docs: draft post wireguard overlay

2026-08-26 11:03:34 +00:00 · 2025-07-08 21:08:29 +10:00
382 changed files with 23421 additions and 50484 deletions
@@ -1,36 +0,0 @@
---
-name: Bug Report
-about: Create a report to help us improve
-title: "[BUG] "
-labels: bug
-assignees: ""
---
-
-**Describe the bug**
-
-<!-- A clear and concise description of what the bug is. -->
-
-**How to reproduce**
-
-<!-- Steps to reproduce the behavior:
-
-1. Run ...
-2. Do ...
-->
-
-**Expected behavior**
-
-<!-- A clear and concise description of what you expected to happen. -->
-
-**Environment:**
-
- Uncloud versions:
-  - Control (client) node (`uc --version`):
-  - Uncloud daemon (from the server) (`uncloudd --version`):
- OS version (`uname -a`):
-  - Client (control node):
-  - Server:
-
-**Additional context**
-
-<!-- Add any other context about the problem here. -->
@@ -1 +0,0 @@
-../AI.md
@@ -28,7 +28,7 @@ jobs:
      - name: Set up Go
        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
-          go-version: "1.25.1"
+          go-version: "1.23.2"

      - name: Install dependencies
        run: |
@@ -36,17 +36,9 @@ jobs:
          git diff --exit-code ||
            (echo "go.mod or go.sum has changed. Please run 'go mod tidy' and commit the changes." && exit 1)

-      - name: Generate docs
-        run: |
-          make cli-docs
-          git diff --exit-code ||
-            (echo "Documentation is out of date. Please run 'make cli-docs' and commit the changes." && exit 1)
-
      - name: Run tests
-        run: |
-          make ucind-image
-          make test
-    timeout-minutes: 15
+        run: make test
+    timeout-minutes: 10

  check-protobuf:
    runs-on: ${{ matrix.os }}
@@ -63,7 +55,7 @@ jobs:
      - name: Install Mise
        uses: jdx/mise-action@13abe502c30c1559a5c37dff303831bab82c9402 # v2.2.3
        with:
-          version: "2025.9.6"
+          version: "2025.6.5"
        env:
          GITHUB_TOKEN: ${{ github.token }}

@@ -1,39 +0,0 @@
-name: Lint
-on:
-  push:
-    branches:
-      - "main"
-      - "test/**"
-      - "release/**"
-  pull_request:
-    branches:
-      - main
-    paths:
-      - "**.go"
-      - "go.*"
-permissions:
-  contents: read
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Set up Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
-        with:
-          go-version: "1.25.1"
-
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
-        with:
-          version: v2.4.0
-
-      - name: Format code
-        run: |
-          make format
-          git diff --exit-code ||
-            (echo "Code is not formatted. Please run 'make format' and commit the changes." && exit 1)
-
-    timeout-minutes: 10
@@ -7,8 +7,6 @@
 *.dll
 *.so
 *.dylib
-/uncloud
-/uncloudd

 # OS X
 .DS_Store
@@ -39,6 +37,3 @@ node_modules/

 # VS Code
 .vscode
-.devcontainer/
-
-.zed/
@@ -1,42 +0,0 @@
-version: "2"
-
-run:
-  concurrency: 4
-  tests: true
-  timeout: 5m
-
-linters:
-  default: none
-  enable:
-    - bodyclose
-    # - dogsled
-    - dupl
-    # - errcheck
-    - gochecknoinits
-    - goconst
-    # - gocritic
-    # - gocyclo
-    # - godot
-    # - gosec
-    # - govet
-    - ineffassign
-    - misspell
-    - nakedret
-    # - prealloc
-    # - revive
-    # - staticcheck
-    - unconvert
-    # - unparam
-    # - unused
-    - whitespace
-  exclusions:
-    rules:
-      - path: ^test/e2e
-        linters:
-          - goconst  # constants here add no value, so we skip goconst only for test/e2e.
-
-formatters:
-  enable:
-    - gofumpt
-    - goimports
-
@@ -16,8 +16,7 @@ builds:
    main: ./cmd/uncloud
    binary: uncloud
    env:
-      # Use CGO to be able to build fsevent required by compose on macOS.
-      - CGO_ENABLED={{ if eq .Os "darwin" }}1{{ else }}0{{ end }}
+      - CGO_ENABLED=0
    goos:
      - darwin
      - linux
@@ -1,97 +1,31 @@
-[[tools."aqua:vektra/mockery"]]
-version = "3.5.3"
-backend = "aqua:vektra/mockery"
-
-[tools."aqua:vektra/mockery".platforms.linux-x64]
-checksum = "sha256:ebce416b0175338525246c376885a1579ca6cd4d4015140ba0c70e6b5339a39c"
-size = 5498859
-url = "https://github.com/vektra/mockery/releases/download/v3.5.3/mockery_3.5.3_Linux_x86_64.tar.gz"
-
-[tools."aqua:vektra/mockery".platforms.macos-arm64]
-checksum = "sha256:a3a94b14c7414e148f2252199ffc4a0108d311358f3d336cbe05bb73cb203704"
-size = 5238877
-url = "https://github.com/vektra/mockery/releases/download/v3.5.3/mockery_3.5.3_Darwin_arm64.tar.gz"
-
-[[tools.go]]
-version = "1.25.1"
+[tools.go]
+version = "1.23.10"
 backend = "core:go"

-[tools.go.platforms.linux-x64]
-checksum = "sha256:7716a0d940a0f6ae8e1f3b3f4f36299dc53e31b16840dbd171254312c41ca12e"
-size = 59660846
-url = "https://dl.google.com/go/go1.25.1.linux-amd64.tar.gz"
+[tools.go.checksums]
+"go1.23.10.darwin-arm64.tar.gz" = "sha256:25c64bfa8a8fd8e7f62fb54afa4354af8409a4bb2358c2699a1003b733e6fce5"
+"go1.23.10.linux-amd64.tar.gz" = "sha256:535f9f81802499f2a7dbfa70abb8fda3793725fcc29460f719815f6e10b5fd60"

-[tools.go.platforms.macos-arm64]
-checksum = "sha256:68deebb214f39d542e518ebb0598a406ab1b5a22bba8ec9ade9f55fb4dd94a6c"
-size = 57906702
-url = "https://dl.google.com/go/go1.25.1.darwin-arm64.tar.gz"
-
-[[tools.golangci-lint]]
-version = "2.4.0"
-backend = "aqua:golangci/golangci-lint"
-
-[tools.golangci-lint.platforms.linux-x64]
-checksum = "sha256:fae792524c04424c0ac369f5b8076f04b45cf29fc945a370e55d369a8dc11840"
-size = 14126779
-url = "https://github.com/golangci/golangci-lint/releases/download/v2.4.0/golangci-lint-2.4.0-linux-amd64.tar.gz"
-
-[tools.golangci-lint.platforms.macos-arm64]
-checksum = "sha256:cd4dd53fa09b6646baff5fd22b8c64d91db02c21c7496df27992d75d34feec59"
-size = 13542526
-url = "https://github.com/golangci/golangci-lint/releases/download/v2.4.0/golangci-lint-2.4.0-darwin-arm64.tar.gz"
-
-[[tools.node]]
-version = "22.20.0"
-backend = "core:node"
-
-[tools.node.platforms.linux-x64]
-checksum = "sha256:eeaccb0378b79406f2208e8b37a62479c70595e20be6b659125eb77dd1ab2a29"
-size = 56645685
-url = "https://nodejs.org/dist/v22.20.0/node-v22.20.0-linux-x64.tar.gz"
-
-[tools.node.platforms.macos-arm64]
-checksum = "sha256:cc04a76a09f79290194c0646f48fec40354d88969bec467789a5d55dd097f949"
-size = 49838299
-url = "https://nodejs.org/dist/v22.20.0/node-v22.20.0-darwin-arm64.tar.gz"
-
-[[tools.protoc]]
+[tools.protoc]
 version = "27.3"
 backend = "aqua:protocolbuffers/protobuf/protoc"

-[tools.protoc.platforms.linux-x64]
-checksum = "blake3:8c2938accf7061164ea3968529a47ced1db4824ca553857f6903c68ae4347739"
-size = 3235873
-url = "https://github.com/protocolbuffers/protobuf/releases/download/v27.3/protoc-27.3-linux-x86_64.zip"
+[tools.protoc.checksums]
+"protoc-27.3-linux-x86_64.zip" = "sha256:6dab2adab83f915126cab53540d48957c40e9e9023969c3e84d44bfb936c7741"
+"protoc-27.3-osx-aarch_64.zip" = "sha256:b22116bd97cdbd7ea25346abe635a9df268515fe5ef5afa93cd9a68fc2513f84"

-[tools.protoc.platforms.macos-arm64]
-checksum = "blake3:650c2494c003e9fddd6f4164a0a36e31da51ae7e1e5208da8cb560a4fe886fcd"
-size = 2372763
-url = "https://github.com/protocolbuffers/protobuf/releases/download/v27.3/protoc-27.3-osx-aarch_64.zip"
-
-[[tools.protoc-gen-go]]
+[tools.protoc-gen-go]
 version = "1.34.2"
 backend = "aqua:protocolbuffers/protobuf-go/protoc-gen-go"

-[tools.protoc-gen-go.platforms.linux-x64]
-checksum = "blake3:f765e393e0f0b25070c13848d88f5e6303e66090132afa1b753e981507a4174e"
-size = 1848331
-url = "https://github.com/protocolbuffers/protobuf-go/releases/download/v1.34.2/protoc-gen-go.v1.34.2.linux.amd64.tar.gz"
+[tools.protoc-gen-go.checksums]
+"protoc-gen-go.v1.34.2.darwin.arm64.tar.gz" = "sha256:17aca7f948dbb624049030cf841e35895cf34183ba006e721247fdeb95ff2780"
+"protoc-gen-go.v1.34.2.linux.amd64.tar.gz" = "sha256:b87bc134dee55576a842141bf0ed27761c635d746780fce5dee038c6dd16554f"

-[tools.protoc-gen-go.platforms.macos-arm64]
-checksum = "blake3:c237256a7f718ac4ccdc037ee30025a0b7c3f79300d7831ec59d76d782443fd5"
-size = 1784028
-url = "https://github.com/protocolbuffers/protobuf-go/releases/download/v1.34.2/protoc-gen-go.v1.34.2.darwin.arm64.tar.gz"
-
-[[tools.protoc-gen-go-grpc]]
+[tools.protoc-gen-go-grpc]
 version = "1.5.1"
 backend = "aqua:grpc/grpc-go/protoc-gen-go-grpc"

-[tools.protoc-gen-go-grpc.platforms.linux-x64]
-checksum = "blake3:197739132f0408f017d0c83773ac1ace85c0572473fdd658ec6e4ccbf20e0552"
-size = 4859466
-url = "https://github.com/grpc/grpc-go/releases/download/cmd/protoc-gen-go-grpc/v1.5.1/protoc-gen-go-grpc.v1.5.1.linux.amd64.tar.gz"
-
-[tools.protoc-gen-go-grpc.platforms.macos-arm64]
-checksum = "blake3:3c668207565d23ea2cf006d699207e3a804ebb929a534bd38a3b4ff4e941e00c"
-size = 4565944
-url = "https://github.com/grpc/grpc-go/releases/download/cmd/protoc-gen-go-grpc/v1.5.1/protoc-gen-go-grpc.v1.5.1.darwin.arm64.tar.gz"
+[tools.protoc-gen-go-grpc.checksums]
+"protoc-gen-go-grpc.v1.5.1.darwin.arm64.tar.gz" = "sha256:d6083feb51dcfe59f26793e99ef01ef5eac68b64294ec2546711f614ac5878f3"
+"protoc-gen-go-grpc.v1.5.1.linux.amd64.tar.gz" = "sha256:a6cac4ea731e54aea304ad44d704a69d1cdc82997084b33637e21a89dc9229d6"
@@ -2,10 +2,7 @@
 experimental = true

 [tools]
-"aqua:vektra/mockery" = "3.5.3"
-go = "1.25.1"
-golangci-lint = "2.4.0"
-node = "22.20.0"
+go = "1.23"
 protoc = "27.3"
 protoc-gen-go = "1.34.2"
 protoc-gen-go-grpc = "1.5.1"
@@ -1,4 +0,0 @@
-packages:
-  github.com/psviderski/uncloud/internal/machine/caddyconfig:
-    interfaces:
-      CaddyfileValidator:
@@ -1,265 +0,0 @@
-# AGENTS.md - Uncloud Project Guide
-
-This document provides comprehensive information about the Uncloud project for AI assistants to understand the codebase,
-architecture, and development practices.
-
-## Project Overview
-
-**Uncloud** is a lightweight clustering and container orchestration tool that enables deployment and management of web
-applications across cloud VMs and bare metal servers. It creates a secure WireGuard mesh network between Docker hosts
-and provides automatic service discovery, load balancing, HTTPS ingress, and simple CLI commands for application
-management.
-
-### Key Characteristics
-
- **Language**: Go
- **Architecture**: Decentralized, no control plane
- **Target**: Self-hosted infrastructure without Kubernetes complexity
- **License**: View LICENSE file for details
- **Status**: Active development, not yet ready for production
-
-## Core Features
-
-### 🏗️ Infrastructure
-
- **Multi-machine deployment**: Combine cloud VMs, dedicated servers, and bare metal
- **Zero-config networking**: Automatic WireGuard mesh with NAT traversal
- **Decentralized design**: No central control plane, all machines are equal
- **Service discovery**: Built-in DNS server resolves service names to container IPs
-
-### 🚀 Application Management
-
- **Docker Compose compatibility**: Uses familiar Docker Compose format
- **Zero-downtime deployments**: Rolling updates without service interruption
- **Automatic HTTPS**: Caddy reverse proxy with Let's Encrypt integration
- **Managed DNS**: Free `*.xxxxxx.uncld.dev` subdomains via Uncloud DNS service
- **Cross-machine scaling**: Run containers across multiple machines
-
-### 🔧 Developer Experience
-
- **Docker-like CLI**: Familiar commands (`uc` binary)
- **Imperative operations**: Direct commands vs. declarative state reconciliation
- **Remote management**: Control entire infrastructure via SSH to any machine
- **Minimal overhead**: ~150MB RAM footprint per machine
-
-## Architecture
-
-### Core Components
-
-1. **CLI (`uc`)** - Main user interface for cluster management
-2. **Daemon (`uncloudd`)** - Machine daemon running on each node
-3. **Corrosion** - Distributed SQLite database for cluster state (Fly.io project)
-4. **Caddy** - Reverse proxy for HTTPS termination and routing
-5. **WireGuard** - Secure mesh networking between machines
-
-### Network Architecture
-
- Each machine gets unique subnet (e.g., `10.210.0.0/24`, `10.210.1.0/24`)
- Containers get cluster-unique IPs for direct communication
- Automatic peer discovery and key management
- NAT traversal for machines behind firewalls
-
-### State Management
-
- **CRDT-based distributed storage** using Corrosion
- **Eventually consistent** state across all machines
- **Gossip protocol** (Serf) for state propagation
- **No quorum requirements** - partial network splits remain functional
-
-## Project Structure
-
-### Key Directories
-
- **`cmd/`**: Contains main applications
-
-    - `uncloud/`: CLI tool with subcommands for machine, service, volume management
-    - `uncloudd/`: Daemon that runs on each machine
-    - `ucind/`: Development cluster management for testing
-
- **`internal/`**: Internal implementation packages
-
-    - `cli/`: Command-line interface logic
-    - `machine/`: Machine lifecycle and state management
-    - `daemon/`: Daemon implementation and gRPC services
-    - `dns/`: Internal DNS server for service discovery
-
- **`pkg/`**: Public API packages for external use
-
-    - `api/`: Core API types and definitions
-    - `client/`: Client libraries for interacting with Uncloud
-
- **`experiment/`**: Experimental features and prototypes
- **`scripts/`**: Installation and utility scripts
- **`test/`**: Test suites and test infrastructure
- **`website/`**: Documentation website (Docusaurus)
-
-    - `landing/`: Landing page
-    - `docs/`: User documentation
-
- **`misc/`**: Design documents and guides
-
-## Key Technologies
-
-### Core Dependencies
-
-```go
-// Networking and orchestration
-github.com/docker/docker // Docker API client
-github.com/docker/compose/v2 // Docker Compose integration
-golang.zx2c4.com/wireguard // WireGuard implementation
-github.com/hashicorp/serf // Gossip protocol
-
-// State management
-github.com/ipfs/go-ds-crdt // CRDT distributed storage
-github.com/dgraph-io/badger/v3 // Embedded database
-
-// Web proxy
-github.com/caddyserver/caddy/v2 // HTTP server and reverse proxy
-
-// CLI and UX
-github.com/spf13/cobra // CLI framework
-github.com/charmbracelet/huh // Interactive forms
-
-// gRPC and networking
-google.golang.org/grpc                     // gRPC framework
-github.com/siderolabs/grpc-proxy // gRPC proxy for forwarding
-```
-
-## Development Workflow
-
-### Build and Development
-
-```bash
-# Build binaries
-go build -o uncloud ./cmd/uncloud
-go build -o uncloudd ./cmd/uncloudd
-```
-
-### Key Make Targets
-
- `proto`: Generate protobuf code
- `ucind-cluster`: Create development cluster
- `update-dev`: Deploy to development machines
- `demo-reset`: Reset demo environment
- `fmt`: Format code
- `test`: Run all tests
- `lint`: Lint the code using golangci-lint
- `lint-and-fix`: Lint the code and fix issues whenever possible
-
-## CLI Commands Structure
-
-The `uc` CLI provides these main command groups:
-
-### Machine Management
-
-```bash
-uc machine init <user@host>     # Initialize new cluster
-uc machine add <user@host>      # Add machine to cluster
-uc machine ls                   # List machines
-uc machine rm <name>            # Remove machine
-```
-
-### Service Management
-
-```bash
-uc run <image>                  # Run container from image
-uc deploy                       # Deploy from compose.yaml
-uc scale <service> <count>      # Scale service replicas
-uc ls                           # List services
-uc rm <service>                 # Remove service
-```
-
-### Context and Connectivity
-
-```bash
-uc context ls                   # List available contexts
-uc context use <name>           # Switch context
-```
-
-### Global Flags
-
- `--connect`: Connect to remote machine directly, without a config file
- `--uncloud-config`: Override config file path
-
-## Development Guidelines
-
-### Code Organization
-
- **Package naming**: Use clear, descriptive names
- **Error handling**: Wrap errors with context using `fmt.Errorf`
- **Logging**: Use structured logging with levels
- **gRPC**: Services defined in `internal/machine/api/pb/`
-
-### Testing
-
- Test files and locations
-    - Unit tests alongside source files (`*_test.go`)
-    - Integration tests in `test/e2e/`
-    - Test fixtures in `test/fixtures/`
- Use table driven tests whenever possible
-
-### Dependencies
-
- Prefer standard library when possible
- Pin versions in `go.mod`
- Document rationale for external dependencies
-
-### Configuration
-
- Support environment variables for key settings
- Validate configuration early
- Provide sensible defaults
-
-## Troubleshooting and Debugging
-
-### Common Issues
-
- **Networking**: Check WireGuard status, iptables rules
- **DNS**: Verify service discovery resolution
- **Containers**: Use standard Docker debugging tools
- **State sync**: Check Corrosion logs for replication issues
-
-### Debugging Tools
-
- Standard Linux networking tools (`ping`, `traceroute`, `wireshark`)
- Docker commands (`docker ps`, `docker logs`)
- SSH access to machines for direct inspection
- gRPC debugging tools
-
-### Logs and Monitoring
-
- Systemd services (getting logs via `journalctl -u SERVICE_NAME`)
-    - `uncloud` -- Uncloud daemon
-    - `uncloud-corrosion` -- Corrosion process
- Machine daemon logs
- Container logs via Docker
-
-## File Patterns and Conventions
-
-### Important Files to Understand
-
- `cmd/uncloud/main.go`: CLI entry point and command structure
- `internal/cli/cli.go`: CLI implementation and configuration
- `internal/machine/machine.go`: Core machine management
- `pkg/api/`: Public API definitions
- `misc/design.md`: Architecture and design philosophy
- `README.md`: Repository README
-
-### Configuration Files
-
- `go.mod/go.sum`: Go dependency management
- `Makefile`: Build and development tasks
- `Dockerfile`: Container build instructions forUncloud-in-Docker (used for testing)
-
-This document should help AI assistants understand the project structure, make informed suggestions, and contribute
-effectively to the Uncloud codebase.
-
-## Documentation
-
-Instructions when generating documentation:
-
- Use conversational language – write as if you were speaking to a friend.
- Keep sentences simple, optimize for clarity and understanding.
- Do not use em dashes (—) or semicolons (;) in sentences. Instead, break complex sentences into simpler ones.
- Place the subject before the action whenever possible. Example: prefer "The function loads data" over "Data is loaded
-  by the function."
@@ -1 +0,0 @@
-./AGENTS.md
@@ -1,6 +1,6 @@
 ARG ALPINE_VERSION=3.20.3

-FROM golang:1.25.1-alpine AS uncloudd
+FROM golang:1.23.2-alpine AS uncloudd

 ARG TARGETOS
 ARG TARGETARCH
@@ -13,7 +13,7 @@ COPY go.mod go.sum ./
 RUN go mod download && go mod verify

 COPY . .
-RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd ./cmd/uncloudd
+RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd cmd/uncloudd/main.go


 FROM alpine:${ALPINE_VERSION} AS corrosion-download
@@ -1,5 +1,6 @@
 CORROSION_IMAGE ?= ghcr.io/psviderski/corrosion:latest
 UCIND_IMAGE ?= ghcr.io/psviderski/ucind:latest
+DOCS_IMAGE ?= ghcr.io/psviderski/uncloud-docs:latest

 update-dev:
 	GOOS=linux GOARCH=amd64 go build -o uncloudd-linux-amd64 ./cmd/uncloudd && \
@@ -38,18 +39,13 @@ demo-reset:

 .PHONY: ucind-cluster
 ucind-cluster:
-	go run ./cmd/ucind cluster rm && go run ./cmd/ucind cluster create -m $(if $(MACHINES_COUNT),$(MACHINES_COUNT),3)
+	go run ./cmd/ucind cluster rm && go run ./cmd/ucind cluster create -m 3

 .PHONY: proto
 proto:
 	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative \
 		--proto_path=. --proto_path=internal/machine/api/vendor internal/machine/api/pb/*.proto

-.PHONY: proto-mise
-proto-mise:
-	mise exec -- protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative \
-		--proto_path=. --proto_path=internal/machine/api/vendor internal/machine/api/pb/*.proto
-
 .PHONY: corrosion-image
 corrosion-image:
 	docker build -t "$(CORROSION_IMAGE)" --target corrosion .
@@ -66,22 +62,14 @@ ucind-image:
 ucind-multiarch-image-push:
 	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(UCIND_IMAGE)" --target ucind .

