViVQ=
 github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ=
@@ -176,6 +202,8 @@ github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004 h1:lkAMpLVBDaj17e85keuznYcH5rqI438v41pKcBl4ZxQ=
+github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
 github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
@@ -230,13 +258,16 @@ github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6N
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
 github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/cskr/pubsub v1.0.2 h1:vlOzMhl6PFn60gRlTQQsIfVwaPB/B/8MziK8FhEPt/0=
 github.com/cskr/pubsub v1.0.2/go.mod h1:/8MzYXk/NJAz782G8RPkFzXTZVu63VotefPnR9TIRis=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davidlazar/go-crypto v0.0.0-20200604182044-b73af7476f6c h1:pFUpOrbxDR6AkioZ1ySsx5yxlDQZ8stG2b88gTPxgJU=
 github.com/davidlazar/go-crypto v0.0.0-20200604182044-b73af7476f6c/go.mod h1:6UhI8N9EjYm1c2odKpFpAYeR8dsBeM7PtzQhRgxRr9U=
 github.com/deckarep/golang-set/v2 v2.8.0 h1:swm0rlPCmdWn9mESxKOjWk8hXSqoxOp+ZlfuyaAdFlQ=
@@ -245,6 +276,7 @@ github.com/decred/dcrd/crypto/blake256 v1.0.1 h1:7PltbUIQB7u/FfZ39+DGa/ShuMyJ5il
 github.com/decred/dcrd/crypto/blake256 v1.0.1/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 h1:rpfIENRNNilwHwZeG5+P150SMrnNEcHYvcCuK6dPZSg=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
+github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
 github.com/dgraph-io/badger v1.6.2 h1:mNw0qs90GVgGGWylh0umH5iag1j6n/PeJtNvL6KY/x8=
 github.com/dgraph-io/badger v1.6.2/go.mod h1:JW2yswe3V058sS0kZ2h/AXeDSqFjxnZcRrVH//y2UQE=
 github.com/dgraph-io/badger/v2 v2.2007.4 h1:TRWBQg8UrlUhaFdco01nO2uXwzKS7zd+HVdwV/GHc4o=
@@ -270,8 +302,11 @@ github.com/docker/buildx v0.29.1 h1:58hxM5Z4mnNje3G5NKfULT9xCr8ooM8XFtlfUK9bKaA=
 github.com/docker/buildx v0.29.1/go.mod h1:J4EFv6oxlPiV1MjO0VyJx2u5tLM7ImDEl9zyB8d4wPI=
 github.com/docker/cli v28.5.0+incompatible h1:crVqLrtKsrhC9c00ythRx435H8LiQnUKRtJLRR+Auxk=
 github.com/docker/cli v28.5.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli-docs-tool v0.10.0 h1:bOD6mKynPQgojQi3s2jgcUWGp/Ebqy1SeCr9VfKQLLU=
+github.com/docker/cli-docs-tool v0.10.0/go.mod h1:5EM5zPnT2E7yCLERZmrDA234Vwn09fzRHP4aX1qwp1U=
 github.com/docker/compose/v2 v2.40.0 h1:y6wuWuxvoIHgDdo9J12OGnXAQmLviRInwFKSEqKW5Cs=
 github.com/docker/compose/v2 v2.40.0/go.mod h1:AZk82SDjtT2YI+7fXLjm8U0jxZU3Xrr0XOfL7OIsP4M=
+github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v28.5.0+incompatible h1:ZdSQoRUE9XxhFI/B8YLvhnEFMmYN9Pp8Egd2qcaFk1E=
@@ -280,10 +315,12 @@ github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqI
 github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c/go.mod h1:CADgU4DSXK5QUlFslkQu2yW2TKzFZcXq/leZfM0UH5Q=
+github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
 github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
+github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
 github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -293,18 +330,24 @@ github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7/go.mod h1:cyGadeNE
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dvsekhvalnov/jose2go v0.0.0-20170216131308-f21a8cedbbae/go.mod h1:7BvyPhdbLxMXIYTFPLsyJRFMsKmOZnQmzh6Gb+uquuM=
+github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 h1:XBBHcIb256gUJtLmY22n99HaZTz+r2Z51xUPi01m3wg=
+github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203/go.mod h1:E1jcSv8FaEny+OP/5k9UxZVw9YFWGj7eI4KR/iOBqCg=
 github.com/elastic/gosigar v0.14.3 h1:xwkKwPia+hSfg9GqrCUKYdId102m9qTJIIr7egmK/uo=
 github.com/elastic/gosigar v0.14.3/go.mod h1:iXRIGg2tLnu7LBdpqzyQfGDEidKCfWcCMS0WKyPWoMs=
+github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
+github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
+github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
-github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/flynn/noise v1.1.0 h1:KjPQoQCEFdZDiP03phOvGi11+SVVhBG2wOWAorLsstg=
@@ -313,9 +356,15 @@ github.com/francoispqt/gojay v1.2.13 h1:d2m3sFjloqoIUQU3TsHBgj6qg/BVGlTBeHDUmyJn
 github.com/francoispqt/gojay v1.2.13/go.mod h1:ehT5mTG4ua4581f1++1WLG0vPdaA9HaiDsoyrBGkyDY=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsevents v0.2.0 h1:BRlvlqjvNTfogHfeBOFvSC9N0Ddy+wzQCQukyoD7o/c=
+github.com/fsnotify/fsevents v0.2.0/go.mod h1:B3eEk39i4hz8y1zaWS/wPrAP4O6wkIl7HQwKBr1qH/w=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fvbommel/sortorder v1.1.0 h1:fUmoe+HLsBTctBDoaBwpQo5N+nrCp8g/BjKb/6ZQmYw=
 github.com/fvbommel/sortorder v1.1.0/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0=
+github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
 github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7G7k=
 github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
 github.com/go-kit/kit v0.4.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
@@ -337,6 +386,15 @@ github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
+github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-sql-driver/mysql v1.3.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
@@ -354,9 +412,13 @@ github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
 github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
 github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/gogo/protobuf v1.0.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/glog v1.2.5 h1:DrW6hGnjIhtvhOIiAKT6Psh/Kd/ldepEa81DKeiRJ5I=
 github.com/golang/glog v1.2.5/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
@@ -368,6 +430,7 @@ github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfb
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
@@ -385,11 +448,14 @@ github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
 github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/cel-go v0.20.1 h1:nDx9r8S3L4pE61eDdt8igGj8rf5kjYR3ILxWIpWNi84=
 github.com/google/cel-go v0.20.1/go.mod h1:kWcIzTsPX0zmQ+H3TirHstLLf9ep5QTsZBN9u4dOYLg=
+github.com/google/certificate-transparency-go v1.0.10-0.20180222191210-5ab67e519c93/go.mod h1:QeJfpSbVSfYc7RgB3gJFj9cbuQMMchQxrWXz8Ruopmg=
 github.com/google/certificate-transparency-go v1.1.8-0.20240110162603-74a5dd331745 h1:heyoXNxkRT155x4jTAiSv5BVSVkueifPUm+Q8LUXMRo=
 github.com/google/certificate-transparency-go v1.1.8-0.20240110162603-74a5dd331745/go.mod h1:zN0wUQgV9LjwLZeFHnrAbQi8hzMVvEWePyk+MhPOk7k=
 github.com/google/flatbuffers v1.12.1/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/flatbuffers v24.3.25+incompatible h1:CX395cjN9Kke9mmalRoL3d81AtFUxJM+yDthflgJGkI=
 github.com/google/flatbuffers v24.3.25+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
+github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -410,6 +476,8 @@ github.com/google/go-tpm-tools v0.4.4/go.mod h1:T8jXkp2s+eltnCDIsXR84/MTcVU9Ja7b
 github.com/google/go-tspi v0.3.0 h1:ADtq8RKfP+jrTyIWIZDIYcKOMecRqNJFOew2IT0Inus=
 github.com/google/go-tspi v0.3.0/go.mod h1:xfMGI3G0PhxCdNVcYr1C4C+EizojDg/TXuX5by8CiHI=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
 github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
@@ -432,16 +500,21 @@ github.com/gopherjs/gopherjs v0.0.0-20190430165422-3e4dfb77656c h1:7lF+Vz0LqiRid
 github.com/gopherjs/gopherjs v0.0.0-20190430165422-3e4dfb77656c/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
 github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w=
+github.com/gorilla/mux v1.7.0/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1 h1:e9Rjr40Z98/clHv5Yg79Is0NtosR5LXRvdr7o/6NwbA=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1/go.mod h1:tIxuGz/9mpox++sgp9fJjHO0+q1X9/UOWd798aAm22M=
+github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
+github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
@@ -475,6 +548,7 @@ github.com/hashicorp/golang-lru/arc/v2 v2.0.7 h1:QxkVTxwColcduO+LP7eJO56r2hFiG8z
 github.com/hashicorp/golang-lru/arc/v2 v2.0.7/go.mod h1:Pe7gBlGdc8clY5LJ0LpJXMt5AmgmWNH1g+oFFVUHOEc=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
@@ -488,6 +562,9 @@ github.com/hashicorp/serf v0.10.1 h1:Z1H2J60yRKvfDYAOZLd2MU0ND4AH/WDz7xYHDWQsIPY
 github.com/hashicorp/serf v0.10.1/go.mod h1:yL2t6BqATOLGc5HF7qbFkTfXoPIY0WZdWHfEvMqbG+4=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
+github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
@@ -503,6 +580,8 @@ github.com/in-toto/in-toto-golang v0.9.0/go.mod h1:xsBVrVsHNsB61++S6Dy2vWosKhuA3
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf h1:FtEj8sfIcaaBfAKrE1Cwb61YDtYq9JxChK1c7AKce7s=
+github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf/go.mod h1:yrqSXGoD/4EKfF26AOGzscPOgTTJcyAwM2rpixWT+t4=
 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
 github.com/ipfs/boxo v0.21.0 h1:XpGXb+TQQ0IUdYaeAxGzWjSs6ow/Lce148A/2IbRDVE=
@@ -600,16 +679,30 @@ github.com/jbenet/go-temp-err-catcher v0.1.0/go.mod h1:0kJRvmDZXNMIiJirNPEYfhpPw
 github.com/jbenet/goprocess v0.1.4 h1:DRGOFReOMqqDNXwW70QkacFW0YN9QnwLV0Vqk+3oU0o=
 github.com/jbenet/goprocess v0.1.4/go.mod h1:5yspPrukOVuOLORacaBi858NqyClJPQxYZlqdZVfqY4=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
+github.com/jinzhu/gorm v0.0.0-20170222002820-5409931a1bb8 h1:CZkYfurY6KGhVtlalI4QwQ6T0Cu6iuY3e0x5RLu96WE=
+github.com/jinzhu/gorm v0.0.0-20170222002820-5409931a1bb8/go.mod h1:Vla75njaFJ8clLU1W44h34PjIkijhjHIYnZxMqCdxqo=
+github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d h1:jRQLvyVGL+iVtDElaEIDdKwpPqUIZJfzkNLV34htpEc=
+github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/jinzhu/now v1.1.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
 github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
 github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/juju/loggo v0.0.0-20190526231331-6e530bcce5d8/go.mod h1:vgyd7OREkbtVEN/8IXZe5Ooef3LQePvuBm9UWj6ZL8U=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
+github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
@@ -624,6 +717,7 @@ github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoK
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -637,6 +731,7 @@ github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 h1:SOEGU9fKiNWd/HOJuq
 github.com/lann/builder v0.0.0-20180802200727-47ae307949d0/go.mod h1:dXGbAdH5GtBTC4WfIxhKZfyBF/HBFgRZSWwZ9g/He9o=
 github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 h1:P6pPBnrTSX3DEVR4fDembhRWSsG5rVo6hYhAB/ADZrk=
 github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0/go.mod h1:vmVJ0l/dxyfGW6FmdpVm2joNMFikkuWg0EoCKLGUMNw=
+github.com/lib/pq v0.0.0-20150723085316-0dad96c0b94f/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
@@ -673,13 +768,19 @@ github.com/lmittmann/tint v1.0.5 h1:NQclAutOfYsqs2F1Lenue6OoWCajs5wJcP3DfWVpePw=
 github.com/lmittmann/tint v1.0.5/go.mod h1:HIS3gSy7qNwGCj+5oRjAutErFBl4BzdQP6cJZ0NfMwE=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/magiconair/properties v1.5.3/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/magiconair/properties v1.8.9 h1:nWcCbLq1N2v/cpNsy5WvQ37Fb+YElfq20WJ/a8RkpQM=
+github.com/magiconair/properties v1.8.9/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/manifoldco/promptui v0.9.0 h1:3V4HzJk1TtXW1MTZMP7mdlwbBpIinw3HztaIlYthEiA=
 github.com/manifoldco/promptui v0.9.0/go.mod h1:ka04sppxSGFAtxX0qhlYQjISsg9mR4GWtQEhdbn6Pgg=
 github.com/marten-seemann/tcp v0.0.0-20210406111302-dfbc87cc63fd h1:br0buuQ854V8u83wA0rVZ8ttrq5CpaPZdvrK0LP2lOk=
 github.com/marten-seemann/tcp v0.0.0-20210406111302-dfbc87cc63fd/go.mod h1:QuCEs1Nt24+FYQEqAAncTDPJIuGs+LxK1MCiFL25pMU=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
+github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
@@ -700,6 +801,7 @@ github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6T
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
+github.com/mattn/go-sqlite3 v1.6.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
 github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
@@ -709,6 +811,7 @@ github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/
 github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
 github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
 github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
+github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI=
 github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
 github.com/mholt/acmez/v2 v2.0.3 h1:CgDBlEwg3QBp6s45tPQmFIBrkRIkBT4rW4orMM6p4sw=
@@ -717,6 +820,7 @@ github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKju
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
 github.com/miekg/dns v1.1.65 h1:0+tIPHzUW0GCge7IiK3guGP57VAw7hoPDfApjkMD1Fc=
 github.com/miekg/dns v1.1.65/go.mod h1:Dzw9769uoKVaLuODMDZz9M6ynFU6Em65csPuoi8G0ck=
+github.com/miekg/pkcs11 v1.0.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
 github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
@@ -741,6 +845,7 @@ github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc
 github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
+github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
@@ -758,14 +863,20 @@ github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
 github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/spdystream v0.5.0 h1:7r0J1Si3QO/kjRitvSLVVFUjxMEb/YLj6S9FF62JBCU=
+github.com/moby/spdystream v0.5.0/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI=
 github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
 github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
+github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk=
+github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
 github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
 github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0=
 github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5XtQ50mQp8=
+github.com/moby/sys/symlink v0.3.0 h1:GZX89mEZ9u53f97npBy4Rc3vJKj7JBDj/PN2I22GrNU=
+github.com/moby/sys/symlink v0.3.0/go.mod h1:3eNdhduHmYPcgsJtZXW1W4XUJdZGBIkttZ8xKqPUJq0=
 github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
 github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
@@ -773,9 +884,12 @@ github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcY
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/mr-tron/base58 v1.1.2/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
@@ -812,20 +926,32 @@ github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOEL
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
 github.com/onsi/ginkgo/v2 v2.22.0 h1:Yed107/8DjTr0lKCNt7Dn8yQ6ybuDRQoMGrNFKzMfHg=
 github.com/onsi/ginkgo/v2 v2.22.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
-github.com/onsi/gomega v1.34.2 h1:pNCwDkzrsv7MS9kpaQvVb1aVLahQXyJ/Tv5oAZMI3i8=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
-github.com/onsi/gomega v1.34.2/go.mod h1:v1xfxRgk0KIsG+QOdm7p8UosrOzPYRo60fd3B/1Dukc=
+github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
+github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
+github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
+github.com/opencontainers/go-digest v0.0.0-20170106003457-a6d0ee40d420/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
 github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8=
 github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U=
+github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
+github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
+github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
@@ -834,6 +960,7 @@ github.com/pbnjay/memory v0.0.0-20210728143218-7b4eea64cf58/go.mod h1:DXv8WO4yhM
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
+github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
 github.com/peterbourgon/diskv/v3 v3.0.1 h1:x06SQA46+PKIUftmEujdwSEpIx8kR+M9eLYsUxeYveU=
 github.com/peterbourgon/diskv/v3 v3.0.1/go.mod h1:kJ5Ny7vLdARGU3WUuy6uzO6T0nb/2gWcT1JiBvRmb5o=
 github.com/pion/datachannel v1.5.6 h1:1IxKJntfSlYkpUj8LlYRSWpYiTTC02nUrOE8T3DqGeg=
@@ -886,31 +1013,35 @@ github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXq
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
 github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
 github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
+github.com/prometheus/client_golang v0.9.0-pre1.0.20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
 github.com/prometheus/client_golang v1.22.0 h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=
 github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0=
+github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
 github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
 github.com/prometheus/common v0.62.0 h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=
 github.com/prometheus/common v0.62.0/go.mod h1:vyBcEuLSvWos9B1+CyL7JZ2up+uFzXhkqml0W5zIY1I=
+github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
-github.com/psviderski/unregistry v0.3.1 h1:2xQ3uMNMyXAASqq9+kGUgNMIFOvPSMIFGdz47uDfjhQ=
+github.com/psviderski/unregistry v0.4.1 h1:KedQTjyj8hHbzygK9uw5YS10amMZ5cjSYHqSjUUBhoE=
-github.com/psviderski/unregistry v0.3.1/go.mod h1:DXLnzrskO5NuRlzZhpbyo1E6KpirnctUvq6WtCGkpUQ=
+github.com/psviderski/unregistry v0.4.1/go.mod h1:DXLnzrskO5NuRlzZhpbyo1E6KpirnctUvq6WtCGkpUQ=
 github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
 github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
 github.com/quic-go/quic-go v0.48.2 h1:wsKXZPeGWpMpCGSWqOcqpW2wZYic/8T3aqiOID0/KWE=
@@ -953,6 +1084,8 @@ github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 h1:nn5Wsu0esKSJiIVhscUt
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
 github.com/secure-systems-lab/go-securesystemslib v0.6.0 h1:T65atpAVCJQK14UA57LMdZGpHi4QYSH/9FZyNGqMYIA=
 github.com/secure-systems-lab/go-securesystemslib v0.6.0/go.mod h1:8Mtpo9JKks/qhPG4HGZ2LGMvrPbzuxwfz/f/zLfEWkk=
+github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b h1:h+3JX2VoWTFuyQEo87pStk/a99dzIO1mM9KxIyLPGTU=
+github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b/go.mod h1:/yeG0My1xr/u+HZrFQ1tOQQQQrOawfyMUH13ai5brBc=
 github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
 github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
@@ -969,12 +1102,15 @@ github.com/siderolabs/gen v0.4.8 h1:VNpbmDLhkXp7qcSEkKk1Ee7vU2afs3xvHrWLGR2UuiY=
 github.com/siderolabs/gen v0.4.8/go.mod h1:7ROKVHHB68R3Amrd4a1ZXz/oMrXWF3Mg3lSEgnkJY5c=
 github.com/siderolabs/grpc-proxy v0.5.1 h1:WTZYLMPTZPt43BzEJ02LT9kYA9qAfquWwCezc6NPPYE=
 github.com/siderolabs/grpc-proxy v0.5.1/go.mod h1:EQwE87LiWxhiIUPBeWmpjJb9DIWxWID8R6ARtdTC+8A=
+github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EEf9cgbU6AtGPK4CTG3Zf6CKMNqf0MHTggAUA=
+github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
 github.com/slackhq/nebula v1.6.1 h1:/OCTR3abj0Sbf2nGoLUrdDXImrCv0ZVFpVPP5qa0DsM=
 github.com/slackhq/nebula v1.6.1/go.mod h1:UmkqnXe4O53QwToSl/gG7sM4BroQwAB7dd4hUaT6MlI=
 github.com/smallstep/assert v0.0.0-20200723003110-82e2b9b3b262 h1:unQFBIznI+VYD1/1fApl1A+9VcBk+9dcqGfnePY87LY=
@@ -1001,19 +1137,27 @@ github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0b
 github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spdx/tools-golang v0.5.5 h1:61c0KLfAcNqAjlg6UNMdkwpMernhw3zVRwDZ2x9XOmk=
 github.com/spdx/tools-golang v0.5.5/go.mod h1:MVIsXx8ZZzaRWNQpUDhC4Dud34edUYJYecciXgrw5vE=
+github.com/spf13/afero v1.1.2 h1:m8/z1t7/fwjysjQRYbP0RD+bUIF/8tJwPdEZsI83ACI=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/cast v0.0.0-20150508191742-4d07383ffe94/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
 github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cobra v0.0.1/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v0.0.5/go.mod h1:3K3wKZymM7VvHMDS9+Akkh4K60UwM26emMESw8tLCHU=
 github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
 github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
+github.com/spf13/jwalterweatherman v0.0.0-20141219030609-3d60171a6431/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/jwalterweatherman v1.0.0 h1:XHEdyB+EcvlqZamSM4ZOMGlc93t6AcsBEu9Gc1vn7yk=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/pflag v1.0.0/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v0.0.0-20150530192845-be5ff3e4840c/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
+github.com/spf13/viper v1.3.2 h1:VUFqw5KcqRf7i70GOzW7N+Q7+gxVBkSSqiXB12+JQ4M=
 github.com/spf13/viper v1.3.2/go.mod h1:ZiWeW+zYFKm7srdB9IoDzzZXaJaI5eL9QjNiN/DMA2s=
 github.com/stoewer/go-strcase v1.2.0 h1:Z2iHWqGXH00XYgqDmNgQbIBxf3wrNq0F3feEy0ainaU=
 github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
@@ -1041,6 +1185,8 @@ github.com/tailscale/tscert v0.0.0-20240517230440-bbccfbf48933 h1:pV0H+XIvFoP7pl
 github.com/tailscale/tscert v0.0.0-20240517230440-bbccfbf48933/go.mod h1:kNGUQ3VESx3VZwRwA9MSCUegIl6+saPL8Noq82ozCaU=
 github.com/theupdateframework/notary v0.7.0 h1:QyagRZ7wlSpjT5N2qQAh/pN+DVqgekv4DzbAiAiEL3c=
 github.com/theupdateframework/notary v0.7.0/go.mod h1:c9DRxcmhHmVLDay4/2fUYdISnHqbFDGRSlXPO0AhYWw=
+github.com/tilt-dev/fsnotify v1.4.8-0.20220602155310-fff9c274a375 h1:QB54BJwA6x8QU9nHY3xJSZR2kX9bgpZekRKGkLTmEXA=
+github.com/tilt-dev/fsnotify v1.4.8-0.20220602155310-fff9c274a375/go.mod h1:xRroudyp5iVtxKqZCrA6n2TLFRBf8bmnjr1UD4x+z7g=
 github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 h1:r0p7fK56l8WPequOaR3i9LBqfPtEdXIQbUTzT55iqT4=
 github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323/go.mod h1:3Iuxbr0P7D3zUzBMAZB+ois3h/et0shEz0qApgHYGpY=
 github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f h1:MoxeMfHAe5Qj/ySSBfL8A7l1V+hxuluj8owsIEEZipI=
@@ -1066,6 +1212,8 @@ github.com/warpfork/go-testmark v0.12.1 h1:rMgCpJfwy1sJ50x0M0NgyphxYYPMOODIJHhsX
 github.com/warpfork/go-testmark v0.12.1/go.mod h1:kHwy7wfvGSPh1rQJYKayD4AbtNaeyZdcGi9tNJTaa5Y=
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0 h1:GDDkbFiaK8jsSDJfjId/PEGEShv6ugrt4kYsC5UIDaQ=
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
 github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
@@ -1075,6 +1223,8 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zclconf/go-cty v1.17.0 h1:seZvECve6XX4tmnvRzWtJNHdscMtYEx5R7bnnVyd/d0=
+github.com/zclconf/go-cty v1.17.0/go.mod h1:wqFzcImaLTI6A5HfsRwB0nj5n0MRZFwmey8YoFPPs3U=
 github.com/zeebo/assert v1.1.0 h1:hU1L1vLTHsnO8x8c9KAR5GmM5QscxHg5RNU5z5qbUWY=
 github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
@@ -1181,15 +1331,18 @@ go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/W
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181203042331-505ab145d0a9/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190923035154-9ee001bba392/go.mod h1:/lpIB1dKB+9EgE3H3cr1v9wB50oz8l4C4h62xy7jSTY=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20201203163018-be400aefbc4c/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
 golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
@@ -1224,6 +1377,7 @@ golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
 golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -1269,6 +1423,7 @@ golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181205085412-a5c9d58dba9a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1284,6 +1439,7 @@ golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190922100055-0a153f010e69/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190924154521-2837fb4f24fe/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -1298,6 +1454,7 @@ golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1395,6 +1552,7 @@ google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a/go.mod h1:a77HrdMjoeKbnd2jmgcWdaS++ZLZAEq3orIOAEIKiVw=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a h1:v2PbRU4K3llS09c7zodFpNePeamkAwG3mPrAery9VeE=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
@@ -1414,16 +1572,31 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
 google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/cenkalti/backoff.v2 v2.2.1 h1:eJ9UAg01/HIHG987TwxvnzK2MgxXq97YY6rYDpY9aII=
+gopkg.in/cenkalti/backoff.v2 v2.2.1/go.mod h1:S0QdOvT2AlerfSBkp0O+dk+bbIMaNbEmVk876gPCthU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
 gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
+gopkg.in/rethinkdb/rethinkdb-go.v6 v6.2.1 h1:d4KQkxAaAiRY2h5Zqis161Pv91A37uZyJOx73duwUwM=
+gopkg.in/rethinkdb/rethinkdb-go.v6 v6.2.1/go.mod h1:WbjuEoo1oadwzQ4apSDU+JTvmllEHtsNHS6y7vFc7iw=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -1446,6 +1619,18 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM=
 howett.net/plist v1.0.0/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
+k8s.io/api v0.32.3 h1:Hw7KqxRusq+6QSplE3NYG4MBxZw1BZnq4aP4cJVINls=
+k8s.io/api v0.32.3/go.mod h1:2wEDTXADtm/HA7CCMD8D8bK4yuBUptzaRhYcYEEYA3k=
+k8s.io/apimachinery v0.32.3 h1:JmDuDarhDmA/Li7j3aPrwhpNBA94Nvk5zLeOge9HH1U=
+k8s.io/apimachinery v0.32.3/go.mod h1:GpHVgxoKlTxClKcteaeuF1Ul/lDVb74KpZcxcmLDElE=
+k8s.io/client-go v0.32.3 h1:RKPVltzopkSgHS7aS98QdscAgtgah/+zmpAogooIqVU=
+k8s.io/client-go v0.32.3/go.mod h1:3v0+3k4IcT9bXTc4V2rt+d2ZPPG700Xy6Oi0Gdl2PaY=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f h1:GA7//TjRY9yWGy1poLzYYJJ4JRdzg3+O6e8I+e+8T5Y=
+k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f/go.mod h1:R/HEjbvWI0qdfb8viZUeVZm0X6IZnxAydC7YU42CMw4=
+k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 h1:M3sRQVHv7vB20Xc2ybTt7ODCeFj6JSWYFzOFnYeS6Ro=
+k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 lukechampine.com/blake3 v1.3.0 h1:sJ3XhFINmHSrYCgl958hscfIa3bw8x4DqMP3u1YvoYE=
 lukechampine.com/blake3 v1.3.0/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1LM6k=
 modernc.org/cc/v4 v4.24.4 h1:TFkx1s6dCkQpd6dKurBNmpo+G8Zl4Sq/ztJ+2+DEsh0=
@@ -1472,3 +1657,11 @@ modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 h1:/Rv+M11QRah1itp8VhT6HoVx1Ray9eB4DBr+K+/sCJ8=
+sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3/go.mod h1:18nIHnGi6636UCz6m8i4DhaJ65T6EruyzmoQqI2BVDo=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.2 h1:MdmvkGuXi/8io6ixD5wud3vOLwc1rj0aNqRlpuvjmwA=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.2/go.mod h1:N8f93tFZh9U6vpxwRArLiikrE5/2tiu1w1AGfACIGE4=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
+tags.cncf.io/container-device-interface v1.0.1 h1:KqQDr4vIlxwfYh0Ed/uJGVgX+CHAkahrgabg6Q8GYxc=
+tags.cncf.io/container-device-interface v1.0.1/go.mod h1:JojJIOeW3hNbcnOH2q0NrWNha/JuHoDZcmYxAZwb2i0=

internal/cli/build.go

@@ -2,176 +2,198 @@ package cli
 
 import (
 	"context"
-	"encoding/base64"
+	"errors"
-	"encoding/json"
 	"fmt"
-	"os"
+	"strings"
 