-.PHONY: mocks
-mocks:
-	@mockery
-
 .PHONY: test
 test:
 ifeq ($(TEST_NAME),)
-	go test -shuffle=on -count=1 -v ./...
+	go test -count=1 -v ./...
 else
-	go test -shuffle=on -race -count=1 -v -run ^$(TEST_NAME)$$ ./...
+	go test -count=1 -v -run ^$(TEST_NAME)$$ ./...
 endif

-.PHONY: test-e2e
-test-e2e:
-	go test -shuffle=on -race -count=1 -v ./test/e2e
-
 .PHONY: test-clean
 test-clean:
 	@CONTAINERS=$$(docker ps --filter "name=ucind-test" -q); \
@@ -101,20 +89,6 @@ test-clean:
 vet:
 	go vet ./...

-.PHONY: format fmt
-format fmt:
-	GOOS=linux golangci-lint fmt
-
-LINT_TARGETS := lint lint-and-fix
-.PHONY: $(LINT_TARGETS) _lint
-$(LINT_TARGETS): _lint
-lint: ARGS=
-lint-and-fix: ARGS=--fix
-_lint:
-# Explicitly set OS to Linux to not skip *_linux.go files when running on macOS.
-# Uncloud daemon won't likely support OS other than Linux anytime soon, so for now we can rely on that.
-	GOOS=linux golangci-lint run $(ARGS)
-
-.PHONY: cli-docs
-cli-docs:
-	go run ./cmd/uncloud docs
+.PHONY: docs-image-push
+docs-image:
+	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(DOCS_IMAGE)" ./docs
@@ -1,10 +1,10 @@
 <div align="center">
-  <img src="./website/landing/images/logo-title.svg#gh-light-mode-only" alt="Uncloud logo"/>
-  <img src="./website/landing/images/logo-title-dark.svg#gh-dark-mode-only" alt="Uncloud logo"/>
-  <p><strong>▸ Deploy and scale containerised apps across servers without Swarm or Kubernetes overhead ◂</strong></p>
+  <img src="./website/images/logo.svg" height="100" width="100" alt="Uncloud logo"/>
+  <h1>Uncloud</h1>
+  <p><strong>Docker simplicity. Multi-machine power.</strong></p>

  <p>
-    <a href="https://uncloud.run/docs"><img src="https://img.shields.io/badge/Docs-blue.svg?style=for-the-badge&logo=gitbook&logoColor=white" alt="Documentation"></a>
+    <a href="https://docs.uncloud.run"><img src="https://img.shields.io/badge/Docs-blue.svg?style=for-the-badge&logo=gitbook&logoColor=white" alt="Documentation"></a>
    <a href="https://discord.gg/eR35KQJhPu"><img src="https://img.shields.io/badge/discord-5865F2.svg?style=for-the-badge&logo=discord&logoColor=white" alt="Join Discord"></a>
    <a href="https://x.com/psviderski"><img src="https://img.shields.io/badge/follow-black?style=for-the-badge&logo=X&logoColor=while" alt="Follow on X"></a>
    <a href="https://github.com/sponsors/psviderski"><img src="https://img.shields.io/badge/Donate-EA4AAA.svg?style=for-the-badge&logo=githubsponsors&logoColor=white" alt="Donate"></a>
@@ -25,14 +25,12 @@ complexity of Kubernetes.

 ## ✨ Features

-* **Deploy anywhere**: Combine cloud VMs, dedicated servers, and bare metal into a unified computing environment,
+* **Deploy anywhere**: Combine cloud VMs, dedicated servers, and bare metal into a unified computing environment —
  regardless of location or provider.
 * **Docker Compose**: Familiar [Docker Compose](https://compose-spec.io/) format for defining services and volumes. No
  need to learn a new bespoke DSL.
 * **Zero-downtime deployments**: Rolling updates without service interruption. Automatic rollback on failure is coming
  soon.
-* **[Unregistry](https://github.com/psviderski/unregistry) integration**: Build and push your Docker images directly to
-  your machines without an external registry. It will transfer only the missing layers, making it fast and efficient.
 * **Service discovery**: Built-in DNS server resolves service names to container IPs.
 * **Persistent storage**: Run stateful services with Docker volumes managed across machines.
 * **Zero-config private network**: Automatic WireGuard mesh with peer discovery and NAT traversal. Containers get unique
@@ -40,20 +38,25 @@ complexity of Kubernetes.
 * **No control plane**: Fully decentralised design eliminates single points of failure and reduces operational overhead.
 * **Imperative over declarative**: Favoring imperative operations over state reconciliation simplifies both the mental
  model and troubleshooting.
-* **Managed DNS**: Automatic DNS records `*.xxxxxx.uncld.dev` for services with public access via managed
+* **Managed DNS**: Automatic DNS records `*.<id>.cluster.uncloud.run` for services with public access via managed
  [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service.
 * **Automatic HTTPS**: Built-in Caddy reverse proxy handles TLS certificate provisioning and renewal using Let's
  Encrypt.
 * **Docker-like CLI**: Familiar commands for managing both infrastructure and applications.
 * **Remote management**: Control your entire infrastructure through SSH access to any single machine in the cluster.

+### 🚀 Coming soon
+
+* **[Unregistry](https://github.com/psviderski/unregistry) integration**: Push your Docker images directly to your
+  machines without an external registry. It will transfer only the missing layers, making it fast and efficient.
+
 ## 🎬 Quick demo

-The screenshot below demonstrates how I use Uncloud to deploy https://uncloud.run website to 2 remote machines from
-the [`compose.yaml`](website/compose.yaml) file on my local machine.
+The screenshot below demonstrates how I use Uncloud to deploy the [Uncloud Documentation](https://docs.uncloud.run)
+website to 2 remote machines (why not?) from the [`compose.yaml`](docs/compose.yaml) file on my local machine.

-It exposes the container port `8000/tcp` as HTTPS on the domain `uncloud.run`, served by the Caddy reverse proxy on the
-remote machines. All managed by Uncloud.
+It exposes the container port `8000/tcp` as HTTPS on the domain `docs.uncloud.run`, served by the Caddy reverse proxy on
+the remote machines. All managed by Uncloud.

 ![Uncloud compose deployment demo](.github/images/compose-deploy.jpg)

@@ -61,15 +64,9 @@ Here is a more advanced use case. Deploy a highly available web app with automat
 on-premises in just a couple minutes.

 <a href="https://uncloud.wistia.com/medias/k47uwt9uau?wvideo=k47uwt9uau">
-<img src="https://embed-ssl.wistia.com/deliveries/4fb71ea442905b81b1ad4e25fc02132e.jpg?image_crop_resized=900x526&image_play_button_rounded=true&image_play_button_size=2x&image_play_button_color=18181Be0" alt="Uncloud demo" width="450" height="263" />
+<img src="https://embed-ssl.wistia.com/deliveries/3cf7014a48b93afc556444bed3e39a8c.jpg?image_crop_resized=900x526&image_play_button_rounded=true&image_play_button_size=2x&image_play_button_color=18181Be0" alt="Uncloud demo" width="450" height="263" />
 </a>

-<br>
-<br>
-
-> **📚 Want more examples?** Check out the [**uncloud-recipes**](https://github.com/psviderski/uncloud-recipes)
-> repository for community recipes and templates for deploying popular services on Uncloud.
-
 ## 💫 Why Uncloud?

 Modern cloud platforms like Heroku and Render offer amazing developer experiences but at a premium price. Traditional
@@ -99,8 +96,8 @@ platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bar
   # or using curl (macOS/Linux)
   curl -fsS https://get.uncloud.run/install.sh | sh
   ```
-
-   See [Installation](https://uncloud.run/docs/getting-started/install-cli) for more options.
+   
+   See [Installation](https://docs.uncloud.run/getting-started/install-cli) for more options.

 2. Initialise your first machine:

@@ -133,15 +130,15 @@ platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bar
   uncloud-uninstall
   ```

-View the [Documentation](https://uncloud.run/docs) for more information.
+View the [Documentation](https://docs.uncloud.run) for more information.

 ## ⚙️ How it works

-Check out the [design document](misc/design.md) to understand Uncloud's design philosophy and goals.
+Check out the [design document](docs/design.md) to understand Uncloud's design philosophy and goals.

 Here is a diagram of an Uncloud multi-provider cluster of 3 machines:

-![Diagram: multi-provider cluster of 3 machines](website/landing/images/diagram.webp)
+![Diagram: multi-provider cluster of 3 machines](website/images/diagram.webp)

 <details>
 <summary>Peek under the hood to see what happens when you run certain commands.</summary>
@@ -281,16 +278,6 @@ using the CLI or directly over SSH. They all have the complete cluster state and
 machine is a full backup of your control plane.
 </details>

-## 🧪 Interactive tutorials
-
-To give you a chance to play with Uncloud without even leaving your browser, we're providing interactive tutorials and playgrounds on the [iximiuz Labs](https://labs.iximiuz.com/) platform.
-
-Available tutorials:
-
-1. [Setting up a new Uncloud cluster](https://labs.iximiuz.com/tutorials/uncloud-create-cluster-ebebf72b) - the tutorial walks you through creating a new cluster with two machines and then deploying a simple web service to it.
-
-You can also launch the [Uncloud playground](https://labs.iximiuz.com/playgrounds/uncloud-cluster-64523f7c) where you can play with an already initialized Uncloud cluster.
-
 ## 🏗 Project status

 Uncloud is currently in active development and is **not ready for production use**. Features may change significantly
@@ -336,21 +323,8 @@ SQLite database used to share Uncloud's cluster state.
  features, and be the first to know when it's ready for production use.
 * Watch this repository for releases.

-## 💖 Sponsors
-
-These companies and projects are helping Uncloud with their generous sponsorship and/or services:
-
-<!-- Sentry -->
-<a href="https://sentry.io/welcome/">
-  <img height="100" alt="Sentry" src="https://github.com/user-attachments/assets/6c1439c0-d20d-40dc-a669-c9aa94651dfa" />
-</a>
-
 ## ❤️ Contributors

-<a href="https://trendshift.io/repositories/14069">
-    <img alt="Trendshift" src="https://trendshift.io/api/badge/repositories/14069" />
-</a>
-
 Thank you [@cedws](https://github.com/cedws) for being the first contributor to Uncloud! 🎉

 <a href="https://github.com/psviderski/uncloud/graphs/contributors">
@@ -2,9 +2,8 @@ package cluster

 import (
 	"fmt"
-
-	"github.com/psviderski/uncloud/internal/ucind"
 	"github.com/spf13/cobra"
+	"github.com/psviderski/uncloud/internal/ucind"
 )

 func NewCreateCommand() *cobra.Command {
@@ -2,9 +2,8 @@ package cluster

 import (
 	"fmt"
-
-	"github.com/psviderski/uncloud/internal/ucind"
 	"github.com/spf13/cobra"
+	"github.com/psviderski/uncloud/internal/ucind"
 )

 func NewRemoveCommand() *cobra.Command {
@@ -13,7 +13,7 @@ func NewRootCommand() *cobra.Command {
 	}
 	cmd.AddCommand(
 		NewCreateCommand(),
-		// NewListCommand(),
+		//NewListCommand(),
 		NewRemoveCommand(),
 	)
 	return cmd
@@ -10,102 +10,68 @@ import (
 	"github.com/spf13/cobra"
 )

-type buildOptions struct {
-	cli.BuildServicesOptions
-	files    []string
-	profiles []string
-}
-
-// NewBuildCommand creates a new command to build images for services from a Compose file.
+// NewBuildCommand creates a new command to build services from a Compose file.
 func NewBuildCommand() *cobra.Command {
-	opts := buildOptions{}
+	opts := cli.BuildOptions{}
 	cmd := &cobra.Command{
 		Use:   "build [FLAGS] [SERVICE...]",
 		Short: "Build services from a Compose file.",
-		Long: `Build images for services from a Compose file using local Docker.
-
-By default, built images remain on the local Docker host. Use --push to upload them
-to cluster machines or --push-registry to upload them to external registries.`,
-		Example: `  # Build all services that have a build section in compose.yaml.
-  uc build
-
-  # Build specific services that have a build section.
-  uc build web api
-
-  # Build services and push images to all cluster machines or service x-machines if specified.
-  uc build --push
-
-  # Build services and push images to specific machines.
-  uc build --push -m machine1,machine2
-
-  # Build services and push images to external registries (e.g., Docker Hub).
-  uc build --push-registry
-
-  # Build services with build arguments, pull newer base images before building, and don't use cache.
-  uc build --build-arg NODE_VERSION=24 --build-arg ENV=production --no-cache --pull`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			opts.Services = args
+
+			if len(args) > 0 {
+				opts.Services = args
+			}

 			return runBuild(cmd.Context(), uncli, opts)
 		},
-		GroupID: "service",
 	}

-	cmd.Flags().StringArrayVar(&opts.BuildArgs, "build-arg", nil,
-		"Set a build-time variable for services. Used in Dockerfiles that declare the variable with ARG.\n"+
-			"Can be specified multiple times. Format: --build-arg VAR=VALUE")
-	cmd.Flags().BoolVar(&opts.Check, "check", false,
-		"Check the build configuration for services without building them.")
-	cmd.Flags().BoolVar(&opts.Deps, "deps", false,
-		"Also build services declared as dependencies of the selected services.")
-	cmd.Flags().StringSliceVarP(&opts.files, "file", "f", nil,
-		"One or more Compose files to build. (default compose.yaml)")
-	cmd.Flags().StringSliceVarP(&opts.Machines, "machine", "m", nil,
-		"Machine names or IDs to push the built images to (requires --push).\n"+
-			"Can be specified multiple times or as a comma-separated list. (default is all machines or x-machines)")
-	cmd.Flags().BoolVar(&opts.NoCache, "no-cache", false,
-		"Do not use cache when building images.")
-	cmd.Flags().StringSliceVarP(&opts.profiles, "profile", "p", nil,
+	cmd.Flags().StringSliceVarP(&opts.Files, "file", "f", nil,
+		"One or more Compose files to build (default compose.yaml)")
+	cmd.Flags().StringSliceVarP(&opts.Profiles, "profile", "p", nil,
 		"One or more Compose profiles to enable.")
-	cmd.Flags().BoolVar(&opts.Pull, "pull", false,
-		"Always attempt to pull newer versions of base images before building.")
-	cmd.Flags().BoolVar(&opts.PushCluster, "push", false,
-		"Upload the built images to cluster machines after building.\n"+
-			"Use --machine to specify which machines. (default is all machines)")
-	cmd.Flags().BoolVar(&opts.PushRegistry, "push-registry", false,
-		"Upload the built images to external registries (e.g., Docker Hub) after building.")
+	cmd.Flags().BoolVarP(&opts.Push, "push", "P", false,
+		"Push built images to the registry after building. (default false)")
+	cmd.Flags().BoolVarP(&opts.NoCache, "no-cache", "n", false,
+		"Do not use cache when building images. (default false)")

 	return cmd
 }

-// runBuild parses the Compose file(s) and builds the images for selected services.
-func runBuild(ctx context.Context, uncli *cli.CLI, opts buildOptions) error {
-	// Validate push flags.
-	if opts.PushCluster && opts.PushRegistry {
-		return fmt.Errorf("cannot specify both --push and --push-registry: choose one push target")
+// TODO: deduplicate with a similar functino for deploy options
+// projectOpts returns the project options for the Compose file(s).
+func projectOptsFromBuildOpts(opts cli.BuildOptions) []composecli.ProjectOptionsFn {
+	projectOpts := []composecli.ProjectOptionsFn{}
+
+	if len(opts.Profiles) > 0 {
+		projectOpts = append(projectOpts, composecli.WithDefaultProfiles(opts.Profiles...))
 	}

-	machines := cli.ExpandCommaSeparatedValues(opts.Machines)
-	// Special handling for an explicit "all" keyword to push to all machines.
-	if len(machines) == 1 && machines[0] == "all" {
-		machines = nil
-	}
-	opts.Machines = machines
+	return projectOpts
+}

-	project, err := compose.LoadProject(ctx, opts.files, composecli.WithDefaultProfiles(opts.profiles...))
+// runBuild parses the Compose file(s), builds the services, and pushes them if requested.
+func runBuild(ctx context.Context, uncli *cli.CLI, opts cli.BuildOptions) error {
+	projectOpts := projectOptsFromBuildOpts(opts)
+	project, err := compose.LoadProject(ctx, opts.Files, projectOpts...)
 	if err != nil {
 		return fmt.Errorf("load compose file(s): %w", err)
 	}

-	servicesToBuild, err := cli.ServicesThatNeedBuild(project, opts.Services, opts.Deps)
-	if err != nil {
-		return fmt.Errorf("determine services to build: %w", err)
+	if len(opts.Services) > 0 {
+		project, err = project.WithSelectedServices(opts.Services)
+		if err != nil {
+			return fmt.Errorf("select services: %w", err)
+		}
 	}
+
+	servicesToBuild := cli.GetServicesThatNeedBuild(project)
+
 	if len(servicesToBuild) == 0 {
 		fmt.Println("No services to build.")
 		return nil
 	}

-	return uncli.BuildServices(ctx, project, opts.BuildServicesOptions)
+	return cli.BuildServices(ctx, servicesToBuild, opts)
 }
@@ -1,70 +0,0 @@
-package caddy
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	"github.com/alecthomas/chroma/v2/quick"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/spf13/cobra"
-)
-
-type configOptions struct {
-	machine string
-	noColor bool
-}
-
-func NewConfigCommand() *cobra.Command {
-	opts := configOptions{}
-
-	cmd := &cobra.Command{
-		Use:   "config",
-		Short: "Show the current Caddy configuration (Caddyfile).",
-		Long:  "Display the current Caddy configuration (Caddyfile) from the connected machine or a specified one.",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return runConfig(cmd.Context(), uncli, opts)
-		},
-	}
-
-	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
-		"Name or ID of the machine to get the configuration from. (default is connected machine)")
-	cmd.Flags().BoolVar(&opts.noColor, "no-color", false,
-		"Disable syntax highlighting for the output.")
-
-	return cmd
-}
-
-func runConfig(ctx context.Context, uncli *cli.CLI, opts configOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	if opts.machine != "" {
-		// If a specific machine is requested, use it to get the Caddy configuration.
-		ctx, _, err = clusterClient.ProxyMachinesContext(ctx, []string{opts.machine})
-		if err != nil {
-			return err
-		}
-	}
-
-	config, err := clusterClient.Caddy.GetConfig(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("get Caddy config: %w", err)
-	}
-
-	// Print the Caddyfile with syntax highlighting.
-	if opts.noColor {
-		fmt.Print(config.Caddyfile)
-	} else {
-		if err = quick.Highlight(os.Stdout, config.Caddyfile, "caddy", "terminal256", "monokai"); err != nil {
-			// If highlighting fails, fall back to plain output.
-			fmt.Print(config.Caddyfile)
-		}
-	}
-
-	return nil
-}
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"maps"
-	"os"
 	"slices"
 	"strings"

@@ -19,9 +18,9 @@ import (
 )

 type deployOptions struct {
-	caddyfile string
-	image     string
-	machines  []string
+	image    string
+	machines []string
+	context  string
 }

 func NewDeployCommand() *cobra.Command {
@@ -38,28 +37,21 @@ func NewDeployCommand() *cobra.Command {
 		},
 	}

-	cmd.Flags().StringVar(&opts.caddyfile, "caddyfile", "",
-		"Path to a custom global Caddy config (Caddyfile) that will be prepended to the auto-generated Caddy config.")
 	cmd.Flags().StringVar(&opts.image, "image", "",
 		"Caddy Docker image to deploy. (default caddy:LATEST_VERSION)")
 	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
-		"Machine names or IDs to deploy to. Can be specified multiple times or as a comma-separated "+
-			"list. (default is all machines)")
+		"Machine names to deploy to. Can be specified multiple times or as a comma-separated "+
+			"list of machine names. (default is all machines)")
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context to deploy to. (default is the current context)",
+	)

 	return cmd
 }

 func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
-	caddyfile := ""
-	if opts.caddyfile != "" {
-		data, err := os.ReadFile(opts.caddyfile)
-		if err != nil {
-			return fmt.Errorf("read Caddyfile: %w", err)
-		}
-		caddyfile = strings.TrimSpace(string(data))
-	}
-
-	clusterClient, err := uncli.ConnectCluster(ctx)
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -99,7 +91,7 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 	placement := api.Placement{
 		Machines: cli.ExpandCommaSeparatedValues(opts.machines),
 	}
-	d, err := clusterClient.NewCaddyDeployment(opts.image, caddyfile, placement)
+	d, err := clusterClient.NewCaddyDeployment(opts.image, placement)
 	if err != nil {
 		return fmt.Errorf("create caddy deployment: %w", err)
 	}
@@ -10,7 +10,6 @@ func NewRootCommand() *cobra.Command {
 		Short: "Manage Caddy reverse proxy service.",
 	}
 	cmd.AddCommand(
-		NewConfigCommand(),
 		NewDeployCommand(),
 	)
 	return cmd
@@ -1,79 +0,0 @@
-package context
-
-import (
-	"fmt"
-
-	"github.com/charmbracelet/huh"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/cli/config"
-	"github.com/spf13/cobra"
-)
-
-func NewConnectionCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:     "connection",
-		Aliases: []string{"conn"},
-		Short:   "Choose a new default connection for the current context.",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return selectConnection(uncli)
-		},
-	}
-	return cmd
-}
-
-func selectConnection(uncli *cli.CLI) error {
-	if uncli.Config == nil {
-		return fmt.Errorf("connection management is not available: Uncloud configuration file is not being used")
-	}
-	if len(uncli.Config.Contexts) == 0 {
-		return fmt.Errorf("no contexts found in Uncloud config (%s)", uncli.Config.Path())
-	}
-
-	currentCtxName := uncli.Config.CurrentContext
-	currentCtx, ok := uncli.Config.Contexts[currentCtxName]
-	if !ok {
-		return fmt.Errorf("current context '%s' not found", currentCtxName)
-	}
-
-	if len(currentCtx.Connections) == 0 {
-		return fmt.Errorf("no connections found in context '%s'", currentCtxName)
-	}
-
-	var selectedConnection int
-	form := huh.NewForm(
-		huh.NewGroup(
-			huh.NewSelect[int]().
-				Title("Select a default connection").
-				Options(buildConnectionOptions(currentCtx.Connections)...).
-				Value(&selectedConnection),
-		),
-	)
-	if err := form.Run(); err != nil {
-		return fmt.Errorf("select connection: %w", err)
-	}
-
-	currentCtx.SetDefaultConnection(selectedConnection)
-	selected := currentCtx.Connections[0]
-
-	if err := uncli.Config.Save(); err != nil {
-		return fmt.Errorf("save config: %w", err)
-	}
-
-	fmt.Printf("Default connection for context '%s' is now '%s'.\n", currentCtxName, selected.String())
-	return nil
-}
-
-func buildConnectionOptions(connections []config.MachineConnection) []huh.Option[int] {
-	options := make([]huh.Option[int], len(connections))
-	for i, conn := range connections {
-		key := conn.String()
-		opt := huh.NewOption(key, i)
-		if i == 0 {
-			opt.Key += " (default)"
-			opt = opt.Selected(true)
-		}
-		options[i] = opt
-	}
-	return options
-}
@@ -12,6 +12,8 @@ import (
 )

 func NewListCommand() *cobra.Command {
+	var clusterContext string
+
 	cmd := &cobra.Command{
 		Use:     "ls",
 		Aliases: []string{"list"},
@@ -22,6 +24,11 @@ func NewListCommand() *cobra.Command {
 		},
 	}

+	cmd.Flags().StringVarP(
+		&clusterContext, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+
 	return cmd
 }

@@ -44,7 +51,7 @@ func list(uncli *cli.CLI) error {
 	for _, name := range contextNames {
 		current := ""
 		if name == currentContext {
-			current = "✓"
+			current = "*"
 		}
 		connCount := len(uncli.Config.Contexts[name].Connections)
 		fmt.Fprintf(tw, "%s\t%s\t%d\n", name, current, connCount)
@@ -19,7 +19,6 @@ func NewRootCommand() *cobra.Command {
 	cmd.AddCommand(
 		NewListCommand(),
 		NewUseCommand(),
-		NewConnectionCommand(),
 	)

 	return cmd
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"strings"

-	"github.com/charmbracelet/lipgloss"
 	composecli "github.com/compose-spec/compose-go/v2/cli"
 	"github.com/docker/compose/v2/pkg/progress"
 	"github.com/psviderski/uncloud/internal/cli"
@@ -14,20 +13,16 @@ import (
 	"github.com/psviderski/uncloud/pkg/client"
 	"github.com/psviderski/uncloud/pkg/client/compose"
 	"github.com/psviderski/uncloud/pkg/client/deploy"
-	"github.com/psviderski/uncloud/pkg/client/deploy/operation"
 	"github.com/spf13/cobra"
 )

 type deployOptions struct {
-	cli.BuildServicesOptions
+	files    []string
+	profiles []string
+	services []string
+	noBuild  bool

-	files      []string
-	profiles   []string
-	services   []string
-	noBuild    bool
-	recreate   bool
-	skipHealth bool
-	yes        bool
+	context string
 }

 // NewDeployCommand creates a new command to deploy services from a Compose file.
@@ -37,38 +32,24 @@ func NewDeployCommand() *cobra.Command {
 		Use:   "deploy [FLAGS] [SERVICE...]",
 		Short: "Deploy services from a Compose file.",
 		RunE: func(cmd *cobra.Command, args []string) error {
-			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
-
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			opts.services = args
+
+			if len(args) > 0 {
+				opts.services = args
+			}

 			return runDeploy(cmd.Context(), uncli, opts)
 		},
-		GroupID: "service",
 	}

-	cmd.Flags().StringArrayVar(&opts.BuildServicesOptions.BuildArgs, "build-arg", nil,
-		"Set a build-time variable for services. Used in Dockerfiles that declare the variable with ARG.\n"+
-			"Can be specified multiple times. Format: --build-arg VAR=VALUE")
-	cmd.Flags().BoolVar(&opts.BuildServicesOptions.Pull, "build-pull", false,
-		"Always attempt to pull newer versions of base images before building service images.")
 	cmd.Flags().StringSliceVarP(&opts.files, "file", "f", nil,
 		"One or more Compose files to deploy services from. (default compose.yaml)")
-	cmd.Flags().BoolVar(&opts.noBuild, "no-build", false,
-		"Do not build new images before deploying services.")
-	cmd.Flags().BoolVar(&opts.BuildServicesOptions.NoCache, "no-cache", false,
-		"Do not use cache when building images.")
 	cmd.Flags().StringSliceVarP(&opts.profiles, "profile", "p", nil,
 		"One or more Compose profiles to enable.")
-	cmd.Flags().BoolVar(&opts.recreate, "recreate", false,
-		"Recreate containers even if their configuration and image haven't changed.")
-	cmd.Flags().BoolVar(&opts.skipHealth, "skip-health", false,
-		"Skip the monitoring period and health checks after starting new containers. Useful for faster emergency "+
-			"deployments.\n"+
-			"Warning: This may cause downtime if new containers fail to start properly.")
-	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
-		"Auto-confirm deployment plan. Should be explicitly set when running non-interactively,\n"+
-			"e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")
+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context to deploy to (default is the current context)")
+	cmd.Flags().BoolVarP(&opts.noBuild, "no-build", "n", false,
+		"Do not build images before deploying services. (default false)")

 	// TODO: Consider adding a filter flag to specify which machines to deploy to but keep the rest running.
 	//  Could be useful to test a new version on a subset of machines before rolling out to all.
@@ -76,9 +57,22 @@ func NewDeployCommand() *cobra.Command {
 	return cmd
 }

+// projectOpts returns the project options for the Compose file(s).
+func projectOpts(opts deployOptions) []composecli.ProjectOptionsFn {
+	projectOpts := []composecli.ProjectOptionsFn{}
+
+	if len(opts.profiles) > 0 {
+		projectOpts = append(projectOpts, composecli.WithDefaultProfiles(opts.profiles...))
+	}
+
+	return projectOpts
+}
+
 // runDeploy parses the Compose file(s) and deploys the services.
 func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
-	project, err := compose.LoadProject(ctx, opts.files, composecli.WithDefaultProfiles(opts.profiles...))
+	projectOpts := projectOpts(opts)
+
+	project, err := compose.LoadProject(ctx, opts.files, projectOpts...)
 	if err != nil {
 		return fmt.Errorf("load compose file(s): %w", err)
 	}
@@ -91,74 +85,30 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 		}
 	}

-	servicesToBuild, err := cli.ServicesThatNeedBuild(project, opts.services, false)
-	if err != nil {
-		return fmt.Errorf("determine services to build: %w", err)
-	}
+	servicesToBuild := cli.GetServicesThatNeedBuild(project)

 	if len(servicesToBuild) > 0 {
 		if opts.noBuild {
 			fmt.Println("Not building services as requested.")
 		} else {
-			// Build service images without pushing them to cluster yet to not connect to the cluster twice.
-			opts.BuildServicesOptions.Deps = true // build dependencies as deploy includes them by default
-			opts.BuildServicesOptions.Services = opts.services
+			buildOpts := cli.BuildOptions{
+				Push:    true,
+				NoCache: false,
+			}

-			if err = uncli.BuildServices(ctx, project, opts.BuildServicesOptions); err != nil {
+			if err := cli.BuildServices(ctx, servicesToBuild, buildOpts); err != nil {
 				return fmt.Errorf("build services: %w", err)
 			}
 		}
-		fmt.Println()
 	}

-	clusterClient, err := uncli.ConnectCluster(ctx)
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
 	defer clusterClient.Close()

-	if len(servicesToBuild) > 0 && !opts.noBuild {
-		// Push built service images to cluster machines one at a time.
-		var errs []error
-		for _, s := range servicesToBuild {
-			if s.Image == "" {
-				// Skip services without an image name (shouldn't happen for services with build config).
-				continue
-			}
-
-			// Push to the specified x-machines or to *all* cluster machines if not specified.
-			var pushOpts client.PushImageOptions
-			if machines, ok := s.Extensions[compose.MachinesExtensionKey].(compose.MachinesSource); ok {
-				pushOpts.Machines = machines
-			}
-			if len(pushOpts.Machines) == 0 {
-				pushOpts.AllMachines = true
-			}
-
-			boldStyle := lipgloss.NewStyle().Bold(true)
-			err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-				if err = clusterClient.PushImage(ctx, s.Image, pushOpts); err != nil {
-					return fmt.Errorf("push image '%s' for service '%s': %w", s.Image, s.Name, err)
-				}
-				return nil
-			}, uncli.ProgressOut(), fmt.Sprintf("Pushing image %s to cluster", boldStyle.Render(s.Image)))
-			// Collect errors to try pushing all images.
-			if err != nil {
-				errs = append(errs, err)
-			}
-		}
-
-		if err = errors.Join(errs...); err != nil {
-			return err
-		}
-		fmt.Println()
-	}
-
-	strategy := &deploy.RollingStrategy{
-		ForceRecreate:     opts.recreate,
-		SkipHealthMonitor: opts.skipHealth,
-	}
-	composeDeploy, err := compose.NewDeploymentWithStrategy(ctx, clusterClient, project, strategy)
+	composeDeploy, err := compose.NewDeployment(ctx, clusterClient, project)
 	if err != nil {
 		return fmt.Errorf("create compose deployment: %w", err)
 	}
@@ -173,27 +123,19 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 		return nil
 	}

-	fmt.Println(lipgloss.NewStyle().Bold(true).Render("Deployment plan"))
+	fmt.Println("Deployment plan:")
 	if err = printPlan(ctx, clusterClient, plan); err != nil {
 		return fmt.Errorf("print deployment plan: %w", err)
 	}
 	fmt.Println()

-	// Ask for plan confirmation before proceeding with the deployment unless auto-confirmed with --yes.
-	if !opts.yes {
-		if !cli.IsStdinTerminal() {
-			return errors.New("cannot ask to confirm deployment plan in non-interactive mode, " +
-				"use --yes flag or set UNCLOUD_AUTO_CONFIRM=true to auto-confirm")
-		}
-
-		confirmed, err := cli.Confirm()
-		if err != nil {
-			return fmt.Errorf("confirm deployment: %w", err)
-		}
-		if !confirmed {
-			fmt.Println("Cancelled. No changes were made.")
-			return nil
-		}
+	confirmed, err := cli.Confirm()
+	if err != nil {
+		return fmt.Errorf("confirm deployment: %w", err)
+	}
+	if !confirmed {
+		fmt.Println("Cancelled. No changes were made.")
+		return nil
 	}

 	return progress.RunWithTitle(ctx, func(ctx context.Context) error {
@@ -204,7 +146,7 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 	}, uncli.ProgressOut(), "Deploying services")
 }

-func printPlan(ctx context.Context, cli *client.Client, plan operation.SequenceOperation) error {
+func printPlan(ctx context.Context, cli *client.Client, plan deploy.SequenceOperation) error {
 	for _, op := range plan.Operations {
 		svcPlan, ok := op.(*deploy.Plan)
 		if !ok {
@@ -12,21 +12,32 @@ import (
 	"google.golang.org/protobuf/types/known/emptypb"
 )

+type releaseOptions struct {
+	context string
+}
+
 func NewReleaseCommand() *cobra.Command {
+	opts := releaseOptions{}
+
 	cmd := &cobra.Command{
 		Use:   "release",
 		Short: "Release the reserved cluster domain.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return release(cmd.Context(), uncli)
+			return release(cmd.Context(), uncli, opts)
 		},
 	}

+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+
 	return cmd
 }

-func release(ctx context.Context, uncli *cli.CLI) error {
-	client, err := uncli.ConnectCluster(ctx)
+func release(ctx context.Context, uncli *cli.CLI, opts releaseOptions) error {
+	client, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -19,6 +19,7 @@ const DefaultUncloudDNSAPIEndpoint = "https://dns.uncloud.run/v1"

 type reserveOptions struct {
 	endpoint string
+	context  string
 }

 func NewReserveCommand() *cobra.Command {
@@ -35,12 +36,16 @@ func NewReserveCommand() *cobra.Command {

 	cmd.Flags().StringVar(&opts.endpoint, "endpoint", DefaultUncloudDNSAPIEndpoint,
 		"API endpoint for the Uncloud DNS service.")
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)

 	return cmd
 }

 func reserve(ctx context.Context, uncli *cli.CLI, opts reserveOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -9,7 +9,7 @@ func NewRootCommand() *cobra.Command {
 		Use:   "dns",
 		Short: "Manage cluster domain in Uncloud DNS.",
 		Long: "Manage cluster domain in Uncloud DNS.\n" +
-			"DNS commands allow you to reserve or release a unique 'xxxxxx.uncld.dev' domain for your " +
+			"DNS commands allow you to reserve or release a unique '<id>.cluster.uncloud.run' domain for your " +
 			"cluster. When reserved, Caddy service deployments will automatically update DNS records to route " +
 			"traffic to the services in the cluster.",
 	}
@@ -10,21 +10,32 @@ import (
 	"github.com/spf13/cobra"
 )

+type showOptions struct {
+	context string
+}
+
 func NewShowCommand() *cobra.Command {
+	opts := showOptions{}
+
 	cmd := &cobra.Command{
 		Use:   "show",
 		Short: "Print the cluster domain name.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return show(cmd.Context(), uncli)
+			return show(cmd.Context(), uncli, opts)
 		},
 	}

+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+
 	return cmd
 }

-func show(ctx context.Context, uncli *cli.CLI) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
+func show(ctx context.Context, uncli *cli.CLI, opts showOptions) error {
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -1,122 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-
-	"github.com/spf13/cobra"
-	"github.com/spf13/cobra/doc"
-)
-
-const docsDir = "website/docs/9-cli-reference"
-
-type cmdWrapper struct {
-	cmd *cobra.Command
-}
-
-// NewDocsCommand creates a new hidden command to generate CLI reference docs.
-func NewDocsCommand() *cobra.Command {
-	wrapper := &cmdWrapper{}
-	cmd := &cobra.Command{
-		Use:                   "docs",
-		Short:                 "Generate Uncloud CLI reference docs",
-		SilenceUsage:          true,
-		DisableFlagsInUseLine: true,
-		Hidden:                true,
-		Args:                  cobra.NoArgs,
-		ValidArgsFunction:     cobra.NoFileCompletions,
-		RunE: func(cmd *cobra.Command, _ []string) error {
-			// Remove existing markdown files.
-			mdFiles, err := filepath.Glob(filepath.Join(docsDir, "*.md"))
-			if err != nil {
-				return fmt.Errorf("list existing CLI docs: %w", err)
-			}
-			for _, f := range mdFiles {
-				if err = os.Remove(f); err != nil {
-					return fmt.Errorf("remove '%s': %w", f, err)
-				}
-			}
-
-			// Generate new CLI reference docs.
-			wrapper.cmd.Root().DisableAutoGenTag = true
-			if err := doc.GenMarkdownTree(cmd.Root(), docsDir); err != nil {
-				return fmt.Errorf("generate CLI docs: %w", err)
-			}
-
-			// Remove *completion*.md files that contain malformatted code blocks that break Docusaurus.
-			mdFiles, err = filepath.Glob(filepath.Join(docsDir, "*completion*.md"))
-			if err != nil {
-				return fmt.Errorf("list generated CLI docs: %w", err)
-			}
-			for _, f := range mdFiles {
-				if err = os.Remove(f); err != nil {
-					return fmt.Errorf("remove '%s': %w", f, err)
-				}
-			}
-
-			// Post-process generated markdown files.
-			mdFiles, err = filepath.Glob(filepath.Join(docsDir, "*.md"))
-			if err != nil {
-				return fmt.Errorf("list generated CLI docs: %w", err)
-			}
-
-			for _, f := range mdFiles {
-				if err = postProcessMarkdown(f); err != nil {
-					return fmt.Errorf("post-process '%s': %w", f, err)
-				}
-			}
-
-			return nil
-		},
-	}
-
-	wrapper.cmd = cmd
-	return cmd
-}
-
-// postProcessMarkdown applies transformations to generated markdown files.
-func postProcessMarkdown(filename string) error {
-	data, err := os.ReadFile(filename)
-	if err != nil {
-		return err
-	}
-
-	content := string(data)
-
-	// Replace "SEE ALSO" with "See also".
-	content = strings.ReplaceAll(content, "SEE ALSO", "See also")
-	// Escape <id> to avoid Docusaurus treating it as an HTML tag.
-	content = strings.ReplaceAll(content, "<id>", "\\<id>")
-
-	// Remove broken links to completion docs.
-	if strings.Contains(content, "[uc completion") {
-		lines := strings.Split(content, "\n")
-		var filteredLines []string
-		for _, line := range lines {
-			if !strings.Contains(line, "[uc completion") {
-				filteredLines = append(filteredLines, line)
-			}
-		}
-		content = strings.Join(filteredLines, "\n")
-	}
-
-	// Adjust heading levels. Process from shortest to longest to avoid double replacements.
-	replacements := []struct {
-		old, new string
-	}{
-		{`(?m)^## `, `# `},
-		{`(?m)^### `, `## `},
-		{`(?m)^#### `, `### `},
-		{`(?m)^##### `, `#### `},
-	}
-
-	for _, r := range replacements {
-		re := regexp.MustCompile(r.old)
-		content = re.ReplaceAllString(content, r.new)
-	}
-
-	return os.WriteFile(filename, []byte(content), 0o644)
-}
@@ -1,307 +0,0 @@
-package image
-
-import (
-	"context"
-	"fmt"
-	"slices"
-	"sort"
-	"strings"
-	"time"
-
-	"github.com/charmbracelet/lipgloss"
-	"github.com/charmbracelet/lipgloss/table"
-	"github.com/containerd/platforms"
-	"github.com/docker/docker/api/types/image"
-	"github.com/docker/go-units"
-	"github.com/muesli/termenv"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/spf13/cobra"
-)
-
-type listOptions struct {
-	machines   []string
-	nameFilter string
-}
-
-func NewListCommand() *cobra.Command {
-	opts := listOptions{}
-
-	cmd := &cobra.Command{
-		Use:     "ls [REPO:[TAG]]",
-		Aliases: []string{"list"},
-		Short:   "List images on machines in the cluster.",
-		Long:    "List images on machines in the cluster. By default, on all machines. Optionally filter by image name.",
-		Example: `  # List all images on all machines.
-  uc image ls
-
-  # List images on specific machine.
-  uc image ls -m machine1
-
-  # List images on multiple machines.
-  uc image ls -m machine1,machine2
-
-  # List images filtered by name (with any tag) on all machines.
-  uc image ls myapp
-
-  # List images filtered by name pattern on specific machine.
-  uc image ls "myapp:1.*" -m machine1`,
-		Args: cobra.MaximumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			if len(args) > 0 {
-				opts.nameFilter = args[0]
-			}
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli, opts)
-		},
-	}
-
-	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
-		"Filter images by machine name or ID. Can be specified multiple times or as a comma-separated list. "+
-			"(default is include all machines)")
-
-	return cmd
-}
-
-// imageRow represents a single image with its metadata for display.
-type imageRow struct {
-	id           string
-	name         string
-	platforms    string
-	createdHuman string
-	createdUnix  int64
-	size         string
-	inUse        string
-	store        string
-	machine      string
-}
-
-func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	// Get all machines to create ID to name mapping.
-	allMachines, err := clusterClient.ListMachines(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("list machines: %w", err)
-	}
-
-	machineIDToName := make(map[string]string)
-	for _, machineMember := range allMachines {
-		if machineMember.Machine != nil && machineMember.Machine.Id != "" && machineMember.Machine.Name != "" {
-			machineIDToName[machineMember.Machine.Id] = machineMember.Machine.Name
-		}
-	}
-
-	machines := cli.ExpandCommaSeparatedValues(opts.machines)
-
-	clusterImages, err := clusterClient.ListImages(ctx, api.ImageFilter{
-		Machines: machines,
-		Name:     opts.nameFilter,
-	})
-	if err != nil {
-		return fmt.Errorf("list images: %w", err)
-	}
-
-	// Collect all images from all machines.
-	var rows []imageRow
-
-	for _, machineImages := range clusterImages {
-		// Get machine name for better readability.
-		machineName := machineImages.Metadata.Machine
-		if m := allMachines.FindByNameOrID(machineName); m != nil {
-			machineName = m.Machine.Name
-		}
-
-		store := "docker"
-		if machineImages.ContainerdStore {
-			store = "containerd"
-		}
-
-		// Process each image for this machine.
-		for _, img := range machineImages.Images {
-			// Show the first 12 chars without 'sha256:' as the image ID like Docker does.
-			id := strings.TrimPrefix(img.ID, "sha256:")[:12]
-
-			name := "<none>"
-			if len(img.RepoTags) > 0 && img.RepoTags[0] != "<none>:<none>" {
-				name = img.RepoTags[0]
-			}
-
-			imgPlatforms, _ := imagePlatforms(img)
-			formattedPlatforms := formatPlatforms(imgPlatforms)
-
-			created := ""
-			createdAt := time.Unix(img.Created, 0)
-			if !createdAt.IsZero() {
-				created = units.HumanDuration(time.Now().UTC().Sub(createdAt)) + " ago"
-			}
-
-			size := units.HumanSizeWithPrecision(float64(img.Size), 3)
-
-			// Check if the image is in use by any containers. Only supported by Docker API >=1.51
-			inUse := "-"
-			if img.Containers != -1 { // -1 means the info is not available.
-				if img.Containers > 0 {
-					inUse = lipgloss.NewStyle().Foreground(lipgloss.Color("10")).Render("●")
-				} else {
-					inUse = lipgloss.NewStyle().Foreground(lipgloss.Color("8")).Render("○")
-				}
-			}
-
-			rows = append(rows, imageRow{
-				id:           id,
-				name:         name,
-				platforms:    formattedPlatforms,
-				createdHuman: created,
-				createdUnix:  img.Created,
-				size:         size,
-				inUse:        inUse,
-				store:        store,
-				machine:      machineName,
-			})
-		}
-	}
-
-	if len(rows) == 0 {
-		if opts.nameFilter != "" {
-			fmt.Printf("No images matching '%s' found.\n", opts.nameFilter)
-		} else {
-			fmt.Println("No images found.")
-		}
-		return nil
-	}
-
-	// Sort images by name, then by machine name.
-	sort.Slice(rows, func(i, j int) bool {
-		if rows[i].name != rows[j].name {
-			return rows[i].name < rows[j].name
-		}
-		return rows[i].machine < rows[j].machine
-	})
-
-	// Print the images in a table format.
-	fmt.Println(formatImageTable(rows))
-
-	return nil
-}
-
-// imagePlatforms returns a list of platforms supported by the image and a boolean indicating if it's multi-platform.
-func imagePlatforms(img image.Summary) ([]string, bool) {
-	var formattedPlatforms []string
-	multiPlatform := false
-
-	for _, m := range img.Manifests {
-		if m.Kind != image.ManifestKindImage || !m.Available {
-			continue
-		}
-
-		if m.ID != img.ID {
-			// There is an image manifest that has digest different from the main image digest.
-			// This means the image manifest is an index or a manifest list (multi-platform image).
-			multiPlatform = true
-		}
-		formattedPlatforms = append(formattedPlatforms, platforms.Format(m.ImageData.Platform))
-	}
-
-	slices.Sort(formattedPlatforms)
-
-	return formattedPlatforms, multiPlatform
-}
-
-func formatPlatforms(platforms []string) string {
-	if len(platforms) == 0 {
-		return "-"
-	}
-
-	platformStyle := lipgloss.NewStyle().
-		BorderForeground(lipgloss.Color("152")).
-		Foreground(lipgloss.Color("0")).
-		Background(lipgloss.Color("152"))
-	// Use fancy pill borders only if the output is a terminal with color support.
-	if lipgloss.ColorProfile() != termenv.Ascii {
-		platformStyle = platformStyle.Border(lipgloss.Border{Left: "", Right: ""}, false, true, false, true)
-	}
-
-	styledPlatforms := make([]string, len(platforms))
-	for i, p := range platforms {
-		styledPlatforms[i] = platformStyle.Render(p)
-	}
-
-	return strings.Join(styledPlatforms, " ")
-}
-
-func formatImageTable(rows []imageRow) string {
-	columns := []struct {
-		name string
-		hide bool
-	}{
-		{name: "IMAGE ID"},
-		{name: "NAME"},
-		{name: "PLATFORMS"},
-		{name: "CREATED"},
-		{name: "SIZE"},
-		{name: "IN USE"},
-		{name: "STORE"},
-		{name: "MACHINE"},
-	}
-
-	// Hide the "IN USE" column if none of the images have that info available.
-	inUseInfoAvailable := slices.ContainsFunc(rows, func(r imageRow) bool {
-		return r.inUse != "-"
-	})
-	if !inUseInfoAvailable {
-		// Hide "IN USE" column.
-		columns[5].hide = true
-	}
-
-	t := table.New().
-		// Remove the default border.
-		Border(lipgloss.Border{}).
-		BorderTop(false).
-		BorderBottom(false).
-		BorderLeft(false).
-		BorderRight(false).
-		BorderHeader(false).
-		BorderColumn(false).
-		StyleFunc(func(row, col int) lipgloss.Style {
-			if row == table.HeaderRow {
-				return lipgloss.NewStyle().Bold(true).PaddingRight(3)
-			}
-			// Regular style for data rows with padding.
-			return lipgloss.NewStyle().PaddingRight(3)
-		})
-
-	var headers []string
-	for _, col := range columns {
-		if !col.hide {
-			headers = append(headers, col.name)
-		}
-	}
-	t.Headers(headers...)
-
-	for _, row := range rows {
-		values := []string{
-			row.id,
-			row.name,
-			row.platforms,
-			row.createdHuman,
-			row.size,
-			row.inUse,
-			row.store,
-			row.machine,
-		}
-		var filteredValues []string
-		for i, v := range values {
-			if !columns[i].hide {
-				filteredValues = append(filteredValues, v)
-			}
-		}
-		t.Row(filteredValues...)
-	}
-
-	return t.String()
-}
@@ -1,94 +0,0 @@
-package image
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/containerd/platforms"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/spf13/cobra"
-)
-
-type pushOptions struct {
-	image    string
-	machines []string
-	platform string
-}
-
-func NewPushCommand() *cobra.Command {
-	opts := pushOptions{}
-
-	cmd := &cobra.Command{
-		Use:   "push IMAGE",
-		Short: "Upload a local Docker image to the cluster.",
-		Long: `Upload a local Docker image to the cluster transferring only the missing layers.
-The image is uploaded to all cluster machines (default) or the specified machine(s).`,
-		Example: `  # Push image to all machines in the cluster.
-  uc image push myapp:latest
-
-  # Push image to specific machine.
-  uc image push myapp:latest -m machine1
-
-  # Push image to multiple machines.
-  uc image push myapp:latest -m machine1,machine2,machine3
-
-  # Push a specific platform of a multi-platform image.
-  uc image push myapp:latest --platform linux/amd64`,
-		Args: cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			opts.image = args[0]
-			return push(cmd.Context(), uncli, opts)
-		},
-	}
-
-	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
-		"Machine names or IDs to push the image to. Can be specified multiple times or as a comma-separated list. "+
-			"(default is all machines)")
-	cmd.Flags().StringVar(
-		&opts.platform, "platform", "",
-		"Push a specific platform of a multi-platform image (e.g., linux/amd64, linux/arm64).\n"+
-			"Local Docker must be configured to use containerd image store to support multi-platform images.",
-	)
-
-	return cmd
-}
-
-func push(ctx context.Context, uncli *cli.CLI, opts pushOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	machines := cli.ExpandCommaSeparatedValues(opts.machines)
-	pushOpts := client.PushImageOptions{}
-
-	// Special handling for an explicit "all" keyword to push to all machines.
-	if len(machines) == 1 && machines[0] == "all" {
-		pushOpts.AllMachines = true
-	} else if len(machines) > 0 {
-		pushOpts.Machines = machines
-	} else {
-		// Default is to push to all machines in the cluster.
-		pushOpts.AllMachines = true
-	}
-
-	if opts.platform != "" {
-		p, err := platforms.Parse(opts.platform)
-		if err != nil {
-			return fmt.Errorf("invalid platform '%s': %w", opts.platform, err)
-		}
-		pushOpts.Platform = &p
-	}
-
-	return progress.RunWithTitle(ctx, func(ctx context.Context) error {
-		if err = clusterClient.PushImage(ctx, opts.image, pushOpts); err != nil {
-			return fmt.Errorf("push image to cluster: %w", err)
-		}
-		return nil
-	}, uncli.ProgressOut(), fmt.Sprintf("Pushing image %s to cluster", opts.image))
-}
@@ -1,19 +0,0 @@
-package image
-
-import (
-	"github.com/spf13/cobra"
-)
-
-func NewRootCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "image",
-		Short: "Manage images on machines in the cluster.",
-	}
-
-	cmd.AddCommand(
-		NewListCommand(),
-		NewPushCommand(),
-	)
-
-	return cmd
-}
@@ -1,19 +0,0 @@
-package main
-
-import (
-	"strings"
-
-	"github.com/psviderski/uncloud/cmd/uncloud/image"
-	"github.com/spf13/cobra"
-)
-
-// NewImagesCommand returns the 'image ls' command modified to work as 'images'.
-func NewImagesCommand() *cobra.Command {
-	listCmd := image.NewListCommand()
-	listCmd.Use = "images [IMAGE]"
-	// Remove 'list' alias since this command is already an alias.
-	listCmd.Aliases = nil
-	listCmd.Example = strings.ReplaceAll(listCmd.Example, "uc image ls", "uc images")
-
-	return listCmd
-}
@@ -5,30 +5,27 @@ import (
 	"errors"
 	"fmt"
 	"net/netip"
-	"strings"
 	"time"