+	"github.com/charmbracelet/lipgloss"
 	composetypes "github.com/compose-spec/compose-go/v2/types"
-	"github.com/distribution/reference"
+	mapset "github.com/deckarep/golang-set/v2"
-	"github.com/docker/cli/cli/config"
+	"github.com/docker/cli/cli/command"
-	"github.com/docker/docker/api/types/build"
+	"github.com/docker/cli/cli/flags"
-	"github.com/docker/docker/api/types/image"
+	composeapi "github.com/docker/compose/v2/pkg/api"
-	dockerclient "github.com/docker/docker/client"
+	composev2 "github.com/docker/compose/v2/pkg/compose"
-	"github.com/docker/docker/pkg/archive"
+	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/docker/docker/pkg/jsonmessage"
+	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/docker/docker/registry"
+	"github.com/psviderski/uncloud/pkg/client/compose"
-	"github.com/moby/term"
 )
 
-type BuildOptions struct {
+// BuildServicesOptions contains options for building services in a Compose project.
-	Files    []string
+type BuildServicesOptions struct {
-	Profiles []string
+	// BuildArgs sets build-time variables for services. Used in Dockerfiles that declare variables with ARG.
-	Services []string
+	BuildArgs []string
-	Push     bool
+	// Check the build configuration for services without building them.
+	Check bool
+	// Deps enables to also build services declared as dependencies of the selected Services.
+	Deps bool
+	// NoCache disables the use of cache when building images.
 	NoCache bool
+	// Pull attempts to pull newer versions of the base images before building.
+	Pull bool
+	// Services specifies which services to build. If empty, all services with a build config are built.
+	Services []string
+
+	// Push targets are mutually exclusive.
+	// PushCluster uploads the built images to cluster machines after building.
+	PushCluster bool
+	// PushRegistry uploads the built images to external registries after building.
+	PushRegistry bool
+
+	// Cluster-specific options (only used if PushCluster is true).
+	// Machines is a list of machine names or IDs to push the image to. If empty, images are pushed to all machines.
+	Machines []string
 }
 
-// GetServicesThatNeedBuild returns a map of services that require building
+// BuildServices builds images for services in the Compose project.
-func GetServicesThatNeedBuild(project *composetypes.Project) map[string]composetypes.ServiceConfig {
+func (cli *CLI) BuildServices(ctx context.Context, project *composetypes.Project, opts BuildServicesOptions) error {
-	servicesToBuild := make(map[string]composetypes.ServiceConfig, len(project.Services))
+	// Validate push targets.
-	for serviceName, service := range project.Services {
+	if opts.PushCluster && opts.PushRegistry {
-		if service.Build == nil {
+		return fmt.Errorf("cannot specify both PushCluster and PushRegistry: choose one push target")
+	}
+
+	// Build service images using Compose implementation.
+	dockerCli, err := command.NewDockerCli()
+	if err != nil {
+		return fmt.Errorf("create docker client: %w", err)
+	}
+	// Initialise the Docker CLI with default options.
+	if err = dockerCli.Initialize(flags.NewClientOptions()); err != nil {
+		return fmt.Errorf("initialise docker client: %w", err)
+	}
+
+	composeService := composev2.NewComposeService(dockerCli)
+	buildOpts := composeapi.BuildOptions{
+		Args:     composetypes.NewMappingWithEquals(opts.BuildArgs),
+		Check:    opts.Check,
+		Deps:     opts.Deps,
+		NoCache:  opts.NoCache,
+		Pull:     opts.Pull,
+		Push:     opts.PushRegistry,
+		Services: opts.Services,
+	}
+
+	if err = composeService.Build(ctx, project, buildOpts); err != nil {
+		return err
+	}
+
+	if !opts.PushCluster {
+		return nil
+	}
+
+	// Push built service images to cluster machines.
+	builtServices, err := ServicesThatNeedBuild(project, opts.Services, opts.Deps)
+	if err != nil {
+		return fmt.Errorf("determine built services: %w", err)
+	}
+	if len(builtServices) == 0 {
+		// No services were built, nothing to push.
+		return nil
+	}
+
+	// Add a line break after the build output.
+	fmt.Fprintln(cli.ProgressOut())
+
+	clusterClient, err := cli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	// Push one service image at a time.
+	var errs []error
+	for _, s := range builtServices {
+		if s.Image == "" {
+			// Skip services without an image name (shouldn't happen for services with build config).
 			continue
 		}
-		servicesToBuild[serviceName] = service
-	}
-	return servicesToBuild
-}
 
-// BuildServices builds the services defined in the provided map.
+		// Push to the specified machines falling back to service x-machines.
-func BuildServices(ctx context.Context, servicesToBuild map[string]composetypes.ServiceConfig, opts BuildOptions) error {
+		// If none specified, push to *all* cluster machines.
-	fmt.Println("Building services...")
+		var pushOpts client.PushImageOptions
 
-	// Init docker client (can be local or remote, depending on DOCKER_HOST environment variable)
+		if len(opts.Machines) > 0 {
-	dockerCli, err := dockerclient.NewClientWithOpts(dockerclient.FromEnv, dockerclient.WithAPIVersionNegotiation())
+			pushOpts.Machines = opts.Machines
-	if err != nil {
+		} else if machines, ok := s.Extensions[compose.MachinesExtensionKey].(compose.MachinesSource); ok {
-		return err
+			pushOpts.Machines = machines
-	}
-	defer dockerCli.Close()
-
-	serviceImages := make(map[string]string, len(servicesToBuild))
-
-	// Build the services using the local docker client and compose libraries
-	for _, service := range servicesToBuild {
-		fmt.Printf("Building service: %s\n", service.Name)
-		imageName, err := buildSingleService(ctx, dockerCli, service, opts)
-		if err != nil {
-			return fmt.Errorf("build service %s: %w", service.Name, err)
-		}
-		serviceImages[service.Name] = imageName
-	}
-	fmt.Printf("Service images are built.\n")
-
-	if opts.Push {
-		err = pushServiceImages(ctx, dockerCli, serviceImages)
 		}
 
-	return err
+		if len(pushOpts.Machines) == 0 {
-}
+			pushOpts.AllMachines = true
-
-// buildSingleService builds a single service using the Docker client and Compose libraries.
-func buildSingleService(ctx context.Context, dockerCli *dockerclient.Client, service composetypes.ServiceConfig, opts BuildOptions) (string, error) {
-	if service.Build == nil {
-		return "", fmt.Errorf("service %s has no build configuration", service.Name)
-	}
-	if service.Image == "" {
-		return "", fmt.Errorf("service %s has no image specified; building services without image is not supported yet",
-			service.Name)
 		}
 
-	buildContextPath := service.Build.Context
+		boldStyle := lipgloss.NewStyle().Bold(true)
-	imageName := service.Image
+		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-
+			if err = clusterClient.PushImage(ctx, s.Image, pushOpts); err != nil {
-	// Create a tar archive of the build context
+				return fmt.Errorf("push image '%s' for service '%s': %w", s.Image, s.Name, err)
-	buildContext, err := archive.TarWithOptions(buildContextPath, &archive.TarOptions{})
-	if err != nil {
-		return "", fmt.Errorf("failed to create build context for service %s: %w", service.Name, err)
-	}
-
-	buildOptions := build.ImageBuildOptions{
-		// TODO: Support Dockerfiles outside the build context
-		// See https://github.com/docker/compose/blob/cf89fd1aa1328d5af77658ccc5a1e1b29981ae80/pkg/compose/build_classic.go#L92
-		Dockerfile: service.Build.Dockerfile,
-		Tags:       []string{imageName},
-		Remove:     true, // Remove intermediate containers
-		NoCache:    opts.NoCache,
-	}
-
-	buildResponse, err := dockerCli.ImageBuild(ctx, buildContext, buildOptions)
-	if err != nil {
-		return "", fmt.Errorf("failed to build image for service %s: %w", service.Name, err)
-	}
-	defer buildResponse.Body.Close()
-
-	// Display the build response
-	fd, isTerminal := term.GetFdInfo(os.Stdout)
-	if err := jsonmessage.DisplayJSONMessagesStream(buildResponse.Body, os.Stdout, fd, isTerminal, nil); err != nil {
-		return "", fmt.Errorf("failed to display build response for service %s: %w", service.Name, err)
-	}
-
-	return imageName, nil
-}
-
-// pushSingleServiceImage pushes a single service image.
-func pushSingleServiceImage(ctx context.Context, dockerCli *dockerclient.Client, serviceName string, imageName string) error {
-	ref, err := reference.ParseNormalizedNamed(imageName)
-	if err != nil {
-		return err
-	}
-
-	repoInfo, err := registry.ParseRepositoryInfo(ref)
-	if err != nil {
-		return err
-	}
-
-	registryKey := repoInfo.Index.Name
-	if repoInfo.Index.Official {
-		registryKey = registry.IndexServer
-	}
-
-	// Load the Docker config file with auth details, if available
-	configFile := config.LoadDefaultConfigFile(os.Stderr)
-
-	authConfig, err := configFile.GetAuthConfig(registryKey)
-	if err != nil {
-		return err
-	}
-
-	authJSON, err := json.Marshal(authConfig)
-	if err != nil {
-		return fmt.Errorf("failed to marshal auth config for registry %s: %w", registryKey, err)
-	}
-
-	authStr := base64.URLEncoding.EncodeToString(authJSON)
-
-	pushOptions := image.PushOptions{
-		RegistryAuth: authStr,
-	}
-	pushResponse, err := dockerCli.ImagePush(ctx, imageName, pushOptions)
-	if err != nil {
-		return fmt.Errorf("failed to push image %s: %w", imageName, err)
-	}
-	defer pushResponse.Close()
-
-	fmt.Printf("Pushing image %s for service %s...\n", imageName, serviceName)
-
-	fd, isTerminal := term.GetFdInfo(os.Stdout)
-	if err := jsonmessage.DisplayJSONMessagesStream(pushResponse, os.Stdout, fd, isTerminal, nil); err != nil {
-		return fmt.Errorf("failed to display push response for image %s: %w", imageName, err)
-	}
-
-	fmt.Printf("Image %s pushed successfully.\n", imageName)
-	return nil
-}
-
-// pushServiceImages pushes all built service images to the registry.
-func pushServiceImages(ctx context.Context, dockerCli *dockerclient.Client, serviceImages map[string]string) error {
-	fmt.Printf("Pushing images...\n")
-	for serviceName, imageName := range serviceImages {
-		if err := pushSingleServiceImage(ctx, dockerCli, serviceName, imageName); err != nil {
-			return fmt.Errorf("push image for service %s: %w", serviceName, err)
-		}
 			}
 			return nil
+		}, cli.ProgressOut(), fmt.Sprintf("Pushing image %s to cluster", boldStyle.Render(s.Image)))
+		// Collect errors to try pushing all images.
+		if err != nil {
+			errs = append(errs, err)
+		}
+	}
+
+	return errors.Join(errs...)
+}
+
+// ServicesThatNeedBuild returns a list of services that require building.
+// deps indicates whether to include services that are dependencies of the selected services.
+// Implementation is based on the logic from docker/compose/v2/pkg/compose/build.go.
+func ServicesThatNeedBuild(
+	project *composetypes.Project, selectedServices []string, deps bool,
+) ([]composetypes.ServiceConfig, error) {
+	servicesToBuild := make([]composetypes.ServiceConfig, 0, len(project.Services))
+
+	var policy composetypes.DependencyOption = composetypes.IgnoreDependencies
+	if deps {
+		policy = composetypes.IncludeDependencies
+	}
+
+	// Also include services used as build.additional_contexts with service: prefix.
+	selectedServices = includeAdditionalContextsServices(project, selectedServices)
+	// Some build dependencies we just introduced may not be enabled, enable them.
+	var err error
+	if project, err = project.WithServicesEnabled(selectedServices...); err != nil {
+		return nil, err
+	}
+	if project, err = project.WithSelectedServices(selectedServices); err != nil {
+		return nil, err
+	}
+
+	err = project.ForEachService(selectedServices, func(serviceName string, service *composetypes.ServiceConfig) error {
+		if service.Build != nil {
+			servicesToBuild = append(servicesToBuild, *service)
+		}
+		return nil
+	}, policy)
+	if err != nil {
+		return nil, err
+	}
+
+	return servicesToBuild, nil
+}
+
+// includeAdditionalContextsServices adds services referenced in build.additional_contexts to the list
+// of selected services.
+func includeAdditionalContextsServices(project *composetypes.Project, selectedServices []string) []string {
+	servicesWithDependencies := mapset.NewSet(selectedServices...)
+	for _, service := range selectedServices {
+		s, ok := project.Services[service]
+		if !ok {
+			s = project.DisabledServices[service]
+		}
+		if s.Build != nil {
+			for _, target := range s.Build.AdditionalContexts {
+				if name, found := strings.CutPrefix(target, composetypes.ServicePrefix); found {
+					servicesWithDependencies.Add(name)
+				}
+			}
+		}
+	}
+	if servicesWithDependencies.Cardinality() > len(selectedServices) {
+		return includeAdditionalContextsServices(project, servicesWithDependencies.ToSlice())
+	}
+
+	return servicesWithDependencies.ToSlice()
 }

internal/cli/cli.go

@@ -30,12 +30,14 @@ const (
 type CLI struct {
 	Config          *config.Config
 	conn            *config.MachineConnection
+	contextOverride string
 }
 
 // New creates a new CLI instance with the given config path or remote machine connection.
 // If the connection is provided, the config is ignored for all operations which is useful for interacting with
 // a cluster without creating a config.
-func New(configPath string, conn *config.MachineConnection) (*CLI, error) {
+// If a non-empty context name is given, it will override the current default.
+func New(configPath string, conn *config.MachineConnection, contextName string) (*CLI, error) {
 	if conn != nil {
 		return &CLI{conn: conn}, nil
 	}
@@ -47,6 +49,7 @@ func New(configPath string, conn *config.MachineConnection) (*CLI, error) {
 
 	return &CLI{
 		Config:          cfg,
+		contextOverride: contextName,
 	}, nil
 }
 
@@ -68,19 +71,28 @@ func (cli *CLI) SetCurrentContext(name string) error {
 	return cli.Config.Save()
 }
 
-// ConnectCluster connects to a cluster using the given context name or the current context if not specified.
+func (cli *CLI) GetContextOverrideOrCurrent() string {
+	contextName := cli.contextOverride
+	if contextName == "" {
+		contextName = cli.Config.CurrentContext
+	}
+	return contextName
+}
+
+// ConnectCluster connects to a cluster using the context override or the current context if not specified.
 // If the CLI was initialised with a machine connection, the config is ignored and the connection is used instead.
-func (cli *CLI) ConnectCluster(ctx context.Context, contextName string) (*client.Client, error) {
+func (cli *CLI) ConnectCluster(ctx context.Context) (*client.Client, error) {
-	return cli.ConnectClusterWithOptions(ctx, contextName, ConnectOptions{
+	return cli.ConnectClusterWithOptions(ctx, ConnectOptions{
 		// Default to showing progress for CLI usage.
 		ShowProgress: true,
 	})
 }
 
-// ConnectClusterWithOptions connects to a cluster using the given context name and options.
+// ConnectClusterWithOptions connects to a cluster with the given options.
 // If the CLI was initialised with a machine connection, the config is ignored and the connection is used instead.
+// If the CLI has an override context, it is used instead of the current default.
 // Options are useful when using the CLI as a library where you may want to disable visual feedback.
-func (cli *CLI) ConnectClusterWithOptions(ctx context.Context, contextName string, opts ConnectOptions) (*client.Client, error) {
+func (cli *CLI) ConnectClusterWithOptions(ctx context.Context, opts ConnectOptions) (*client.Client, error) {
 	if cli.conn != nil {
 		return ConnectCluster(ctx, *cli.conn, opts)
 	}
@@ -92,6 +104,8 @@ func (cli *CLI) ConnectClusterWithOptions(ctx context.Context, contextName strin
 			cli.Config.Path(),
 		)
 	}
+
+	contextName := cli.contextOverride
 	if contextName == "" {
 		// If the cluster is not specified, use the current cluster if set.
 		if cli.Config.CurrentContext == "" {
@@ -157,7 +171,7 @@ func (cli *CLI) InitCluster(ctx context.Context, opts InitClusterOptions) (*clie
 		return cli.initRemoteMachine(ctx, opts)
 	}
 	// TODO: implement local machine initialisation
-	return nil, fmt.Errorf("local machine initialisation is not implemented yet")
+	return nil, fmt.Errorf("local machine initialisation is not implemented yet. Please specify a remote machine")
 }
 
 func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions) (*client.Client, error) {
@@ -228,8 +242,21 @@ func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions)
 
 	// Save the machine's SSH connection details in the context config.
 	connCfg := config.MachineConnection{
-		SSH:        config.NewSSHDestination(opts.RemoteMachine.User, opts.RemoteMachine.Host, opts.RemoteMachine.Port),
 		SSHKeyFile: opts.RemoteMachine.KeyPath,
+		MachineID:  resp.Machine.Id,
+	}
+	if opts.RemoteMachine.UseSSHCLI {
+		connCfg.SSHCLI = config.NewSSHDestination(
+			opts.RemoteMachine.User,
+			opts.RemoteMachine.Host,
+			opts.RemoteMachine.Port,
+		)
+	} else {
+		connCfg.SSH = config.NewSSHDestination(
+			opts.RemoteMachine.User,
+			opts.RemoteMachine.Host,
+			opts.RemoteMachine.Port,
+		)
 	}
 	cli.Config.Contexts[contextName].Connections = append(cli.Config.Contexts[contextName].Connections, connCfg)
 	if err = cli.Config.Save(); err != nil {
@@ -265,7 +292,6 @@ func (cli *CLI) newContextName(name string) (string, error) {
 }
 
 type AddMachineOptions struct {
-	Context       string
 	MachineName   string
 	PublicIP      *netip.Addr
 	RemoteMachine *RemoteMachine
@@ -278,11 +304,8 @@ type AddMachineOptions struct {
 // cluster. The machine client is connected to the new machine and can be used to interact with it.
 // Both client should be closed after use by the caller.
 func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client.Client, *client.Client, error) {
-	contextName := opts.Context
+	contextName := cli.GetContextOverrideOrCurrent()
-	if contextName == "" {
+	c, err := cli.ConnectCluster(ctx)
-		contextName = cli.Config.CurrentContext
-	}
-	c, err := cli.ConnectCluster(ctx, contextName)
 	if err != nil {
 		return nil, nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
 	}
@@ -396,11 +419,21 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 
 	// Save the machine's SSH connection details in the context config.
 	connCfg := config.MachineConnection{
-		SSH:        config.NewSSHDestination(opts.RemoteMachine.User, opts.RemoteMachine.Host, opts.RemoteMachine.Port),
 		SSHKeyFile: opts.RemoteMachine.KeyPath,
+		MachineID:  addResp.Machine.Id,
 	}
-	if contextName == "" {
+	if opts.RemoteMachine.UseSSHCLI {
-		contextName = cli.Config.CurrentContext
+		connCfg.SSHCLI = config.NewSSHDestination(
+			opts.RemoteMachine.User,
+			opts.RemoteMachine.Host,
+			opts.RemoteMachine.Port,
+		)
+	} else {
+		connCfg.SSH = config.NewSSHDestination(
+			opts.RemoteMachine.User,
+			opts.RemoteMachine.Host,
+			opts.RemoteMachine.Port,
+		)
 	}
 	cli.Config.Contexts[contextName].Connections = append(cli.Config.Contexts[contextName].Connections, connCfg)
 	if err = cli.Config.Save(); err != nil {
@@ -420,6 +453,35 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 func provisionOrConnectRemoteMachine(
 	ctx context.Context, remoteMachine *RemoteMachine, skipInstall bool, version string,
 ) (*client.Client, error) {
+	// Use SSH CLI
+	if remoteMachine.UseSSHCLI {
+		exec := sshexec.NewSSHCLIRemote(
+			remoteMachine.User,
+			remoteMachine.Host,
+			remoteMachine.Port,
+			remoteMachine.KeyPath,
+		)
+
+		if !skipInstall {
+			if err := provisionMachine(ctx, exec, version); err != nil {
+				return nil, fmt.Errorf("provision machine: %w", err)
+			}
+		}
+
+		sshConfig := &connector.SSHConnectorConfig{
+			User:    remoteMachine.User,
+			Host:    remoteMachine.Host,
+			Port:    remoteMachine.Port,
+			KeyPath: remoteMachine.KeyPath,
+		}
+		machineClient, err := client.New(ctx, connector.NewSSHCLIConnector(sshConfig))
+		if err != nil {
+			return nil, fmt.Errorf("connect to remote machine: %w", err)
+		}
+		return machineClient, nil
+	}
+
+	// Use Go SSH
 	sshClient, err := sshexec.Connect(remoteMachine.User, remoteMachine.Host, remoteMachine.Port, remoteMachine.KeyPath)
 	// If the SSH connection using SSH agent fails and no key path is provided, try to use the default SSH key.
 	if err != nil && remoteMachine.KeyPath == "" {

internal/cli/config/connection.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"errors"
 	"fmt"
 	"net"
 	"net/netip"
@@ -17,23 +18,56 @@ const (
 
 type MachineConnection struct {
 	SSH        SSHDestination `yaml:"ssh,omitempty"`
+	SSHCLI     SSHDestination `yaml:"ssh_cli,omitempty"`
 	SSHKeyFile string         `yaml:"ssh_key_file,omitempty"`
 	// TCP is the address and port of the machine's API server.
 	// The pointer is used to omit the field when not set. Otherwise, yaml marshalling includes an empty object.
 	TCP *netip.AddrPort `yaml:"tcp,omitempty"`
+	// Unix is the path to the machine's API unix socket.
+	Unix      string        `yaml:"unix,omitempty"`
 	Host      string        `yaml:"host,omitempty"`
 	PublicKey secret.Secret `yaml:"public_key,omitempty"`
+	MachineID string        `yaml:"machine_id,omitempty"`
 }
 
 func (c MachineConnection) String() string {
 	if c.SSH != "" {
-		return string(c.SSH)
+		return "ssh://" + string(c.SSH)
+	} else if c.SSHCLI != "" {
+		return "ssh+cli://" + string(c.SSHCLI)
 	} else if c.TCP != nil && c.TCP.IsValid() {
 		return fmt.Sprintf("tcp://%s", c.TCP)
+	} else if c.Unix != "" {
+		return fmt.Sprintf("unix://%s", c.Unix)
 	}
 	return "unknown connection"
 }
 