-	"github.com/charmbracelet/huh/spinner"
-	"github.com/charmbracelet/lipgloss"
+	"github.com/cenkalti/backoff/v4"
 	"github.com/docker/compose/v2/pkg/progress"
 	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
 	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/psviderski/uncloud/internal/cli/config"
-	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/psviderski/uncloud/pkg/client"
 	"github.com/spf13/cobra"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )

 type addOptions struct {
-	name        string
-	noCaddy     bool
-	noInstall   bool
-	publicIP    string
-	sshKey      string
-	version     string
-	wgEndpoints []string
-	yes         bool
+	name     string
+	noCaddy  bool
+	publicIP string
+	sshKey   string
+	context  string
+	version  string
 }

 func NewAddCommand() *cobra.Command {
@@ -36,33 +33,19 @@ func NewAddCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "add [USER@]HOST[:PORT]",
 		Short: "Add a remote machine to a cluster.",
-		Long: `Add a new machine to an existing Uncloud cluster.
-
-Connection methods:
-  ssh://user@host       - Use built-in SSH library (default, no prefix required)
-  ssh+cli://user@host   - Use system SSH command (supports ProxyJump, SSH config)`,
-		Args: cobra.ExactArgs(1),
+		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
-
 			uncli := cmd.Context().Value("cli").(*cli.CLI)

-			// Determine if SSH CLI needs to be used and strip scheme
-			destination := args[0]
-			useSSHCLI := strings.HasPrefix(destination, "ssh+cli://")
-			destination = strings.TrimPrefix(destination, "ssh+cli://")
-			destination = strings.TrimPrefix(destination, "ssh://")
-
-			user, host, port, err := config.SSHDestination(destination).Parse()
+			user, host, port, err := config.SSHDestination(args[0]).Parse()
 			if err != nil {
 				return fmt.Errorf("parse remote machine: %w", err)
 			}
-			remoteMachine := &cli.RemoteMachine{
-				User:      user,
-				Host:      host,
-				Port:      port,
-				KeyPath:   opts.sshKey,
-				UseSSHCLI: useSSHCLI,
+			remoteMachine := cli.RemoteMachine{
+				User:    user,
+				Host:    host,
+				Port:    port,
+				KeyPath: opts.sshKey,
 			}

 			return add(cmd.Context(), uncli, remoteMachine, opts)
@@ -73,46 +56,33 @@ Connection methods:
 		&opts.noCaddy, "no-caddy", false,
 		"Don't deploy Caddy reverse proxy service to the machine.",
 	)
-	cmd.Flags().BoolVar(
-		&opts.noInstall, "no-install", false,
-		"Skip installation of Docker, Uncloud daemon, and dependencies on the machine. "+
-			"Assumes they're already installed and running.",
-	)
 	cmd.Flags().StringVar(
 		&opts.publicIP, "public-ip", "auto",
 		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
-			fmt.Sprintf("blank '' or '%s' to disable ingress on this machine, or specify an IP address.", PublicIPNone),
+			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
 	)
 	cmd.Flags().StringVarP(
-		&opts.sshKey, "ssh-key", "i", "",
-		fmt.Sprintf("Path to SSH private key for remote login (if not already added to SSH agent). (default %q)",
-			cli.DefaultSSHKeyPath),
+		&opts.sshKey, "ssh-key", "i", "~/.ssh/id_ed25519",
+		"Path to SSH private key for remote login (if not already added to SSH agent).",
 	)
 	cmd.Flags().StringVar(
 		&opts.version, "version", "latest",
 		"Version of the Uncloud daemon to install on the machine.",
 	)
-	cmd.Flags().StringSliceVar(
-		&opts.wgEndpoints, "wg-endpoint", nil,
-		fmt.Sprintf("WireGuard endpoint address in format: IP, IP:PORT, IPv6, or [IPv6]:PORT. "+
-			"Default port %d is used if omitted.\n", network.WireGuardPort)+
-			"Other machines in the cluster will use this endpoint to establish a WireGuard connection to this machine.\n"+
-			"Multiple endpoints can be specified by repeating the flag or using a comma-separated list.\n"+
-			"If not specified, the machine's routable IPs and public IP are auto-detected and used as endpoints.",
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context to add the machine to. (default is the current context)",
 	)
-	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
-		"Auto-confirm prompts (e.g., resetting an already initialised machine).\n"+
-			"Should be explicitly set when running non-interactively, e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")

 	return cmd
 }

-func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine, opts addOptions) error {
+func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, opts addOptions) error {
 	var publicIP *netip.Addr
 	switch opts.publicIP {
 	case "auto":
 		publicIP = &netip.Addr{}
-	case "", PublicIPNone:
+	case "", "none":
 		publicIP = nil
 	default:
 		ip, err := netip.ParseAddr(opts.publicIP)
@@ -122,24 +92,13 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 		publicIP = &ip
 	}

-	addOpts := cli.AddMachineOptions{
+	clusterClient, machineClient, err := uncli.AddMachine(ctx, cli.AddMachineOptions{
+		Context:       opts.context,
 		MachineName:   opts.name,
 		PublicIP:      publicIP,
 		RemoteMachine: remoteMachine,
-		SkipInstall:   opts.noInstall,
 		Version:       opts.version,
-		AutoConfirm:   opts.yes,
-	}
-	if len(opts.wgEndpoints) > 0 {
-		expanded := cli.ExpandCommaSeparatedValues(opts.wgEndpoints)
-		endpoints, err := cli.ParseWireGuardEndpoints(expanded)
-		if err != nil {
-			return fmt.Errorf("parse WireGuard endpoint (--wg-endpoint): %w", err)
-		}
-		addOpts.WireguardEndpoints = endpoints
-	}
-
-	clusterClient, machineClient, err := uncli.AddMachine(ctx, addOpts)
+	})
 	if err != nil {
 		return err
 	}
@@ -150,97 +109,79 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine,
 		return nil
 	}

-	// Wait for the cluster to be initialised on the machine to be able to deploy the Caddy service.
-	err = spinner.New().
-		Title(" Waiting for the machine to join the cluster...").
-		Type(spinner.MiniDot).
-		Style(lipgloss.NewStyle().Foreground(lipgloss.Color("3"))).
-		TitleStyle(lipgloss.NewStyle()).
-		ActionWithErr(func(ctx context.Context) error {
-			return machineClient.WaitClusterReady(ctx, 5*time.Minute)
-		}).
-		Run()
-	if err != nil {
-		return fmt.Errorf("wait for machine to join the cluster: %w", err)
+	// Wait for the cluster to be initialised to be able to deploy the Caddy service.
+	fmt.Println("Waiting for the machine to be ready...")
+	fmt.Println()
+	if err = waitClusterInitialised(ctx, machineClient); err != nil {
+		return fmt.Errorf("wait for cluster to be initialised on machine: %w", err)
 	}
-	fmt.Println("Machine joined the cluster.")

-	// TODO: scale the existing Caddy service to the new machine instead of running a new deployment
-	//  that may cause a small downtime.
 	// Deploy a Caddy service container to the added machine. If caddy service is already deployed on other machines,
-	// use the deployed image version.
+	// use the deployed image version. Otherwise, use the latest version.
 	// NOTE: We use the cluster client to inspect and scale the Caddy service because the newly added machine may have
 	// issues accessing the Machine API of existing machines in the cluster.
 	// See the issue for more details: https://github.com/psviderski/uncloud/issues/65.
 	caddyImage := ""
 	caddySvc, err := clusterClient.InspectService(ctx, client.CaddyServiceName)
 	if err != nil {
-		if errors.Is(err, api.ErrNotFound) {
-			// Caddy service is not deployed.
-			return nil
+		if !errors.Is(err, api.ErrNotFound) {
+			return fmt.Errorf("inspect caddy service: %w", err)
 		}
-		return fmt.Errorf("inspect caddy service: %w", err)
-	}
-	caddyImage = caddySvc.Containers[0].Container.Config.Image
-	// Find the latest created container and use its image.
-	var latestCreated time.Time
-	for _, c := range caddySvc.Containers[1:] {
-		created, err := time.Parse(time.RFC3339Nano, c.Container.Created)
-		if err != nil {
-			continue
-		}
-		if created.After(latestCreated) {
-			latestCreated = created
-			caddyImage = c.Container.Config.Image
+	} else {
+		caddyImage = caddySvc.Containers[0].Container.Config.Image
+		// Find the latest created container and use its image.
+		var latestCreated time.Time
+		for _, c := range caddySvc.Containers[1:] {
+			created, err := time.Parse(time.RFC3339Nano, c.Container.Created)
+			if err != nil {
+				continue
+			}
+			if created.After(latestCreated) {
+				latestCreated = created
+				caddyImage = c.Container.Config.Image
+			}
 		}
 	}

-	d, err := clusterClient.NewCaddyDeployment(caddyImage, "", api.Placement{})
+	// TODO: scale the existing Caddy service to the new machine instead of running a new deployment
+	//  that may cause a small downtime.
+	d, err := clusterClient.NewCaddyDeployment(caddyImage, api.Placement{})
 	if err != nil {
 		return fmt.Errorf("create caddy deployment: %w", err)
 	}

-	plan, err := d.Plan(ctx)
+	err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+		if _, err = d.Run(ctx); err != nil {
+			return fmt.Errorf("deploy caddy: %w", err)
+		}
+		return nil
+	}, uncli.ProgressOut(), fmt.Sprintf("Deploying service %s", d.Spec.Name))
 	if err != nil {
-		return fmt.Errorf("plan caddy deployment: %w", err)
-	}
-
-	fmt.Println()
-	if len(plan.Operations) == 0 {
-		fmt.Printf("%s service is up to date.\n", client.CaddyServiceName)
-	} else {
-		// Initialise a machine and container name resolver to properly format the plan output.
-		resolver, err := clusterClient.ServiceOperationNameResolver(ctx, caddySvc)
-		if err != nil {
-			return fmt.Errorf("create machine and container name resolver for service operations: %w", err)
-		}
-
-		fmt.Println("caddy deployment plan:")
-		fmt.Println(plan.Format(resolver))
-		fmt.Println()
-
-		if !opts.yes {
-			confirmed, err := cli.Confirm()
-			if err != nil {
-				return fmt.Errorf("confirm deployment: %w", err)
-			}
-			if !confirmed {
-				fmt.Println("Cancelled. No changes were made.")
-				return nil
-			}
-		}
-
-		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-			if _, err = d.Run(ctx); err != nil {
-				return fmt.Errorf("deploy caddy: %w", err)
-			}
-			return nil
-		}, uncli.ProgressOut(), fmt.Sprintf("Deploying service %s (%s mode)", d.Spec.Name, d.Spec.Mode))
-		if err != nil {
-			return err
-		}
+		return err
 	}

 	fmt.Println()
 	return caddy.UpdateDomainRecords(ctx, machineClient, uncli.ProgressOut())
 }
+
+func waitClusterInitialised(ctx context.Context, client *client.Client) error {
+	boff := backoff.WithContext(backoff.NewExponentialBackOff(
+		backoff.WithMaxInterval(1*time.Second),
+		backoff.WithMaxElapsedTime(5*time.Minute),
+	), ctx)
+
+	check := func() error {
+		_, err := client.ListMachines(ctx, nil)
+		if err == nil {
+			return nil
+		}
+
+		statusErr := status.Convert(err)
+		if statusErr.Code() == codes.FailedPrecondition {
+			return err
+		}
+		return backoff.Permanent(err)
+	}
+
+	return backoff.Retry(check, boff)
+}
@@ -1,6 +0,0 @@
-package machine
-
-const (
-	// PublicIPNone is the value used to indicate removal of public IP
-	PublicIPNone = "none"
-)
@@ -4,11 +4,7 @@ import (
 	"context"
 	"fmt"
 	"net/netip"
-	"strings"
-	"time"

-	"github.com/charmbracelet/huh/spinner"
-	"github.com/charmbracelet/lipgloss"
 	"github.com/docker/compose/v2/pkg/progress"
 	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
 	"github.com/psviderski/uncloud/cmd/uncloud/dns"
@@ -16,85 +12,50 @@ import (
 	"github.com/psviderski/uncloud/internal/cli/config"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/machine/cluster"
-	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/spf13/cobra"
 )

 type initOptions struct {
-	context     string
 	dnsEndpoint string
 	name        string
 	network     string
 	noCaddy     bool
 	noDNS       bool
-	noInstall   bool
 	publicIP    string
 	sshKey      string
 	version     string
-	wgEndpoints []string
-	yes         bool
+	context     string
 }

 func NewInitCommand() *cobra.Command {
 	opts := initOptions{}
 	cmd := &cobra.Command{
-		Use:   "init [schema://]USER@HOST[:PORT]",
+		Use:   "init [USER@HOST:PORT]",
 		Short: "Initialise a new cluster with a remote machine as the first member.",
-		Long: `Initialise a new cluster by setting up a remote machine as the first member.
-This command creates a new context in your Uncloud config to manage the cluster.
-
-Connection methods:
-  ssh://user@host       - Use built-in SSH library (default, no prefix required)
-  ssh+cli://user@host   - Use system SSH command (supports ProxyJump, SSH config)`,
-		Example: `  # Initialise a new cluster with default settings.
-  uc machine init root@<your-server-ip>
-
-  # Initialise with a context name 'prod' in the Uncloud config (~/.config/uncloud/config.yaml) and machine name 'vps1'.
-  uc machine init root@<your-server-ip> -c prod -n vps1
-
-  # Initialise with a non-root user and custom SSH port and key.
-  uc machine init ubuntu@<your-server-ip>:2222 -i ~/.ssh/mykey
-
-  # Initialise without Caddy (no reverse proxy) and without an automatically managed domain name (xxxxxx.uncld.dev).
-  # You can deploy Caddy with 'uc caddy deploy' and reserve a domain with 'uc dns reserve' later.
-  uc machine init root@<your-server-ip> --no-caddy --no-dns`,
+		// TODO: include usage examples of initialising a remote machine.
 		// TODO: support initialising a cluster on the local machine.
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
-
 			uncli := cmd.Context().Value("cli").(*cli.CLI)

 			var remoteMachine *cli.RemoteMachine
 			if len(args) > 0 {
-				// Determine if SSH CLI is requested and strip scheme
-				destination := args[0]
-				useSSHCLI := strings.HasPrefix(destination, "ssh+cli://")
-				destination = strings.TrimPrefix(destination, "ssh+cli://")
-				destination = strings.TrimPrefix(destination, "ssh://")
-
-				user, host, port, err := config.SSHDestination(destination).Parse()
+				user, host, port, err := config.SSHDestination(args[0]).Parse()
 				if err != nil {
 					return fmt.Errorf("parse remote machine: %w", err)
 				}
 				remoteMachine = &cli.RemoteMachine{
-					User:      user,
-					Host:      host,
-					Port:      port,
-					KeyPath:   opts.sshKey,
-					UseSSHCLI: useSSHCLI,
+					User:    user,
+					Host:    host,
+					Port:    port,
+					KeyPath: opts.sshKey,
 				}
 			}

 			return initCluster(cmd.Context(), uncli, remoteMachine, opts)
 		},
 	}
-
-	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", cli.DefaultContextName,
-		"Name of the new context to be created in the Uncloud config to manage the cluster.",
-	)
 	cmd.Flags().StringVar(&opts.dnsEndpoint, "dns-endpoint", dns.DefaultUncloudDNSAPIEndpoint,
 		"API endpoint for the Uncloud DNS service.")
 	cmd.Flags().StringVarP(
@@ -107,52 +68,34 @@ Connection methods:
 	)
 	cmd.Flags().BoolVar(
 		&opts.noCaddy, "no-caddy", false,
-		"Don't deploy Caddy reverse proxy service to the machine. You can deploy it later with 'uc caddy deploy'.",
+		"Don't deploy Caddy reverse proxy service to the machine.",
 	)
 	cmd.Flags().BoolVar(
 		&opts.noDNS, "no-dns", false,
-		"Don't reserve a cluster domain in Uncloud DNS. You can reserve it later with 'uc dns reserve'.",
-	)
-	cmd.Flags().BoolVar(
-		&opts.noInstall, "no-install", false,
-		"Skip installation of Docker, Uncloud daemon, and dependencies on the machine. "+
-			"Assumes they're already installed and running.",
+		"Don't reserve a cluster domain in Uncloud DNS.",
 	)
 	cmd.Flags().StringVar(
 		&opts.publicIP, "public-ip", "auto",
 		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
-			fmt.Sprintf("blank '' or '%s' to disable ingress on this machine, or specify an IP address.", PublicIPNone),
+			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
 	)
 	cmd.Flags().StringVarP(
-		&opts.sshKey, "ssh-key", "i", "",
-		fmt.Sprintf("Path to SSH private key for remote login (if not already added to SSH agent). (default %q)",
-			cli.DefaultSSHKeyPath),
+		&opts.sshKey, "ssh-key", "i", "~/.ssh/id_ed25519",
+		"Path to SSH private key for remote login (if not already added to SSH agent).",
 	)
 	cmd.Flags().StringVar(
 		&opts.version, "version", "latest",
 		"Version of the Uncloud daemon to install on the machine.",
 	)
-	cmd.Flags().StringSliceVar(
-		&opts.wgEndpoints, "wg-endpoint", nil,
-		fmt.Sprintf("WireGuard endpoint address in format: IP, IP:PORT, IPv6, or [IPv6]:PORT. "+
-			"Default port %d is used if omitted.\n", network.WireGuardPort)+
-			"Other machines in the cluster will use this endpoint to establish a WireGuard connection to this machine.\n"+
-			"Multiple endpoints can be specified by repeating the flag or using a comma-separated list.\n"+
-			"If not specified, the machine's routable IPs and public IP are auto-detected and used as endpoints.",
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "default",
+		"Name of the created context for the initialised cluster in the Uncloud config.",
 	)
-	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
-		"Auto-confirm prompts (e.g., resetting an already initialised machine).\n"+
-			"Should be explicitly set when running non-interactively, e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")

 	return cmd
 }

 func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine, opts initOptions) error {
-	if uncli.Config == nil {
-		// Config is nil when connecting directly to a remote machine (--connect) without using Uncloud config.
-		return fmt.Errorf("do not specify --connect when initialising a new cluster")
-	}
-
 	netPrefix, err := netip.ParsePrefix(opts.network)
 	if err != nil {
 		return fmt.Errorf("parse network CIDR: %w", err)
@@ -162,7 +105,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 	switch opts.publicIP {
 	case "auto":
 		publicIP = &netip.Addr{}
-	case "", PublicIPNone:
+	case "", "none":
 		publicIP = nil
 	default:
 		ip, err := netip.ParseAddr(opts.publicIP)
@@ -171,52 +114,27 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 		}
 		publicIP = &ip
 	}
-	initOpts := cli.InitClusterOptions{
+	client, err := uncli.InitCluster(ctx, cli.InitClusterOptions{
 		Context:       opts.context,
 		MachineName:   opts.name,
 		Network:       netPrefix,
 		PublicIP:      publicIP,
 		RemoteMachine: remoteMachine,
-		SkipInstall:   opts.noInstall,
 		Version:       opts.version,
-		AutoConfirm:   opts.yes,
-	}
-	if len(opts.wgEndpoints) > 0 {
-		expanded := cli.ExpandCommaSeparatedValues(opts.wgEndpoints)
-		endpoints, err := cli.ParseWireGuardEndpoints(expanded)
-		if err != nil {
-			return fmt.Errorf("parse WireGuard endpoint (--wg-endpoint): %w", err)
-		}
-		initOpts.WireguardEndpoints = endpoints
-	}
-
-	client, err := uncli.InitCluster(ctx, initOpts)
+	})
 	if err != nil {
 		return err
 	}
 	defer client.Close()