+func (c *MachineConnection) Validate() error {
+	setCount := 0
+	if c.SSH != "" {
+		setCount++
+	}
+	if c.SSHCLI != "" {
+		setCount++
+	}
+	if c.TCP != nil && c.TCP.IsValid() {
+		setCount++
+	}
+	if c.Unix != "" {
+		setCount++
+	}
+
+	if setCount == 0 {
+		return errors.New("no connection method specified (ssh, ssh_cli, tcp, or unix required)")
+	}
+	if setCount > 1 {
+		return errors.New("only one connection method allowed per connection (ssh, ssh_cli, tcp, or unix)")
+	}
+
+	return nil
+}
+
 // SSHDestination represents an SSH destination string in the canonical form of "user@host:port".
 // The default user "root" and port 22 can be omitted.
 type SSHDestination string

internal/cli/config/connection_test.go

@@ -0,0 +1,205 @@
+package config
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMachineConnection_String(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		conn MachineConnection
+		want string
+	}{
+		{
+			name: "ssh connection",
+			conn: MachineConnection{
+				SSH: "user@host.com",
+			},
+			want: "ssh://user@host.com",
+		},
+		{
+			name: "ssh connection with port",
+			conn: MachineConnection{
+				SSH: "user@host.com:2222",
+			},
+			want: "ssh://user@host.com:2222",
+		},
+		{
+			name: "ssh_cli connection",
+			conn: MachineConnection{
+				SSHCLI: "user@host.com",
+			},
+			want: "ssh+cli://user@host.com",
+		},
+		{
+			name: "ssh_cli connection with port",
+			conn: MachineConnection{
+				SSHCLI: "user@host.com:2222",
+			},
+			want: "ssh+cli://user@host.com:2222",
+		},
+		{
+			name: "tcp connection",
+			conn: MachineConnection{
+				TCP: func() *netip.AddrPort {
+					addr := netip.MustParseAddrPort("10.0.0.1:8080")
+					return &addr
+				}(),
+			},
+			want: "tcp://10.0.0.1:8080",
+		},
+		{
+			name: "unix connection",
+			conn: MachineConnection{
+				Unix: "/run/uncloud/uncloud.sock",
+			},
+			want: "unix:///run/uncloud/uncloud.sock",
+		},
+		{
+			name: "no connection",
+			conn: MachineConnection{},
+			want: "unknown connection",
+		},
+		{
+			name: "ssh connection with machine id",
+			conn: MachineConnection{
+				SSH:       "user@host.com",
+				MachineID: "ed98b9f7575308c340263cd279e3b568",
+			},
+			// String() does not use MachineID; just verifying entry with it is valid
+			want: "ssh://user@host.com",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := tt.conn.String()
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestMachineConnection_Validate(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		conn    MachineConnection
+		wantErr bool
+		errMsg  string
+	}{
+		{
+			name: "ssh only - valid",
+			conn: MachineConnection{
+				SSH: "user@host",
+			},
+			wantErr: false,
+		},
+		{
+			name: "ssh_cli only - valid",
+			conn: MachineConnection{
+				SSHCLI: "user@host",
+			},
+			wantErr: false,
+		},
+		{
+			name: "tcp only - valid",
+			conn: MachineConnection{
+				TCP: func() *netip.AddrPort {
+					addr := netip.MustParseAddrPort("10.0.0.1:8080")
+					return &addr
+				}(),
+			},
+			wantErr: false,
+		},
+		{
+			name: "unix only - valid",
+			conn: MachineConnection{
+				Unix: "/path/to/socket",
+			},
+			wantErr: false,
+		},
+		{
+			name:    "no connection method - error",
+			conn:    MachineConnection{},
+			wantErr: true,
+			errMsg:  "no connection method specified",
+		},
+		{
+			name: "ssh and ssh_cli - error",
+			conn: MachineConnection{
+				SSH:    "user@host",
+				SSHCLI: "user@host",
+			},
+			wantErr: true,
+			errMsg:  "only one connection method allowed",
+		},
+		{
+			name: "ssh and unix - error",
+			conn: MachineConnection{
+				SSH:  "user@host",
+				Unix: "/path/to/socket",
+			},
+			wantErr: true,
+			errMsg:  "only one connection method allowed",
+		},
+		{
+			name: "ssh and tcp - error",
+			conn: MachineConnection{
+				SSH: "user@host",
+				TCP: func() *netip.AddrPort {
+					addr := netip.MustParseAddrPort("10.0.0.1:8080")
+					return &addr
+				}(),
+			},
+			wantErr: true,
+			errMsg:  "only one connection method allowed",
+		},
+		{
+			name: "ssh_cli and tcp - error",
+			conn: MachineConnection{
+				SSHCLI: "user@host",
+				TCP: func() *netip.AddrPort {
+					addr := netip.MustParseAddrPort("10.0.0.1:8080")
+					return &addr
+				}(),
+			},
+			wantErr: true,
+			errMsg:  "only one connection method allowed",
+		},
+		{
+			name: "all three - error",
+			conn: MachineConnection{
+				SSH:    "user@host",
+				SSHCLI: "user@host2",
+				TCP: func() *netip.AddrPort {
+					addr := netip.MustParseAddrPort("10.0.0.1:8080")
+					return &addr
+				}(),
+			},
+			wantErr: true,
+			errMsg:  "only one connection method allowed",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			err := tt.conn.Validate()
+			if tt.wantErr {
+				assert.Error(t, err)
+				assert.Contains(t, err.Error(), tt.errMsg)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}

internal/cli/config/context.go

@@ -4,3 +4,21 @@ type Context struct {
 	Name        string              `yaml:"-"`
 	Connections []MachineConnection `yaml:"connections"`
 }
+
+func (c *Context) SetDefaultConnection(index int) {
+	// Do nothing if the index is out of range.
+	if index < 0 || index >= len(c.Connections) {
+		return
+	}
+
+	selected := c.Connections[index]
+	newConnections := make([]MachineConnection, 0, len(c.Connections))
+	newConnections = append(newConnections, selected)
+
+	for i, conn := range c.Connections {
+		if i != index {
+			newConnections = append(newConnections, conn)
+		}
+	}
+	c.Connections = newConnections
+}

internal/cli/connect.go

@@ -56,10 +56,33 @@ func connectClusterWithProgress(ctx context.Context, conn config.MachineConnecti
 }
 
 func connectCluster(ctx context.Context, conn config.MachineConnection) (*client.Client, error) {
+	// Determine which SSH type is configured
+	var sshDest config.SSHDestination
+	var useSSHCLI bool
+
+	// Validate connection configuration early to provide clear error messages.
+	if err := conn.Validate(); err != nil {
+		return nil, fmt.Errorf("invalid connection configuration: %w", err)
+	}
+
 	if conn.SSH != "" {
-		user, host, port, err := conn.SSH.Parse()
+		sshDest = conn.SSH
+		useSSHCLI = false
+	} else if conn.SSHCLI != "" {
+		sshDest = conn.SSHCLI
+		useSSHCLI = true
+	} else if conn.TCP != nil && conn.TCP.IsValid() {
+		return client.New(ctx, connector.NewTCPConnector(*conn.TCP))
+	} else if conn.Unix != "" {
+		return client.New(ctx, connector.NewUnixConnector(conn.Unix))
+	} else {
+		return nil, errors.New("connection configuration is invalid")
+	}
+
+	// Parse SSH destination and create config (shared for both types)
+	user, host, port, err := sshDest.Parse()
 	if err != nil {
-			return nil, fmt.Errorf("parse SSH connection %q: %w", conn.SSH, err)
+		return nil, fmt.Errorf("parse SSH connection %q: %w", sshDest, err)
 	}
 
 	keyPath := fs.ExpandHomeDir(conn.SSHKeyFile)
@@ -70,12 +93,12 @@ func connectCluster(ctx context.Context, conn config.MachineConnection) (*client
 		Port:    port,
 		KeyPath: keyPath,
 	}
-		return client.New(ctx, connector.NewSSHConnector(sshConfig))
-	} else if conn.TCP != nil && conn.TCP.IsValid() {
-		return client.New(ctx, connector.NewTCPConnector(*conn.TCP))
-	}
 
-	return nil, errors.New("connection configuration is invalid")
+	// Create appropriate connector based on type
+	if useSSHCLI {
+		return client.New(ctx, connector.NewSSHCLIConnector(sshConfig))
+	}
+	return client.New(ctx, connector.NewSSHConnector(sshConfig))
 }
 
 // connectModel is a TUI model for connecting to a cluster with a progress spinner.

internal/cli/machine.go

@@ -25,6 +25,7 @@ type RemoteMachine struct {
 	Host      string
 	Port      int
 	KeyPath   string
+	UseSSHCLI bool // indicates ssh+cli:// should be used
 }
 
 func installCmd(user string, version string) string {

internal/docker/client.go

@@ -16,6 +16,7 @@ type Client struct {
 }
 
 // WaitDaemonReady waits for the Docker daemon to start and be ready to serve requests.
+// TODO(lhf): convert into a Client method.
 func WaitDaemonReady(ctx context.Context, cli *client.Client) error {
 	// Retry to ping the Docker daemon until it's ready or the context is canceled.
 	boff := backoff.WithContext(backoff.NewExponentialBackOff(

internal/gitutil/state.go

@@ -0,0 +1,96 @@
+package gitutil
+
+import (
+	"fmt"
+	"os/exec"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// GitState contains information about the Git repository state.
+type GitState struct {
+	// Date is the current commit datetime.
+	Date time.Time
+	// IsDirty indicates whether there are uncommitted changes.
+	IsDirty bool
+	// IsRepo indicates whether the directory is a Git repository.
+	IsRepo bool
+	// SHA is the full SHA-1 (40 characters) of the current commit.
+	SHA string
+}
+
+// InspectGitState inspects the Git repo state from the specified directory.
+// If the directory is not a Git repository, or if git utility is not available,
+// returns GitState with IsRepo=false and no error.
+func InspectGitState(dir string) (GitState, error) {
+	// Check if git command is available.
+	if _, err := exec.LookPath("git"); err != nil {
+		return GitState{}, nil
+	}
+
+	state := GitState{
+		IsRepo: isGitRepo(dir),
+	}
+	if !state.IsRepo {
+		return state, nil
+	}
+
+	// Get the current commit SHA.
+	sha, err := gitCommand(dir, "rev-parse", "HEAD")
+	if err != nil {
+		return state, fmt.Errorf("get current commit SHA: %w", err)
+	}
+	state.SHA = strings.TrimSpace(sha)
+
+	// Get the current commit timestamp.
+	timestamp, err := gitCommand(dir, "log", "-1", "--format=%ct")
+	if err != nil {
+		return state, fmt.Errorf("get current commit timestamp: %w", err)
+	}
+	seconds, err := strconv.ParseInt(strings.TrimSpace(timestamp), 10, 64)
+	if err != nil {
+		return state, fmt.Errorf("parse current commit timestamp: %w", err)
+	}
+	state.Date = time.Unix(seconds, 0).UTC()
+
+	// Check for uncommitted changes.
+	status, err := gitCommand(dir, "status", "--porcelain")
+	if err != nil {
+		return state, fmt.Errorf("check git status: %w", err)
+	}
+	state.IsDirty = strings.TrimSpace(status) != ""
+
+	return state, nil
+}
+
+// isGitRepo checks if the directory is a Git repository.
+func isGitRepo(dir string) bool {
+	_, err := gitCommand(dir, "rev-parse", "--git-dir")
+	return err == nil
+}
+
+// gitCommand runs a git command in the specified directory.
+func gitCommand(dir string, args ...string) (string, error) {
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	output, err := cmd.Output()
+	if err != nil {
+		if exitErr, ok := err.(*exec.ExitError); ok {
+			return "", fmt.Errorf("git command failed: %s", exitErr.Stderr)
+		}
+		return "", err
+	}
+
+	return string(output), nil
+}
+
+// ShortSHA returns a truncated SHA with the specified length.
+// If length is negative, zero, or greater than the SHA length, it returns the full SHA.
+// Returns empty string if SHA is empty.
+func (s *GitState) ShortSHA(length int) string {
+	if length <= 0 || length > len(s.SHA) {
+		length = len(s.SHA)
+	}
+	return s.SHA[:length]
+}

internal/gitutil/state_test.go

@@ -0,0 +1,168 @@
+package gitutil
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestInspectGitState_GitNotAvailable(t *testing.T) {
+	// Reset the PATH env var to simulate git not being available.
+	t.Setenv("PATH", "")
+
+	tmpDir := t.TempDir()
+
+	state, err := InspectGitState(tmpDir)
+	require.NoError(t, err)
+
+	assert.False(t, state.IsRepo)
+	assert.Empty(t, state.SHA)
+	assert.Empty(t, state.ShortSHA(7))
+	assert.True(t, state.Date.IsZero())
+	assert.False(t, state.IsDirty)
+}
+
+func TestInspectGitState_NotARepo(t *testing.T) {
+	// Create a temporary directory that's not a git repo.
+	tmpDir := t.TempDir()
+
+	state, err := InspectGitState(tmpDir)
+	require.NoError(t, err)
+
+	// If tmpDir happens to be in a git repo (e.g., parent directory), skip this test.
+	// This is common when running tests from within the project itself.
+	if state.IsRepo {
+		t.Skip("tmpDir is within a git repository, skipping test")
+	}
+
+	assert.False(t, state.IsRepo)
+	assert.Empty(t, state.SHA)
+	assert.Empty(t, state.ShortSHA(7))
+	assert.True(t, state.Date.IsZero()) // Should have zero time if not a repo.
+	assert.False(t, state.IsDirty)
+}
+
+func TestInspectGitState_CleanRepo(t *testing.T) {
+	// Create a temporary git repo.
+	tmpDir := t.TempDir()
+	initGitRepo(t, tmpDir)
+
+	createAndCommitFile(t, tmpDir, "test.txt", "test content")
+
+	state, err := InspectGitState(tmpDir)
+	require.NoError(t, err)
+
+	assert.True(t, state.IsRepo)
+	assert.Len(t, state.SHA, 40)
+	assert.Equal(t, state.ShortSHA(7), state.SHA[:7])
+	assert.False(t, state.Date.IsZero())
+	assert.False(t, state.IsDirty)
+}
+
+func TestInspectGitState_DirtyRepo(t *testing.T) {
+	// Create a temporary git repo.
+	tmpDir := t.TempDir()
+	initGitRepo(t, tmpDir)
+
+	createAndCommitFile(t, tmpDir, "test.txt", "test content")
+
+	// Modify the file to make the repo dirty.
+	err := os.WriteFile(filepath.Join(tmpDir, "test.txt"), []byte("modified content"), 0o644)
+	require.NoError(t, err)
+
+	state, err := InspectGitState(tmpDir)
+	require.NoError(t, err)
+
+	assert.True(t, state.IsRepo)
+	assert.True(t, state.IsDirty)
+}
+
+func TestInspectGitState_UntrackedFiles(t *testing.T) {
+	// Create a temporary git repo.
+	tmpDir := t.TempDir()
+	initGitRepo(t, tmpDir)
+
+	createAndCommitFile(t, tmpDir, "test.txt", "test content")
+
+	// Add an untracked file.
+	err := os.WriteFile(filepath.Join(tmpDir, "untracked.txt"), []byte("untracked"), 0o644)
+	require.NoError(t, err)
+
+	state, err := InspectGitState(tmpDir)
+	require.NoError(t, err)
+
+	assert.True(t, state.IsRepo)
+	assert.True(t, state.IsDirty) // Untracked files make the repo dirty.
+}
+
+func TestGitState_ShortSHA(t *testing.T) {
+	state := &GitState{
+		SHA: "1234567890abcdef1234567890abcdef12345678",
+	}
+
+	tests := []struct {
+		name     string
+		length   int
+		expected string
+	}{
+		{"short 7", 7, "1234567"},
+		{"short 10", 10, "1234567890"},
+		{"full SHA", 40, "1234567890abcdef1234567890abcdef12345678"},
+		{"longer than SHA", 50, "1234567890abcdef1234567890abcdef12345678"},
+		{"negative", -42, "1234567890abcdef1234567890abcdef12345678"},
+		{"zero", 0, "1234567890abcdef1234567890abcdef12345678"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := state.ShortSHA(tt.length)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestGitState_ShortSHA_Empty(t *testing.T) {
+	state := &GitState{
+		SHA: "",
+	}
+
+	result := state.ShortSHA(7)
+	assert.Empty(t, result)
+}
+
+// Helper functions.
+
+func initGitRepo(t *testing.T, dir string) {
+	t.Helper()
+
+	// Initialize git repo.
+	runGitCommand(t, dir, "init")
+	runGitCommand(t, dir, "config", "user.email", "test@example.com")
+	runGitCommand(t, dir, "config", "user.name", "Test User")
+}
+
+func createAndCommitFile(t *testing.T, dir, filename, content string) {
+	t.Helper()
+
+	// Create file.
+	path := filepath.Join(dir, filename)
+	err := os.WriteFile(path, []byte(content), 0o644)
+	require.NoError(t, err)
+
+	// Commit file.
+	runGitCommand(t, dir, "add", filename)
+	runGitCommand(t, dir, "commit", "-m", "Add "+filename)
+}
+
+func runGitCommand(t *testing.T, dir string, args ...string) {
+	t.Helper()
+
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	output, err := cmd.CombinedOutput()
+	require.NoError(t, err, "git command failed: %s", output)
+}

internal/log/env.go

@@ -0,0 +1,19 @@
+package log
+
+import (
+	"log/slog"
+	"os"
+	"slices"
+	"strings"
+)
+
+func InitLoggerFromEnv() {
+	debugValues := []string{"1", "true", "yes"}
+	if slices.Contains(debugValues, strings.ToLower(os.Getenv("DEBUG"))) {
+		logger := slog.New(NewSlogTextHandler(os.Stderr, &slog.HandlerOptions{
+			Level: slog.LevelDebug,
+		}))
+		slog.SetDefault(logger)
+	}
+	slog.Debug("logger initialized")
+}

internal/machine/api/pb/docker.proto

@@ -5,6 +5,7 @@ package api;
 option go_package = "github.com/psviderski/uncloud/internal/machine/api/pb";
 
 import "google/protobuf/empty.proto";
+import "google/protobuf/timestamp.proto";
 import "internal/machine/api/pb/common.proto";
 
 service Docker {
@@ -15,6 +16,9 @@ service Docker {
   rpc ListContainers(ListContainersRequest) returns (ListContainersResponse);
   rpc RemoveContainer(RemoveContainerRequest) returns (google.protobuf.Empty);
 
+  rpc ExecContainer(stream ExecContainerRequest) returns (stream ExecContainerResponse);
+  rpc ContainerLogs(ContainerLogsRequest) returns (stream ContainerLogEntry);
+
   rpc PullImage(PullImageRequest) returns (stream JSONMessage);
   rpc InspectImage(InspectImageRequest) returns (InspectImageResponse);
   // InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's
@@ -92,6 +96,64 @@ message RemoveContainerRequest {
   bytes options = 2;
 }
 
+message ExecContainerRequest {
+  oneof payload {
+    // Initial configuration for the exec session. Must be sent as the first message.
+    ExecConfig config = 1;
+    // Raw stdin data to be written to the exec process.
+    bytes stdin = 2;
+    // TTY resize event (only used when TTY is enabled).
+    ResizeEvent resize = 3;
+  }
+}
+
+message ExecConfig {
+  // Container ID to execute the command in.
+  string container_id = 1;
+  // JSON serialised ExecOptions
+  bytes options = 2;
+}
+
+message ResizeEvent {
+  uint32 height = 1;
+  uint32 width = 2;
+}
+
+message ExecContainerResponse {
+  oneof payload {
+    // Exec instance ID returned after creating the exec.
+    string exec_id = 1;
+    // Raw stdout data from the exec process.
+    bytes stdout = 2;
+    // Raw stderr data from the exec process (only when TTY is disabled).
+    bytes stderr = 3;
+    // Exit code of the exec process. Sent as the final message.
+    int32 exit_code = 4;
+  }
+}
+
+message ContainerLogsRequest {
+  string container_id = 1;
+  // Options for logs retrieval.
+  bool follow = 2;
+  int32 tail = 3; // -1 means all
+  string since = 4; // https://www.rfc-editor.org/rfc/rfc3339.html timestamp or Go duration string
+  string until = 5; // https://www.rfc-editor.org/rfc/rfc3339.html timestamp or Go duration string
+}
+
+message ContainerLogEntry {
+  enum StreamType {
+    UNKNOWN = 0;
+    STDOUT = 1;
+    STDERR = 2;
+    HEARTBEAT = 3;
+  }
+  StreamType stream = 1;
+  google.protobuf.Timestamp timestamp = 2;
+  // Log line content. Empty for heartbeat entries.
+  bytes message = 3;
+}
+
 message PullImageRequest {
   string image = 1;
   // JSON serialised image.PullOptions.

internal/machine/api/pb/docker_grpc.pb.go

@@ -26,6 +26,8 @@ const (
 	Docker_StopContainer_FullMethodName           = "/api.Docker/StopContainer"
 	Docker_ListContainers_FullMethodName          = "/api.Docker/ListContainers"
 	Docker_RemoveContainer_FullMethodName         = "/api.Docker/RemoveContainer"
+	Docker_ExecContainer_FullMethodName           = "/api.Docker/ExecContainer"
+	Docker_ContainerLogs_FullMethodName           = "/api.Docker/ContainerLogs"
 	Docker_PullImage_FullMethodName               = "/api.Docker/PullImage"
 	Docker_InspectImage_FullMethodName            = "/api.Docker/InspectImage"
 	Docker_InspectRemoteImage_FullMethodName      = "/api.Docker/InspectRemoteImage"
@@ -49,6 +51,8 @@ type DockerClient interface {
 	StopContainer(ctx context.Context, in *StopContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	ListContainers(ctx context.Context, in *ListContainersRequest, opts ...grpc.CallOption) (*ListContainersResponse, error)
 	RemoveContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	ExecContainer(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[ExecContainerRequest, ExecContainerResponse], error)
+	ContainerLogs(ctx context.Context, in *ContainerLogsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ContainerLogEntry], error)
 	PullImage(ctx context.Context, in *PullImageRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[JSONMessage], error)
 	InspectImage(ctx context.Context, in *InspectImageRequest, opts ...grpc.CallOption) (*InspectImageResponse, error)
 	// InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's
@@ -132,9 +136,41 @@ func (c *dockerClient) RemoveContainer(ctx context.Context, in *RemoveContainerR
 	return out, nil
 }
 
+func (c *dockerClient) ExecContainer(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[ExecContainerRequest, ExecContainerResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &Docker_ServiceDesc.Streams[0], Docker_ExecContainer_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[ExecContainerRequest, ExecContainerResponse]{ClientStream: stream}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Docker_ExecContainerClient = grpc.BidiStreamingClient[ExecContainerRequest, ExecContainerResponse]
+
+func (c *dockerClient) ContainerLogs(ctx context.Context, in *ContainerLogsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ContainerLogEntry], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &Docker_ServiceDesc.Streams[1], Docker_ContainerLogs_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[ContainerLogsRequest, ContainerLogEntry]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Docker_ContainerLogsClient = grpc.ServerStreamingClient[ContainerLogEntry]
+
 func (c *dockerClient) PullImage(ctx context.Context, in *PullImageRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[JSONMessage], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	stream, err := c.cc.NewStream(ctx, &Docker_ServiceDesc.Streams[0], Docker_PullImage_FullMethodName, cOpts...)
+	stream, err := c.cc.NewStream(ctx, &Docker_ServiceDesc.Streams[2], Docker_PullImage_FullMethodName, cOpts...)
 	if err != nil {
 		return nil, err
 	}
@@ -261,6 +297,8 @@ type DockerServer interface {
 	StopContainer(context.Context, *StopContainerRequest) (*emptypb.Empty, error)
 	ListContainers(context.Context, *ListContainersRequest) (*ListContainersResponse, error)
 	RemoveContainer(context.Context, *RemoveContainerRequest) (*emptypb.Empty, error)
+	ExecContainer(grpc.BidiStreamingServer[ExecContainerRequest, ExecContainerResponse]) error
+	ContainerLogs(*ContainerLogsRequest, grpc.ServerStreamingServer[ContainerLogEntry]) error
 	PullImage(*PullImageRequest, grpc.ServerStreamingServer[JSONMessage]) error
 	InspectImage(context.Context, *InspectImageRequest) (*InspectImageResponse, error)
 	// InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's
@@ -302,6 +340,12 @@ func (UnimplementedDockerServer) ListContainers(context.Context, *ListContainers
 func (UnimplementedDockerServer) RemoveContainer(context.Context, *RemoveContainerRequest) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method RemoveContainer not implemented")
 }
+func (UnimplementedDockerServer) ExecContainer(grpc.BidiStreamingServer[ExecContainerRequest, ExecContainerResponse]) error {
+	return status.Errorf(codes.Unimplemented, "method ExecContainer not implemented")
+}
+func (UnimplementedDockerServer) ContainerLogs(*ContainerLogsRequest, grpc.ServerStreamingServer[ContainerLogEntry]) error {
+	return status.Errorf(codes.Unimplemented, "method ContainerLogs not implemented")
+}
 func (UnimplementedDockerServer) PullImage(*PullImageRequest, grpc.ServerStreamingServer[JSONMessage]) error {
 	return status.Errorf(codes.Unimplemented, "method PullImage not implemented")
 }
@@ -464,6 +508,24 @@ func _Docker_RemoveContainer_Handler(srv interface{}, ctx context.Context, dec f
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Docker_ExecContainer_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(DockerServer).ExecContainer(&grpc.GenericServerStream[ExecContainerRequest, ExecContainerResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Docker_ExecContainerServer = grpc.BidiStreamingServer[ExecContainerRequest, ExecContainerResponse]
+
+func _Docker_ContainerLogs_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(ContainerLogsRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(DockerServer).ContainerLogs(m, &grpc.GenericServerStream[ContainerLogsRequest, ContainerLogEntry]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Docker_ContainerLogsServer = grpc.ServerStreamingServer[ContainerLogEntry]
+
 func _Docker_PullImage_Handler(srv interface{}, stream grpc.ServerStream) error {
 	m := new(PullImageRequest)
 	if err := stream.RecvMsg(m); err != nil {
@@ -728,6 +790,17 @@ var Docker_ServiceDesc = grpc.ServiceDesc{
 		},
 	},
 	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "ExecContainer",
+			Handler:       _Docker_ExecContainer_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+		{
+			StreamName:    "ContainerLogs",
+			Handler:       _Docker_ContainerLogs_Handler,
+			ServerStreams: true,
+		},
 		{
 			StreamName:    "PullImage",
 			Handler:       _Docker_PullImage_Handler,

internal/machine/cluster.go

@@ -358,6 +358,14 @@ func (cc *clusterController) handleMachineChanges(ctx context.Context) error {
 					slog.Error("Failed to list machines.", "err", err)
 					continue
 				}
+				// Skip reconfiguration if the machines list is empty. This can happen when joining the cluster.
+				// Corrosion can notifies about table changes before the data is fully replicated.
+				// Reconfiguring with an empty list would remove all peers and lock this machine out of the cluster.
+				// See https://github.com/psviderski/uncloud/issues/155.
+				if len(machines) == 0 {
+					slog.Debug("Skipping peer reconfiguration: machines list in store is empty.")
+					continue
+				}
 				if err = cc.configurePeers(machines); err != nil {
 					slog.Error("Failed to configure peers.", "err", err)
 				}

internal/machine/dns/server.go

@@ -8,6 +8,7 @@ import (
 	"math/rand/v2"
 	"net"
 	"net/netip"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -40,6 +41,7 @@ type Resolver interface {
 // to upstream DNS servers.
 type Server struct {
 	listenAddr      netip.Addr
+	localSubnet     netip.Prefix
 	resolver        Resolver
 	upstreamServers []netip.AddrPort
 
@@ -53,7 +55,7 @@ type Server struct {
 // NewServer creates a new DNS server with the given configuration.
 // If upstreams is nil, nameservers from /etc/resolv.conf will be used. An empty upstreams list means to only resolve
 // internal DNS queries and not forward any external queries.
-func NewServer(listenAddr netip.Addr, resolver Resolver, upstreams []netip.AddrPort) (*Server, error) {
+func NewServer(listenAddr netip.Addr, localSubnet netip.Prefix, resolver Resolver, upstreams []netip.AddrPort) (*Server, error) {
 	if !listenAddr.IsValid() {
 		return nil, fmt.Errorf("invalid listen address: %s", listenAddr)
 	}
@@ -87,6 +89,7 @@ func NewServer(listenAddr netip.Addr, resolver Resolver, upstreams []netip.AddrP
 
 	return &Server{
 		listenAddr:       listenAddr,
+		localSubnet:      localSubnet,
 		resolver:         resolver,
 		upstreamServers:  upstreams,
 		forwardSemaphore: make(chan struct{}, maxConcurrentForwards),
@@ -287,7 +290,7 @@ func (s *Server) forwardRequest(req *dns.Msg, proto string) (*dns.Msg, error) {
 // handleAQuery processes an A query for the internal domain and returns A records for the requested name.
 // The internal domain suffix is already stripped from the name. An empty list is returned if no records are found.
 func (s *Server) handleAQuery(name string) []dns.RR {
-	serviceName := trimInternalDomain(name)
+	serviceName, mode := extractModeFromDomain(trimInternalDomain(name))
 	ips := s.resolver.Resolve(serviceName)
 	if len(ips) == 0 {
 		s.log.Debug("Failed to resolve service name.", "service", serviceName)
@@ -296,10 +299,28 @@ func (s *Server) handleAQuery(name string) []dns.RR {
 	s.log.Debug("Resolved service name.", "service", serviceName, "ips", ips)
 
 	if len(ips) > 1 {
-		// TODO: sort by proximity to the requesting container/machine. For now, just shuffle the IPs.
+		// Shuffle the IPs to approximate round-robin.
+		// We want to do this as a baseline for "nearest" mode, as well.
 		rand.Shuffle(len(ips), func(i, j int) {
 			ips[i], ips[j] = ips[j], ips[i]
 		})
+
+		// Default (mode == "") currently behaves the same as round-robin,
+		// and nothing additional to do for round-robin (mode == "rr").
+
+		if mode == "nearest" {
+			// Sort IPs on local subnet to the top.
+			slices.SortFunc(ips, func(a, b netip.Addr) int {
+				aIsLocal := s.localSubnet.Contains(a)
+				bIsLocal := s.localSubnet.Contains(b)
+				if aIsLocal && !bIsLocal {
+					return -1
+				} else if bIsLocal && !aIsLocal {
+					return 1
+				}
+				return 0
+			})
+		}
 	}
 