-	// Since the cluster API needs a few moments to become ready after cluster initialisation,
-	// we keep the user informed during this wait. We wait here even if no Caddy or DNS is requested
-	// as the cluster needs to be ready so that commands such as 'uc machine ls' work immediately after init.
-	err = spinner.New().
-		Title(" Waiting for the cluster to be ready...").
-		Type(spinner.MiniDot).
-		Style(lipgloss.NewStyle().Foreground(lipgloss.Color("3"))).
-		TitleStyle(lipgloss.NewStyle()).
-		ActionWithErr(func(ctx context.Context) error {
-			return client.WaitClusterReady(ctx, 1*time.Minute)
-		}).
-		Run()
-	if err != nil {
-		return fmt.Errorf("wait for cluster to be ready: %w", err)
-	}
-	fmt.Println("Cluster is ready.")
-
 	if opts.noCaddy && opts.noDNS {
 		return nil
 	}

+	// Deploy the Caddy service to the initialised machine.
+	// The creation of a deployment plan talks to cluster API. Since the API needs a few moments to become available
+	// after cluster initialisation, we keep the user informed during this wait.
+	fmt.Println("Waiting for the machine to be ready...")
 	fmt.Println()

 	if !opts.noDNS {
@@ -228,7 +146,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 	}

 	if !opts.noCaddy {
-		d, err := client.NewCaddyDeployment("", "", api.Placement{})
+		d, err := client.NewCaddyDeployment("", api.Placement{})
 		if err != nil {
 			return fmt.Errorf("create caddy deployment: %w", err)
 		}
@@ -14,20 +14,25 @@ import (
 )

 func NewListCommand() *cobra.Command {
+	var contextName string
 	cmd := &cobra.Command{
 		Use:     "ls",
 		Aliases: []string{"list"},
 		Short:   "List machines in a cluster.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli)
+			return list(cmd.Context(), uncli, contextName)
 		},
 	}
+	cmd.Flags().StringVarP(
+		&contextName, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
 	return cmd
 }

-func list(ctx context.Context, uncli *cli.CLI) error {
-	client, err := uncli.ConnectCluster(ctx)
+func list(ctx context.Context, uncli *cli.CLI, clusterName string) error {
+	client, err := uncli.ConnectCluster(ctx, clusterName)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -41,7 +46,7 @@ func list(ctx context.Context, uncli *cli.CLI) error {
 	// Print the list of machines in a table format.
 	tw := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
 	// Print header.
-	if _, err = fmt.Fprintln(tw, "NAME\tSTATE\tADDRESS\tPUBLIC IP\tWIREGUARD ENDPOINTS\tMACHINE ID"); err != nil {
+	if _, err = fmt.Fprintln(tw, "NAME\tSTATE\tADDRESS\tPUBLIC IP\tWIREGUARD ENDPOINTS"); err != nil {
 		return fmt.Errorf("write header: %w", err)
 	}
 	// Print rows.
@@ -63,8 +68,8 @@ func list(ctx context.Context, uncli *cli.CLI) error {
 		}

 		if _, err = fmt.Fprintf(
-			tw, "%s\t%s\t%s\t%s\t%s\t%s\n", m.Name, capitalise(member.State.String()), subnet, publicIP,
-			strings.Join(endpoints, ", "), member.Machine.Id,
+			tw, "%s\t%s\t%s\t%s\t%s\n", m.Name, capitalise(member.State.String()), subnet, publicIP,
+			strings.Join(endpoints, ", "),
 		); err != nil {
 			return fmt.Errorf("write row: %w", err)
 		}
@@ -1,42 +0,0 @@
-package machine
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/spf13/cobra"
-)
-
-func NewRenameCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "rename OLD_NAME NEW_NAME",
-		Short: "Rename a machine in the cluster.",
-		Long: `Rename a machine in the cluster.
-
-This command changes the name of an existing machine while preserving all other
-configuration including network settings, public IP, and cluster membership.`,
-		Args: cobra.ExactArgs(2),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return rename(cmd.Context(), uncli, args[0], args[1])
-		},
-	}
-	return cmd
-}
-
-func rename(ctx context.Context, uncli *cli.CLI, oldName, newName string) error {
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return err
-	}
-	defer client.Close()
-
-	machine, err := client.RenameMachine(ctx, oldName, newName)
-	if err != nil {
-		return fmt.Errorf("rename machine: %w", err)
-	}
-
-	fmt.Printf("Machine %q renamed to %q (ID: %s)\n", oldName, machine.Name, machine.Id)
-	return nil
-}
@@ -14,14 +14,14 @@ import (
 	"github.com/docker/compose/v2/pkg/progress"
 	"github.com/docker/docker/api/types/container"
 	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/spf13/cobra"
 )

 type removeOptions struct {
-	noReset bool
+	force   bool
 	yes     bool
+	context string
 }

 func NewRmCommand() *cobra.Command {
@@ -30,7 +30,7 @@ func NewRmCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "rm MACHINE",
 		Aliases: []string{"remove", "delete"},
-		Short:   "Remove a machine from a cluster and reset it.",
+		Short:   "Remove a machine from a cluster.",
 		Args:    cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
@@ -38,83 +38,51 @@ func NewRmCommand() *cobra.Command {
 		},
 	}

+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)")
 	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
 		"Do not prompt for confirmation before removing the machine.")
-	cmd.Flags().BoolVar(&opts.noReset, "no-reset", false,
-		"Do not reset the machine after removing it from the cluster. This will leave all containers and data intact.")

 	return cmd
 }

-func remove(ctx context.Context, uncli *cli.CLI, nameOrID string, opts removeOptions) error {
-	// TODO: automatically choose a connection to the machine that is not being removed.
-	client, err := uncli.ConnectCluster(ctx)
+func remove(ctx context.Context, uncli *cli.CLI, machineName string, opts removeOptions) error {
+	client, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
 	defer client.Close()

 	// Verify the machine exists and list all service containers on it including stopped ones.
-	mctx, machines, err := client.ProxyMachinesContext(ctx, []string{nameOrID})
+	listCtx, machines, err := api.ProxyMachinesContext(ctx, client, []string{machineName})
 	if err != nil {
 		return err
 	}
 	if len(machines) == 0 {
-		return fmt.Errorf("machine '%s' not found in the cluster", nameOrID)
+		return fmt.Errorf("machine '%s' not found in the cluster", machineName)
 	}
 	m := machines[0].Machine

-	// Verify if the machine being removed is the proxy machine we're connected to.
-	proxyMachine, err := client.MachineClient.Inspect(ctx, nil)
+	listOpts := container.ListOptions{All: true}
+	machineContainers, err := client.Docker.ListServiceContainers(listCtx, "", listOpts)
 	if err != nil {
-		return fmt.Errorf("inspect proxy machine: %w", err)
-	}
-	if proxyMachine.Id == m.Id {
-		allMachines, err := client.ListMachines(ctx, nil)
-		if err != nil {
-			return fmt.Errorf("list machines: %w", err)
-		}
-		if len(allMachines) > 1 {
-			return errors.New("cannot remove the machine you are currently connected to. " +
-				"Please connect to another machine in the cluster and try again. " +
-				"Use --connect flag or update 'connections' for the cluster context in your Uncloud config")
-			// It's ok to remove the proxy machine if it's the last one in the cluster.
-		}
+		return fmt.Errorf("list containers: %w", err)
 	}
+	containers := machineContainers[0].Containers

-	// TODO: mark the machine as being removed and unschedulable when this is possible to prevent new containers
-	//  from being scheduled on it while the removal is in progress.
-
-	reset := !opts.noReset
-	var containers []api.ServiceContainer
-	reachable := false
-	if reset {
-		// Check if the machine is up and has service containers.
-		listOpts := container.ListOptions{All: true}
-		machineContainers, err := client.Docker.ListServiceContainers(mctx, "", listOpts)
-		if err == nil {
-			reachable = true
-			containers = machineContainers[0].Containers
-			if len(containers) > 0 {
-				plural := ""
-				if len(containers) > 1 {
-					plural = "s"
-				}
-				fmt.Printf("Found %d service container%s on machine '%s':\n", len(containers), plural, m.Name)
-				fmt.Println(formatContainerTree(containers))
-				fmt.Println()
-				fmt.Println("This will remove all service containers from the machine, remove it from the cluster, " +
-					"and reset it to the uninitialised state.")
-			} else {
-				fmt.Printf("No service containers found on machine '%s'.\n", m.Name)
-				fmt.Println("This will remove the machine from the cluster and reset it to the uninitialised state.")
-			}
-		} else {
-			fmt.Printf("This will remove machine '%s' from the cluster without resetting it as it's unreachable.\n",
-				m.Name)
+	if len(containers) > 0 {
+		plural := ""
+		if len(containers) > 1 {
+			plural = "s"
 		}
+		fmt.Printf("Found %d service container%s on machine '%s':\n", len(containers), plural, m.Name)
+		fmt.Println(formatContainerTree(containers))
+		fmt.Println()
+		fmt.Println("This will remove all service containers on the machine, reset it to the uninitialised state, " +
+			"and remove it from the cluster.")
 	} else {
-		fmt.Printf("This will remove machine '%s' from the cluster without resetting it.\n", m.Name)
+		fmt.Printf("No service containers found on machine '%s'.\n", m.Name)
+		fmt.Println("This will reset the machine to the uninitialised state and remove it from the cluster.")
 	}

 	if !opts.yes {
@@ -128,50 +96,23 @@ func remove(ctx context.Context, uncli *cli.CLI, nameOrID string, opts removeOpt
 		}
 	}

-	if reset && len(containers) > 0 {
+	if len(containers) > 0 {
 		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
 			return removeContainers(ctx, client, containers)
 		}, uncli.ProgressOut(), "Removing containers")
+
 		if err != nil {
 			return fmt.Errorf("remove containers: %w", err)
 		}
 		fmt.Println()
 	}

-	if _, err = client.RemoveMachine(ctx, &pb.RemoveMachineRequest{Id: m.Id}); err != nil {
-		return fmt.Errorf("remove machine from cluster: %w", err)
-	}
-	fmt.Printf("Machine '%s' removed from the cluster.\n", m.Name)
+	// TODO: 4. Implement and call Reset via Machine API to reset the machine state to uninitialised.
+	// TODO: 5. Remove the machine from the cluster store.

-	if reset && reachable {
-		_, err = client.MachineClient.Reset(mctx, &pb.ResetRequest{})
-		if err != nil {
-			fmt.Printf("WARNING: Failed to reset machine: %v\n", err)
-		} else {
-			fmt.Println("Machine reset initiated and will complete in the background.")
-		}
-	}
-
-	// Remove the connection to the machine from the uncloud config if it exists.
-	if uncli.Config != nil {
-		contextName := uncli.GetContextOverrideOrCurrent()
-		if context, ok := uncli.Config.Contexts[contextName]; ok {
-			for i, c := range context.Connections {
-				if c.MachineID == m.Id {
-					context.Connections = slices.Delete(context.Connections, i, i+1)
-					break
-				}
-			}
-			if err := uncli.Config.Save(); err != nil {
-				return fmt.Errorf("save config: %w", err)
-			}
-		}
-	}
-
-	// TODO: If Caddy was running on this machine and a cluster domain is reserved,
-	//  let the user know that the DNS records should be updated.
-
-	return nil
+	return fmt.Errorf("resetting machine is not fully implemented yet")
+	//fmt.Printf("Machine '%s' removed from the cluster.\n", m.Name)
+	//return nil
 }

 // formatContainerTree formats a list of containers grouped by service as a tree structure.
@@ -8,15 +8,14 @@ func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "machine",
 		Aliases: []string{"m"},
-		Short:   "Manage machines in the cluster.",
+		Short:   "Manage machines in an Uncloud cluster.",
 	}
 	cmd.AddCommand(
 		NewAddCommand(),
 		NewInitCommand(),
 		NewListCommand(),
-		NewRenameCommand(),
 		NewRmCommand(),
-		NewUpdateCommand(),
+		NewTokenCommand(),
 	)
 	return cmd
 }
@@ -0,0 +1,38 @@
+package machine
+
+import (
+	"fmt"
+	"github.com/spf13/cobra"
+	"github.com/psviderski/uncloud/internal/daemon"
+	"github.com/psviderski/uncloud/internal/machine"
+)
+
+type tokenOptions struct {
+	dataDir string
+}
+
+func NewTokenCommand() *cobra.Command {
+	opts := tokenOptions{}
+	cmd := &cobra.Command{
+		Use:   "token",
+		Short: "Print the local machine's token for adding it to a cluster.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			token, err := daemon.MachineToken(opts.dataDir)
+			if err != nil {
+				return fmt.Errorf("get machine token: %w", err)
+			}
+			tokenStr, err := token.String()
+			if err != nil {
+				return fmt.Errorf("encode machine token: %w", err)
+			}
+			fmt.Println(tokenStr)
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.dataDir, "data-dir", "d", machine.DefaultDataDir,
+		"Directory for storing persistent machine state.")
+	_ = cmd.MarkFlagDirname("data-dir")
+
+	return cmd
+}
@@ -1,174 +0,0 @@
-package machine
-
-import (
-	"context"
-	"fmt"
-	"net/netip"
-	"strings"
-
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/internal/machine/api/pb"
-	"github.com/psviderski/uncloud/internal/machine/network"
-	"github.com/spf13/cobra"
-)
-
-type updateOptions struct {
-	name        string
-	publicIP    string
-	wgEndpoints []string
-}
-
-func NewUpdateCommand() *cobra.Command {
-	opts := updateOptions{}
-	cmd := &cobra.Command{
-		Use:   "update MACHINE [flags]",
-		Short: "Update machine configuration in the cluster.",
-		Long: `Update machine configuration in the cluster.
-
-Change the name, public IP address, or WireGuard endpoints of an existing machine.
-At least one flag must be specified to perform an update.`,
-		Example: `  # Rename a machine.
-  uc machine update machine1 --name web-server
-
-  # Set the public IP address of a machine.
-  uc machine update machine1 --public-ip 203.0.113.10
-
-  # Remove the public IP address from a machine.
-  uc machine update machine1 --public-ip none
-
-  # Update WireGuard endpoints for a machine.
-  uc machine update machine1 --wg-endpoint 203.0.113.10 --wg-endpoint 192.168.1.5
-
-  # Update multiple properties at once.
-  uc machine update machine1 --name web-server --public-ip 203.0.113.10`,
-		Args: cobra.ExactArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return update(cmd.Context(), uncli, cmd, opts, args[0])
-		},
-	}
-
-	cmd.Flags().StringVar(
-		&opts.name, "name", "",
-		"New name for the machine",
-	)
-	cmd.Flags().StringVar(
-		&opts.publicIP, "public-ip", "",
-		fmt.Sprintf("Public IP address of the machine for ingress configuration. Use '%s' or '' to remove the public IP.",
-			PublicIPNone),
-	)
-	cmd.Flags().StringSliceVar(
-		&opts.wgEndpoints, "wg-endpoint", nil,
-		fmt.Sprintf("WireGuard endpoint address in format: IP, IP:PORT, IPv6, or [IPv6]:PORT. "+
-			"Default port %d is used if omitted.\n", network.WireGuardPort)+
-			"Other machines in the cluster will use this endpoint to establish a WireGuard connection to this machine.\n"+
-			"Multiple endpoints can be specified by repeating the flag or using a comma-separated list.",
-	)
-
-	return cmd
-}
-
-func update(ctx context.Context, uncli *cli.CLI, cmd *cobra.Command, opts updateOptions, machineNameOrID string) error {
-	// Check if at least one flag was explicitly set.
-	if !cmd.Flags().Changed("name") && !cmd.Flags().Changed("public-ip") && !cmd.Flags().Changed("wg-endpoint") {
-		return fmt.Errorf("at least one update flag must be specified (--name, --public-ip, --wg-endpoint)")
-	}
-
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return err
-	}
-	defer client.Close()
-
-	// First, resolve the machine to get its ID
-	machine, err := client.InspectMachine(ctx, machineNameOrID)
-	if err != nil {
-		return fmt.Errorf("find machine: %w", err)
-	}
-
-	// Build the update request
-	req := &pb.UpdateMachineRequest{
-		MachineId: machine.Machine.Id,
-	}
-
-	if opts.name != "" {
-		req.Name = &opts.name
-	}
-
-	// Check if --public-ip flag was explicitly provided
-	if cmd.Flags().Changed("public-ip") {
-		if opts.publicIP == "" || opts.publicIP == PublicIPNone {
-			req.PublicIp = &pb.IP{} // Empty IP to signal removal
-		} else {
-			// Parse and validate the public IP
-			ip, err := netip.ParseAddr(opts.publicIP)
-			if err != nil {
-				return fmt.Errorf("invalid public IP address %q: %w", opts.publicIP, err)
-			}
-			req.PublicIp = pb.NewIP(ip)
-		}
-	}
-
-	// Parse and set endpoints if the flag was explicitly provided.
-	if cmd.Flags().Changed("wg-endpoint") {
-		expanded := cli.ExpandCommaSeparatedValues(opts.wgEndpoints)
-		endpoints, err := cli.ParseWireGuardEndpoints(expanded)
-		if err != nil {
-			return err
-		}
-		if len(endpoints) == 0 {
-			return fmt.Errorf("at least one endpoint must be specified if --wg-endpoint flag is used")
-		}
-		req.Endpoints = endpoints
-	}
-
-	// Perform the update operation
-	updatedMachine, err := client.UpdateMachine(ctx, req)
-	if err != nil {
-		return fmt.Errorf("update machine: %w", err)
-	}
-
-	// Report what was changed
-	changes := make([]string, 0)
-	if opts.name != "" {
-		changes = append(changes, fmt.Sprintf("name: %q -> %q", machine.Machine.Name, updatedMachine.Name))
-	}
-	if cmd.Flags().Changed("public-ip") {
-		oldIP := PublicIPNone
-		if machine.Machine.PublicIp != nil {
-			if addr, err := machine.Machine.PublicIp.ToAddr(); err == nil {
-				oldIP = addr.String()
-			}
-		}
-		newIP := PublicIPNone
-		if updatedMachine.PublicIp != nil {
-			if addr, err := updatedMachine.PublicIp.ToAddr(); err == nil {
-				newIP = addr.String()
-			}
-		}
-		changes = append(changes, fmt.Sprintf("public IP: %s -> %s", oldIP, newIP))
-	}
-	if cmd.Flags().Changed("wg-endpoint") {
-		formatEndpoints := func(eps []*pb.IPPort) string {
-			if len(eps) == 0 {
-				return "none"
-			}
-			parts := make([]string, len(eps))
-			for i, ep := range eps {
-				ap, _ := ep.ToAddrPort()
-				parts[i] = ap.String()
-			}
-			return strings.Join(parts, ", ")
-		}
-		oldEndpoints := formatEndpoints(machine.Machine.Network.Endpoints)
-		newEndpoints := formatEndpoints(updatedMachine.Network.Endpoints)
-		changes = append(changes, fmt.Sprintf("endpoints: %s -> %s", oldEndpoints, newEndpoints))
-	}
-
-	fmt.Printf("Machine '%s' (ID: %s) configuration updated:\n", updatedMachine.Name, updatedMachine.Id)
-	for _, change := range changes {
-		fmt.Printf("  %s\n", change)
-	}
-
-	return nil
-}
@@ -6,19 +6,15 @@ import (
 	"net/netip"
 	"strings"