 	// Create A records for each IP.
@@ -345,3 +366,13 @@ func trimInternalDomain(name string) string {
 
 	return strings.TrimSuffix(name, "."+InternalDomain)
 }
+
+func extractModeFromDomain(name string) (string, string) {
+	modes := []string{"nearest", "rr"}
+	for _, mode := range modes {
+		if cut, found := strings.CutPrefix(name, mode+"."); found {
+			return cut, mode
+		}
+	}
+	return name, ""
+}

internal/machine/docker/client_exec.go

@@ -0,0 +1,303 @@
+package docker
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log/slog"
+	"os"
+	"os/signal"
+
+	"github.com/moby/term"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/pkg/api"
+	"golang.org/x/sync/errgroup"
+	"golang.org/x/sys/unix"
+)
+
+// ExecConfig contains options for executing a command in a container.
+type ExecConfig struct {
+	// Container ID to execute the command in.
+	ContainerID string
+	// Exec configuration.
+	Options api.ExecOptions
+}
+
+// sendResizeRequest sends a terminal resize request to the exec stream.
+func sendResizeRequest(stream pb.Docker_ExecContainerClient, size *term.Winsize) error {
+	slog.Debug("sending resize request", "width", size.Width, "height", size.Height)
+	return stream.Send(
+		&pb.ExecContainerRequest{
+			Payload: &pb.ExecContainerRequest_Resize{
+				Resize: &pb.ResizeEvent{
+					Height: uint32(size.Height),
+					Width:  uint32(size.Width),
+				},
+			},
+		})
+}
+
+// setupTerminal configures the terminal for interactive TTY sessions.
+// It checks if stdin is a terminal, sets it to raw mode, and sets up resize handling.
+// Returns a cleanup function to restore terminal state, or an error.
+func setupTerminal(ctx context.Context, stream pb.Docker_ExecContainerClient) (func(), error) {
+	inFd, isTerminal := term.GetFdInfo(os.Stdin)
+	if !isTerminal {
+		return nil, fmt.Errorf("stdin is not a terminal")
+	}
+
+	// Set terminal to raw mode
+	oldState, err := term.SetRawTerminal(inFd)
+	if err != nil {
+		return nil, fmt.Errorf("set raw terminal: %w", err)
+	}
+
+	// Cleanup function
+	restoreFunc := func() {
+		_ = term.RestoreTerminal(inFd, oldState)
+	}
+
+	// Set up resize handling
+	if err := handleTerminalResize(ctx, inFd, stream); err != nil {
+		restoreFunc()
+		return nil, err
+	}
+
+	return restoreFunc, nil
+}
+
+// handleTerminalResize sends initial window size and handles window resize signals for TTY sessions.
+func handleTerminalResize(ctx context.Context, inFd uintptr, stream pb.Docker_ExecContainerClient) error {
+	// Handle window resize signals
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, unix.SIGWINCH)
+
+	// Send initial window size
+	if size, err := term.GetWinsize(inFd); err == nil {
+		_ = sendResizeRequest(stream, size)
+	}
+
+	go func() {
+		defer signal.Stop(sigCh)
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-sigCh:
+				size, err := term.GetWinsize(inFd)
+				if err != nil {
+					slog.Debug("get window size", "error", err)
+					continue
+				}
+				if err = sendResizeRequest(stream, size); err != nil {
+					slog.Debug("send resize request", "error", err)
+				}
+			}
+		}
+	}()
+
+	return nil
+}
+
+// handleClientInputStream reads from stdin and sends data to the remote server.
+// It also periodically checks for context cancellation to exit gracefully when e.g.
+// the output stream is closed.
+func handleClientInputStream(ctx context.Context, stream pb.Docker_ExecContainerClient, stdin io.Reader) error {
+	slog.Debug("Input goroutine started")
+	defer slog.Debug("Input goroutine exited")
+
+	defer stream.CloseSend()
+
+	// Channel to receive stdin data
+	stdinCh := make(chan []byte)
+
+	stdinErrCh := make(chan error, 1)
+
+	// Read from stdin in a separate goroutine
+	// Note: this goroutine may continue blocking on Read even after we exit from the function,
+	// but that's OK - it will eventually unblock when data arrives or stdin closes.
+	go func() {
+		buf := make([]byte, 32*1024) // 32KB buffer
+		for {
+			n, err := stdin.Read(buf)
+			if n > 0 {
+				data := make([]byte, n)
+				copy(data, buf[:n])
+				select {
+				case stdinCh <- data:
+				case <-ctx.Done():
+					slog.Debug("stdin reader exiting due to context done")
+					return
+				}
+			}
+			if err != nil {
+				if err == io.EOF {
+					slog.Debug("stdin reader: EOF received")
+				} else {
+					slog.Debug("stdin reader error", "error", err)
+				}
+				stdinErrCh <- err
+				return
+			}
+		}
+	}()
+
+	// Send stdin data to the server or exit when context is cancelled
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case data := <-stdinCh:
+			if err := stream.Send(&pb.ExecContainerRequest{
+				Payload: &pb.ExecContainerRequest_Stdin{Stdin: data},
+			}); err != nil {
+				return fmt.Errorf("send stdin: %w", err)
+			}
+		case err := <-stdinErrCh:
+			if err != io.EOF {
+				return fmt.Errorf("read stdin: %w", err)
+			}
+			return nil
+		}
+	}
+}
+
+// handleClientOutputStream receives output from the exec stream and writes to stdout/stderr.
+// It also captures the exit code and signals completion via context cancellation.
+func handleClientOutputStream(ctx context.Context, stream pb.Docker_ExecContainerClient, stdout, stderr io.Writer, exitCode *int) error {
+	slog.Debug("Output goroutine started")
+	defer slog.Debug("Output goroutine exited")
+
+	for {
+		resp, err := stream.Recv()
+		if err == io.EOF {
+			slog.Debug("output stream: EOF received")
+			return nil
+		}
+		if err != nil {
+			return fmt.Errorf("receive from stream: %w", err)
+		}
+
+		switch payload := resp.Payload.(type) {
+		case *pb.ExecContainerResponse_ExecId:
+			// This is sent first; we already processed it earlier, so just ignore duplicates.
+		case *pb.ExecContainerResponse_Stdout:
+			if _, err := stdout.Write(payload.Stdout); err != nil {
+				return fmt.Errorf("write stdout: %w", err)
+			}
+		case *pb.ExecContainerResponse_Stderr:
+			if _, err := stderr.Write(payload.Stderr); err != nil {
+				return fmt.Errorf("write stderr: %w", err)
+			}
+		case *pb.ExecContainerResponse_ExitCode:
+			slog.Debug("received exit code", "code", payload.ExitCode)
+			*exitCode = int(payload.ExitCode)
+			return nil
+		}
+	}
+}
+
+// ExecContainer executes a command in a running container with bidirectional streaming.
+// TODO: This can be merged with pkg/client as it's an unnecessary logic split.
+func (c *Client) ExecContainer(ctx context.Context, opts ExecConfig) (exitCode int, err error) {
+	// Note: In non-interactive mode (without TTY), signals like SIGTERM/SIGINT will terminate the client
+	// process without being forwarded to the remote container process. We could catch and forward these
+	// signals (useful for long-running commands), but for example "kubectl exec" doesn't do this either (as of November 2025),
+	// so we keep it simple for now.
+
+	slog.Debug("starting ExecContainer", "containerID", opts.ContainerID, "options", opts.Options)
+
+	// Initialize exit code to non-zero in case we have to return early
+	exitCode = 1
+
+	// Set up I/O streams - use custom streams if provided, otherwise default to os.Stdin/Stdout/Stderr
+	stdin := io.Reader(os.Stdin)
+	stdout := io.Writer(os.Stdout)
+	stderr := io.Writer(os.Stderr)
+
+	if opts.Options.Stdin != nil {
+		stdin = opts.Options.Stdin
+	}
+	if opts.Options.Stdout != nil {
+		stdout = opts.Options.Stdout
+	}
+	if opts.Options.Stderr != nil {
+		stderr = opts.Options.Stderr
+	}
+
+	// Marshal the exec config
+	configBytes, err := json.Marshal(opts.Options)
+	if err != nil {
+		return -1, fmt.Errorf("marshal exec config: %w", err)
+	}
+
+	// Create the bidirectional stream
+	stream, err := c.GRPCClient.ExecContainer(ctx)
+	if err != nil {
+		return -1, fmt.Errorf("create exec stream: %w", err)
+	}
+
+	// Send the initial configuration
+	if err := stream.Send(&pb.ExecContainerRequest{
+		Payload: &pb.ExecContainerRequest_Config{
+			Config: &pb.ExecConfig{
+				ContainerId: opts.ContainerID,
+				Options:     configBytes,
+			},
+		},
+	}); err != nil {
+		return -1, fmt.Errorf("send exec config: %w", err)
+	}
+
+	// Receive the exec ID
+	resp, err := stream.Recv()
+	if err != nil {
+		return -1, fmt.Errorf("receive exec ID: %w", err)
+	}
+	execID := resp.GetExecId()
+	if execID == "" {
+		return -1, fmt.Errorf("expected exec ID in first response")
+	}
+
+	errGroup, ctx := errgroup.WithContext(ctx)
+
+	// Create cancellable context for goroutine coordination
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	// Handle terminal setup for interactive sessions
+	if opts.Options.AttachStdin && opts.Options.Tty {
+		restoreTerminal, err := setupTerminal(ctx, stream)
+		if err != nil {
+			return -1, fmt.Errorf("setup terminal: %w", err)
+		}
+		if restoreTerminal != nil {
+			defer restoreTerminal()
+		}
+	}
+
+	// Handle stdin stream if needed
+	if opts.Options.AttachStdin {
+		errGroup.Go(func() error {
+			return handleClientInputStream(ctx, stream, stdin)
+		})
+	} else {
+		// Close send direction immediately if not attaching stdin
+		stream.CloseSend()
+	}
+
+	// Handle output streams (stdout/stderr)
+	errGroup.Go(func() error {
+		defer cancel()
+		return handleClientOutputStream(ctx, stream, stdout, stderr, &exitCode)
+	})
+
+	err = errGroup.Wait()
+
+	if err == nil && opts.Options.Detach {
+		return 0, nil
+	}
+
+	return exitCode, err
+}

internal/machine/docker/server.go

@@ -23,6 +23,7 @@ import (
 	"github.com/distribution/reference"
 	dockercommand "github.com/docker/cli/cli/command"
 	dockerconfig "github.com/docker/cli/cli/config"
+	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/api/types/image"
@@ -30,6 +31,7 @@ import (
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/volume"
 	"github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/stdcopy"
 	"github.com/docker/go-connections/nat"
 	"github.com/google/go-containerregistry/pkg/authn"
 	"github.com/google/go-containerregistry/pkg/name"
@@ -45,6 +47,7 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 var fullDockerIDRegex = regexp.MustCompile(`^[a-f0-9]{64}$`)
@@ -611,6 +614,7 @@ func (s *Server) CreateServiceContainer(
 			NanoCPUs:          spec.Container.Resources.CPU,
 			Memory:            spec.Container.Resources.Memory,
 			MemoryReservation: spec.Container.Resources.MemoryReservation,
+			DeviceRequests:    spec.Container.Resources.DeviceReservations,
 		},
 		// Restart service containers if they exit or a machine restarts unless they are explicitly stopped.
 		// For one-off containers and batch jobs we plan to use a different service type/mode.
@@ -1011,3 +1015,349 @@ func (s *Server) RemoveServiceContainer(ctx context.Context, req *pb.RemoveConta
 
 	return resp, nil
 }
+
+// logsHeartbeatInterval is the interval at which heartbeat entries are sent when there are no logs to stream.
+const logsHeartbeatInterval = 200 * time.Millisecond
+
+// ContainerLogs streams logs from a container.
+func (s *Server) ContainerLogs(
+	req *pb.ContainerLogsRequest, stream grpc.ServerStreamingServer[pb.ContainerLogEntry],
+) error {
+	// Stream context is cancelled when the client has disconnected or the stream has ended.
+	ctx := stream.Context()
+
+	opts := ContainerLogsOptions{
+		ContainerID: req.ContainerId,
+		Follow:      req.Follow,
+		Tail:        int(req.Tail),
+		Since:       req.Since,
+		Until:       req.Until,
+	}
+
+	logsCh, err := s.service.ContainerLogs(ctx, opts)
+	if err != nil {
+		if errdefs.IsNotFound(err) {
+			return status.Error(codes.NotFound, err.Error())
+		}
+		return status.Errorf(codes.Internal, "get container logs: %v", err)
+	}
+
+	log := slog.With("container_id", req.ContainerId, "stream_id", fmt.Sprintf("%p", stream)[2:])
+	log.Debug("Starting container logs streaming.",
+		"follow", req.Follow, "tail", req.Tail, "since", req.Since, "until", req.Until)
+
+	// Heartbeats are needed only when following logs to let the client know when there are no new log entries
+	// to allow it to advance the watermark of last received log timestamp.
+	var heartbeatCh <-chan time.Time
+	if req.Follow {
+		heartbeatTicker := time.NewTicker(logsHeartbeatInterval)
+		defer heartbeatTicker.Stop()
+		heartbeatCh = heartbeatTicker.C
+	}
+
+	started := time.Now()
+	lastSent := time.Time{}
+
+	for {
+		select {
+		case entry, ok := <-logsCh:
+			if !ok {
+				// Channel closed, no more log entries.
+				return nil
+			}
+
+			if entry.Err != nil {
+				return status.Error(codes.Internal, entry.Err.Error())
+			}
+
+			pbEntry := &pb.ContainerLogEntry{
+				Stream:    api.LogStreamTypeToProto(entry.Stream),
+				Timestamp: timestamppb.New(entry.Timestamp),
+				Message:   entry.Message,
+			}
+			if err = stream.Send(pbEntry); err != nil {
+				return status.Errorf(codes.Internal, "send log entry: %v", err)
+			}
+			lastSent = entry.Timestamp
+
+		case now := <-heartbeatCh:
+			// Only send heartbeat if no log entries have been sent since the last heartbeat interval or
+			// if no log entries have been sent at all for at least a heartbeat interval since starting.
+			if now.Sub(lastSent) < logsHeartbeatInterval ||
+				(lastSent.IsZero() && now.Sub(started) < logsHeartbeatInterval) {
+				continue
+			}
+
+			// Use the timestamp one heartbeat in the past to be conservative. This reduces the chance of sending
+			// a timestamp that is greater than a log entry currently being parsed but not yet sent, which would
+			// cause the client to incorrectly believe it has received all logs up to that point.
+			heartbeat := &pb.ContainerLogEntry{
+				Stream:    pb.ContainerLogEntry_HEARTBEAT,
+				Timestamp: timestamppb.New(now.Add(-logsHeartbeatInterval)),
+			}
+			if err = stream.Send(heartbeat); err != nil {
+				return status.Errorf(codes.Internal, "send log stream heartbeat: %v", err)
+			}
+			lastSent = heartbeat.Timestamp.AsTime()
+			log.Debug("Sent log stream heartbeat.", "timestamp", lastSent)
+
+		case <-ctx.Done():
+			return status.Error(codes.Canceled, ctx.Err().Error())
+		}
+	}
+}
+
+// receiveExecConfig receives and validates the initial exec configuration from the stream.
+func (s *Server) receiveExecConfig(stream pb.Docker_ExecContainerServer) (*pb.ExecConfig, api.ExecOptions, error) {
+	req, err := stream.Recv()
+	if err != nil {
+		return nil, api.ExecOptions{}, status.Errorf(codes.InvalidArgument, "receive config: %v", err)
+	}
+
+	execConfig := req.GetConfig()
+	if execConfig == nil {
+		return nil, api.ExecOptions{}, status.Error(codes.InvalidArgument, "first message must contain exec config")
+	}
+
+	// Unmarshal the Uncloud's execOpts
+	var execOpts api.ExecOptions
+	if err := json.Unmarshal(execConfig.Options, &execOpts); err != nil {
+		return nil, api.ExecOptions{}, status.Errorf(codes.InvalidArgument, "unmarshal exec config: %v", err)
+	}
+
+	return execConfig, execOpts, nil
+}
+
+// handleServerExecInput reads from the gRPC stream and writes to Docker stdin, handling resize requests.
+func (s *Server) handleServerExecInput(
+	ctx context.Context,
+	stream pb.Docker_ExecContainerServer,
+	attachConn types.HijackedResponse,
+	execID string,
+	tty bool,
+) error {
+	slog.Debug("Input goroutine started", "exec_id", execID, "tty", tty)
+	defer slog.Debug("Input goroutine exited", "exec_id", execID)
+
+	defer attachConn.CloseWrite()
+	for {
+		select {
+		case <-ctx.Done():
+			slog.Debug("Input goroutine context canceled via context", "exec_id", execID)
+			return nil
+		default:
+		}
+
+		req, err := stream.Recv()
+		switch {
+		case errors.Is(err, io.EOF):
+			slog.Debug("Input goroutine received EOF", "exec_id", execID)
+			return nil
+		case status.Code(err) == codes.Canceled:
+			// Can be the case when the output goroutine ends and the stream context is canceled.
+			slog.Debug("Input goroutine context canceled", "exec_id", execID)
+			return nil
+		case err == nil:
+			// continue processing
+		default:
+			return fmt.Errorf("receive from stream: %w", err)
+		}
+
+		switch payload := req.Payload.(type) {
+		case *pb.ExecContainerRequest_Stdin:
+			if _, err := attachConn.Conn.Write(payload.Stdin); err != nil {
+				return fmt.Errorf("write to stdin: %w", err)
+			}
+		case *pb.ExecContainerRequest_Resize:
+			if tty {
+				resizeOpts := container.ResizeOptions{
+					Height: uint(payload.Resize.Height),
+					Width:  uint(payload.Resize.Width),
+				}
+				if err := s.client.ContainerExecResize(ctx, execID, resizeOpts); err != nil {
+					slog.Warn("Failed to resize TTY", "err", err, "exec_id", execID)
+				}
+			}
+		}
+	}
+}
+
+// handleServerExecOutput reads from Docker stdout/stderr and writes to the gRPC stream.
+func (s *Server) handleServerExecOutput(
+	stream pb.Docker_ExecContainerServer,
+	attachResp types.HijackedResponse,
+	execID string,
+	tty bool,
+) error {
+	slog.Debug("Output goroutine started", "exec_id", execID, "tty", tty)
+	defer slog.Debug("Output goroutine exited", "exec_id", execID)
+
+	if tty {
+		// In TTY mode, all output is stdout - copy directly to stream
+		stdoutWriter := &grpcStreamWriter{stream: stream, isStderr: false}
+		_, err := io.Copy(stdoutWriter, attachResp.Reader)
+		if err != nil && err != io.EOF {
+			return fmt.Errorf("copy tty output: %w", err)
+		}
+		return nil
+	} else {
+		// In non-TTY mode, Docker multiplexes stdout/stderr with headers
+		// Use stdcopy to demultiplex
+		slog.Debug("Starting StdCopy for non-TTY", "exec_id", execID)
+		stdoutWriter := &grpcStreamWriter{stream: stream, isStderr: false}
+		stderrWriter := &grpcStreamWriter{stream: stream, isStderr: true}
+
+		written, err := stdcopy.StdCopy(stdoutWriter, stderrWriter, attachResp.Reader)
+		slog.Debug("StdCopy completed", "exec_id", execID, "bytes", written, "err", err)
+		if err != nil && err != io.EOF {
+			return fmt.Errorf("demultiplex docker output: %w", err)
+		}
+		return nil
+	}
+}
+
+// grpcStreamWriter is a writer that sends data to a gRPC stream as stdout or stderr.
+type grpcStreamWriter struct {
+	stream   pb.Docker_ExecContainerServer
+	isStderr bool
+}
+
+func (w *grpcStreamWriter) Write(p []byte) (n int, err error) {
+	data := make([]byte, len(p))
+	copy(data, p)
+
+	var resp *pb.ExecContainerResponse
+	if w.isStderr {
+		resp = &pb.ExecContainerResponse{
+			Payload: &pb.ExecContainerResponse_Stderr{Stderr: data},
+		}
+	} else {
+		resp = &pb.ExecContainerResponse{
+			Payload: &pb.ExecContainerResponse_Stdout{Stdout: data},
+		}
+	}
+
+	if err := w.stream.Send(resp); err != nil {
+		return 0, err
+	}
+	return len(p), nil
+}
+
+// ExecContainer executes a command in a running container with bidirectional streaming for stdin/stdout/stderr.
+func (s *Server) ExecContainer(stream pb.Docker_ExecContainerServer) error {
+	slog.Debug("ExecContainer server-side called")
+	defer slog.Debug("ExecContainer server-side ended")
+
+	ctx := stream.Context()
+
+	// Receive and validate configuration
+	execConfig, execOpts, err := s.receiveExecConfig(stream)
+	if err != nil {
+		return err
+	}
+
+	// Convert to Docker's ExecOptions
+	dockerExecOpts := container.ExecOptions{
+		Cmd:          execOpts.Command,
+		AttachStdin:  execOpts.AttachStdin,
+		AttachStdout: execOpts.AttachStdout,
+		AttachStderr: execOpts.AttachStderr,
+		Tty:          execOpts.Tty,
+		User:         execOpts.User,
+		Privileged:   execOpts.Privileged,
+		WorkingDir:   execOpts.WorkingDir,
+		Env:          execOpts.Env,
+	}
+
+	// Create the exec instance
+	execResp, err := s.client.ContainerExecCreate(ctx, execConfig.ContainerId, dockerExecOpts)
+	if err != nil {
+		if errdefs.IsNotFound(err) {
+			return status.Error(codes.NotFound, err.Error())
+		}
+		return status.Errorf(codes.Internal, "create exec: %v", err)
+	}
+
+	// Send the exec ID back to the client
+	if err := stream.Send(&pb.ExecContainerResponse{
+		Payload: &pb.ExecContainerResponse_ExecId{ExecId: execResp.ID},
+	}); err != nil {
+		return status.Errorf(codes.Internal, "send exec ID: %v", err)
+	}
+	slog.Debug("Sent exec ID to the client", "exec_id", execResp.ID)
+
+	// For detached mode, start without attaching
+	if execOpts.Detach {
+		dockerStartOpts := container.ExecStartOptions{
+			Tty:    dockerExecOpts.Tty,
+			Detach: true,
+		}
+		if err := s.client.ContainerExecStart(ctx, execResp.ID, dockerStartOpts); err != nil {
+			return status.Errorf(codes.Internal, "start exec: %v", err)
+		}
+		return nil
+	}
+
+	// For attached mode, attach to the exec instance
+	attachOpts := container.ExecAttachOptions{
+		Tty: dockerExecOpts.Tty,
+	}
+	attachConn, err := s.client.ContainerExecAttach(ctx, execResp.ID, attachOpts)
+	if err != nil {
+		return status.Errorf(codes.Internal, "attach to exec: %v", err)
+	}
+	defer attachConn.Close()
+
+	// Create a cancelable context for the input handler
+	handlerCtx, cancelInput := context.WithCancel(ctx)
+	defer cancelInput()
+
+	// Create a channel to wait for output completion
+	outputDone := make(chan error, 1)
+
+	// Start stdin handler if stdin is attached
+	if dockerExecOpts.AttachStdin {
+		go func() {
+			err := s.handleServerExecInput(handlerCtx, stream, attachConn, execResp.ID, dockerExecOpts.Tty)
+			if err != nil {
+				slog.Warn("Error in exec input handler", "err", err, "exec_id", execResp.ID)
+			}
+		}()
+	} else {
+		// If not attaching stdin, close the write side immediately
+		attachConn.CloseWrite()
+	}
+
+	// Start output handler
+	// We only wait for this goroutine to complete - it signals when the exec process finishes
+	go func() {
+		outputDone <- s.handleServerExecOutput(stream, attachConn, execResp.ID, dockerExecOpts.Tty)
+	}()
+
+	// Wait for the output goroutine to complete (it signals when done)
+	// We only wait for the output handler goroutine, not for the stdin one.
+	if err := <-outputDone; err != nil {
+		slog.Warn("Error in exec output handler", "err", err, "exec_id", execResp.ID)
+	}
+	// Do a best-effort cancellation of the stdin handler.
+	// We can't guarantee immediate exit because it may be blocked on stream.Recv(), but at
+	// least we want to send a cancel signal explicitly.
+	cancelInput()
+
+	inspectResp, err := s.client.ContainerExecInspect(ctx, execResp.ID)
+	if err != nil {
+		slog.Error("Failed to inspect exec after completion", "err", err, "exec_id", execResp.ID)
+		return status.Errorf(codes.Internal, "inspect exec: %v", err)
+	}
+
+	// Send the exit code
+	slog.Debug("Sending exec exit code", "exec_id", execResp.ID, "exit_code", inspectResp.ExitCode)
+	if err := stream.Send(&pb.ExecContainerResponse{
+		Payload: &pb.ExecContainerResponse_ExitCode{ExitCode: int32(inspectResp.ExitCode)},
+	}); err != nil {
+		slog.Error("Failed to send exec exit code", "err", err, "exec_id", execResp.ID)
+		return status.Errorf(codes.Internal, "send exit code: %v", err)
+	}
+
+	return nil
+}

internal/machine/docker/service.go

@@ -1,18 +1,22 @@
 package docker
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
+	"strconv"
 	"strings"
+	"time"
 
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/stdcopy"
 	"github.com/jmoiron/sqlx"
 	"github.com/psviderski/uncloud/pkg/api"
 	"google.golang.org/grpc/codes"
@@ -150,3 +154,104 @@ func (s *Service) ListImages(ctx context.Context, opts image.ListOptions) (Image
 
 	return imagesResp, nil
 }
+
+// ContainerLogsOptions specifies parameters for ContainerLogs.
+type ContainerLogsOptions struct {
+	ContainerID string
+	Follow      bool
+	Tail        int
+	Since       string
+	Until       string
+}
+
+// ContainerLogs streams logs from a container and returns demultiplexed entries via a channel.
+// The channel is closed when streaming completes or context is cancelled.
+func (s *Service) ContainerLogs(ctx context.Context, opts ContainerLogsOptions) (<-chan api.ContainerLogEntry, error) {
+	dockerOpts := container.LogsOptions{
+		ShowStdout: true,
+		ShowStderr: true,
+		Follow:     opts.Follow,
+		Tail:       strconv.FormatInt(int64(opts.Tail), 10),
+		Since:      opts.Since,
+		Until:      opts.Until,
+		Timestamps: true,
+	}
+
+	reader, err := s.Client.ContainerLogs(ctx, opts.ContainerID, dockerOpts)
+	if err != nil {
+		return nil, err
+	}
+
+	outCh := make(chan api.ContainerLogEntry)
+	stdoutWriter := &logsChannelWriter{ctx: ctx, ch: outCh, isStderr: false}
+	stderrWriter := &logsChannelWriter{ctx: ctx, ch: outCh, isStderr: true}
+
+	// Wrap the context in a cancellable one to unblock the second goroutine below when StdCopy completes.
+	ctx, cancel := context.WithCancel(ctx)
+
+	// Run StdCopy in a goroutine to be able to handle context cancellation.
+	go func() {
+		defer close(outCh)
+		defer cancel()
+
+		// StdCopy is blocking and will return when the reader is closed in another goroutine below or on error.
+		if _, err := stdcopy.StdCopy(stdoutWriter, stderrWriter, reader); err != nil {
+			// Send error as the last entry.
+			select {
+			case outCh <- api.ContainerLogEntry{Err: fmt.Errorf("demultiplex container logs: %w", err)}:
+			case <-ctx.Done():
+			}
+		}
+	}()
+
+	// Close the reader when the context is done to cancel StdCopy if it's still running.
+	go func() {
+		<-ctx.Done()
+		reader.Close()
+	}()
+
+	return outCh, nil
+}
+
+// logsChannelWriter is a writer for stdcopy.StdCopy that sends demultiplexed container logs to a channel.
+type logsChannelWriter struct {
+	ctx      context.Context
+	ch       chan<- api.ContainerLogEntry
+	isStderr bool
+}
+
+func (w *logsChannelWriter) Write(data []byte) (n int, err error) {
+	// Parse timestamp and message from the demultiplexed Docker log payload if the data looks like it contains one.
+	// Format: 2025-01-01T00:00:00.000000000Z message
+	timestamp := time.Time{}
+	message := data
+	if len(data) > 30 && data[4] == '-' && data[7] == '-' && data[10] == 'T' {
+		timestampPart, messagePart, found := bytes.Cut(data, []byte(" "))
+		if found {
+			timestamp, err = time.Parse(time.RFC3339Nano, string(timestampPart))
+			if err != nil {
+				timestamp = time.Time{}
+			}
+			message = messagePart
+		}
+	}
+
+	entry := api.ContainerLogEntry{
+		Timestamp: timestamp,
+		// Clone is required because message is a slice into data, which stdcopy.StdCopy may reuse
+		// after Write returns but before the entry is consumed from the channel.
+		Message: bytes.Clone(message),
+	}
+	if w.isStderr {
+		entry.Stream = api.LogStreamStderr
+	} else {
+		entry.Stream = api.LogStreamStdout
+	}
+
+	select {
+	case w.ch <- entry:
+		return len(data), nil
+	case <-w.ctx.Done():
+		return 0, w.ctx.Err()
+	}
+}

internal/machine/machine.go

@@ -430,7 +430,12 @@ func (m *Machine) Run(ctx context.Context) error {
 			}
 
 			dnsResolver := dns.NewClusterResolver(m.store)
-			dnsServer, err := dns.NewServer(m.IP(), dnsResolver, m.config.DNSUpstreams)
+			dnsServer, err := dns.NewServer(
+				m.IP(),
+				m.state.Network.Subnet,
+				dnsResolver,
+				m.config.DNSUpstreams,
+			)
 			if err != nil {
 				return fmt.Errorf("create embedded DNS server: %w", err)
 			}
@@ -816,7 +821,14 @@ func (m *Machine) JoinCluster(_ context.Context, req *pb.JoinClusterRequest) (*e
 	if err := m.state.Save(); err != nil {
 		return nil, status.Errorf(codes.Internal, "save machine state: %v", err)
 	}
-	slog.Info("Machine configured to join the cluster.", "id", m.state.ID, "name", m.state.Name)
+	slog.Info(
+		"Machine configured to join the cluster.",
+		"id", m.state.ID,
+		"name", m.state.Name,
+		"subnet", m.state.Network.Subnet.String(),
+		"management_ip", m.state.Network.ManagementIP.String(),
+		"peers", len(m.state.Network.Peers),
+	)
 	// Signal that the machine is initialised as a member of a cluster.
 	m.initialised <- struct{}{}
 

internal/machine/network/wireguard_linux.go

@@ -79,7 +79,7 @@ func (n *WireGuardNetwork) Configure(config Config) error {
 	if err := n.configureDevice(config); err != nil {
 		return err
 	}
-	slog.Info("Configured WireGuard interface.", "name", n.link.Attrs().Name)
+	slog.Info("Configured WireGuard interface.", "name", n.link.Attrs().Name, "peers", len(n.peers))
 
 	managementPrefix, err := addrToSingleIPPrefix(config.ManagementIP)
 	if err != nil {

internal/sshexec/sshcli.go

@@ -0,0 +1,72 @@
+package sshexec
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os/exec"
+	"strconv"
+	"strings"
+)
+
+type SSHCLIRemote struct {
+	user    string
+	host    string
+	port    int
+	keyPath string
+}
+
+func NewSSHCLIRemote(user, host string, port int, keyPath string) *SSHCLIRemote {
+	return &SSHCLIRemote{
+		user:    user,
+		host:    host,
+		port:    port,
+		keyPath: keyPath,
+	}
+}
+
+// TODO: Refactor and reuse this with buildDialArgs and buildSSHArgs from
+// SSHCLI Connector.
+func (r *SSHCLIRemote) buildSSHArgs() []string {
+	args := []string{"-o", "ConnectTimeout=5"}
+
+	if r.port != 0 && r.port != 22 {
+		args = append(args, "-p", strconv.Itoa(r.port))
+	}
+
+	if r.keyPath != "" {
+		args = append(args, "-i", r.keyPath)
+	}
+
+	args = append(args, r.user+"@"+r.host)
+	return args
+}
+
+func (r *SSHCLIRemote) Run(ctx context.Context, cmd string) (string, error) {
+	args := r.buildSSHArgs()
+	args = append(args, cmd)
+
+	execCmd := exec.CommandContext(ctx, "ssh", args...)
+	output, err := execCmd.CombinedOutput()
+	if err != nil {
+		return strings.TrimSpace(string(output)),
+			fmt.Errorf("run command on remote host: %w: %s", err, string(output))
+	}
+	return strings.TrimSpace(string(output)), nil
+}
+
+func (r *SSHCLIRemote) Stream(ctx context.Context, cmd string, stdout, stderr io.Writer) error {
+	args := r.buildSSHArgs()
+	args = append(args, cmd)
+
+	execCmd := exec.CommandContext(ctx, "ssh", args...)
+	execCmd.Stdout = stdout
+	execCmd.Stderr = stderr
+
+	return execCmd.Run()
+}
+
+// no-op as there is no persistent connection.
+func (r *SSHCLIRemote) Close() error {
+	return nil
+}

internal/sshexec/sshcli_test.go

@@ -0,0 +1,76 @@
+package sshexec
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSSHCLIRemote_buildSSHArgs(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		user     string
+		host     string
+		port     int
+		keyPath  string
+		expected []string
+	}{
+		{
+			name:     "default port, no key",
+			user:     "root",
+			host:     "example.com",
+			port:     22,
+			keyPath:  "",
+			expected: []string{"-o", "ConnectTimeout=5", "root@example.com"},
+		},
+		{
+			name:     "custom port",
+			user:     "ubuntu",
+			host:     "192.168.1.10",
+			port:     2222,
+			keyPath:  "",
+			expected: []string{"-o", "ConnectTimeout=5", "-p", "2222", "ubuntu@192.168.1.10"},
+		},
+		{
+			name:     "with key path",
+			user:     "root",
+			host:     "example.com",
+			port:     22,
+			keyPath:  "/path/to/key",
+			expected: []string{"-o", "ConnectTimeout=5", "-i", "/path/to/key", "root@example.com"},
+		},
+		{
+			name:     "all options",
+			user:     "admin",
+			host:     "server.local",
+			port:     2222,
+			keyPath:  "~/.ssh/id_rsa",
+			expected: []string{"-o", "ConnectTimeout=5", "-p", "2222", "-i", "~/.ssh/id_rsa", "admin@server.local"},
+		},
+		{
+			name:     "port zero (default)",
+			user:     "root",
+			host:     "example.com",
+			port:     0,
+			keyPath:  "",
+			expected: []string{"-o", "ConnectTimeout=5", "root@example.com"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			remote := &SSHCLIRemote{
+				user:    tt.user,
+				host:    tt.host,
+				port:    tt.port,
+				keyPath: tt.keyPath,
+			}
+			result := remote.buildSSHArgs()
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}

internal/ucind/cluster.go

@@ -142,7 +142,7 @@ func (p *Provisioner) initCluster(ctx context.Context, machines []Machine) error
 
 	// Join the rest of the machines to the cluster.
 	for _, m := range machines[1:] {
-		if err = WaitMachineReady(ctx, m, 5*time.Second); err != nil {
+		if err = WaitMachineReady(ctx, m, 30*time.Second); err != nil {
 			return fmt.Errorf("wait for machine %q to be ready: %w", m.Name, err)
 		}
 

misc/user_guide.md

@@ -22,7 +22,7 @@ Uncloud stores its configuration in `~/.config/uncloud/config.yaml`. If you wish
 
 Begin by initialising the first node in your cluster with `uc machine init [USER@HOST:PORT]`. If you do not have a need for Caddy reverse proxy, you may disable this feature with `--no-caddy`. If you want to avoid using uncloud's managed DNS service, add the `--no-dns` flag.
 
-This command will idempotently install Docker, uncloudd, uncloud-corrosion. If Caddy is enabled, it will set up a reverse proxy. If Uncloud DNS is enabled, it will create a DNS A record for the machine's public IP address under `*.[CLUSTER ID].cluster.uncloud.run`.
+This command will idempotently install Docker, uncloudd, uncloud-corrosion. If Caddy is enabled, it will set up a reverse proxy. If Uncloud DNS is enabled, it will create a DNS A record for the machine's public IP address under `*.[CLUSTER ID].uncld.dev`.
 
 If you wish to uninstall Uncloud and its components, run `uncloud-uninstall`.
 

pkg/api/client.go

@@ -2,13 +2,10 @@ package api
 
 import (
 	"context"
-	"fmt"
-	"strings"
 
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/volume"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
-	"google.golang.org/grpc/metadata"
 )
 
 type Client interface {
@@ -28,6 +25,7 @@ type ContainerClient interface {
 	RemoveContainer(ctx context.Context, serviceNameOrID, containerNameOrID string, opts container.RemoveOptions) error
 	StartContainer(ctx context.Context, serviceNameOrID, containerNameOrID string) error
 	StopContainer(ctx context.Context, serviceNameOrID, containerNameOrID string, opts container.StopOptions) error
+	ExecContainer(ctx context.Context, serviceNameOrID, containerNameOrID string, config ExecOptions) (int, error)
 }
 
 type DNSClient interface {
@@ -50,6 +48,8 @@ type ServiceClient interface {
 	RunService(ctx context.Context, spec ServiceSpec) (RunServiceResponse, error)
 	InspectService(ctx context.Context, id string) (Service, error)
 	RemoveService(ctx context.Context, id string) error
+	StopService(ctx context.Context, id string, opts container.StopOptions) error
+	StartService(ctx context.Context, id string) error
 }
 
 type VolumeClient interface {
@@ -57,41 +57,3 @@ type VolumeClient interface {
 	ListVolumes(ctx context.Context, filter *VolumeFilter) ([]MachineVolume, error)
 	RemoveVolume(ctx context.Context, machineNameOrID, volumeName string, force bool) error
 }
-
-// ProxyMachinesContext returns a new context that proxies gRPC requests to the specified machines.
-// If namesOrIDs is nil, all machines are included.
-func ProxyMachinesContext(
-	ctx context.Context, cli MachineClient, namesOrIDs []string,
-) (context.Context, MachineMembersList, error) {
-	// TODO: move the machine IP resolution to the proxy router to allow setting machine names and IDs in the metadata.
-	machines, err := cli.ListMachines(ctx, nil)
-	if err != nil {
-		return nil, nil, fmt.Errorf("list machines: %w", err)
-	}
-
-	var proxiedMachines MachineMembersList
-	var notFound []string
-	for _, nameOrID := range namesOrIDs {
-		if m := machines.FindByNameOrID(nameOrID); m != nil {
-			proxiedMachines = append(proxiedMachines, m)
-		} else {
-			notFound = append(notFound, nameOrID)
-		}
-	}
-
-	if len(notFound) > 0 {
-		return nil, nil, fmt.Errorf("machines not found: %s", strings.Join(notFound, ", "))
-	}
-
-	if len(namesOrIDs) == 0 {
-		proxiedMachines = machines
-	}
-
-	md := metadata.New(nil)
-	for _, m := range proxiedMachines {
-		machineIP, _ := m.Machine.Network.ManagementIp.ToAddr()
-		md.Append("machines", machineIP.String())
-	}
-
-	return metadata.NewOutgoingContext(ctx, md), proxiedMachines, nil
-}

pkg/api/container.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/pkg/stringid"
 	"github.com/docker/go-units"
 )
 
@@ -144,6 +145,11 @@ type ServiceContainer struct {
 	ServiceSpec ServiceSpec
 }
 
+// ShortID returns the truncated ID of the container (12 characters).
+func (c *ServiceContainer) ShortID() string {
+	return stringid.TruncateID(c.ID)
+}
+
 // ServiceID returns the ID of the service this container belongs to.
 func (c *ServiceContainer) ServiceID() string {
 	return c.Config.Labels[LabelServiceID]

pkg/api/container_exec.go

@@ -0,0 +1,37 @@
+package api
+
+import "io"
+
+// ExecOptions contains configuration for executing a command in a container.
+type ExecOptions struct {
+	// Command is the command to run in the container.
+	Command []string
+	// AttachStdin attaches the stdin stream to the exec session.
+	AttachStdin bool
+	// AttachStdout attaches the stdout stream to the exec session.
+	AttachStdout bool
+	// AttachStderr attaches the stderr stream to the exec session.
+	AttachStderr bool
+	// Tty allocates a pseudo-TTY for the exec session.
+	Tty bool
+	// Detach runs the command in the background without attaching to streams.
+	Detach bool
+
+	//// Not yet implemented fields
+	// User specifies the user to run the command as.
+	User string
+	// Privileged runs the command in privileged mode.
+	Privileged bool
+	// WorkingDir sets the working directory for the command.
+	WorkingDir string
+	// Env sets environment variables for the command.
+	Env []string
+
+	// Client-side only fields (not serialized, not sent to server)
+	// Stdin is the input stream. Defaults to os.Stdin if nil.
+	Stdin io.Reader `json:"-"`
+	// Stdout is the output stream. Defaults to os.Stdout if nil.
+	Stdout io.Writer `json:"-"`
+	// Stderr is the error stream. Defaults to os.Stderr if nil.
+	Stderr io.Writer `json:"-"`
+}

pkg/api/logs.go

@@ -0,0 +1,87 @@
+package api
+
+import (
+	"errors"
+	"time"
+
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+)
+
+const (
+	LogStreamUnknown LogStreamType = iota
+	LogStreamStdout
+	LogStreamStderr
+	// LogStreamHeartbeat represents a heartbeat log entry with a timestamp indicating that
+	// there are no older logs than this timestamp.
+	LogStreamHeartbeat
+)
+
+type LogStreamType int
+
+// LogStreamTypeFromProto converts a protobuf ContainerLogEntry.StreamType to the internal LogStreamType.
+func LogStreamTypeFromProto(s pb.ContainerLogEntry_StreamType) LogStreamType {
+	switch s {
+	case pb.ContainerLogEntry_STDOUT:
+		return LogStreamStdout
+	case pb.ContainerLogEntry_STDERR:
+		return LogStreamStderr
+	case pb.ContainerLogEntry_HEARTBEAT:
+		return LogStreamHeartbeat
+	default:
+		return LogStreamUnknown
+	}
+}
+
+// LogStreamTypeToProto converts LogStreamType to protobuf ContainerLogEntry.StreamType.
+func LogStreamTypeToProto(s LogStreamType) pb.ContainerLogEntry_StreamType {
+	switch s {
+	case LogStreamStdout:
+		return pb.ContainerLogEntry_STDOUT
+	case LogStreamStderr:
+		return pb.ContainerLogEntry_STDERR
+	case LogStreamHeartbeat:
+		return pb.ContainerLogEntry_HEARTBEAT
+	default:
+		return pb.ContainerLogEntry_UNKNOWN
+	}
+}
+
+// ServiceLogsOptions specifies parameters for ServiceLogs.
+type ServiceLogsOptions struct {
+	Follow bool
+	Tail   int
+	Since  string
+	Until  string
+	// Machines filters logs to only include containers running on the specified machines (names or IDs).
+	// If empty, logs from all machines are included.
+	Machines []string
+}
+
+// ServiceLogEntry represents a single log entry from a service container.
+type ServiceLogEntry struct {
+	// Metadata may not be set if an error occurred (Err is not nil).
+	Metadata ServiceLogEntryMetadata
+	ContainerLogEntry
+}
+
+// ServiceLogEntryMetadata contains metadata about the source of a log entry.
+type ServiceLogEntryMetadata struct {
+	ServiceID   string
+	ServiceName string
+	ContainerID string
+	MachineID   string
+	MachineName string
+}
+
+// ContainerLogEntry represents a single log entry from a container.
+type ContainerLogEntry struct {
+	Stream    LogStreamType
+	Timestamp time.Time
+	Message   []byte
+	// Err indicates that an error occurred while streaming logs from a container.
+	// Other fields are not set if Err is not nil.
+	Err error
+}
+
+// ErrLogStreamStalled indicates that a log stream stopped sending data and may be unresponsive.
+var ErrLogStreamStalled = errors.New("log stream stopped responding")

pkg/api/resources.go

@@ -1,5 +1,9 @@
 package api
 
+import (
+	"github.com/docker/docker/api/types/container"
+)
+
 const (
 	MilliCore = 1_000_000
 	Core      = 1000 * MilliCore
@@ -13,4 +17,6 @@ type ContainerResources struct {
 	// MemoryReservation is the minimum amount of memory (in bytes) the container needs to run efficiently.
 	// TODO: implement a placement constraint that checks available memory on machines.
 	MemoryReservation int64
+	// Device reservations/requests for access to things like GPUs
+	DeviceReservations []container.DeviceRequest
 }

pkg/api/service.go

@@ -8,6 +8,7 @@ import (
 	"slices"
 	"strings"
 
+	mapset "github.com/deckarep/golang-set/v2"
 	"github.com/distribution/reference"
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
@@ -366,6 +367,16 @@ type MachineServiceContainer struct {
 	Container ServiceContainer
 }
 
+// MachineIDs returns a list of unique machine IDs where the service containers are running.
+func (s *Service) MachineIDs() []string {
+	ids := mapset.NewSet[string]()
+	for _, mc := range s.Containers {
+		ids.Add(mc.MachineID)
+	}
+
+	return ids.ToSlice()
+}
+
 // Images returns a sorted list of unique images used by the service containers.
 func (s *Service) Images() []string {
 	images := make(map[string]struct{})

pkg/api/volume.go

@@ -83,6 +83,9 @@ func (v *VolumeSpec) SetDefaults() VolumeSpec {
 		if spec.VolumeOptions.Name == "" {
 			spec.VolumeOptions.Name = spec.Name
 		}
+		if spec.VolumeOptions.Driver != nil && spec.VolumeOptions.Driver.Name == "" {
+			spec.VolumeOptions.Driver.Name = VolumeDriverLocal
+		}
 	}
 	// TODO: set explicit default values for Propagation and Recursive for bind mounts?
 

pkg/api/volume_test.go

@@ -0,0 +1,142 @@
+package api
+
+import (
+	"testing"
+
+	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/api/types/volume"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestVolumeSpec_MatchesDockerVolume(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		spec     VolumeSpec
+		vol      volume.Volume
+		expected bool
+	}{
+		{
+			name: "match with explicit local driver",
+			spec: VolumeSpec{
+				Type: VolumeTypeVolume,
+				VolumeOptions: &VolumeOptions{
+					Driver: &mount.Driver{
+						Name: "local",
+						Options: map[string]string{
+							"foo": "bar",
+						},
+					},
+				},
+			},
+			vol: volume.Volume{
+				Driver: "local",
+				Options: map[string]string{
+					"foo": "bar",
+				},
+			},
+			expected: true,
+		},
+		{
+			name: "match with empty driver name in spec (implicit local)",
+			spec: VolumeSpec{
+				Type: VolumeTypeVolume,
+				VolumeOptions: &VolumeOptions{
+					Driver: &mount.Driver{
+						Name: "", // Implicitly local
+						Options: map[string]string{
+							"foo": "bar",
+						},
+					},
+				},
+			},
+			vol: volume.Volume{
+				Driver: "local",
+				Options: map[string]string{
+					"foo": "bar",
+				},
+			},
+			expected: true,
+		},
+		{
+			name: "non-match with different driver options",
+			spec: VolumeSpec{
+				Type: VolumeTypeVolume,
+				VolumeOptions: &VolumeOptions{
+					Driver: &mount.Driver{
+						Name: "local",
+						Options: map[string]string{
+							"foo": "baz",
+						},
+					},
+				},
+			},
+			vol: volume.Volume{
+				Driver: "local",
+				Options: map[string]string{
+					"foo": "bar",
+				},
+			},
+			expected: false,
+		},
+		{
+			name: "non-match with different driver name",
+			spec: VolumeSpec{
+				Type: VolumeTypeVolume,
+				VolumeOptions: &VolumeOptions{
+					Driver: &mount.Driver{
+						Name: "custom",
+						Options: map[string]string{
+							"foo": "bar",
+						},
+					},
+				},
+			},
+			vol: volume.Volume{
+				Driver: "local",
+				Options: map[string]string{
+					"foo": "bar",
+				},
+			},
+			expected: false,
+		},
+		{
+			name: "match external volume without driver by name only",
+			spec: VolumeSpec{
+				Name: "external",
+				Type: VolumeTypeVolume,
+			},
+			vol: volume.Volume{
+				Name:   "external",
+				Driver: "local",
+				Options: map[string]string{
+					"foo": "bar",
+				},
+			},
+			expected: true,
+		},
+		{
+			name: "non-match external volume by name",
+			spec: VolumeSpec{
+				Name: "unknown",
+				Type: VolumeTypeVolume,
+			},
+			vol: volume.Volume{
+				Name:   "external",
+				Driver: "local",
+				Options: map[string]string{
+					"foo": "bar",
+				},
+			},
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			matches := tt.spec.MatchesDockerVolume(tt.vol)
+			assert.Equal(t, tt.expected, matches)
+		})
+	}
+}

pkg/client/caddy.go

@@ -71,6 +71,13 @@ func (cli *Client) NewCaddyDeployment(image, config string, placement api.Placem
 				Protocol:      api.ProtocolTCP,
 				Mode:          api.PortModeHost,
 			},
+			// Needed for HTTP/3 (QUIC)
+			{
+				PublishedPort: 443,
+				ContainerPort: 443,
+				Protocol:      api.ProtocolUDP,
+				Mode:          api.PortModeHost,
+			},
 		},
 		Volumes: []api.VolumeSpec{
 			{

pkg/client/client.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"strings"
 
 	"github.com/docker/cli/cli/streams"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
@@ -57,6 +58,7 @@ func New(ctx context.Context, connector Connector) (*Client, error) {
 	c.ClusterClient = pb.NewClusterClient(c.conn)
 	c.Caddy = pb.NewCaddyClient(c.conn)
 	c.Docker = docker.NewClient(c.conn)
+
 	return c, nil
 }
 
@@ -75,3 +77,41 @@ func proxyToMachine(ctx context.Context, machine *pb.MachineInfo) context.Contex
 	md := metadata.Pairs("machines", machineIP.String())
 	return metadata.NewOutgoingContext(ctx, md)
 }
+
+// ProxyMachinesContext returns a new context that proxies gRPC requests to the specified machines.
+// If namesOrIDs is nil, all machines are included.
+func (cli *Client) ProxyMachinesContext(
+	ctx context.Context, namesOrIDs []string,
+) (context.Context, api.MachineMembersList, error) {
+	// TODO: move the machine IP resolution to the proxy router to allow setting machine names and IDs in the metadata.
+	machines, err := cli.ListMachines(ctx, nil)
+	if err != nil {
+		return nil, nil, fmt.Errorf("list machines: %w", err)
+	}
+
+	var proxiedMachines api.MachineMembersList
+	var notFound []string
+	for _, nameOrID := range namesOrIDs {
+		if m := machines.FindByNameOrID(nameOrID); m != nil {
+			proxiedMachines = append(proxiedMachines, m)
+		} else {
+			notFound = append(notFound, nameOrID)
+		}
+	}
+
+	if len(notFound) > 0 {
+		return nil, nil, fmt.Errorf("machines not found: %s", strings.Join(notFound, ", "))
+	}
+
+	if len(namesOrIDs) == 0 {
+		proxiedMachines = machines
+	}
+
+	md := metadata.New(nil)
+	for _, m := range proxiedMachines {
+		machineIP, _ := m.Machine.Network.ManagementIp.ToAddr()
+		md.Append("machines", machineIP.String())
+	}
+
+	return metadata.NewOutgoingContext(ctx, md), proxiedMachines, nil
+}

pkg/client/compose/caddy_test.go

@@ -1,8 +1,11 @@
 package compose
 
 import (
+	"context"
+	"os"
 	"testing"
 
+	composecli "github.com/compose-spec/compose-go/v2/cli"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -178,7 +181,15 @@ services:
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			project, err := loadProjectFromContent(t, tt.composeYAML)
+			// Get current working directory for relative path resolution to testdata directory.
+			wd, err := os.Getwd()
+			require.NoError(t, err)
+
+			project, err := LoadProjectFromContent(
+				context.Background(),
+				tt.composeYAML,
+				composecli.WithWorkingDirectory(wd),
+			)
 
 			if tt.wantErr != "" {
 				require.ErrorContains(t, err, tt.wantErr)

pkg/client/compose/deploy.go

@@ -49,10 +49,6 @@ func NewDeploymentWithStrategy(ctx context.Context, cli Client, project *types.P
 		ClusterDomain: domain,
 	}
 
-	if strategy == nil {
-		strategy = &deploy.RollingStrategy{State: state}
-	}
-
 	return &Deployment{
 		Client:       cli,
 		Project:      project,
@@ -88,6 +84,7 @@ func (d *Deployment) Plan(ctx context.Context) (deploy.SequenceOperation, error)
 	}
 