-	"github.com/charmbracelet/lipgloss"
 	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
 	cmdcontext "github.com/psviderski/uncloud/cmd/uncloud/context"
 	"github.com/psviderski/uncloud/cmd/uncloud/dns"
-	"github.com/psviderski/uncloud/cmd/uncloud/image"
 	"github.com/psviderski/uncloud/cmd/uncloud/machine"
 	"github.com/psviderski/uncloud/cmd/uncloud/service"
 	"github.com/psviderski/uncloud/cmd/uncloud/volume"
-	"github.com/psviderski/uncloud/cmd/uncloud/wg"
 	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/psviderski/uncloud/internal/cli/config"
 	"github.com/psviderski/uncloud/internal/fs"
-	"github.com/psviderski/uncloud/internal/log"
 	"github.com/psviderski/uncloud/internal/version"
 	"github.com/spf13/cobra"
 )
@@ -26,24 +22,17 @@ import (
 type globalOptions struct {
 	configPath string
 	connect    string
-	context    string
 }

 func main() {
-	log.InitLoggerFromEnv()
-
 	opts := globalOptions{}
 	cmd := &cobra.Command{
-		Use:           "uc",
-		Short:         "A CLI tool for managing Uncloud resources such as machines, services, and volumes.",
+		Use:           "uncloud",
+		Short:         "A CLI tool for managing Uncloud resources such as clusters, machines, and services.",
 		Version:       version.String(),
 		SilenceUsage:  true,
 		SilenceErrors: true,
 		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
-			cli.BindEnvToFlag(cmd, "connect", "UNCLOUD_CONNECT")
-			cli.BindEnvToFlag(cmd, "context", "UNCLOUD_CONTEXT")
-			cli.BindEnvToFlag(cmd, "uncloud-config", "UNCLOUD_CONFIG")
-
 			var conn *config.MachineConnection
 			if opts.connect != "" {
 				if strings.HasPrefix(opts.connect, "tcp://") {
@@ -54,17 +43,11 @@ func main() {
 					conn = &config.MachineConnection{
 						TCP: &addrPort,
 					}
-				} else if strings.HasPrefix(opts.connect, "ssh+cli://") {
-					dest := opts.connect[len("ssh+cli://"):]
-					conn = &config.MachineConnection{
-						SSHCLI: config.SSHDestination(dest),
-					}
-				} else if strings.HasPrefix(opts.connect, "unix://") {
-					conn = &config.MachineConnection{
-						Unix: opts.connect[len("unix://"):],
-					}
 				} else {
-					dest := strings.TrimPrefix(opts.connect, "ssh://")
+					dest := opts.connect
+					if strings.HasPrefix(dest, "ssh://") {
+						dest = dest[len("ssh://"):]
+					}
 					conn = &config.MachineConnection{
 						SSH: config.SSHDestination(dest),
 					}
@@ -72,7 +55,7 @@ func main() {
 			}

 			configPath := fs.ExpandHomeDir(opts.configPath)
-			uncli, err := cli.New(configPath, conn, opts.context)
+			uncli, err := cli.New(configPath, conn)
 			if err != nil {
 				return fmt.Errorf("initialise CLI: %w", err)
 			}
@@ -82,60 +65,28 @@ func main() {
 	}

 	cmd.PersistentFlags().StringVar(&opts.connect, "connect", "",
-		"Connect to a remote cluster machine without using the Uncloud configuration file. [$UNCLOUD_CONNECT]\n"+
-			"Format: [ssh://]user@host[:port], ssh+cli://user@host[:port], tcp://host:port, or unix:///path/to/uncloud.sock")
+		"Connect to a remote cluster machine without using the Uncloud configuration file.\n"+
+			"Format: [ssh://]user@host[:port] or tcp://host:port")
+	// TODO: allow to override using UNCLOUD_CONFIG env var.
 	cmd.PersistentFlags().StringVar(&opts.configPath, "uncloud-config", "~/.config/uncloud/config.yaml",
-		"Path to the Uncloud configuration file. [$UNCLOUD_CONFIG]")
+		"Path to the Uncloud configuration file.")
 	_ = cmd.MarkPersistentFlagFilename("uncloud-config", "yaml", "yml")
-	cmd.PersistentFlags().StringVarP(&opts.context, "context", "c", "",
-		"Name of the cluster context to use (default is the current context). [$UNCLOUD_CONTEXT]")
-
-	// Set custom help function to show links to docs and Discord only for the root 'uc' command.
-	defaultHelpFunc := cmd.HelpFunc()
-	cmd.SetHelpFunc(func(c *cobra.Command, args []string) {
-		defaultHelpFunc(c, args)
-		// Only show links for the root 'uc' command.
-		if c.Name() == "uc" {
-			urlStyle := lipgloss.NewStyle().
-				Underline(true).
-				Foreground(lipgloss.Color("12")) // light blue
-
-			fmt.Fprintln(c.OutOrStdout())
-			fmt.Fprintf(c.OutOrStdout(), "Learn more about Uncloud:       %s\n",
-				urlStyle.Render("https://uncloud.run/docs"))
-			fmt.Fprintf(c.OutOrStdout(), "Join our Discord community:     %s\n",
-				urlStyle.Render("https://uncloud.run/discord"))
-		}
-	})
-
-	cmd.AddGroup(&cobra.Group{
-		ID:    "service",
-		Title: "Deploy and manage services:",
-	})
+	// TODO: make --context a global flag and pass it as a value of the command context.

 	cmd.AddCommand(
-		NewBuildCommand(),
 		NewDeployCommand(),
-		NewDocsCommand(),
-		NewImagesCommand(),
-		NewPsCommand(),
+		NewBuildCommand(),
 		caddy.NewRootCommand(),
 		cmdcontext.NewRootCommand(),
 		dns.NewRootCommand(),
-		image.NewRootCommand(),
 		machine.NewRootCommand(),
 		service.NewRootCommand(),
-		service.NewExecCommand("service"),
-		service.NewInspectCommand("service"),
-		service.NewListCommand("service"),
-		service.NewLogsCommand("service"),
-		service.NewRmCommand("service"),
-		service.NewRunCommand("service"),
-		service.NewScaleCommand("service"),
-		service.NewStartCommand("service"),
-		service.NewStopCommand("service"),
+		service.NewInspectCommand(),
+		service.NewListCommand(),
+		service.NewRmCommand(),
+		service.NewRunCommand(),
+		service.NewScaleCommand(),
 		volume.NewRootCommand(),
-		wg.NewRootCommand(),
 	)
 	cobra.CheckErr(cmd.Execute())
 }
@@ -1,284 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"sort"
-	"time"
-
-	"github.com/charmbracelet/huh/spinner"
-	"github.com/charmbracelet/lipgloss"
-	"github.com/charmbracelet/lipgloss/table"
-	"github.com/docker/docker/api/types/container"
-	"github.com/docker/go-units"
-	"github.com/spf13/cobra"
-
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/pkg/client"
-)
-
-const (
-	sortByService = "service"
-	sortByMachine = "machine"
-	sortByHealth  = "health"
-)
-
-type containerHighlight int
-
-const (
-	highlightDanger containerHighlight = iota
-	highlightWarning
-	highlightSuccess
-	highlightNormal
-)
-
-type psOptions struct {
-	sortBy string
-}
-
-func NewPsCommand() *cobra.Command {
-	opts := psOptions{}
-	cmd := &cobra.Command{
-		Use:   "ps",
-		Short: "List all service containers.",
-		Long: `List all service containers across all machines in the cluster.
-
-This command provides a comprehensive overview of all running containers that are part of a service,
-making it easy to see the distribution and status of containers across the cluster.`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-
-			if opts.sortBy != sortByService && opts.sortBy != sortByMachine && opts.sortBy != sortByHealth {
-				return fmt.Errorf("invalid value for --sort: %q, must be one of '%s', '%s' or '%s'", opts.sortBy,
-					sortByService, sortByMachine, sortByHealth)
-			}
-
-			return runPs(cmd.Context(), uncli, opts)
-		},
-		GroupID: "service",
-	}
-	cmd.Flags().StringVarP(&opts.sortBy, "sort", "s", sortByService,
-		"Sort containers by 'service', 'machine', or 'health'.")
-	return cmd
-}
-
-type containerInfo struct {
-	serviceName string
-	machineName string
-	id          string
-	name        string
-	image       string
-	status      string
-	highlight   containerHighlight
-	created     time.Time
-	ip          string
-}
-
-func runPs(ctx context.Context, uncli *cli.CLI, opts psOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	var containers []containerInfo
-	err = spinner.New().
-		Title(" Collecting container info...").
-		Type(spinner.MiniDot).
-		Style(lipgloss.NewStyle().Foreground(lipgloss.Color("3"))).
-		ActionWithErr(func(ctx context.Context) error {
-			containers, err = collectContainers(ctx, clusterClient)
-			return err
-		}).
-		Run()
-	if err != nil {
-		return fmt.Errorf("collect containers: %w", err)
-	}
-
-	// Sort the containers based on the sorting option.
-	sort.SliceStable(containers, func(i, j int) bool {
-		a, b := containers[i], containers[j]
-		switch opts.sortBy {
-		case sortByHealth:
-			if a.highlight != b.highlight {
-				return a.highlight < b.highlight
-			}
-			if a.serviceName != b.serviceName {
-				return a.serviceName < b.serviceName
-			}
-		case sortByMachine:
-			if a.machineName != b.machineName {
-				return a.machineName < b.machineName
-			}
-			if a.serviceName != b.serviceName {
-				return a.serviceName < b.serviceName
-			}
-		default: // sortByService
-			if a.serviceName != b.serviceName {
-				return a.serviceName < b.serviceName
-			}
-		}
-		// Fallback to creation time (newest first).
-		return a.created.After(b.created)
-	})
-
-	return printContainers(containers)
-}
-
-func printContainers(containers []containerInfo) error {
-	t := table.New().
-		// Remove the default border.
-		Border(lipgloss.Border{}).
-		BorderTop(false).
-		BorderBottom(false).
-		BorderLeft(false).
-		BorderRight(false).
-		BorderHeader(false).
-		BorderColumn(false).
-		StyleFunc(func(row, col int) lipgloss.Style {
-			if row == table.HeaderRow {
-				return lipgloss.NewStyle().Bold(true).PaddingRight(3)
-			}
-			// Regular style for data rows with padding.
-			return lipgloss.NewStyle().PaddingRight(3)
-		})
-
-	t.Headers("SERVICE", "CONTAINER ID", "CONTAINER NAME", "IMAGE", "CREATED", "STATUS", "IP ADDRESS", "MACHINE")
-
-	for _, ctr := range containers {
-		id := ctr.id
-		if len(id) > 12 {
-			id = id[:12]
-		}
-
-		created := units.HumanDuration(time.Now().UTC().Sub(ctr.created)) + " ago"
-
-		var statusStyle lipgloss.Style
-		switch ctr.highlight {
-		case highlightSuccess:
-			statusStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("2")) // Green
-		case highlightDanger:
-			statusStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("1")) // Red
-		case highlightWarning:
-			statusStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("3")) // Yellow
-		default:
-			statusStyle = lipgloss.NewStyle() // Default
-		}
-
-		t.Row(
-			ctr.serviceName,
-			id,
-			ctr.name,
-			ctr.image,
-			created,
-			statusStyle.Render(ctr.status),
-			ctr.ip,
-			ctr.machineName,
-		)
-	}
-
-	fmt.Println(t)
-	return nil
-}
-
-func collectContainers(ctx context.Context, cli *client.Client) ([]containerInfo, error) {
-	listCtx, machines, err := cli.ProxyMachinesContext(ctx, nil)
-	if err != nil {
-		return nil, fmt.Errorf("proxy machines context: %w", err)
-	}
-
-	// Create a map of IP to machine name for resolving response metadata
-	machinesNamesByIP := make(map[string]string)
-	for _, m := range machines {
-		if addr, err := m.Machine.Network.ManagementIp.ToAddr(); err == nil {
-			machinesNamesByIP[addr.String()] = m.Machine.Name
-		}
-	}
-
-	// List all service containers across all machines in the cluster.
-	machineContainers, err := cli.Docker.ListServiceContainers(
-		listCtx, "", container.ListOptions{All: true},
-	)
-	if err != nil {
-		return nil, fmt.Errorf("list service containers: %w", err)
-	}
-
-	var containers []containerInfo
-	for _, msc := range machineContainers {
-		// Metadata can be nil if the request was broadcasted to only one machine.
-		if msc.Metadata == nil && len(machineContainers) > 1 {
-			return nil, fmt.Errorf("something went wrong with gRPC proxy: metadata is missing for a machine response")
-		}
-
-		machineName := "unknown"
-		if msc.Metadata != nil {
-			var ok bool
-			machineName, ok = machinesNamesByIP[msc.Metadata.Machine]
-			if !ok {
-				// Fallback to machine's IP as name.
-				machineName = msc.Metadata.Machine
-			}
-		} else {
-			// Fallback to the first available machine name.
-			if len(machines) > 0 {
-				machineName = machines[0].Machine.Name
-			}
-		}
-
-		if msc.Metadata != nil && msc.Metadata.Error != "" {
-			client.PrintWarning(fmt.Sprintf("failed to list containers on machine %s: %s", machineName,
-				msc.Metadata.Error))
-			continue
-		}
-
-		for _, ctr := range msc.Containers {
-			if ctr.Container.State == nil || ctr.Container.Config == nil {
-				continue
-			}
-
-			status, err := ctr.Container.HumanState()
-			if err != nil {
-				return nil, fmt.Errorf("get human state for container %s: %w", ctr.Container.ID, err)
-			}
-
-			var highlight containerHighlight
-			healthStatus := ""
-			if ctr.Container.State.Health != nil {
-				healthStatus = ctr.Container.State.Health.Status
-			}
-
-			if healthStatus == container.Unhealthy || ctr.Container.State.Status == "dead" || ctr.Container.State.OOMKilled || ctr.Container.State.Dead {
-				highlight = highlightDanger
-			} else if healthStatus == container.Healthy {
-				highlight = highlightSuccess
-			} else if ctr.Container.State.Status == "running" {
-				highlight = highlightNormal
-			} else { // Other non-critical but noteworthy states
-				highlight = highlightWarning
-			}
-
-			created, _ := time.Parse(time.RFC3339Nano, ctr.Container.Created)
-
-			ip := ctr.Container.UncloudNetworkIP()
-			ipStr := ""
-			// The container might not have an IP if it's not running or uses the host network.
-			if ip.IsValid() {
-				ipStr = ip.String()
-			}
-
-			info := containerInfo{
-				serviceName: ctr.ServiceName(),
-				machineName: machineName,
-				id:          ctr.Container.ID,
-				name:        ctr.Container.Name,
-				image:       ctr.Container.Config.Image,
-				status:      status,
-				highlight:   highlight,
-				created:     created,
-				ip:          ipStr,
-			}
-			containers = append(containers, info)
-		}
-	}
-	return containers, nil
-}
@@ -1,442 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"net/netip"
-	"testing"
-
-	"github.com/psviderski/uncloud/internal/machine/api/pb"
-	"github.com/psviderski/uncloud/internal/machine/docker"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/protobuf/types/known/emptypb"
-)
-
-// mockDockerClient implements pb.DockerClient
-type mockDockerClient struct {
-	pb.DockerClient // Embed to avoid implementing all methods
-	listResp        *pb.ListServiceContainersResponse
-	listErr         error
-}
-
-func (m *mockDockerClient) ListServiceContainers(ctx context.Context, in *pb.ListServiceContainersRequest, opts ...grpc.CallOption) (*pb.ListServiceContainersResponse, error) {
-	return m.listResp, m.listErr
-}
-
-// mockClusterClient implements pb.ClusterClient
-type mockClusterClient struct {
-	pb.ClusterClient // Embed to avoid implementing all methods
-	machinesResp     *pb.ListMachinesResponse
-	machinesErr      error
-}
-
-func (m *mockClusterClient) ListMachines(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*pb.ListMachinesResponse, error) {
-	return m.machinesResp, m.machinesErr
-}
-
-func TestCollectContainers_NilMetadata(t *testing.T) {
-	// Setup container data
-	containerData := map[string]interface{}{
-		"Id":   "container1",
-		"Name": "test-container",
-		"Config": map[string]interface{}{
-			"Image": "test-image",
-		},
-		"State": map[string]interface{}{
-			"Status":     "running",
-			"StartedAt":  "2023-01-01T12:00:00Z",
-			"FinishedAt": "0001-01-01T00:00:00Z",
-		},
-		"NetworkSettings": map[string]interface{}{
-			"Networks": map[string]interface{}{},
-		},
-	}
-	containerJSON, err := json.Marshal(containerData)
-	require.NoError(t, err)
-
-	serviceSpecJSON, err := json.Marshal(map[string]interface{}{})
-	require.NoError(t, err)
-
-	// Setup mocks
-	mockDocker := &mockDockerClient{
-		listResp: &pb.ListServiceContainersResponse{
-			Messages: []*pb.MachineServiceContainers{
-				{
-					Metadata: nil, // Simulating the issue: nil metadata
-					Containers: []*pb.ServiceContainer{
-						{
-							Container:   containerJSON,
-							ServiceSpec: serviceSpecJSON,
-						},
-					},
-				},
-			},
-		},
-	}
-
-	machineIP := "10.0.0.1"
-	mockCluster := &mockClusterClient{
-		machinesResp: &pb.ListMachinesResponse{
-			Machines: []*pb.MachineMember{
-				{
-					Machine: &pb.MachineInfo{
-						Name: "machine-1",
-						Network: &pb.NetworkConfig{
-							ManagementIp: pb.NewIP(netip.MustParseAddr(machineIP)),
-						},
-					},
-					State: pb.MachineMember_UP,
-				},
-			},
-		},
-	}
-
-	// Construct client with mocks
-	cli := &client.Client{
-		Docker: &docker.Client{
-			GRPCClient: mockDocker,
-		},
-		ClusterClient: mockCluster,
-	}
-
-	// Execute
-	containers, err := collectContainers(context.Background(), cli)
-	require.NoError(t, err)
-
-	// Verify
-	assert.Len(t, containers, 1)
-	if len(containers) > 0 {
-		c := containers[0]
-		assert.Equal(t, "container1", c.id)
-		assert.Equal(t, "test-container", c.name)
-		assert.Equal(t, "machine-1", c.machineName, "Should fall back to the single machine name when metadata is nil")
-	}
-}
-
-func TestCollectContainers_NilMetadata_MultipleMachines_Error(t *testing.T) {
-	// If we have multiple machines but receive nil metadata, it should return an error as it is ambiguous
-
-	// Setup container data
-	containerData1 := map[string]interface{}{
-		"Id": "container1",
-	}
-	containerJSON1, _ := json.Marshal(containerData1)
-
-	containerData2 := map[string]interface{}{
-		"Id": "container2",
-		"Config": map[string]interface{}{
-			"Image": "test-image",
-		},
-		"State": map[string]interface{}{
-			"Status":     "running",
-			"StartedAt":  "2023-01-01T12:00:00Z",
-			"FinishedAt": "0001-01-01T00:00:00Z",
-		},
-		"NetworkSettings": map[string]interface{}{
-			"Networks": map[string]interface{}{},
-		},
-	}
-	containerJSON2, _ := json.Marshal(containerData2)
-
-	serviceSpecJSON, _ := json.Marshal(map[string]interface{}{})
-
-	// Setup mocks
-	mockDocker := &mockDockerClient{
-		listResp: &pb.ListServiceContainersResponse{
-			Messages: []*pb.MachineServiceContainers{
-				{
-					Metadata: nil, // Nil metadata
-					Containers: []*pb.ServiceContainer{
-						{
-							Container:   containerJSON1,
-							ServiceSpec: serviceSpecJSON,
-						},
-					},
-				},
-				{
-					Metadata: &pb.Metadata{Machine: "10.0.0.2"},
-					Containers: []*pb.ServiceContainer{
-						{
-							Container:   containerJSON2,
-							ServiceSpec: serviceSpecJSON,
-						},
-					},
-				},
-			},
-		},
-	}
-
-	mockCluster := &mockClusterClient{
-		machinesResp: &pb.ListMachinesResponse{
-			Machines: []*pb.MachineMember{
-				{
-					Machine: &pb.MachineInfo{
-						Name: "machine-1",
-						Network: &pb.NetworkConfig{
-							ManagementIp: pb.NewIP(netip.MustParseAddr("10.0.0.1")),
-						},
-					},
-				},
-				{
-					Machine: &pb.MachineInfo{
-						Name: "machine-2",
-						Network: &pb.NetworkConfig{
-							ManagementIp: pb.NewIP(netip.MustParseAddr("10.0.0.2")),
-						},
-					},
-				},
-			},
-		},
-	}
-
-	// Construct client with mocks
-	cli := &client.Client{
-		Docker: &docker.Client{
-			GRPCClient: mockDocker,
-		},
-		ClusterClient: mockCluster,
-	}
-
-	// Execute
-	_, err := collectContainers(context.Background(), cli)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "metadata is missing for a machine response")
-}
-
-func TestCollectContainers_MetadataPresent_MultipleMachines(t *testing.T) {
-	// Verify correct mapping of containers to machines when metadata is present
-
-	// Setup container data
-	containerData1 := map[string]interface{}{
-		"Id":   "container1",
-		"Name": "container-1",
-		"Config": map[string]interface{}{
-			"Image": "image-1",
-		},
-		"State": map[string]interface{}{
-			"Status":     "running",
-			"StartedAt":  "2023-01-01T12:00:00Z",
-			"FinishedAt": "0001-01-01T00:00:00Z",
-		},
-		"NetworkSettings": map[string]interface{}{
-			"Networks": map[string]interface{}{},
-		},
-	}
-	containerJSON1, _ := json.Marshal(containerData1)
-
-	containerData2 := map[string]interface{}{
-		"Id":   "container2",
-		"Name": "container-2",
-		"Config": map[string]interface{}{
-			"Image": "image-2",
-		},
-		"State": map[string]interface{}{
-			"Status":     "running",
-			"StartedAt":  "2023-01-01T12:00:00Z",
-			"FinishedAt": "0001-01-01T00:00:00Z",
-		},
-		"NetworkSettings": map[string]interface{}{
-			"Networks": map[string]interface{}{},
-		},
-	}
-	containerJSON2, _ := json.Marshal(containerData2)
-
-	serviceSpecJSON, _ := json.Marshal(map[string]interface{}{})
-
-	// Setup mocks
-	mockDocker := &mockDockerClient{
-		listResp: &pb.ListServiceContainersResponse{
-			Messages: []*pb.MachineServiceContainers{
-				{
-					Metadata: &pb.Metadata{Machine: "10.0.0.1"},
-					Containers: []*pb.ServiceContainer{
-						{
-							Container:   containerJSON1,
-							ServiceSpec: serviceSpecJSON,
-						},
-					},
-				},
-				{
-					Metadata: &pb.Metadata{Machine: "10.0.0.2"},
-					Containers: []*pb.ServiceContainer{
-						{
-							Container:   containerJSON2,
-							ServiceSpec: serviceSpecJSON,
-						},
-					},
-				},
-			},
-		},
-	}
-
-	mockCluster := &mockClusterClient{
-		machinesResp: &pb.ListMachinesResponse{
-			Machines: []*pb.MachineMember{
-				{
-					Machine: &pb.MachineInfo{
-						Name: "machine-1",
-						Network: &pb.NetworkConfig{
-							ManagementIp: pb.NewIP(netip.MustParseAddr("10.0.0.1")),
-						},
-					},
-				},
-				{
-					Machine: &pb.MachineInfo{
-						Name: "machine-2",
-						Network: &pb.NetworkConfig{
-							ManagementIp: pb.NewIP(netip.MustParseAddr("10.0.0.2")),
-						},
-					},
-				},
-			},
-		},
-	}
-
-	cli := &client.Client{
-		Docker:        &docker.Client{GRPCClient: mockDocker},
-		ClusterClient: mockCluster,
-	}
-
-	containers, err := collectContainers(context.Background(), cli)
-	require.NoError(t, err)
-
-	assert.Len(t, containers, 2)
-	// Order is not guaranteed by the map iteration in logic or parallel fetch (though here it's mocked sequential),
-	// but collectContainers just appends.
-	// We'll find them by ID.
-	for _, c := range containers {
-		if c.id == "container1" {
-			assert.Equal(t, "machine-1", c.machineName)
-		} else if c.id == "container2" {
-			assert.Equal(t, "machine-2", c.machineName)
-		} else {
-			t.Errorf("unexpected container id: %s", c.id)
-		}
-	}
-}
-
-func TestCollectContainers_NilMetadata_NoMachines(t *testing.T) {
-	// Case: 1 msc with nil metadata but no machines at all
-
-	containerData := map[string]interface{}{
-		"Id": "container1",
-		"Config": map[string]interface{}{
-			"Image": "test-image",
-		},
-		"State": map[string]interface{}{
-			"Status":     "running",
-			"StartedAt":  "2023-01-01T12:00:00Z",
-			"FinishedAt": "0001-01-01T00:00:00Z",
-		},
-		"NetworkSettings": map[string]interface{}{
-			"Networks": map[string]interface{}{},
-		},
-	}
-	containerJSON, _ := json.Marshal(containerData)
-	serviceSpecJSON, _ := json.Marshal(map[string]interface{}{})
-
-	mockDocker := &mockDockerClient{
-		listResp: &pb.ListServiceContainersResponse{
-			Messages: []*pb.MachineServiceContainers{
-				{
-					Metadata: nil,
-					Containers: []*pb.ServiceContainer{
-						{
-							Container:   containerJSON,
-							ServiceSpec: serviceSpecJSON,
-						},
-					},
-				},
-			},
-		},
-	}
-
-	// No machines in cluster response
-	mockCluster := &mockClusterClient{
-		machinesResp: &pb.ListMachinesResponse{
-			Machines: []*pb.MachineMember{},
-		},
-	}
-
-	cli := &client.Client{
-		Docker:        &docker.Client{GRPCClient: mockDocker},
-		ClusterClient: mockCluster,
-	}
-
-	containers, err := collectContainers(context.Background(), cli)
-	require.NoError(t, err)
-
-	assert.Len(t, containers, 1)
-	if len(containers) > 0 {
-		assert.Equal(t, "unknown", containers[0].machineName)
-	}
-}
-
-func TestCollectContainers_MetadataPresent_NotInMapping(t *testing.T) {
-	// Case: msc with metadata that is not in the IP-to-name mapping
-
-	containerData := map[string]interface{}{
-		"Id": "container1",
-		"Config": map[string]interface{}{
-			"Image": "test-image",
-		},
-		"State": map[string]interface{}{
-			"Status":     "running",
-			"StartedAt":  "2023-01-01T12:00:00Z",
-			"FinishedAt": "0001-01-01T00:00:00Z",
-		},
-		"NetworkSettings": map[string]interface{}{
-			"Networks": map[string]interface{}{},
-		},
-	}
-	containerJSON, _ := json.Marshal(containerData)
-	serviceSpecJSON, _ := json.Marshal(map[string]interface{}{})
-
-	mockDocker := &mockDockerClient{
-		listResp: &pb.ListServiceContainersResponse{
-			Messages: []*pb.MachineServiceContainers{
-				{
-					Metadata: &pb.Metadata{Machine: "10.0.0.99"}, // Unknown IP
-					Containers: []*pb.ServiceContainer{
-						{
-							Container:   containerJSON,
-							ServiceSpec: serviceSpecJSON,
-						},
-					},
-				},
-			},
-		},
-	}
-
-	mockCluster := &mockClusterClient{
-		machinesResp: &pb.ListMachinesResponse{
-			Machines: []*pb.MachineMember{
-				{
-					Machine: &pb.MachineInfo{
-						Name: "machine-1",
-						Network: &pb.NetworkConfig{
-							ManagementIp: pb.NewIP(netip.MustParseAddr("10.0.0.1")),
-						},
-					},
-				},
-			},
-		},
-	}
-
-	cli := &client.Client{
-		Docker:        &docker.Client{GRPCClient: mockDocker},
-		ClusterClient: mockCluster,
-	}
-
-	containers, err := collectContainers(context.Background(), cli)
-	require.NoError(t, err)
-
-	assert.Len(t, containers, 1)
-	if len(containers) > 0 {
-		// Should fallback to the IP/string in metadata
-		assert.Equal(t, "10.0.0.99", containers[0].machineName)
-	}
-}
@@ -1,133 +0,0 @@
-package service
-
-import (
-	"context"
-	"fmt"
-	"os"
-
-	"github.com/docker/cli/cli/streams"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/spf13/cobra"
-)
-
-type execCliOptions struct {
-	detach      bool
-	interactive bool
-	noTty       bool
-	containerId string
-}
-
-var DEFAULT_COMMAND = []string{"sh", "-c", "command -v bash >/dev/null 2>&1 && exec bash || exec sh"}
-
-func NewExecCommand(groupID string) *cobra.Command {
-	opts := execCliOptions{}
-
-	execCmd := &cobra.Command{
-		Use:   "exec [OPTIONS] SERVICE [COMMAND ARGS...]",
-		Short: "Execute a command in a running service container.",
-		Long: `Execute a command (interactive shell by default) in a running container within a service.
-If the service has multiple replicas and no container ID is specified, the command will be executed in a random container.
-	`,
-		Example: `
-  # Start an interactive shell ("bash" or "sh" will be tried by default)
-  uc exec web-service
-
-  # Start an interactive shell with explicit command
-  uc exec web-service /bin/zsh
-
-  # List files in the specific container of the service; --container accepts full ID or a (unique) prefix
-  uc exec --container d792e web-service ls -la
-
-  # Pipe input to a command inside the service container
-  cat backup.sql | uc exec -T db-service psql -U postgres mydb
-
-  # Run a task in the background (detached mode)
-  uc exec -d web-service /scripts/cleanup.sh`,
-		Args: cobra.MinimumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			serviceName := args[0]
-			command := args[1:]
-			if len(command) == 0 {
-				command = DEFAULT_COMMAND
-			}
-			return runExec(cmd.Context(), uncli, serviceName, command, opts)
-		},
-		GroupID: groupID,
-	}
-
-	execCmd.Flags().BoolVarP(&opts.detach, "detach", "d", false, "Detached mode: run command in the background")
-
-	execCmd.Flags().BoolVarP(&opts.noTty, "no-tty", "T", false,
-		"Disable pseudo-TTY allocation. By default 'uc exec' allocates a TTY when connected to a terminal.")
-
-	// Keep "-i" and "-t" flags hidden for compatibility with docker exec
-	execCmd.Flags().BoolVarP(&opts.interactive, "interactive", "i", true, "Keep STDIN open even if not attached")
-	execCmd.Flags().MarkHidden("interactive")
-
-	execCmd.Flags().BoolP("tty", "t", false, "Allocate a pseudo-TTY")
-	execCmd.Flags().MarkHidden("tty")
-
-	// Common flags
-	execCmd.Flags().StringVar(&opts.containerId, "container", "",
-		"ID of the container to exec into. Accepts full ID or a unique prefix "+
-			"(default is the random container of the service)")
-
-	// This tells Cobra that all flags must come before positional arguments, so that
-	// commands with their own flags can be handled correctly.
-	execCmd.Flags().SetInterspersed(false)
-
-	return execCmd
-}
-
-func runExec(ctx context.Context, uncli *cli.CLI, serviceName string, command []string, opts execCliOptions) error {
-	// Disable TTY allocation if not connected to a terminal
-	if !cli.IsStdoutTerminal() {
-		opts.noTty = true
-	}
-
-	if !opts.detach {
-		// Check if we're trying to attach to a TTY from a non-TTY client, e.g.
-		// when doing an 'cmd | uc exec ...'
-		stdin := streams.NewIn(os.Stdin)
-		// TODO: this logic/behavior mirrors docker-compose, but we can be smarter about it and detect TTY dynamically
-		if err := stdin.CheckTty(opts.interactive, !opts.noTty); err != nil {
-			return fmt.Errorf("check TTY: %w; use -T option to disable TTY allocation", err)
-		}
-	}
-
-	client, err := uncli.ConnectClusterWithOptions(ctx, cli.ConnectOptions{
-		ShowProgress: false,
-	})
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	execConfig := api.ExecOptions{
-		Command:     command,
-		AttachStdin: opts.interactive,
-		Tty:         !opts.noTty,
-		Detach:      opts.detach,
-	}
-
-	if !opts.detach {
-		execConfig.AttachStdout = true
-		execConfig.AttachStderr = true
-	}
-
-	exitCode, err := client.ExecContainer(ctx, serviceName, opts.containerId, execConfig)
-	if err != nil {
-		return fmt.Errorf("exec container: %w", err)
-	}
-
-	// For non-detached mode, exit with the same code as the executed command
-	if !opts.detach {
-		if exitCode != 0 {
-			os.Exit(exitCode)
-		}
-	}
-
-	return nil
-}
@@ -4,22 +4,22 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"slices"
 	"text/tabwriter"
 	"time"