 	// Check external volumes and plan the creation of missing volumes before deploying services.
+	// Updates the cluster state (d.state) with the scheduled volumes.
 	volumeOps, err := d.planVolumes(serviceSpecs)
 	if err != nil {
 		return plan, err
@@ -98,8 +95,8 @@ func (d *Deployment) Plan(ctx context.Context) (deploy.SequenceOperation, error)
 
 	for _, spec := range serviceSpecs {
 		// TODO: properly handle depends_on conditions in the service deployment plan as the first operation.
-		// Pass the update cluster state with scheduled volumes to the deployment.
+		// Pass the updated cluster state with the scheduled volumes to the deployment.
-		deployment := deploy.NewDeployment(d.Client, spec, d.Strategy)
+		deployment := deploy.NewDeploymentWithClusterState(d.Client, spec, d.Strategy, d.state)
 		servicePlan, err := deployment.Plan(ctx)
 		if err != nil {
 			return plan, fmt.Errorf("create deployment plan for service '%s': %w", spec.Name, err)

pkg/client/compose/imagetemplate.go

@@ -0,0 +1,194 @@
+package compose
+
+import (
+	"bytes"
+	"fmt"
+	"text/template"
+	"time"
+
+	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/distribution/reference"
+	"github.com/psviderski/uncloud/internal/gitutil"
+)
+
+const (
+	// DefaultTagTemplate is the default tag template appended to images without a tag when building locally.
+	// Format:
+	// If the project workdir is a git repo: "2025-08-16-130734.84d33bb" or "2025-08-16-130734.84d33bb.dirty"
+	// If not a git repo: "2025-08-16-130734" which is the current date and time.
+	DefaultTagTemplate = `{{if .Git.IsRepo}}{{gitdate "2006-01-02-150405"}}.{{gitsha 7}}{{if .Git.IsDirty}}.dirty{{end}}{{else}}{{date "2006-01-02-150405"}}{{end}}`
+	// DefaultImageTemplate is the default image template used when no image is specified.
+	DefaultImageTemplate = "{{.Project}}/{{.Service}}:" + DefaultTagTemplate
+)
+
+// ImageTemplateContext contains structured data for image template processing.
+type ImageTemplateContext struct {
+	// Project is the project name.
+	Project string
+	// Service is the service name where the image is defined.
+	Service string
+	// Git is the git repo state.
+	Git gitutil.GitState
+	// Tag is the rendered DefaultTagTemplate used for images without a tag.
+	Tag string
+}
+
+// newImageTemplateContext creates an ImageTemplateContext for the given project, service, and git state.
+func newImageTemplateContext(
+	projectName, serviceName string, gitState gitutil.GitState,
+) (ImageTemplateContext, error) {
+	ctx := ImageTemplateContext{
+		Project: projectName,
+		Service: serviceName,
+		Git:     gitState,
+	}
+
+	tag, err := processImageTemplate(DefaultTagTemplate, ctx)
+	if err != nil {
+		return ImageTemplateContext{}, fmt.Errorf("process default tag template: %w", err)
+	}
+	ctx.Tag = tag
+
+	return ctx, nil
+}
+
+// ProcessImageTemplates processes image names in services to expand Go template expressions using
+// git metadata. If a service has no image specified, uses the default template {{.Project}}/{{.Service}}:{{.Tag}}.
+// If a service has a build section and an image without a tag, appends the default tag template.
+// Fully specified images are left unchanged.
+//
+// Template context: ImageTemplateContext
+// Template functions: gitsha(length?), gitdate(format, timezone?), date(format, timezone?)
+//
+// Examples:
+//
+//	image: myapp:{{.Tag}}                        → myapp:2025-08-16-130734.84d33bb
+//	image: registry.io/api:v1.0-{{gitsha 7}}     → registry.io/api:v1.0-84d33bb
+//	image: worker:{{gitdate "2006-01-02"}}       → worker:2025-08-16
+//	build: . / image: mybackend                  → mybackend:2025-08-16-130734.84d33bb
+//	build: . / (no image)                        → myproject/myservice:2025-08-16-130734.84d33bb
+//	image: postgres                              → postgres (unchanged)
+func ProcessImageTemplates(project *types.Project) (*types.Project, error) {
+	gitState, err := gitutil.InspectGitState(project.WorkingDir)
+	if err != nil {
+		return nil, fmt.Errorf("inspect git state at '%s': %w", project.WorkingDir, err)
+	}
+	ctx, err := newImageTemplateContext(project.Name, "", gitState)
+	if err != nil {
+		return nil, err
+	}
+
+	// Process each service's image.
+	for name, service := range project.Services {
+		ctx.Service = service.Name
+
+		processedImage := ""
+		image := service.Image
+
+		if image == "" {
+			image = DefaultImageTemplate
+		} else {
+			// Check if image contains any template markers.
+			processed, err := processImageTemplate(image, ctx)
+			if err != nil {
+				return nil, fmt.Errorf("process image template for service '%s': %w", name, err)
+			}
+
+			if processed == image {
+				// Image doesn't contain template markers.
+				// If it doesn't have a tag and has a build section, use the default template for the tag.
+				tagged, err := hasTag(image)
+				if err != nil {
+					return nil, err
+				}
+				if !tagged && service.Build != nil {
+					image = image + ":" + DefaultTagTemplate
+				}
+			} else {
+				// Image contains a template which has been processed successfully so use the result.
+				processedImage = processed
+			}
+		}
+
+		if processedImage == "" {
+			if processedImage, err = processImageTemplate(image, ctx); err != nil {
+				return nil, fmt.Errorf("process image template for service '%s': %w", name, err)
+			}
+		}
+
+		service.Image = processedImage
+		project.Services[name] = service
+	}
+
+	return project, nil
+}
+
+// processImageTemplate processes a single image string through the template engine.
+func processImageTemplate(image string, ctx ImageTemplateContext) (string, error) {
+	funcMap := template.FuncMap{
+		"gitsha": func(length ...int) string {
+			l := 0
+			if len(length) > 0 {
+				l = length[0]
+			}
+			return ctx.Git.ShortSHA(l)
+		},
+		"gitdate": func(layout string, timezone ...string) string {
+			if !ctx.Git.IsRepo || ctx.Git.Date.IsZero() {
+				return ""
+			}
+
+			date := ctx.Git.Date
+			if len(timezone) > 0 {
+				if loc, err := time.LoadLocation(timezone[0]); err == nil {
+					date = date.In(loc)
+				}
+			}
+
+			return date.Format(layout)
+		},
+		"date": func(layout string, timezone ...string) string {
+			t := time.Now().UTC()
+			if len(timezone) > 0 {
+				if loc, err := time.LoadLocation(timezone[0]); err == nil {
+					t = t.In(loc)
+				}
+			}
+
+			return t.Format(layout)
+		},
+	}
+
+	// Parse and execute the template.
+	tmpl, err := template.New("image").Funcs(funcMap).Parse(image)
+	if err != nil {
+		return "", fmt.Errorf("parse image template '%s': %w", image, err)
+	}
+
+	var buf bytes.Buffer
+	if err = tmpl.Execute(&buf, ctx); err != nil {
+		return "", fmt.Errorf("execute image template: %w", err)
+	}
+
+	return buf.String(), nil
+}
+
+// hasTag checks if an image name already has an explicit tag or digest.
+// Returns an error if the image reference is invalid.
+func hasTag(image string) (bool, error) {
+	ref, err := reference.ParseNormalizedNamed(image)
+	if err != nil {
+		return false, fmt.Errorf("parse image reference '%s': %w", image, err)
+	}
+
+	// Check if it has an explicit tag (e.g., "myapp:v1.0").
+	if _, ok := ref.(reference.Tagged); ok {
+		return true, nil
+	}
+	// Check if it has a digest (e.g., "myapp@sha256:...").
+	if _, ok := ref.(reference.Digested); ok {
+		return true, nil
+	}
+
+	return false, nil
+}

pkg/client/compose/imagetemplate_test.go

@@ -0,0 +1,466 @@
+package compose
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/psviderski/uncloud/internal/gitutil"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestProcessImageTemplates_Integration(t *testing.T) {
+	// Create a temporary directory for the test git repository.
+	tmpDir := t.TempDir()
+	initGitRepo(t, tmpDir)
+
+	// Create an initial commit.
+	testFile := filepath.Join(tmpDir, "test.txt")
+	err := os.WriteFile(testFile, []byte("initial content"), 0o644)
+	require.NoError(t, err)
+	runGitCommand(t, tmpDir, "add", "test.txt")
+	runGitCommand(t, tmpDir, "commit", "-m", "Initial commit")
+
+	gitState, err := gitutil.InspectGitState(tmpDir)
+	require.NoError(t, err)
+	require.True(t, gitState.IsRepo)
+	require.False(t, gitState.IsDirty)
+	require.NotEmpty(t, gitState.SHA)
+
+	expectedTag := gitState.Date.UTC().Format("2006-01-02-150405") + "." + gitState.SHA[:7]
+	expectedDate := gitState.Date.UTC().Format("2006-01-02")
+
+	t.Run("clean repository", func(t *testing.T) {
+		project := &types.Project{
+			Name:       "myproject",
+			WorkingDir: tmpDir,
+			Services: types.Services{
+				"service1": {
+					Name:  "service1",
+					Image: "myapp:{{.Tag}}",
+					Build: &types.BuildConfig{Context: "."},
+				},
+				"service2": {
+					Name:  "service2",
+					Image: `myapp:v1.0-{{gitsha 7}}`,
+					Build: &types.BuildConfig{Context: "."},
+				},
+				"service3": {
+					Name:  "service3",
+					Image: "myapp", // No tag, has build, should get default tag template appended.
+					Build: &types.BuildConfig{Context: "."},
+				},
+				"service4": {
+					Name:  "service4",
+					Image: "", // Empty image, has build, should use default template.
+					Build: &types.BuildConfig{Context: "."},
+				},
+				"service5": {
+					Name:  "service5",
+					Image: "{{.Project}}/{{.Service}}:custom", // Custom template.
+					Build: &types.BuildConfig{Context: "."},
+				},
+				"service6": {
+					Name:  "service6",
+					Image: `registry.example.com/{{.Project}}/{{.Service}}:{{gitdate "2006-01-02"}}-{{gitsha 7}}`,
+					Build: &types.BuildConfig{Context: "."},
+				},
+				"service7": {
+					Name:  "service7",
+					Image: `myapp:{{if .Git.IsRepo}}git-{{.Git.SHA}}{{else}}no-git{{end}}`,
+					Build: &types.BuildConfig{Context: "."},
+				},
+				"service8": {
+					Name:  "service8",
+					Image: `myapp:{{gitdate "20060102"}}.{{gitsha 10}}{{if .Git.IsDirty}}.dirty{{end}}`,
+					Build: &types.BuildConfig{Context: "."},
+				},
+				"postgres": {
+					Name:  "postgres",
+					Image: "postgres", // No build section, should NOT get tag appended.
+				},
+				"redis": {
+					Name:  "redis",
+					Image: "redis:7.2", // Third-party with tag, should be unchanged.
+				},
+			},
+		}
+
+		p, err := ProcessImageTemplates(project)
+		require.NoError(t, err)
+
+		assert.Equal(t, "myapp:"+expectedTag, p.Services["service1"].Image)
+		assert.Equal(t, "myapp:v1.0-"+gitState.SHA[:7], p.Services["service2"].Image)
+		assert.Equal(t, "myapp:"+expectedTag, p.Services["service3"].Image)
+		assert.Equal(t, "myproject/service4:"+expectedTag, p.Services["service4"].Image)
+		assert.Equal(t, "myproject/service5:custom", p.Services["service5"].Image)
+		expectedService6 := "registry.example.com/myproject/service6:" + expectedDate + "-" + gitState.SHA[:7]
+		assert.Equal(t, expectedService6, p.Services["service6"].Image)
+		assert.Equal(t, "myapp:git-"+gitState.SHA, p.Services["service7"].Image)
+		expectedService8 := "myapp:" + gitState.Date.UTC().Format("20060102") + "." + gitState.SHA[:10]
+		assert.Equal(t, expectedService8, p.Services["service8"].Image)
+
+		// Images without build section should be unchanged.
+		assert.Equal(t, "postgres", p.Services["postgres"].Image, "postgres image should not have tag appended")
+		assert.Equal(t, "redis:7.2", p.Services["redis"].Image, "redis image should be unchanged")
+	})
+
+	t.Run("dirty repository", func(t *testing.T) {
+		// Make the repository dirty by creating an uncommitted file.
+		dirtyFile := filepath.Join(tmpDir, "uncommitted.txt")
+		err := os.WriteFile(dirtyFile, []byte("uncommitted changes"), 0o644)
+		require.NoError(t, err)
+
+		dirtyGitState, err := gitutil.InspectGitState(tmpDir)
+		require.NoError(t, err)
+		require.True(t, dirtyGitState.IsDirty)
+		require.Equal(t, gitState.SHA, dirtyGitState.SHA)
+
+		project := &types.Project{
+			Name:       "myproject",
+			WorkingDir: tmpDir,
+			Services: types.Services{
+				"default": {
+					Name:  "default",
+					Build: &types.BuildConfig{Context: "."},
+				},
+				"app": {
+					Name:  "app",
+					Image: `myapp:{{gitdate "2006-01-02"}}-{{gitsha 7}}{{if .Git.IsDirty}}.dirty{{end}}`,
+					Build: &types.BuildConfig{Context: "."},
+				},
+			},
+		}
+
+		p, err := ProcessImageTemplates(project)
+		require.NoError(t, err)
+
+		expectedDirtyDate := dirtyGitState.Date.UTC().Format("2006-01-02")
+
+		assert.Equal(t, "myproject/default:"+expectedTag+".dirty", p.Services["default"].Image)
+		expectedApp := "myapp:" + expectedDirtyDate + "-" + dirtyGitState.SHA[:7] + ".dirty"
+		assert.Equal(t, expectedApp, p.Services["app"].Image)
+	})
+
+	t.Run("non-git directory", func(t *testing.T) {
+		nonGitDir := t.TempDir()
+
+		project := &types.Project{
+			Name:       "myproject",
+			WorkingDir: nonGitDir,
+			Services: types.Services{
+				"default": {
+					Name:  "default",
+					Build: &types.BuildConfig{Context: "."},
+				},
+				"app": {
+					Name:  "app",
+					Image: `myapp:{{if .Git.IsRepo}}git{{else}}{{date "2006-01-02"}}{{end}}`,
+					Build: &types.BuildConfig{Context: "."},
+				},
+			},
+		}
+
+		p, err := ProcessImageTemplates(project)
+		require.NoError(t, err)
+
+		assert.Regexp(t, regexp.MustCompile("^myproject/default:"+expectedDate+`-\d{6}$`), p.Services["default"].Image)
+		assert.Equal(t, "myapp:"+expectedDate, p.Services["app"].Image)
+	})
+}
+
+func TestProcessImageTemplate(t *testing.T) {
+	// Fixed time for testing: 2025-08-16 13:07:34 UTC.
+	fixedTime := time.Date(2025, 8, 16, 13, 7, 34, 0, time.UTC)
+
+	gitState := gitutil.GitState{
+		Date:    fixedTime,
+		IsDirty: false,
+		IsRepo:  true,
+		SHA:     "84d33bb1234567890abcdef1234567890abcdef",
+	}
+	ctx, err := newImageTemplateContext("myproject", "myservice", gitState)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name     string
+		image    string
+		expected string
+		wantErr  bool
+	}{
+		{
+			name:     "no template markers",
+			image:    "myapp:v1.0",
+			expected: "myapp:v1.0",
+		},
+		{
+			name:     "git SHA function with length",
+			image:    "myapp:{{gitsha 10}}",
+			expected: "myapp:84d33bb123",
+		},
+		{
+			name:     "git SHA function full length",
+			image:    "myapp:{{gitsha}}",
+			expected: "myapp:84d33bb1234567890abcdef1234567890abcdef",
+		},
+		{
+			name:     "git SHA function negative length",
+			image:    "myapp:{{gitsha -1}}",
+			expected: "myapp:84d33bb1234567890abcdef1234567890abcdef",
+		},
+		{
+			name:     "git date",
+			image:    `myapp:{{gitdate "2006-01-02"}}`,
+			expected: "myapp:2025-08-16",
+		},
+		{
+			name:     "git date with time",
+			image:    `myapp:{{gitdate "2006-01-02-150405"}}`,
+			expected: "myapp:2025-08-16-130734",
+		},
+		{
+			name:     "git date with timezone",
+			image:    `myapp:{{gitdate "2006-01-02-150405" "Australia/Brisbane"}}`,
+			expected: "myapp:2025-08-16-230734",
+		},
+		{
+			name:     "current date",
+			image:    `myapp:{{date "2006-01-02"}}`,
+			expected: `^myapp:\d{4}-\d{2}-\d{2}$`,
+		},
+		{
+			name:     "current date with time",
+			image:    `myapp:{{date "20060102-150405"}}`,
+			expected: `^myapp:\d{8}-\d{6}$`,
+		},
+		{
+			name:     "current date with timezone",
+			image:    `myapp:{{date "20060102-150405" "Local"}}`,
+			expected: `^myapp:\d{8}-\d{6}$`,
+		},
+		{
+			name:     "multiple template functions",
+			image:    `myapp:v1.0-{{gitdate "2006-01-02"}}-{{gitsha 7}}`,
+			expected: "myapp:v1.0-2025-08-16-84d33bb",
+		},
+		{
+			name:     "project and service variables",
+			image:    "{{.Project}}/{{.Service}}:{{gitsha 7}}",
+			expected: "myproject/myservice:84d33bb",
+		},
+		{
+			name:     "git SHA variable",
+			image:    "myapp:{{.Git.SHA}}",
+			expected: "myapp:84d33bb1234567890abcdef1234567890abcdef",
+		},
+		{
+			name:     "tag variable",
+			image:    "myapp:{{.Tag}}",
+			expected: "myapp:2025-08-16-130734.84d33bb",
+		},
+		{
+			name:     "default image template short",
+			image:    "{{.Project}}/{{.Service}}:{{.Tag}}",
+			expected: "myproject/myservice:2025-08-16-130734.84d33bb",
+		},
+		{
+			name:     "default image template long",
+			image:    `{{.Project}}/{{.Service}}:{{if .Git.IsRepo}}{{gitdate "2006-01-02-150405"}}.{{gitsha 7}}{{if .Git.IsDirty}}.dirty{{end}}{{else}}{{date "2006-01-02-150405"}}{{end}}`,
+			expected: "myproject/myservice:2025-08-16-130734.84d33bb",
+		},
+		{
+			name:     "whitespace only",
+			image:    "   ",
+			expected: "   ",
+		},
+		{
+			name:    "invalid template syntax",
+			image:   "myapp:{{.Git.NonExistent.Field}}",
+			wantErr: true,
+		},
+		{
+			name:    "unclosed template",
+			image:   "myapp:{{.Tag",
+			wantErr: true,
+		},
+		{
+			name:    "invalid gitsha argument - not a number",
+			image:   `myapp:{{gitsha "abc"}}`,
+			wantErr: true,
+		},
+		{
+			name:    "invalid date format - missing quotes",
+			image:   "myapp:{{date 2006-01-02}}",
+			wantErr: true,
+		},
+		{
+			name:    "division by zero in template",
+			image:   "myapp:{{divide 1 0}}",
+			wantErr: true,
+		},
+		{
+			name:    "undefined function",
+			image:   "myapp:{{undefined_func}}",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := processImageTemplate(tt.image, ctx)
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				if strings.HasPrefix(tt.expected, "^") {
+					assert.Regexp(t, tt.expected, result)
+				} else {
+					assert.Equal(t, tt.expected, result)
+				}
+			}
+		})
+	}
+}
+
+func TestHasTag(t *testing.T) {
+	tests := []struct {
+		name    string
+		image   string
+		want    bool
+		wantErr bool
+	}{
+		{
+			name:  "image with tag",
+			image: "myapp:v1.0",
+			want:  true,
+		},
+		{
+			name:  "image without tag",
+			image: "myapp",
+			want:  false,
+		},
+		{
+			name:  "registry with port and tag",
+			image: "localhost:5000/myapp:v1.0",
+			want:  true,
+		},
+		{
+			name:  "registry with port, no tag",
+			image: "localhost:5000/myapp",
+			want:  false,
+		},
+		{
+			name:  "registry path with tag",
+			image: "registry.example.com/org/myapp:v1.0",
+			want:  true,
+		},
+		{
+			name:  "registry path without tag",
+			image: "registry.example.com/org/myapp",
+			want:  false,
+		},
+		{
+			name:  "image with digest",
+			image: "myapp@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
+			want:  true,
+		},
+		{
+			name:  "registry with tag and digest",
+			image: "registry.example.com/myapp:v1.0@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef",
+			want:  true,
+		},
+		// Invalid image references.
+		{
+			name:    "image with empty tag",
+			image:   "myapp:",
+			want:    false,
+			wantErr: true,
+		},
+		{
+			name:    "empty string",
+			image:   "",
+			want:    false,
+			wantErr: true,
+		},
+		{
+			name:    "invalid characters - spaces",
+			image:   "my app:v1.0",
+			want:    false,
+			wantErr: true,
+		},
+		{
+			name:    "invalid characters - uppercase in name",
+			image:   "MyApp:v1.0",
+			want:    false,
+			wantErr: true,
+		},
+		{
+			name:    "invalid digest format",
+			image:   "myapp@invalid-digest",
+			want:    false,
+			wantErr: true,
+		},
+		{
+			name:    "double colon",
+			image:   "myapp::tag",
+			want:    false,
+			wantErr: true,
+		},
+		{
+			name:    "starts with slash",
+			image:   "/myapp:v1.0",
+			want:    false,
+			wantErr: true,
+		},
+		{
+			name:    "ends with slash",
+			image:   "myapp/:v1.0",
+			want:    false,
+			wantErr: true,
+		},
+		{
+			name:    "invalid tag characters",
+			image:   "myapp:v1.0@latest",
+			want:    false,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := hasTag(tt.image)
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tt.want, result)
+			}
+		})
+	}
+}
+
+// Helper functions.
+
+func initGitRepo(t *testing.T, dir string) {
+	t.Helper()
+
+	// Initialize git repo.
+	runGitCommand(t, dir, "init")
+	runGitCommand(t, dir, "config", "user.email", "test@example.com")
+	runGitCommand(t, dir, "config", "user.name", "Test User")
+}
+
+func runGitCommand(t *testing.T, dir string, args ...string) {
+	t.Helper()
+
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	output, err := cmd.CombinedOutput()
+	require.NoError(t, err, "git command failed: %s", output)
+}

pkg/client/compose/port_test.go

@@ -1,6 +1,7 @@
 package compose
 
 import (
+	"context"
 	"net/netip"
 	"testing"
 
@@ -301,7 +302,7 @@ services:
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			project, err := loadProjectFromContent(t, tt.content)
+			project, err := LoadProjectFromContent(context.Background(), tt.content)
 			if tt.wantErr != "" {
 				require.Error(t, err)
 				assert.Contains(t, err.Error(), tt.wantErr)
@@ -375,7 +376,7 @@ services:
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			project, err := loadProjectFromContent(t, tt.content)
+			project, err := LoadProjectFromContent(context.Background(), tt.content)
 			require.NoError(t, err)
 
 			service, err := project.GetService("web")
@@ -402,7 +403,7 @@ services:
       - "9090:9090/tcp@host"
 `
 
-	project, err := loadProjectFromContent(t, content)
+	project, err := LoadProjectFromContent(context.Background(), content)
 	require.NoError(t, err)
 
 	service, err := project.GetService("web")

pkg/client/compose/project.go

@@ -3,20 +3,23 @@ package compose
 import (
 	"context"
 	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
 
 	composecli "github.com/compose-spec/compose-go/v2/cli"
 	"github.com/compose-spec/compose-go/v2/types"
 )
 
-// FakeProjectName is a placeholder name for the project to be able to strip it from the resource names used as prefix.
+// LoadProject loads a Compose project from the default locations or the given paths.
-const FakeProjectName = "f-a-k-e"
-
 func LoadProject(ctx context.Context, paths []string, opts ...composecli.ProjectOptionsFn) (*types.Project, error) {
 	defaultOpts := []composecli.ProjectOptionsFn{
-		composecli.WithName(FakeProjectName),
 		// First apply os.Environment, always wins.
 		composecli.WithOsEnv,
-		// Read dot env file to populate project environment.
+		// Set the local .env file to be loaded by WithDotEnv. COMPOSE_DISABLE_ENV_FILE can disable it.
+		composecli.WithEnvFiles(),
+		// Read environment variables from .env files set by WithEnvFiles (.env by default) to make available
+		// for interpolation.
 		composecli.WithDotEnv,
 		// Get compose file path set by COMPOSE_FILE.
 		composecli.WithConfigFileEnv,
@@ -40,6 +43,7 @@ func LoadProject(ctx context.Context, paths []string, opts ...composecli.Project
 		return nil, err
 	}
 
+	removeProjectPrefixFromNames(project)
 	if project, err = transformServicesCaddyExtension(project); err != nil {
 		return nil, err
 	}
@@ -52,5 +56,39 @@ func LoadProject(ctx context.Context, paths []string, opts ...composecli.Project
 		return nil, err
 	}
 