 	"github.com/docker/docker/pkg/stringid"
 	"github.com/docker/go-units"
+
 	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/spf13/cobra"
 )

 type inspectOptions struct {
 	service string
+	cluster string
 }

-func NewInspectCommand(groupID string) *cobra.Command {
+func NewInspectCommand() *cobra.Command {
 	opts := inspectOptions{}
 	cmd := &cobra.Command{
 		Use:   "inspect SERVICE",
@@ -30,13 +30,16 @@ func NewInspectCommand(groupID string) *cobra.Command {
 			opts.service = args[0]
 			return inspect(cmd.Context(), uncli, opts)
 		},
-		GroupID: groupID,
 	}
+	cmd.Flags().StringVarP(
+		&opts.cluster, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
 	return cmd
 }

 func inspect(ctx context.Context, uncli *cli.CLI, opts inspectOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
+	client, err := uncli.ConnectCluster(ctx, opts.cluster)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -56,31 +59,23 @@ func inspect(ctx context.Context, uncli *cli.CLI, opts inspectOptions) error {
 		machinesNamesByID[m.Machine.Id] = m.Machine.Name
 	}

-	fmt.Printf("Service ID: %s\n", svc.ID)
-	fmt.Printf("Name:       %s\n", svc.Name)
-	fmt.Printf("Mode:       %s\n", svc.Mode)
+	fmt.Printf("ID:    %s\n", svc.ID)
+	fmt.Printf("Name:  %s\n", svc.Name)
+	fmt.Printf("Mode:  %s\n", svc.Mode)
 	fmt.Println()

-	// Parse created times for sorting and display.
-	createdTimes := make(map[string]time.Time, len(svc.Containers))
-	for _, ctr := range svc.Containers {
-		createdTimes[ctr.Container.ID], _ = time.Parse(time.RFC3339Nano, ctr.Container.Created)
-	}
-
-	// Sort containers by created time (newest first).
-	slices.SortFunc(svc.Containers, func(a, b api.MachineServiceContainer) int {
-		return createdTimes[b.Container.ID].Compare(createdTimes[a.Container.ID])
-	})
-
 	// Print the list of containers in a table format.
 	tw := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
-	if _, err = fmt.Fprintln(tw, "CONTAINER ID\tIMAGE\tCREATED\tSTATUS\tIP ADDRESS\tMACHINE"); err != nil {
+	if _, err = fmt.Fprintln(tw, "CONTAINER ID\tIMAGE\tCREATED\tSTATUS\tMACHINE"); err != nil {
 		return fmt.Errorf("write header: %w", err)
 	}

-	now := time.Now().UTC()
 	for _, ctr := range svc.Containers {
-		created := units.HumanDuration(now.Sub(createdTimes[ctr.Container.ID])) + " ago"
+		createdAt, err := time.Parse(time.RFC3339Nano, ctr.Container.Created)
+		if err != nil {
+			return fmt.Errorf("parse created time: %w", err)
+		}
+		created := units.HumanDuration(time.Now().UTC().Sub(createdAt)) + " ago"

 		machine := machinesNamesByID[ctr.MachineID]
 		if machine == "" {
@@ -91,21 +86,13 @@ func inspect(ctx context.Context, uncli *cli.CLI, opts inspectOptions) error {
 			return fmt.Errorf("get human state: %w", err)
 		}

-		ip := ctr.Container.UncloudNetworkIP()
-		ipStr := ""
-		// The container might not have an IP if it's not running or uses the host network.
-		if ip.IsValid() {
-			ipStr = ip.String()
-		}
-
 		_, err = fmt.Fprintf(
 			tw,
-			"%s\t%s\t%s\t%s\t%s\t%s\n",
+			"%s\t%s\t%s\t%s\t%s\n",
 			stringid.TruncateID(ctr.Container.ID),
 			ctr.Container.Config.Image,
 			created,
 			state,
-			ipStr,
 			machine,
 		)
 		if err != nil {
@@ -1,358 +0,0 @@
-package service
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"slices"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/charmbracelet/lipgloss"
-	mapset "github.com/deckarep/golang-set/v2"
-	"github.com/docker/docker/pkg/stringid"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/pkg/api"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/psviderski/uncloud/pkg/client/compose"
-	"github.com/spf13/cobra"
-)
-
-type logsOptions struct {
-	files    []string
-	follow   bool
-	tail     string
-	since    string
-	until    string
-	utc      bool
-	machines []string
-}
-
-func NewLogsCommand(groupID string) *cobra.Command {
-	var options logsOptions
-
-	cmd := &cobra.Command{
-		Use:     "logs [SERVICE...]",
-		Aliases: []string{"log"},
-		Short:   "View service logs.",
-		Long: `View logs from all replicas of the specified service(s) across all machines in the cluster.
-
-If no services are specified, streams logs from all services defined in the Compose file
-(compose.yaml by default or the file(s) specified with --file).`,
-		Example: `  # View recent logs for a service.
-  uc logs web
-
-  # Stream logs in real-time (follow mode).
-  uc logs -f web
-
-  # View logs from multiple services.
-  uc logs web api db
-
-  # View logs from all services in compose.yaml.
-  uc logs
-
-  # Show last 20 lines per replica (default is 100).
-  uc logs -n 20 web
-
-  # Show all logs without line limit.
-  uc logs -n all web
-
-  # View logs from a specific time range.
-  uc logs --since 3h --until 1h30m web
-
-  # View logs only from replicas running on specific machines.
-  uc logs -m machine1,machine2 web api`,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return runLogs(cmd.Context(), uncli, args, options)
-		},
-		GroupID: groupID,
-	}
-
-	cmd.Flags().StringSliceVar(&options.files, "file", nil,
-		"One or more Compose files to load service names from when no services are specified. (default compose.yaml)")
-	cmd.Flags().BoolVarP(&options.follow, "follow", "f", false,
-		"Continually stream new logs.")
-	cmd.Flags().StringSliceVarP(&options.machines, "machine", "m", nil,
-		"Filter logs by machine name or ID. Can be specified multiple times or as a comma-separated list.")
-	cmd.Flags().StringVar(&options.since, "since", "",
-		"Show logs generated on or after the given timestamp. Accepts relative duration, RFC 3339 date, or Unix timestamp.\n"+
-			"Examples:\n"+
-			"  --since 2m30s                      Relative duration (2 minutes 30 seconds ago)\n"+
-			"  --since 1h                         Relative duration (1 hour ago)\n"+
-			"  --since 2025-11-24                 RFC 3339 date only (midnight using local timezone)\n"+
-			"  --since 2024-05-14T22:50:00        RFC 3339 date/time using local timezone\n"+
-			"  --since 2024-01-31T10:30:00Z       RFC 3339 date/time in UTC\n"+
-			"  --since 1763953966                 Unix timestamp (seconds since January 1, 1970)")
-	cmd.Flags().StringVarP(&options.tail, "tail", "n", "100",
-		"Show the most recent logs and limit the number of lines shown per replica. Use 'all' to show all logs.")
-	cmd.Flags().StringVar(&options.until, "until", "",
-		"Show logs generated before the given timestamp. Accepts relative duration, RFC 3339 date, or Unix timestamp.\n"+
-			"See --since for examples.")
-	cmd.Flags().BoolVar(&options.utc, "utc", false,
-		"Print timestamps in UTC instead of local timezone.")
-
-	return cmd
-}
-
-func runLogs(ctx context.Context, uncli *cli.CLI, serviceNames []string, opts logsOptions) error {
-	// If no services specified, try to load them from the Compose file(s).
-	fromCompose := false
-	if len(serviceNames) == 0 {
-		fromCompose = true
-		project, err := compose.LoadProject(ctx, opts.files)
-		if err != nil {
-			return fmt.Errorf("load Compose file(s): %w", err)
-		}
-		// View logs for all services, including disabled by inactive profiles.
-		serviceNames = append(project.ServiceNames(), project.DisabledServiceNames()...)
-		if len(serviceNames) == 0 {
-			return errors.New("no services found in Compose file(s)")
-		}
-	}
-
-	// Parse tail option.
-	tail := -1
-	if opts.tail != "all" {
-		tailInt, err := strconv.Atoi(opts.tail)
-		if err != nil {
-			return fmt.Errorf("invalid --tail value '%s': %w", opts.tail, err)
-		}
-		tail = tailInt
-	}
-
-	c, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer c.Close()
-
-	logsOpts := api.ServiceLogsOptions{
-		Follow:   opts.follow,
-		Tail:     tail,
-		Since:    opts.since,
-		Until:    opts.until,
-		Machines: cli.ExpandCommaSeparatedValues(opts.machines),
-	}
-
-	// Collect log streams from all services. When service names come from a Compose file,
-	// skip the ones that are not found in the cluster (they may have been removed or not deployed yet).
-	machineIDsSet := mapset.NewSet[string]()
-	svcStreams := make([]<-chan api.ServiceLogEntry, 0, len(serviceNames))
-	var foundServices, notFoundServices []string
-
-	for _, serviceName := range serviceNames {
-		svc, ch, err := c.ServiceLogs(ctx, serviceName, logsOpts)
-		if err != nil {
-			if errors.Is(err, api.ErrNotFound) && fromCompose {
-				notFoundServices = append(notFoundServices, serviceName)
-				continue
-			}
-			return fmt.Errorf("stream logs for service '%s': %w", serviceName, err)
-		}
-		svcStreams = append(svcStreams, ch)
-		foundServices = append(foundServices, serviceName)
-
-		machineIDs := svc.MachineIDs()
-		machineIDsSet.Append(machineIDs...)
-	}
-
-	if fromCompose {
-		if len(foundServices) == 0 {
-			return fmt.Errorf("stream logs for services defined in %s: no services found in the cluster",
-				strings.Join(opts.files, ", "))
-		}
-		serviceNames = foundServices
-
-		for _, name := range notFoundServices {
-			client.PrintWarning(fmt.Sprintf("service '%s' not found in the cluster, skipping", name))
-		}
-	}
-
-	var stream <-chan api.ServiceLogEntry
-	if len(serviceNames) == 1 {
-		stream = svcStreams[0]
-	} else {
-		// Merge all service streams into a single sorted stream without stall detection as its handled per-service.
-		merger := client.NewLogMerger(svcStreams, client.LogMergerOptions{})
-		stream = merger.Stream()
-	}
-
-	// Fetch machine names for all machines (machineIDsSet) service containers are running on.
-	machines, err := c.ListMachines(ctx, &api.MachineFilter{NamesOrIDs: machineIDsSet.ToSlice()})
-	if err != nil {
-		return fmt.Errorf("list machines: %w", err)
-	}
-	machineNames := make([]string, 0, len(machines))
-	for _, m := range machines {
-		machineNames = append(machineNames, m.Machine.Name)
-	}
-
-	formatter := newLogFormatter(machineNames, serviceNames, opts.utc)
-
-	// Print merged logs.
-	for entry := range stream {
-		if entry.Err != nil {
-			formatter.printError(entry)
-			continue
-		}
-		formatter.printEntry(entry)
-	}
-
-	return nil
-}
-
-// Available colors for machine/service differentiation.
-var colorPalette = []lipgloss.Color{
-	lipgloss.Color("10"), // Bright green
-	lipgloss.Color("11"), // Bright yellow
-	lipgloss.Color("12"), // Bright blue
-	lipgloss.Color("13"), // Bright magenta
-	lipgloss.Color("14"), // Bright cyan
-	lipgloss.Color("2"),  // Green
-	lipgloss.Color("3"),  // Yellow
-	lipgloss.Color("4"),  // Blue
-	lipgloss.Color("5"),  // Magenta
-	lipgloss.Color("6"),  // Cyan
-}
-
-// logFormatter handles formatting and printing of log entries with dynamic column alignment.
-type logFormatter struct {
-	machineNames []string
-	serviceNames []string
-
-	maxMachineWidth int
-	maxServiceWidth int
-
-	utc bool
-}
-
-func newLogFormatter(machineNames, serviceNames []string, utc bool) *logFormatter {
-	slices.Sort(machineNames)
-	slices.Sort(serviceNames)
-
-	maxMachineWidth := 0
-	for _, name := range machineNames {
-		if len(name) > maxMachineWidth {
-			maxMachineWidth = len(name)
-		}
-	}
-
-	maxServiceWidth := 0
-	for _, name := range serviceNames {
-		if len(name) > maxServiceWidth {
-			maxServiceWidth = len(name)
-		}
-	}
-
-	return &logFormatter{
-		machineNames:    machineNames,
-		serviceNames:    serviceNames,
-		maxMachineWidth: maxMachineWidth,
-		maxServiceWidth: maxServiceWidth,
-		utc:             utc,
-	}
-}
-
-// formatTimestamp formats timestamp using local timezone or UTC if configured.
-func (f *logFormatter) formatTimestamp(t time.Time) string {
-	if f.utc {
-		t = t.UTC()
-	} else {
-		t = t.In(time.Local)
-	}
-	dimStyle := lipgloss.NewStyle().Faint(true)
-
-	return dimStyle.Render(t.Format(time.StampMilli))
-}
-
-func (f *logFormatter) formatMachine(name string) string {
-	style := lipgloss.NewStyle().Bold(true).PaddingRight(f.maxMachineWidth - len(name))
-
-	if len(f.serviceNames) == 1 {
-		// Machine name is coloured for single-service logs.
-		i := slices.Index(f.machineNames, name)
-		if i == -1 {
-			f.machineNames = append(f.machineNames, name)
-			i = len(f.machineNames) - 1
-		}
-
-		style = style.Foreground(colorPalette[i%len(colorPalette)])
-	}
-
-	return style.Render(name)
-}
-
-func (f *logFormatter) formatServiceContainer(serviceName, containerID string) string {
-	styleService := lipgloss.NewStyle().Bold(true).PaddingRight(f.maxServiceWidth - len(serviceName))
-	styleContainer := lipgloss.NewStyle().Faint(true)
-
-	if len(f.serviceNames) > 1 {
-		// Service name is coloured for multi-service logs.
-		i := slices.Index(f.serviceNames, serviceName)
-		if i == -1 {
-			f.serviceNames = append(f.serviceNames, serviceName)
-			i = len(f.serviceNames) - 1
-		}
-
-		styleService = styleService.Foreground(colorPalette[i%len(colorPalette)])
-	}
-
-	return styleService.Render(serviceName) + styleContainer.Render("["+containerID[:5]+"]")
-}
-
-// printEntry prints a single log entry with proper formatting.
-func (f *logFormatter) printEntry(entry api.ServiceLogEntry) {
-	if entry.Stream != api.LogStreamStdout && entry.Stream != api.LogStreamStderr {
-		return
-	}
-
-	var output strings.Builder
-
-	// Timestamp
-	output.WriteString(f.formatTimestamp(entry.Timestamp))
-	output.WriteString(" ")
-
-	// Machine name
-	output.WriteString(f.formatMachine(entry.Metadata.MachineName))
-	output.WriteString(" ")
-
-	// Service[container_id]
-	output.WriteString(f.formatServiceContainer(entry.Metadata.ServiceName, entry.Metadata.ContainerID))
-	output.WriteString(" ")
-
-	// Message
-	output.Write(entry.Message)
-
-	// Print to appropriate stream.
-	if entry.Stream == api.LogStreamStderr {
-		fmt.Fprint(os.Stderr, output.String())
-	} else {
-		fmt.Print(output.String())
-	}
-}
-
-// printError prints an error entry (e.g., stalled stream warning).
-func (f *logFormatter) printError(entry api.ServiceLogEntry) {
-	if entry.Metadata.ContainerID != "" {
-		msg := fmt.Sprintf("WARNING: log stream from %s[%s] on machine '%s'",
-			entry.Metadata.ServiceName,
-			stringid.TruncateID(entry.Metadata.ContainerID),
-			entry.Metadata.MachineName)
-
-		if errors.Is(entry.Err, api.ErrLogStreamStalled) {
-			msg += " stopped responding"
-		} else {
-			msg += fmt.Sprintf(": %v", entry.Err)
-		}
-
-		style := lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("11")) // Bold bright yellow
-		fmt.Fprintln(os.Stderr, style.Render(msg))
-	} else {
-		msg := fmt.Sprintf("ERROR: %v", entry.Err)
-		style := lipgloss.NewStyle().Bold(true).Foreground(lipgloss.Color("9")) // Bold bright red
-		fmt.Fprintln(os.Stderr, style.Render(msg))
-	}
-}
@@ -4,31 +4,34 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"slices"
 	"strings"
 	"text/tabwriter"