+	// Process image templates in services to expand Go template expressions using git repo state.
+	if project, err = ProcessImageTemplates(project); err != nil {
+		return nil, err
+	}
+
 	return project, nil
 }
+
+// LoadProjectFromContent loads a Compose project from the given YAML content.
+func LoadProjectFromContent(
+	ctx context.Context, content string, opts ...composecli.ProjectOptionsFn,
+) (*types.Project, error) {
+	// Create a temporary directory for the compose file.
+	tmpDir, err := os.MkdirTemp("", "uncloud-compose-*")
+	if err != nil {
+		return nil, fmt.Errorf("create temporary directory: %w", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	// Write the YAML content to compose.yaml in the temporary directory.
+	composePath := filepath.Join(tmpDir, "compose.yaml")
+	if err := os.WriteFile(composePath, []byte(content), 0o644); err != nil {
+		return nil, fmt.Errorf("write compose file: %w", err)
+	}
+
+	return LoadProject(ctx, []string{composePath}, opts...)
+}
+
+// removeProjectPrefixFromNames removes the project name prefix from volume names.
+func removeProjectPrefixFromNames(project *types.Project) {
+	prefix := project.Name + "_"
+	for name, vol := range project.Volumes {
+		vol.Name = strings.TrimPrefix(vol.Name, prefix)
+		project.Volumes[name] = vol
+	}
+}

pkg/client/compose/project_test.go

@@ -0,0 +1,188 @@
+package compose
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestLoadProject_EnvFileInterpolation tests that environment variables from .env files
+// are properly loaded and available for interpolation in compose files.
+func TestLoadProject_EnvFileInterpolation(t *testing.T) {
+	tests := []struct {
+		name        string
+		composeYAML string
+		envFile     string
+		verify      func(t *testing.T, projectDir string)
+	}{
+		// This is a regression test for https://github.com/psviderski/uncloud/issues/144.
+		{
+			name: "simple variable interpolation",
+			envFile: `KEY1=value1
+KEY2=value2
+`,
+			composeYAML: `services:
+  web:
+    image: nginx
+    command: ["echo", "${KEY1}", "${KEY2}"]
+`,
+			verify: func(t *testing.T, projectDir string) {
+				project, err := LoadProject(context.Background(), []string{filepath.Join(projectDir, "compose.yaml")})
+				require.NoError(t, err)
+				require.NotNil(t, project)
+				require.Len(t, project.Services, 1)
+
+				webService := project.Services["web"]
+				require.NotNil(t, webService)
+				require.Len(t, webService.Command, 3)
+				assert.Equal(t, "echo", webService.Command[0])
+				assert.Equal(t, "value1", webService.Command[1], "KEY1 should be interpolated from .env file")
+				assert.Equal(t, "value2", webService.Command[2], "KEY2 should be interpolated from .env file")
+			},
+		},
+		{
+			name: "environment variable interpolation in service environment",
+			envFile: `DATABASE_URL=postgres://localhost:5432/mydb
+REDIS_URL=redis://localhost:6379
+`,
+			composeYAML: `services:
+  app:
+    image: myapp:latest
+    environment:
+      - DB_CONNECTION=${DATABASE_URL}
+      - CACHE_URL=${REDIS_URL}
+`,
+			verify: func(t *testing.T, projectDir string) {
+				project, err := LoadProject(context.Background(), []string{filepath.Join(projectDir, "compose.yaml")})
+				require.NoError(t, err)
+				require.NotNil(t, project)
+				require.Len(t, project.Services, 1)
+
+				appService := project.Services["app"]
+				require.NotNil(t, appService)
+				require.NotNil(t, appService.Environment)
+
+				assert.Equal(t, "postgres://localhost:5432/mydb", *appService.Environment["DB_CONNECTION"],
+					"DATABASE_URL should be interpolated from .env file")
+				assert.Equal(t, "redis://localhost:6379", *appService.Environment["CACHE_URL"],
+					"REDIS_URL should be interpolated from .env file")
+			},
+		},
+		{
+			name: "variable with default value when not in env file",
+			envFile: `EXISTING_VAR=exists
+`,
+			composeYAML: `services:
+  test:
+    image: busybox
+    environment:
+      - VAR1=${EXISTING_VAR}
+      - VAR2=${MISSING_VAR:-default_value}
+`,
+			verify: func(t *testing.T, projectDir string) {
+				project, err := LoadProject(context.Background(), []string{filepath.Join(projectDir, "compose.yaml")})
+				require.NoError(t, err)
+				require.NotNil(t, project)
+
+				testService := project.Services["test"]
+				require.NotNil(t, testService)
+
+				assert.Equal(t, "exists", *testService.Environment["VAR1"],
+					"EXISTING_VAR should be interpolated from .env file")
+				assert.Equal(t, "default_value", *testService.Environment["VAR2"],
+					"MISSING_VAR should use default value")
+			},
+		},
+		{
+			name: "os environment overrides .env file",
+			envFile: `MY_VAR=from_env_file
+`,
+			composeYAML: `services:
+  override:
+    image: alpine
+    environment:
+      - TEST_VAR=${MY_VAR}
+`,
+			verify: func(t *testing.T, projectDir string) {
+				t.Setenv("MY_VAR", "from_os_env")
+
+				project, err := LoadProject(context.Background(), []string{filepath.Join(projectDir, "compose.yaml")})
+				require.NoError(t, err)
+				require.NotNil(t, project)
+
+				overrideService := project.Services["override"]
+				require.NotNil(t, overrideService)
+
+				// OS environment should win over .env file (WithOsEnv comes before WithDotEnv).
+				assert.Equal(t, "from_os_env", *overrideService.Environment["TEST_VAR"],
+					"OS environment should override .env file")
+			},
+		},
+		{
+			name:    "no .env file - missing variables get empty string",
+			envFile: "",
+			composeYAML: `services:
+  missing:
+    image: ubuntu
+    command: ["echo", "${UNDEFINED_VAR}"]
+`,
+			verify: func(t *testing.T, projectDir string) {
+				os.Remove(filepath.Join(projectDir, ".env"))
+
+				project, err := LoadProject(context.Background(), []string{filepath.Join(projectDir, "compose.yaml")})
+				require.NoError(t, err)
+				require.NotNil(t, project)
+
+				missingService := project.Services["missing"]
+				require.NotNil(t, missingService)
+				require.Len(t, missingService.Command, 2)
+				assert.Equal(t, "", missingService.Command[1], "undefined variable should be empty string")
+			},
+		},
+		{
+			name:    "COMPOSE_DISABLE_ENV_FILE disables .env loading",
+			envFile: `MY_VAR=from_env_file`,
+			composeYAML: `services:
+  web:
+    image: nginx
+    command: ["echo", "${MY_VAR}"]
+`,
+			verify: func(t *testing.T, projectDir string) {
+				t.Setenv("COMPOSE_DISABLE_ENV_FILE", "true")
+
+				project, err := LoadProject(context.Background(), []string{filepath.Join(projectDir, "compose.yaml")})
+				require.NoError(t, err)
+				require.NotNil(t, project)
+
+				webService := project.Services["web"]
+				require.NotNil(t, webService)
+				require.Len(t, webService.Command, 2)
+
+				assert.Equal(t, "", webService.Command[1], "variable should be empty when .env file is disabled")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tempDir := t.TempDir()
+
+			composeFile := filepath.Join(tempDir, "compose.yaml")
+			err := os.WriteFile(composeFile, []byte(tt.composeYAML), 0o644)
+			require.NoError(t, err)
+
+			// Write .env file if provided.
+			if tt.envFile != "" {
+				envFile := filepath.Join(tempDir, ".env")
+				err = os.WriteFile(envFile, []byte(tt.envFile), 0o644)
+				require.NoError(t, err)
+			}
+
+			tt.verify(t, tempDir)
+		})
+	}
+}

pkg/client/compose/service.go

@@ -5,9 +5,9 @@ import (
 	"maps"
 	"os"
 	"slices"
-	"strings"
 
 	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/opencontainers/go-digest"
 	"github.com/psviderski/uncloud/pkg/api"
@@ -124,6 +124,10 @@ func resourcesFromCompose(service types.ServiceConfig) api.ContainerResources {
 		MemoryReservation: int64(service.MemReservation),
 	}
 
+	// Convert GPU device requests from compose format, appending "gpu" capability.
+	resources.DeviceReservations = append(resources.DeviceReservations,
+		deviceReservationsFromCompose(service.Gpus, "gpu")...)
+
 	// Map resources from deploy section if specified.
 	if service.Deploy != nil {
 		if service.Deploy.Resources.Limits != nil {
@@ -139,12 +143,40 @@ func resourcesFromCompose(service types.ServiceConfig) api.ContainerResources {
 			if service.Deploy.Resources.Reservations.MemoryBytes > 0 {
 				resources.MemoryReservation = int64(service.Deploy.Resources.Reservations.MemoryBytes)
 			}
+			// Handle arbitrary device reservations (same structure as Gpus above).
+			resources.DeviceReservations = append(resources.DeviceReservations,
+				deviceReservationsFromCompose(service.Deploy.Resources.Reservations.Devices)...)
 		}
 	}
 
 	return resources
 }
 
+// Converts compose-go DeviceRequest format to Docker API DeviceRequest format.
+// Additional capabilities can be appended via extraCapabilities (e.g., "gpu" for service.Gpus).
+func deviceReservationsFromCompose(devices []types.DeviceRequest, extraCapabilities ...string) []container.DeviceRequest {
+	if devices == nil {
+		return nil
+	}
+
+	requests := make([]container.DeviceRequest, 0, len(devices))
+	for _, deviceRequest := range devices {
+		// Docker expects an OR'd list of AND'd capabilities (e.g. [][]string),
+		// but compose-go provides a single AND'd list (e.g. []string).
+		capabilities := [][]string{append(deviceRequest.Capabilities, extraCapabilities...)}
+
+		spec := container.DeviceRequest{
+			Driver:       deviceRequest.Driver,
+			Count:        int(deviceRequest.Count),
+			DeviceIDs:    deviceRequest.IDs,
+			Capabilities: capabilities,
+			Options:      deviceRequest.Options,
+		}
+		requests = append(requests, spec)
+	}
+	return requests
+}
+
 func volumeSpecsFromCompose(
 	volumes types.Volumes, serviceVolumes []types.ServiceVolumeConfig,
 ) ([]api.VolumeSpec, []api.VolumeMount, error) {
@@ -207,7 +239,7 @@ func dockerVolumeSpecFromCompose(serviceVolume types.ServiceVolumeConfig, volume
 		Name: serviceVolume.Source,
 		Type: api.VolumeTypeVolume,
 		VolumeOptions: &api.VolumeOptions{
-			Name: strings.TrimPrefix(volume.Name, FakeProjectName+"_"),
+			Name: volume.Name,
 		},
 	}
 
@@ -217,7 +249,7 @@ func dockerVolumeSpecFromCompose(serviceVolume types.ServiceVolumeConfig, volume
 	}
 
 	if !volume.External {
-		if volume.Driver != "" {
+		if volume.Driver != "" || len(volume.DriverOpts) > 0 {
 			spec.VolumeOptions.Driver = &mount.Driver{
 				Name:    volume.Driver,
 				Options: volume.DriverOpts,

pkg/client/compose/service_test.go

@@ -3,13 +3,14 @@ package compose
 import (
 	"context"
 	"net/netip"
+	"os"
 	"path/filepath"
 	"slices"
 	"strings"
 	"testing"
 
-	"github.com/compose-spec/compose-go/v2/loader"
+	composecli "github.com/compose-spec/compose-go/v2/cli"
-	"github.com/compose-spec/compose-go/v2/types"
+	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/go-units"
 	"github.com/google/go-cmp/cmp"
@@ -19,50 +20,6 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// loadProjectFromContent loads a compose project from YAML content
-func loadProjectFromContent(t *testing.T, content string) (*types.Project, error) {
-	t.Helper()
-	ctx := context.Background()
-
-	configDetails := types.ConfigDetails{
-		ConfigFiles: []types.ConfigFile{
-			{
-				Filename: "docker-compose.yml",
-				Content:  []byte(content),
-			},
-		},
-	}
-
-	project, err := loader.LoadWithContext(ctx, configDetails, func(o *loader.Options) {
-		o.SetProjectName("test", true)
-		// Register our custom extensions
-		if o.KnownExtensions == nil {
-			o.KnownExtensions = map[string]any{}
-		}
-		o.KnownExtensions[CaddyExtensionKey] = Caddy{}
-		o.KnownExtensions[PortsExtensionKey] = PortsSource{}
-		o.KnownExtensions[MachinesExtensionKey] = MachinesSource{}
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	// Apply extension transformations since we're not using LoadProject.
-	if project, err = transformServicesCaddyExtension(project); err != nil {
-		return nil, err
-	}
-	if project, err = transformServicesPortsExtension(project); err != nil {
-		return nil, err
-	}
-
-	// Validate extension combinations after all transformations.
-	if err = validateServicesExtensions(project); err != nil {
-		return nil, err
-	}
-
-	return project, nil
-}
-
 func TestServiceSpecFromCompose(t *testing.T) {
 	t.Parallel()
 
@@ -423,7 +380,15 @@ services:
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			project, err := loadProjectFromContent(t, tt.composeYAML)
+			// Get current working directory for relative path resolution to testdata directory.
+			wd, err := os.Getwd()
+			require.NoError(t, err)
+
+			project, err := LoadProjectFromContent(
+				context.Background(),
+				tt.composeYAML,
+				composecli.WithWorkingDirectory(wd),
+			)
 			require.NoError(t, err)
 
 			spec, err := ServiceSpecFromCompose(project, "web")
@@ -434,6 +399,301 @@ services:
 	}
 }
 
+func TestServiceSpecFromCompose_GPUs(t *testing.T) {
+	tests := []struct {
+		name               string
+		composeYAML        string
+		expectedDeviceReqs []container.DeviceRequest
+	}{
+		{
+			name: "gpus_all_shorthand",
+			composeYAML: `
+services:
+  ai:
+    image: nvidia/cuda
+    gpus: all
+`,
+			expectedDeviceReqs: []container.DeviceRequest{
+				{
+					Count:        -1,
+					Capabilities: [][]string{{"gpu"}},
+				},
+			},
+		},
+		{
+			name: "gpus_device_ids",
+			composeYAML: `
+services:
+  ai:
+    image: nvidia/cuda
+    gpus:
+      - device_ids: ['0', '1']
+        capabilities: [compute]
+`,
+			expectedDeviceReqs: []container.DeviceRequest{
+				{
+					DeviceIDs:    []string{"0", "1"},
+					Capabilities: [][]string{{"compute", "gpu"}},
+				},
+			},
+		},
+		{
+			name: "gpus_count",
+			composeYAML: `
+services:
+  ai:
+    image: nvidia/cuda
+    gpus:
+      - count: 2
+        capabilities: [utility]
+`,
+			expectedDeviceReqs: []container.DeviceRequest{
+				{
+					Count:        2,
+					Capabilities: [][]string{{"utility", "gpu"}},
+				},
+			},
+		},
+		{
+			name: "gpus_driver_and_options",
+			composeYAML: `
+services:
+  ai:
+    image: nvidia/cuda
+    gpus:
+      - driver: nvidia
+        count: 1
+        capabilities: [compute, utility]
+        options:
+          key1: value1
+          key2: value2
+`,
+			expectedDeviceReqs: []container.DeviceRequest{
+				{
+					Driver:       "nvidia",
+					Count:        1,
+					Capabilities: [][]string{{"compute", "utility", "gpu"}},
+					Options: map[string]string{
+						"key1": "value1",
+						"key2": "value2",
+					},
+				},
+			},
+		},
+		{
+			name: "deploy_resources_reservations_devices",
+			composeYAML: `
+services:
+  ai:
+    image: nvidia/cuda
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: 1
+              capabilities: [gpu]
+`,
+			expectedDeviceReqs: []container.DeviceRequest{
+				{
+					Driver:       "nvidia",
+					Count:        1,
+					Capabilities: [][]string{{"gpu"}},
+				},
+			},
+		},
+		{
+			name: "gpus_with_existing_gpu_capability",
+			composeYAML: `
+services:
+  ai:
+    image: nvidia/cuda
+    gpus:
+      - capabilities: [gpu, compute]
+`,
+			expectedDeviceReqs: []container.DeviceRequest{
+				{
+					// defaults to "all" when count not specified
+					Count: -1,
+					// gpu appended even if already present (matching Docker Compose behavior)
+					Capabilities: [][]string{{"gpu", "compute", "gpu"}},
+				},
+			},
+		},
+		{
+			name: "multiple_device_reservations",
+			composeYAML: `
+services:
+  ai:
+    image: nvidia/cuda
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - driver: nvidia
+              count: 2
+              capabilities: [gpu, compute]
+            - capabilities: [tpu]
+              count: 1
+`,
+			expectedDeviceReqs: []container.DeviceRequest{
+				{
+					Driver:       "nvidia",
+					Count:        2,
+					Capabilities: [][]string{{"gpu", "compute"}},
+				},
+				{
+					Count:        1,
+					Capabilities: [][]string{{"tpu"}},
+				},
+			},
+		},
+		{
+			name: "tpu_reservation",
+			composeYAML: `
+services:
+  ai:
+    image: tensorflow/tensorflow:latest
+    deploy:
+      resources:
+        reservations:
+          devices:
+            - capabilities: [tpu]
+              count: 4
+              driver: google
+`,
+			expectedDeviceReqs: []container.DeviceRequest{
+				{
+					Driver:       "google",
+					Count:        4,
+					Capabilities: [][]string{{"tpu"}},
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			project, err := LoadProjectFromContent(context.Background(), tt.composeYAML)
+			require.NoError(t, err)
+
+			spec, err := ServiceSpecFromCompose(project, "ai")
+			require.NoError(t, err)
+
+			assert.Equal(t, tt.expectedDeviceReqs, spec.Container.Resources.DeviceReservations,
+				"DeviceReservations should match expected")
+		})
+	}
+}
+
+func TestServiceSpecFromCompose_VolumeDriverOpts(t *testing.T) {
+	tests := []struct {
+		name           string
+		composeYAML    string
+		expectedVolume api.VolumeSpec
+	}{
+		{
+			name: "volume with driver_opts only (no driver specified)",
+			composeYAML: `
+services:
+  test:
+    image: nginx
+    volumes:
+      - nfsmount:/data/nfs
+volumes:
+  nfsmount:
+    driver_opts:
+      type: "nfs"
+      o: "addr=192.168.1.100,nolock,soft"
+      device: ":/mnt/share"
+`,
+			expectedVolume: api.VolumeSpec{
+				Name: "nfsmount",
+				Type: api.VolumeTypeVolume,
+				VolumeOptions: &api.VolumeOptions{
+					Name: "nfsmount",
+					Driver: &mount.Driver{
+						Options: map[string]string{
+							"type":   "nfs",
+							"o":      "addr=192.168.1.100,nolock,soft",
+							"device": ":/mnt/share",
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "volume with driver and driver_opts",
+			composeYAML: `
+services:
+  test:
+    image: nginx
+    volumes:
+      - nfsmount:/data/nfs
+volumes:
+  nfsmount:
+    driver: local
+    driver_opts:
+      type: "nfs"
+      o: "addr=192.168.1.100,nolock,soft"
+      device: ":/mnt/share"
+`,
+			expectedVolume: api.VolumeSpec{
+				Name: "nfsmount",
+				Type: api.VolumeTypeVolume,
+				VolumeOptions: &api.VolumeOptions{
+					Name: "nfsmount",
+					Driver: &mount.Driver{
+						Name: "local",
+						Options: map[string]string{
+							"type":   "nfs",
+							"o":      "addr=192.168.1.100,nolock,soft",
+							"device": ":/mnt/share",
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "external volume ignores driver_opts",
+			composeYAML: `
+services:
+  test:
+    image: nginx
+    volumes:
+      - extvolume:/data
+volumes:
+  extvolume:
+    external: true
+`,
+			expectedVolume: api.VolumeSpec{
+				Name: "extvolume",
+				Type: api.VolumeTypeVolume,
+				VolumeOptions: &api.VolumeOptions{
+					Name: "extvolume",
+				},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			project, err := LoadProjectFromContent(context.Background(), tt.composeYAML)
+			require.NoError(t, err)
+
+			spec, err := ServiceSpecFromCompose(project, "test")
+			require.NoError(t, err)
+
+			require.Len(t, spec.Volumes, 1, "expected exactly one volume")
+			actualVolume := spec.Volumes[0]
+
+			cmpOpts := cmp.Options{cmpopts.EquateEmpty()}
+			assert.True(t, cmp.Equal(actualVolume, tt.expectedVolume, cmpOpts...),
+				"Volume mismatch:\n%s", cmp.Diff(actualVolume, tt.expectedVolume, cmpOpts...))
+		})
+	}
+}
+
 func TestServiceSpecFromCompose_XMachinesPlacement(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -570,7 +830,7 @@ services:
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			project, err := loadProjectFromContent(t, tt.composeYAML)
+			project, err := LoadProjectFromContent(context.Background(), tt.composeYAML)
 
 			if tt.expectError {
 				assert.Error(t, err)

pkg/client/connector/sshcli.go

@@ -0,0 +1,154 @@
+package connector
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strconv"
+
+	"github.com/docker/cli/cli/connhelper/commandconn"
+	"github.com/psviderski/uncloud/internal/machine"
+	"golang.org/x/net/proxy"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// SSHCLIConnector establishes a connection to the machine API by executing SSH CLI
+// and running `uncloudd dial-stdio` on the remote machine.
+type SSHCLIConnector struct {
+	config SSHConnectorConfig
+	conn   net.Conn
+}
+
+func NewSSHCLIConnector(cfg *SSHConnectorConfig) *SSHCLIConnector {
+	return &SSHCLIConnector{config: *cfg}
+}
+
+// sshCLIDialer implements proxy.ContextDialer by spawning SSH processes with -W flag.
+type sshCLIDialer struct {
+	config SSHConnectorConfig
+}
+
+// buildDialArgs constructs SSH command arguments for -W flag dialing.
+func (d *sshCLIDialer) buildDialArgs(address string) []string {
+	args := []string{}
+
+	// Add connection timeout to fail fast when node is down.
+	args = append(args, "-o", "ConnectTimeout=5")
+
+	// Add port if non-standard.
+	if d.config.Port != 0 && d.config.Port != 22 {
+		args = append(args, "-p", strconv.Itoa(d.config.Port))
+	}
+
+	// Add identity file if specified.
+	if d.config.KeyPath != "" {
+		args = append(args, "-i", d.config.KeyPath)
+	}
+
+	// Add -W flag for stdin/stdout forwarding to target address.
+	args = append(args, "-W", address)
+
+	// Add user@host.
+	args = append(args, d.config.User+"@"+d.config.Host)
+
+	return args
+}
+
+// DialContext establishes a connection to the target address through an SSH tunnel using -W flag.
+func (d *sshCLIDialer) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	// Only support TCP connections.
+	if network != "tcp" {
+		return nil, fmt.Errorf("unsupported network type: %s", network)
+	}
+
+	// Build SSH command arguments.
+	args := d.buildDialArgs(address)
+
+	// Create connection using commandconn.
+	conn, err := commandconn.New(ctx, "ssh", args...)
+	if err != nil {
+		return nil, fmt.Errorf("SSH connection to %s@%s for dialing %s: %w", d.config.User, d.config.Host, address, err)
+	}
+
+	return conn, nil
+}
+
+func (c *SSHCLIConnector) Connect(ctx context.Context) (*grpc.ClientConn, error) {
+	// Build SSH command arguments.
+	args := c.buildSSHArgs()
+
+	// Create connection using commandconn.
+	conn, err := commandconn.New(ctx, "ssh", args...)
+	if err != nil {
+		return nil, fmt.Errorf("SSH connection to %s@%s: %w", c.config.User, c.config.Host, err)
+	}
+	c.conn = conn
+
+	// Create gRPC client over the connection.
+	// Use a custom dialer that returns our existing connection.
+	grpcConn, err := grpc.NewClient(
+		"passthrough:///", // Dummy target since we're using a custom dialer.
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) {
+			return c.conn, nil
+		}),
+	)
+	if err != nil {
+		c.conn.Close()
+		return nil, fmt.Errorf("create machine API client: %w", err)
+	}
+
+	return grpcConn, nil
+}
+
+// buildSSHArgs constructs the SSH command arguments.
+func (c *SSHCLIConnector) buildSSHArgs() []string {
+	args := []string{}
+
+	// Add connection timeout to fail fast when node is down.
+	args = append(args, "-o", "ConnectTimeout=5")
+
+	// Add port if non-standard.
+	if c.config.Port != 0 && c.config.Port != 22 {
+		args = append(args, "-p", strconv.Itoa(c.config.Port))
+	}
+
+	// Add identity file if specified (backward compatibility with SSHKeyFile).
+	if c.config.KeyPath != "" {
+		args = append(args, "-i", c.config.KeyPath)
+	}
+
+	// Add user@host.
+	args = append(args, c.config.User+"@"+c.config.Host)
+
+	// Add remote command: uncloudd dial-stdio
+	args = append(args, "uncloudd", "dial-stdio")
+
+	// Add socket path if non-default.
+	if c.config.SockPath != "" && c.config.SockPath != machine.DefaultUncloudSockPath {
+		args = append(args, "--socket", c.config.SockPath)
+	}
+
+	return args
+}
+
+// Dialer returns a proxy dialer for establishing connections within the cluster through SSH tunnels.
+func (c *SSHCLIConnector) Dialer() (proxy.ContextDialer, error) {
+	if c.config == (SSHConnectorConfig{}) {
+		return nil, fmt.Errorf("SSH connector not configured")
+	}
+
+	return &sshCLIDialer{
+		config: c.config,
+	}, nil
+}
+
+func (c *SSHCLIConnector) Close() error {
+	if c.conn != nil {
+		err := c.conn.Close()
+		c.conn = nil
+		return err
+	}
+	return nil
+}

pkg/client/connector/sshcli_test.go

@@ -0,0 +1,166 @@
+package connector
+
+import (
+	"testing"
+
+	"github.com/psviderski/uncloud/internal/machine"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSSHCLIConnector_buildSSHArgs(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		config   SSHConnectorConfig
+		expected []string
+	}{
+		{
+			name: "basic connection",
+			config: SSHConnectorConfig{
+				User: "root",
+				Host: "example.com",
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "root@example.com", "uncloudd", "dial-stdio"},
+		},
+		{
+			name: "with custom port",
+			config: SSHConnectorConfig{
+				User: "root",
+				Host: "example.com",
+				Port: 2222,
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "-p", "2222", "root@example.com", "uncloudd", "dial-stdio"},
+		},
+		{
+			name: "with identity file",
+			config: SSHConnectorConfig{
+				User:    "root",
+				Host:    "example.com",
+				KeyPath: "/path/to/key",
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "-i", "/path/to/key", "root@example.com", "uncloudd", "dial-stdio"},
+		},
+		{
+			name: "with custom socket path",
+			config: SSHConnectorConfig{
+				User:     "root",
+				Host:     "example.com",
+				SockPath: "/custom/path/uncloud.sock",
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "root@example.com", "uncloudd", "dial-stdio", "--socket", "/custom/path/uncloud.sock"},
+		},
+		{
+			name: "with default socket path (not included)",
+			config: SSHConnectorConfig{
+				User:     "root",
+				Host:     "example.com",
+				SockPath: machine.DefaultUncloudSockPath,
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "root@example.com", "uncloudd", "dial-stdio"},
+		},
+		{
+			name: "all options combined",
+			config: SSHConnectorConfig{
+				User:     "root",
+				Host:     "example.com",
+				Port:     2222,
+				KeyPath:  "/path/to/key",
+				SockPath: "/custom/path/uncloud.sock",
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "-p", "2222", "-i", "/path/to/key", "root@example.com", "uncloudd", "dial-stdio", "--socket", "/custom/path/uncloud.sock"},
+		},
+		{
+			name: "port 22 not included (default)",
+			config: SSHConnectorConfig{
+				User: "root",
+				Host: "example.com",
+				Port: 0,
+			},
+			expected: []string{"-o", "ConnectTimeout=5", "root@example.com", "uncloudd", "dial-stdio"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			c := &SSHCLIConnector{config: tt.config}
+			got := c.buildSSHArgs()
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}
+
+func TestSSHCLIDialer_buildDialArgs(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		config   SSHConnectorConfig
+		address  string
+		expected []string
+	}{
+		{
+			name: "basic connection",
+			config: SSHConnectorConfig{
+				User: "root",
+				Host: "example.com",
+			},
+			address:  "10.210.1.1:5000",
+			expected: []string{"-o", "ConnectTimeout=5", "-W", "10.210.1.1:5000", "root@example.com"},
+		},
+		{
+			name: "custom port",
+			config: SSHConnectorConfig{
+				User: "root",
+				Host: "example.com",
+				Port: 2222,
+			},
+			address:  "10.210.1.1:5000",
+			expected: []string{"-o", "ConnectTimeout=5", "-p", "2222", "-W", "10.210.1.1:5000", "root@example.com"},
+		},
+		{
+			name: "with identity file",
+			config: SSHConnectorConfig{
+				User:    "root",
+				Host:    "example.com",
+				Port:    22,
+				KeyPath: "/home/user/.ssh/id_rsa",
+			},
+			address:  "10.210.1.1:5000",
+			expected: []string{"-o", "ConnectTimeout=5", "-i", "/home/user/.ssh/id_rsa", "-W", "10.210.1.1:5000", "root@example.com"},
+		},
+		{
+			name: "custom port with identity file",
+			config: SSHConnectorConfig{
+				User:    "root",
+				Host:    "example.com",
+				Port:    2222,
+				KeyPath: "/home/user/.ssh/id_rsa",
+			},
+			address:  "10.210.1.1:5000",
+			expected: []string{"-o", "ConnectTimeout=5", "-p", "2222", "-i", "/home/user/.ssh/id_rsa", "-W", "10.210.1.1:5000", "root@example.com"},
+		},
+		{
+			name: "zero port defaults to 22",
+			config: SSHConnectorConfig{
+				User: "root",
+				Host: "example.com",
+				Port: 0,
+			},
+			address:  "10.210.1.1:5000",
+			expected: []string{"-o", "ConnectTimeout=5", "-W", "10.210.1.1:5000", "root@example.com"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			d := &sshCLIDialer{config: tt.config}
+			got := d.buildDialArgs(tt.address)
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}

pkg/client/connector/unix.go

@@ -0,0 +1,41 @@
+package connector
+
+import (
+	"context"
+	"fmt"
+
+	"golang.org/x/net/proxy"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// UnixConnector establishes a connection to the machine API through a unix domain socket.
+type UnixConnector struct {
+	socketPath string
+}
+
+func NewUnixConnector(socketPath string) *UnixConnector {
+	return &UnixConnector{socketPath: socketPath}
+}
+
+func (c *UnixConnector) Connect(_ context.Context) (*grpc.ClientConn, error) {
+	// gRPC uses "unix:path" syntax for unix sockets.
+	target := "unix:" + c.socketPath
+
+	conn, err := grpc.NewClient(
+		target,
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("create machine API client: %w", err)
+	}
+	return conn, nil
+}
+
+func (c *UnixConnector) Dialer() (proxy.ContextDialer, error) {
+	return nil, fmt.Errorf("proxy connections are not supported over a unix connection")
+}
+
+func (c *UnixConnector) Close() error {
+	return nil
+}

pkg/client/container.go

@@ -199,6 +199,7 @@ func toPullProgressEvent(jm jsonmessage.JSONMessage) *progress.Event {
 }
 
 // InspectContainer returns the information about the specified container within the service.
+// containerNameOrID can be name, full ID, or ID prefix of the container.
 func (cli *Client) InspectContainer(
 	ctx context.Context, serviceNameOrID, containerNameOrID string,
 ) (api.MachineServiceContainer, error) {
@@ -207,10 +208,23 @@ func (cli *Client) InspectContainer(
 		return api.MachineServiceContainer{}, fmt.Errorf("inspect service: %w", err)
 	}
 
+	prefixMatchCandidates := []api.MachineServiceContainer{}
 	for _, c := range svc.Containers {
-		if c.Container.ID == containerNameOrID || c.Container.Name == containerNameOrID {
+		if c.Container.ID == containerNameOrID ||
+			c.Container.Name == containerNameOrID {
 			return c, nil
 		}
+
+		if strings.HasPrefix(c.Container.ID, containerNameOrID) {
+			prefixMatchCandidates = append(prefixMatchCandidates, c)
+		}
+	}
+
+	if len(prefixMatchCandidates) == 1 {
+		return prefixMatchCandidates[0], nil
+	} else if len(prefixMatchCandidates) > 1 {
+		return api.MachineServiceContainer{}, fmt.Errorf(
+			"multiple containers found with ID prefix '%s'", containerNameOrID)
 	}
 
 	return api.MachineServiceContainer{}, api.ErrNotFound
@@ -294,3 +308,49 @@ func (cli *Client) RemoveContainer(
 
 	return nil
 }
+
+// ExecContainer executes a command in a container within the service.
+// If containerNameOrID is empty, the first container in the service will be used.
+func (cli *Client) ExecContainer(
+	ctx context.Context, serviceNameOrID, containerNameOrID string, execOpts api.ExecOptions,
+) (int, error) {
+	var ctr api.MachineServiceContainer
+
+	if containerNameOrID == "" {
+		// Find the first (random) container in the service
+		service, err := cli.InspectService(ctx, serviceNameOrID)
+		if err != nil {
+			return -1, fmt.Errorf("inspect service: %w", err)
+		}
+		if len(service.Containers) == 0 {
+			return -1, fmt.Errorf("no containers found in service %s", serviceNameOrID)
+		}
+		ctr = service.Containers[0]
+	} else {
+		// Find the specific container
+		var err error
+		ctr, err = cli.InspectContainer(ctx, serviceNameOrID, containerNameOrID)
+		if err != nil {
+			return -1, fmt.Errorf("inspect container: %w", err)
+		}
+	}
+
+	machine, err := cli.InspectMachine(ctx, ctr.MachineID)
+	if err != nil {
+		return -1, fmt.Errorf("inspect machine '%s': %w", ctr.MachineID, err)
+	}
+
+	// Proxy Docker gRPC requests to the machine hosting the container
+	ctx = proxyToMachine(ctx, machine.Machine)
+
+	// Execute the command in the container
+	exitCode, err := cli.Docker.ExecContainer(ctx, machinedocker.ExecConfig{
+		ContainerID: ctr.Container.ID,
+		Options:     execOpts,
+	})
+	if err != nil {
+		return exitCode, fmt.Errorf("exec in container %s: %w", ctr.Container.Name, err)
+	}
+
+	return exitCode, nil
+}

pkg/client/deploy/container.go

@@ -83,11 +83,17 @@ func EvalContainerSpecChange(current api.ServiceSpec, new api.ServiceSpec) Conta
 		}
 	}
 
+	// Device reservations are immutable, so we'll need to recreate if any have changed
+	if !reflect.DeepEqual(current.Container.Resources.DeviceReservations, newResources.DeviceReservations) {
+		return ContainerNeedsRecreate
+	}
+
 	// Check if any mutable properties changed.
 	if !current.Caddy.Equals(new.Caddy) {
 		return ContainerNeedsRecreate
 	}
 
+	// Remaining resources are mutable.
 	if !reflect.DeepEqual(current.Container.Resources, newResources) {
 		return ContainerNeedsUpdate
 	}

pkg/client/deploy/container_test.go

@@ -3,6 +3,7 @@ package deploy
 import (
 	"testing"
 
+	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/stretchr/testify/assert"
@@ -1350,6 +1351,398 @@ func TestEvalContainerSpecChange_Volumes(t *testing.T) {
 	}
 }
 
+func TestEvalContainerSpecChange_DeviceReservations(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		current api.ContainerResources
+		new     api.ContainerResources
+		want    ContainerSpecStatus
+	}{
+		{
+			name:    "empty",
+			current: api.ContainerResources{},
+			new:     api.ContainerResources{},
+			want:    ContainerUpToDate,
+		},
+		{
+			name:    "both nil",
+			current: api.ContainerResources{DeviceReservations: nil},
+			new:     api.ContainerResources{DeviceReservations: nil},
+			want:    ContainerUpToDate,
+		},
+		{
+			name:    "both empty",
+			current: api.ContainerResources{DeviceReservations: []container.DeviceRequest{}},
+			new:     api.ContainerResources{DeviceReservations: []container.DeviceRequest{}},
+			want:    ContainerUpToDate,
+		},
+		{
+			name:    "set GPU request",
+			current: api.ContainerResources{},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        -1, // all
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			want: ContainerNeedsRecreate,
+		},
+		{
+			name: "unset GPU request",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        -1,
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			new:  api.ContainerResources{},
+			want: ContainerNeedsRecreate,
+		},
+		{
+			name: "identical GPU request",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Driver:       "nvidia",
+						Count:        2,
+						Capabilities: [][]string{{"gpu", "compute"}},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Driver:       "nvidia",
+						Count:        2,
+						Capabilities: [][]string{{"gpu", "compute"}},
+					},
+				},
+			},
+			want: ContainerUpToDate,
+		},
+		{
+			name: "change GPU count",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        2,
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			want: ContainerNeedsRecreate,
+		},
+		{
+			name: "change GPU driver",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Driver:       "nvidia",
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Driver:       "amd",
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			want: ContainerNeedsRecreate,
+		},
+		{
+			name: "change device IDs",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						DeviceIDs:    []string{"0"},
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						DeviceIDs:    []string{"0", "1"},
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			want: ContainerNeedsRecreate,
+		},
+		{
+			name: "change capabilities",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu", "compute"}},
+					},
+				},
+			},
+			want: ContainerNeedsRecreate,
+		},
+		{
+			name: "set options",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+						Options: map[string]string{
+							"key": "value",
+						},
+					},
+				},
+			},
+			want: ContainerNeedsRecreate,
+		},
+		{
+			name: "change options",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+						Options: map[string]string{
+							"key": "value1",
+						},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+						Options: map[string]string{
+							"key": "value2",
+						},
+					},
+				},
+			},
+			want: ContainerNeedsRecreate,
+		},
+		{
+			name: "unset options",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+						Options: map[string]string{
+							"key": "value",
+						},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			want: ContainerNeedsRecreate,
+		},
+		{
+			name: "add device request",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+					},
+					{
+						Count:        1,
+						Capabilities: [][]string{{"tpu"}},
+					},
+				},
+			},
+			want: ContainerNeedsRecreate,
+		},
+		{
+			name: "remove device request",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+					},
+					{
+						Count:        1,
+						Capabilities: [][]string{{"tpu"}},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			want: ContainerNeedsRecreate,
+		},
+		{
+			name: "multiple identical device requests",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Driver:       "nvidia",
+						Count:        2,
+						Capabilities: [][]string{{"gpu", "compute"}},
+					},
+					{
+						Count:        1,
+						Capabilities: [][]string{{"tpu"}},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Driver:       "nvidia",
+						Count:        2,
+						Capabilities: [][]string{{"gpu", "compute"}},
+					},
+					{
+						Count:        1,
+						Capabilities: [][]string{{"tpu"}},
+					},
+				},
+			},
+			want: ContainerUpToDate,
+		},
+		{
+			name: "reordered device requests",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Driver:       "nvidia",
+						Count:        2,
+						Capabilities: [][]string{{"gpu"}},
+					},
+					{
+						Count:        1,
+						Capabilities: [][]string{{"tpu"}},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Count:        1,
+						Capabilities: [][]string{{"tpu"}},
+					},
+					{
+						Driver:       "nvidia",
+						Count:        2,
+						Capabilities: [][]string{{"gpu"}},
+					},
+				},
+			},
+			want: ContainerNeedsRecreate,
+		},
+		{
+			name: "complex GPU configuration identical",
+			current: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Driver:       "nvidia",
+						Count:        2,
+						DeviceIDs:    []string{"0", "1"},
+						Capabilities: [][]string{{"gpu", "compute", "utility"}},
+						Options: map[string]string{
+							"runtime": "nvidia",
+							"compute": "exclusive",
+						},
+					},
+				},
+			},
+			new: api.ContainerResources{
+				DeviceReservations: []container.DeviceRequest{
+					{
+						Driver:       "nvidia",
+						Count:        2,
+						DeviceIDs:    []string{"0", "1"},
+						Capabilities: [][]string{{"gpu", "compute", "utility"}},
+						Options: map[string]string{
+							"runtime": "nvidia",
+							"compute": "exclusive",
+						},
+					},
+				},
+			},
+			want: ContainerUpToDate,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			currentSpec := api.ServiceSpec{
+				Container: api.ContainerSpec{
+					Image:     "nvidia/cuda:latest",
+					Resources: tt.current,
+				},
+			}
+			newSpec := api.ServiceSpec{
+				Container: api.ContainerSpec{
+					Image:     "nvidia/cuda:latest",
+					Resources: tt.new,
+				},
+			}
+
+			result := EvalContainerSpecChange(currentSpec, newSpec)
+			assert.Equal(t, tt.want, result)
+		})
+	}
+}
+
 func TestEvalContainerSpecChange_Mixed(t *testing.T) {
 	t.Parallel()
 
@@ -1399,6 +1792,32 @@ func TestEvalContainerSpecChange_Mixed(t *testing.T) {
 			},
 			want: ContainerNeedsRecreate,
 		},
+		{
+			name: "mutable memory change with immutable device reservation change",
+			current: api.ServiceSpec{
+				Container: api.ContainerSpec{
+					Image: "nvidia/cuda:latest",
+					Resources: api.ContainerResources{
+						Memory: 100 * 1024 * 1024,
+					},
+				},
+			},
+			new: api.ServiceSpec{
+				Container: api.ContainerSpec{
+					Image: "nvidia/cuda:latest",
+					Resources: api.ContainerResources{
+						Memory: 200 * 1024 * 1024,
+						DeviceReservations: []container.DeviceRequest{
+							{
+								Count:        1,
+								Capabilities: [][]string{{"gpu"}},
+							},
+						},
+					},
+				},
+			},
+			want: ContainerNeedsRecreate,
+		},
 	}
 
 	for _, tt := range tests {

pkg/client/deploy/deploy.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 
 	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client/deploy/scheduler"
 )
 
 type Client interface {
@@ -25,6 +26,8 @@ type Deployment struct {
 	Strategy Strategy
 	cli      Client
 	plan     *Plan
+	// state is an optional current and planned cluster state used for scheduling decisions.
+	state *scheduler.ClusterState
 }
 
 type Plan struct {
@@ -47,6 +50,16 @@ func NewDeployment(cli Client, spec api.ServiceSpec, strategy Strategy) *Deploym
 	}
 }
 
+// NewDeploymentWithClusterState creates a new deployment like NewDeployment but also with a provided current cluster
+// state used for scheduling decisions.
+func NewDeploymentWithClusterState(
+	cli Client, spec api.ServiceSpec, strategy Strategy, state *scheduler.ClusterState,
+) *Deployment {
+	d := NewDeployment(cli, spec, strategy)
+	d.state = state
+	return d
+}
+
 // Plan returns a plan of operations to reconcile the service to the desired state.
 // If a plan has already been created, the same plan will be returned.
 func (d *Deployment) Plan(ctx context.Context) (Plan, error) {
@@ -73,7 +86,14 @@ func (d *Deployment) Plan(ctx context.Context) (Plan, error) {
 		return Plan{}, fmt.Errorf("resolve service spec: %w", err)
 	}
 
-	plan, err := d.Strategy.Plan(ctx, d.cli, d.Service, resolvedSpec)
+	if d.state == nil {
+		d.state, err = scheduler.InspectClusterState(ctx, d.cli)
+		if err != nil {
+			return Plan{}, fmt.Errorf("inspect cluster state: %w", err)
+		}
+	}
+
+	plan, err := d.Strategy.Plan(d.state, d.Service, resolvedSpec)
 	if err != nil {
 		return Plan{}, fmt.Errorf("create plan using %s strategy: %w", d.Strategy.Type(), err)
 	}

pkg/client/deploy/operation.go

@@ -29,6 +29,8 @@ type NameResolver interface {
 	ContainerName(containerID string) string
 }
 
+// TODO: pass api.ServiceContainer to operations to simplify operation formatting in the plan.
+
 // RunContainerOperation creates and starts a new container on a specific machine.
 type RunContainerOperation struct {
 	ServiceID string
@@ -56,8 +58,8 @@ func (o *RunContainerOperation) Format(resolver NameResolver) string {
 }
 
 func (o *RunContainerOperation) String() string {
-	return fmt.Sprintf("RunContainerOperation[service_id=%s, image=%s, machine_id=%s]",
+	return fmt.Sprintf("RunContainerOperation[machine_id=%s service_id=%s image=%s]",
-		o.ServiceID, o.Spec.Container.Image, o.MachineID)
+		o.MachineID, o.ServiceID, o.Spec.Container.Image)
 }
 
 // StopContainerOperation stops a container on a specific machine.
@@ -76,26 +78,26 @@ func (o *StopContainerOperation) Execute(ctx context.Context, cli Client) error
 
 func (o *StopContainerOperation) Format(resolver NameResolver) string {
 	machineName := resolver.MachineName(o.MachineID)
-	return fmt.Sprintf("%s: Stop container [name=%s]", machineName, resolver.ContainerName(o.ContainerID))
+	return fmt.Sprintf("%s: Stop container [id=%s name=%s]", machineName,
+		o.ContainerID[:12], resolver.ContainerName(o.ContainerID))
 }
 
 func (o *StopContainerOperation) String() string {
-	return fmt.Sprintf("StopContainerOperation[service_id=%s, container_id=%s, machine_id=%s]",
+	return fmt.Sprintf("StopContainerOperation[machine_id=%s service_id=%s container_id=%s]",
-		o.ServiceID, o.ContainerID, o.MachineID)
+		o.MachineID, o.ServiceID, o.ContainerID)
 }
 
 // RemoveContainerOperation stops and removes a container from a specific machine.
 type RemoveContainerOperation struct {
-	ServiceID   string
-	ContainerID string
 	MachineID string
+	Container api.ServiceContainer
 }
 
 func (o *RemoveContainerOperation) Execute(ctx context.Context, cli Client) error {
-	if err := cli.StopContainer(ctx, o.ServiceID, o.ContainerID, container.StopOptions{}); err != nil {
+	if err := cli.StopContainer(ctx, o.Container.ServiceID(), o.Container.ID, container.StopOptions{}); err != nil {
 		return fmt.Errorf("stop container: %w", err)
 	}
-	if err := cli.RemoveContainer(ctx, o.ServiceID, o.ContainerID, container.RemoveOptions{
+	if err := cli.RemoveContainer(ctx, o.Container.ServiceID(), o.Container.ID, container.RemoveOptions{
 		// Remove anonymous volumes created by the container.
 		RemoveVolumes: true,
 	}); err != nil {
@@ -107,12 +109,13 @@ func (o *RemoveContainerOperation) Execute(ctx context.Context, cli Client) erro
 
 func (o *RemoveContainerOperation) Format(resolver NameResolver) string {
 	machineName := resolver.MachineName(o.MachineID)
-	return fmt.Sprintf("%s: Remove container [name=%s]", machineName, resolver.ContainerName(o.ContainerID))
+	return fmt.Sprintf("%s: Remove container [id=%s image=%s]",
+		machineName, o.Container.ShortID(), o.Container.Config.Image)
 }
 
 func (o *RemoveContainerOperation) String() string {
-	return fmt.Sprintf("RemoveContainerOperation[service_id=%s, container_id=%s, machine_id=%s]",
+	return fmt.Sprintf("RemoveContainerOperation[machine_id=%s service_id=%s container_id=%s]",
-		o.ServiceID, o.ContainerID, o.MachineID)
+		o.MachineID, o.Container.ServiceID(), o.Container.ID)
 }
 
 // CreateVolumeOperation creates a volume on a specific machine.
@@ -151,8 +154,8 @@ func (o *CreateVolumeOperation) Format(_ NameResolver) string {
 }
 
 func (o *CreateVolumeOperation) String() string {
-	return fmt.Sprintf("CreateVolumeOperation[volume=%s, machine_id=%s]",
+	return fmt.Sprintf("CreateVolumeOperation[machine_id=%s volume=%s]",
-		o.VolumeSpec.DockerVolumeName(), o.MachineID)
+		o.MachineID, o.VolumeSpec.DockerVolumeName())
 }
 
 // SequenceOperation is a composite operation that executes a sequence of operations in order.

pkg/client/deploy/scheduler/volume.go

@@ -17,7 +17,7 @@ import (
 //   - If a volume already exists on a machine, it must be used instead of creating a new one.
 //   - A missing volume must only be created on one machine.
 type VolumeScheduler struct {
-	// state is the current state of machines and their resources in the cluster.
+	// state is the current and planned state of machines and their resources in the cluster.
 	state *ClusterState
 	// serviceSpecs is a list of service specifications included in the deployment.
 	serviceSpecs []api.ServiceSpec
@@ -83,7 +83,10 @@ func NewVolumeScheduler(state *ClusterState, specs []api.ServiceSpec) (*VolumeSc
 			if spec, ok := volumeSpecs[vol.Name]; ok {
 				if !spec.MatchesDockerVolume(vol) {
 					return nil, fmt.Errorf("volume '%s' specification does not match the existing volume "+
-						"on machine '%s'", vol.Name, machine.Info.Name)
+						"on machine '%s'. Use a different volume name or adjust the volume options to match "+
+						"the existing volume. You can also remove the existing volume from the machine(s) with "+
+						"'uc volume rm' (WARNING: the data will be lost) and run the deployment again to create "+
+						"a new volume with the correct specification", vol.Name, machine.Info.Name)
 				}
 
 				if _, setInitialised := existingVolumeMachines[vol.Name]; !setInitialised {
@@ -106,6 +109,7 @@ func NewVolumeScheduler(state *ClusterState, specs []api.ServiceSpec) (*VolumeSc
 // Schedule determines what missing volumes should be created and where for services in the multi-service deployment.
 // It returns a map of machine IDs to a list of api.VolumeSpec that should be created on that machine,
 // or an error if services can't be scheduled due to scheduling constraints.
+// It also updates the state of the machines in the cluster state to reflect the scheduled volumes.
 func (s *VolumeScheduler) Schedule() (map[string][]api.VolumeSpec, error) {
 	if len(s.serviceSpecs) == 0 {
 		// No services with volume mounts, nothing to schedule.

pkg/client/deploy/strategy.go

@@ -1,7 +1,6 @@
 package deploy
 
 import (
-	"context"
 	"fmt"
 	"math/rand/v2"
 	"slices"
@@ -18,31 +17,31 @@ type Strategy interface {
 	// Type returns the type of the deployment strategy, e.g. "rolling", "blue-green".
 	Type() string
 	// Plan returns the operation to reconcile the service to the desired state.
-	// If the service does not exist (new deployment), svc will be nil.
+	// If the service does not exist (new deployment), svc will be nil. state provides the current and planned state
-	Plan(ctx context.Context, cli scheduler.Client, svc *api.Service, spec api.ServiceSpec) (Plan, error)
+	// of the cluster for scheduling decisions.
+	Plan(state *scheduler.ClusterState, svc *api.Service, spec api.ServiceSpec) (Plan, error)
 }
 
 // RollingStrategy implements a rolling update deployment pattern where containers are updated one at a time
 // to minimize service disruption.
 type RollingStrategy struct {
-	State         *scheduler.ClusterState
+	// ForceRecreate indicates whether all containers should be recreated during the deployment,
+	// regardless of whether their specifications have changed.
 	ForceRecreate bool
+
+	// state is the current and planned state of the cluster used for scheduling decisions.
+	state *scheduler.ClusterState
 }
 
 func (s *RollingStrategy) Type() string {
 	return "rolling"
 }
 
-func (s *RollingStrategy) Plan(
+func (s *RollingStrategy) Plan(state *scheduler.ClusterState, svc *api.Service, spec api.ServiceSpec) (Plan, error) {
-	ctx context.Context, cli scheduler.Client, svc *api.Service, spec api.ServiceSpec,
+	if state == nil {
-) (Plan, error) {
+		return Plan{}, fmt.Errorf("cluster state must be provided")
-	if s.State == nil {
-		state, err := scheduler.InspectClusterState(ctx, cli)
-		if err != nil {
-			return Plan{}, fmt.Errorf("inspect cluster state: %w", err)
-		}
-		s.State = state
 	}
+	s.state = state
 
 	// We can assume that the spec is valid at this point because it has been validated by the deployment.
 	switch spec.Mode {
@@ -65,7 +64,7 @@ func (s *RollingStrategy) planReplicated(svc *api.Service, spec api.ServiceSpec)
 		return plan, err
 	}
 
-	sched := scheduler.NewServiceScheduler(s.State, spec)
+	sched := scheduler.NewServiceScheduler(s.state, spec)
 	// TODO: return a detailed report on required constraints and which ones are satisfied?
 	availableMachines, err := sched.EligibleMachines()
 	if err != nil {
@@ -182,9 +181,8 @@ func (s *RollingStrategy) planReplicated(svc *api.Service, spec api.ServiceSpec)
 
 		// Remove the old container.
 		plan.Operations = append(plan.Operations, &RemoveContainerOperation{
-			ServiceID:   plan.ServiceID,
-			ContainerID: ctr.ID,
 			MachineID: m.Id,
+			Container: ctr,
 		})
 	}
 
@@ -192,9 +190,8 @@ func (s *RollingStrategy) planReplicated(svc *api.Service, spec api.ServiceSpec)
 	for mid, containers := range containersOnMachine {
 		for _, c := range containers {
 			plan.Operations = append(plan.Operations, &RemoveContainerOperation{
-				ServiceID:   plan.ServiceID,
-				ContainerID: c.ID,
 				MachineID: mid,
+				Container: c,
 			})
 		}
 	}
@@ -223,7 +220,7 @@ func (s *RollingStrategy) planGlobal(svc *api.Service, spec api.ServiceSpec) (Pl
 		}
 	}
 
-	sched := scheduler.NewServiceScheduler(s.State, spec)
+	sched := scheduler.NewServiceScheduler(s.state, spec)
 	availableMachines, err := sched.EligibleMachines()
 	if err != nil {
 		return plan, err
@@ -244,9 +241,8 @@ func (s *RollingStrategy) planGlobal(svc *api.Service, spec api.ServiceSpec) (Pl
 	for _, containers := range containersOnMachine {
 		for _, c := range containers {
 			plan.Operations = append(plan.Operations, &RemoveContainerOperation{
-				ServiceID:   plan.ServiceID,
-				ContainerID: c.Container.ID,
 				MachineID: c.MachineID,
+				Container: c.Container,
 			})
 		}
 	}
@@ -295,9 +291,8 @@ func reconcileGlobalContainer(
 					continue
 				}
 				ops = append(ops, &RemoveContainerOperation{
-					ServiceID:   serviceID,
-					ContainerID: old.Container.ID,
 					MachineID: old.MachineID,
+					Container: old.Container,
 				})
 			}
 			break
@@ -338,9 +333,8 @@ func reconcileGlobalContainer(
 	// Remove the old containers.
 	for _, c := range containers {
 		ops = append(ops, &RemoveContainerOperation{
-			ServiceID:   serviceID,
-			ContainerID: c.Container.ID,
 			MachineID: c.MachineID,
+			Container: c.Container,
 		})
 	}