 	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/spf13/cobra"
 )

-func NewListCommand(groupID string) *cobra.Command {
+func NewListCommand() *cobra.Command {
+	// TODO(lhf): rename to context
+	var cluster string
 	cmd := &cobra.Command{
 		Use:     "ls",
 		Aliases: []string{"list"},
 		Short:   "List services.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli)
+			return list(cmd.Context(), uncli, cluster)
 		},
-		GroupID: groupID,
 	}
+	cmd.Flags().StringVarP(
+		&cluster, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
 	return cmd
 }

-func list(ctx context.Context, uncli *cli.CLI) error {
-	client, err := uncli.ConnectCluster(ctx)
+func list(ctx context.Context, uncli *cli.CLI, clusterName string) error {
+	client, err := uncli.ConnectCluster(ctx, clusterName)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -39,15 +42,15 @@ func list(ctx context.Context, uncli *cli.CLI) error {
 		return fmt.Errorf("list services: %w", err)
 	}

-	// Sort services by name.
+	serviceNames := make(map[string]struct{}, len(services))
 	haveDuplicateNames := false
-	slices.SortFunc(services, func(a, b api.Service) int {
-		if a.Name == b.Name {
+	for _, svc := range services {
+		if _, exists := serviceNames[svc.Name]; exists {
 			haveDuplicateNames = true
-			return strings.Compare(a.ID, b.ID)
+			break
 		}
-		return strings.Compare(a.Name, b.Name)
-	})
+		serviceNames[svc.Name] = struct{}{}
+	}

 	// Print the list of services in a table format.
 	tw := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
@@ -58,29 +61,19 @@ func list(ctx context.Context, uncli *cli.CLI) error {
 			return fmt.Errorf("write header: %w", err)
 		}
 	}
-	if _, err = fmt.Fprintln(tw, "NAME\tMODE\tREPLICAS\tIMAGE\tENDPOINTS"); err != nil {
+	if _, err = fmt.Fprintln(tw, "NAME\tMODE\tREPLICAS\tENDPOINTS"); err != nil {
 		return fmt.Errorf("write header: %w", err)
 	}
 	for _, s := range services {
-		images := strings.Join(s.Images(), ", ")
-		endpoints := strings.Join(s.Endpoints(), ", ")
-
-		// If no endpoints from ports, check if the service uses custom Caddy config.
-		if endpoints == "" {
-			for _, ctr := range s.Containers {
-				if ctr.Container.ServiceSpec.CaddyConfig() != "" {
-					endpoints = "(custom Caddy config)"
-				}
-			}
-		}
+		endpointsSlice := s.Endpoints()
+		endpoints := strings.Join(endpointsSlice, ", ")

 		if haveDuplicateNames {
 			if _, err = fmt.Fprintf(tw, "%s\t", s.ID); err != nil {
 				return fmt.Errorf("write row: %w", err)
 			}
 		}
-		if _, err = fmt.Fprintf(tw, "%s\t%s\t%d\t%s\t%s\n",
-			s.Name, s.Mode, len(s.Containers), images, endpoints); err != nil {
+		if _, err = fmt.Fprintf(tw, "%s\t%s\t%d\t%s\n", s.Name, s.Mode, len(s.Containers), endpoints); err != nil {
 			return fmt.Errorf("write row: %w", err)
 		}
 	}
@@ -11,32 +11,31 @@ import (

 type rmOptions struct {
 	services []string
+	cluster  string
 }

-func NewRmCommand(groupID string) *cobra.Command {
+func NewRmCommand() *cobra.Command {
 	opts := rmOptions{}
 	cmd := &cobra.Command{
 		Use:     "rm SERVICE [SERVICE...]",
 		Aliases: []string{"remove", "delete"},
 		Short:   "Remove one or more services.",
-		Long: `Remove one or more services.
-
-The volumes used by the services are preserved and should be removed separately
-with 'uc volume rm'. Anonymous Docker volumes (automatically created from VOLUME
-directives in image Dockerfiles) are automatically removed with their containers.`,
-		Args: cobra.MinimumNArgs(1),
+		Args:    cobra.MinimumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
 			opts.services = args
 			return rm(cmd.Context(), uncli, opts)
 		},
-		GroupID: groupID,
 	}
+	cmd.Flags().StringVarP(
+		&opts.cluster, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
 	return cmd
 }

 func rm(ctx context.Context, uncli *cli.CLI, opts rmOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
+	client, err := uncli.ConnectCluster(ctx, opts.cluster)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -51,5 +50,5 @@ func rm(ctx context.Context, uncli *cli.CLI, opts rmOptions) error {
 		}, uncli.ProgressOut(), "Removing service "+s)
 	}

-	return err
+	return nil
 }
@@ -8,18 +8,14 @@ func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "service",
 		Aliases: []string{"svc"},
-		Short:   "Manage services in the cluster.",
+		Short:   "Manage services in an Uncloud cluster.",
 	}
 	cmd.AddCommand(
-		NewExecCommand(""),
-		NewInspectCommand(""),
-		NewListCommand(""),
-		NewLogsCommand(""),
-		NewRmCommand(""),
-		NewRunCommand(""),
-		NewScaleCommand(""),
-		NewStartCommand(""),
-		NewStopCommand(""),
+		NewInspectCommand(),
+		NewListCommand(),
+		NewRmCommand(),
+		NewRunCommand(),
+		NewScaleCommand(),
 	)
 	return cmd
 }
@@ -17,7 +17,6 @@ import (
 )

 type runOptions struct {
-	caddyfile         string
 	command           []string
 	cpu               dockeropts.NanoCPUs
 	entrypoint        string
@@ -34,9 +33,11 @@ type runOptions struct {
 	replicas          uint
 	user              string
 	volumes           []string
+
+	cluster string
 }

-func NewRunCommand(groupID string) *cobra.Command {
+func NewRunCommand() *cobra.Command {
 	opts := runOptions{}

 	cmd := &cobra.Command{
@@ -54,12 +55,8 @@ func NewRunCommand(groupID string) *cobra.Command {

 			return run(cmd.Context(), uncli, opts)
 		},
-		GroupID: groupID,
 	}

-	cmd.Flags().StringVar(&opts.caddyfile, "caddyfile", "",
-		"Path to a custom Caddy config (Caddyfile) for the service. "+
-			"Cannot be used together with non-@host published ports.")
 	cmd.Flags().VarP(&opts.cpu, "cpu", "",
 		"Maximum number of CPU cores a service container can use. Fractional values are allowed: "+
 			"0.5 for half a core or 2.25 for two and a quarter cores.")
@@ -85,7 +82,7 @@ func NewRunCommand(groupID string) *cobra.Command {
 		"Give extended privileges to service containers. This is a security risk and should be used with caution.")
 	cmd.Flags().StringSliceVarP(&opts.publish, "publish", "p", nil,
 		"Publish a service port to make it accessible outside the cluster. Can be specified multiple times.\n"+
-			"Format: [hostname:]container_port[/protocol] or [host_ip:]host_port:container_port[/protocol]@host\n"+
+			"Format: [hostname:][load_balancer_port:]container_port[/protocol] or [host_ip:]:host_port:container_port[/protocol]@host\n"+
 			"Supported protocols: tcp, udp, http, https (default is tcp). If a hostname for http(s) port is not specified\n"+
 			"and a cluster domain is reserved, service-name.cluster-domain will be used as the hostname.\n"+
 			"Examples:\n"+
@@ -111,6 +108,11 @@ func NewRunCommand(groupID string) *cobra.Command {
 			"  -v /data/uploads:/app/uploads         	 Bind mount /data/uploads host directory to /app/uploads in container\n"+
 			"  -v /host/path:/container/path:ro 		 Bind mount a host directory or file as read-only")

+	cmd.Flags().StringVarP(
+		&opts.cluster, "context", "c", "",
+		"Name of the cluster context to run the service in. (default is the current context)",
+	)
+
 	return cmd
 }

@@ -120,7 +122,7 @@ func run(ctx context.Context, uncli *cli.CLI, opts runOptions) error {
 		return err
 	}

-	clusterClient, err := uncli.ConnectCluster(ctx)
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.cluster)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -159,15 +161,6 @@ func run(ctx context.Context, uncli *cli.CLI, opts runOptions) error {
 func prepareServiceSpec(opts runOptions) (api.ServiceSpec, error) {
 	var spec api.ServiceSpec

-	caddyfile := ""
-	if opts.caddyfile != "" {
-		data, err := os.ReadFile(opts.caddyfile)
-		if err != nil {
-			return spec, fmt.Errorf("read Caddyfile: %w", err)
-		}
-		caddyfile = strings.TrimSpace(string(data))
-	}
-
 	env, err := parseEnv(opts.env)
 	if err != nil {
 		return spec, err
@@ -225,12 +218,6 @@ func prepareServiceSpec(opts runOptions) (api.ServiceSpec, error) {
 		Volumes:   volumes,
 	}

-	if caddyfile != "" {
-		spec.Caddy = &api.CaddySpec{
-			Config: caddyfile,
-		}
-	}
-
 	// Overwrite the default ENTRYPOINT of the image or reset it if an empty string is passed.
 	if opts.entrypoint != "" {
 		spec.Container.Entrypoint = []string{opts.entrypoint}
@@ -15,9 +15,10 @@ import (
 type scaleOptions struct {
 	service  string
 	replicas uint
+	cluster  string
 }

-func NewScaleCommand(groupID string) *cobra.Command {
+func NewScaleCommand() *cobra.Command {
 	opts := scaleOptions{}
 	cmd := &cobra.Command{
 		Use:   "scale SERVICE REPLICAS",
@@ -36,9 +37,13 @@ func NewScaleCommand(groupID string) *cobra.Command {

 			return scale(cmd.Context(), uncli, opts)
 		},
-		GroupID: groupID,
 	}

+	cmd.Flags().StringVarP(
+		&opts.cluster, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+
 	return cmd
 }

@@ -52,7 +57,7 @@ func scale(ctx context.Context, uncli *cli.CLI, opts scaleOptions) error {
 		)
 	}

-	clusterClient, err := uncli.ConnectCluster(ctx)
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.cluster)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -1,54 +0,0 @@
-//nolint:dupl
-package service
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/spf13/cobra"
-)
-
-type startOptions struct {
-	services []string
-}
-
-func NewStartCommand(groupID string) *cobra.Command {
-	opts := startOptions{}
-	cmd := &cobra.Command{
-		Use:   "start SERVICE [SERVICE...]",
-		Short: "Start one or more services.",
-		Long: `Start one or more previously stopped services.
-
-Starts all containers of the specified service(s) across all machines in the cluster.
-Services can be specified by name or ID.`,
-		Args: cobra.MinimumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			opts.services = args
-			return start(cmd.Context(), uncli, opts)
-		},
-		GroupID: groupID,
-	}
-	return cmd
-}
-
-func start(ctx context.Context, uncli *cli.CLI, opts startOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	for _, s := range opts.services {
-		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-			if err = client.StartService(ctx, s); err != nil {
-				return fmt.Errorf("start service '%s': %w", s, err)
-			}
-			return nil
-		}, uncli.ProgressOut(), "Starting service "+s)
-	}
-
-	return err
-}
@@ -1,68 +0,0 @@
-//nolint:dupl
-package service
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/docker/docker/api/types/container"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/spf13/cobra"
-)
-
-type stopOptions struct {
-	services []string
-	signal   string
-	timeout  int
-}
-
-func NewStopCommand(groupID string) *cobra.Command {
-	opts := stopOptions{}
-	cmd := &cobra.Command{
-		Use:   "stop SERVICE [SERVICE...]",
-		Short: "Stop one or more services.",
-		Long: `Stop one or more running services.
-
-Gracefully stops all containers of the specified service(s) across all machines in the cluster.
-Services can be specified by name or ID. Stopped services can be restarted with 'uc start'.`,
-		Args: cobra.MinimumNArgs(1),
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			opts.services = args
-			return stop(cmd.Context(), uncli, opts)
-		},
-		GroupID: groupID,
-	}
-	cmd.Flags().StringVarP(&opts.signal, "signal", "s", "",
-		"Signal to send to each container's main process.\n"+
-			"Can be a signal name (SIGTERM, SIGINT, SIGHUP, etc.) or a number. (default SIGTERM)")
-	cmd.Flags().IntVarP(&opts.timeout, "timeout", "t", 10,
-		"Seconds to wait for each container to stop gracefully before forcibly killing it with SIGKILL.\n"+
-			"Use -1 to wait indefinitely.")
-	return cmd
-}
-
-func stop(ctx context.Context, uncli *cli.CLI, opts stopOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	stopOpts := container.StopOptions{
-		Signal:  opts.signal,
-		Timeout: &opts.timeout,
-	}
-
-	for _, s := range opts.services {
-		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-			if err = client.StopService(ctx, s, stopOpts); err != nil {
-				return fmt.Errorf("stop service '%s': %w", s, err)
-			}
-			return nil
-		}, uncli.ProgressOut(), "Stopping service "+s)
-	}
-
-	return err
-}
@@ -19,6 +19,7 @@ type createOptions struct {
 	driverOpts []string
 	labels     []string
 	machine    string
+	context    string
 }

 func NewCreateCommand() *cobra.Command {
@@ -49,12 +50,14 @@ func NewCreateCommand() *cobra.Command {
 		"Labels to assign to the volume in the form of 'key=value' pairs. Can be specified multiple times.")
 	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
 		"Name or ID of the machine to create the volume on.")
+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)")

 	return cmd
 }

 func create(ctx context.Context, uncli *cli.CLI, name string, opts createOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
+	client, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -13,6 +13,7 @@ import (

 type inspectOptions struct {
 	machine string
+	context string
 }

 func NewInspectCommand() *cobra.Command {
@@ -31,12 +32,14 @@ func NewInspectCommand() *cobra.Command {
 	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
 		"Name or ID of the machine where the volume is located. "+
 			"If not specified, the volume will be searched across all machines.")
+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)")

 	return cmd
 }

 func inspect(ctx context.Context, uncli *cli.CLI, name string, opts inspectOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
+	client, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -16,6 +16,7 @@ import (
 type listOptions struct {
 	machines []string
 	quiet    bool
+	context  string
 }

 func NewListCommand() *cobra.Command {
@@ -37,11 +38,14 @@ func NewListCommand() *cobra.Command {
 	cmd.Flags().BoolVarP(&opts.quiet, "quiet", "q", false,
 		"Only display volume names.")

+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)")
+
 	return cmd
 }

 func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
+	client, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -14,6 +14,7 @@ type removeOptions struct {
 	force    bool
 	machines []string
 	yes      bool
+	context  string
 }

 func NewRemoveCommand() *cobra.Command {
@@ -40,11 +41,14 @@ func NewRemoveCommand() *cobra.Command {
 	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
 		"Do not prompt for confirmation before removing the volume(s).")

+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)")
+
 	return cmd
 }

 func remove(ctx context.Context, uncli *cli.CLI, names []string, opts removeOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
+	client, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -7,7 +7,7 @@ import (
 func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "volume",
-		Short: "Manage volumes in the cluster.",
+		Short: "Manage volumes in an Uncloud cluster.",
 	}
 	cmd.AddCommand(
 		NewCreateCommand(),
@@ -1,132 +0,0 @@
-package wg
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"strings"
-	"text/tabwriter"
-	"time"
-
-	"github.com/docker/go-units"
-	"github.com/psviderski/uncloud/internal/cli"
-	"github.com/spf13/cobra"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-)
-
-func NewRootCommand() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "wg",
-		Short: "Inspect WireGuard network",
-	}
-	cmd.AddCommand(newShowCommand())
-	return cmd
-}
-
-type showOptions struct {
-	machine string
-}
-
-func newShowCommand() *cobra.Command {
-	opts := showOptions{}
-	cmd := &cobra.Command{
-		Use:   "show",
-		Short: "Show WireGuard network configuration for a machine.",
-		Long: "Show the WireGuard network configuration for the machine currently connected to " +
-			"(or specified by the global --connect flag).",
-		Args: cobra.NoArgs,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return runShow(cmd.Context(), uncli, opts)
-		},
-	}
-	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
-		"Name or ID of the machine to show the configuration for. (default is connected machine)")
-	return cmd
-}
-
-func runShow(ctx context.Context, uncli *cli.CLI, opts showOptions) error {
-	client, err := uncli.ConnectCluster(ctx)
-	if err != nil {
-		return fmt.Errorf("connection failed: %w", err)
-	}
-	defer client.Close()
-
-	if opts.machine != "" {
-		// Proxy requests to the specified machine.
-		ctx, _, err = client.ProxyMachinesContext(ctx, []string{opts.machine})
-		if err != nil {
-			return err
-		}
-	}
-
-	resp, err := client.MachineClient.InspectWireGuardNetwork(ctx, nil)
-	if err != nil {
-		if status.Code(err) == codes.Unimplemented {
-			return fmt.Errorf("inspect WireGuard network: "+
-				"make sure the target machine is running uncloudd daemon version >= 0.16.0: %w", err)
-		}
-		return err
-	}
-
-	machines, err := client.ListMachines(ctx, nil)
-	if err != nil {
-		return fmt.Errorf("list machines: %w", err)
-	}
-	machinesNamesByPublicKey := make(map[string]string)
-	for _, m := range machines {
-		publicKey := wgtypes.Key(m.Machine.Network.PublicKey).String()
-		machinesNamesByPublicKey[publicKey] = m.Machine.Name
-	}
-
-	// Fetch the machine's name for more descriptive output
-	inspectResp, err := client.MachineClient.InspectMachine(ctx, nil)
-	if err == nil {
-		fmt.Printf("Machine name:         %s\n", inspectResp.Machines[0].Machine.Name)
-	}
-
-	fmt.Printf("WireGuard interface:  %s\n", resp.InterfaceName)
-	fmt.Printf("WireGuard public key: %s\n", wgtypes.Key(resp.PublicKey).String())
-	fmt.Printf("WireGuard port:       %d\n", resp.ListenPort)
-	fmt.Println()
-
-	if len(resp.Peers) == 0 {
-		fmt.Println("No WireGuard peers configured.")
-		return nil
-	}
-
-	tw := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
-	if _, err = fmt.Fprintln(tw, "PEER\tPUBLIC KEY\tENDPOINT\tHANDSHAKE\tRECEIVED\tSENT\tALLOWED IPS"); err != nil {
-		return fmt.Errorf("write header: %w", err)
-	}
-
-	for _, peer := range resp.Peers {
-		machineName, ok := machinesNamesByPublicKey[wgtypes.Key(peer.PublicKey).String()]
-		if !ok {
-			machineName = "(unknown)"
-		}
-
-		lastHandshake := ""
-		if peer.LastHandshakeTime != nil {
-			lastHandshake = time.Since(peer.LastHandshakeTime.AsTime()).Round(time.Second).String() + " ago"
-		}
-
-		_, err = fmt.Fprintf(
-			tw,
-			"%s\t%s\t%s\t%s\t%s\t%s\t%s\n",
-			machineName,
-			wgtypes.Key(peer.PublicKey).String(),
-			peer.Endpoint,
-			lastHandshake,
-			units.HumanSize(float64(peer.ReceiveBytes)),
-			units.HumanSize(float64(peer.TransmitBytes)),
-			strings.Join(peer.AllowedIps, ", "),
-		)
-		if err != nil {
-			return fmt.Errorf("write row: %w", err)
-		}
-	}
-	return tw.Flush()
-}
@@ -1,128 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"os"
-
-	"github.com/psviderski/uncloud/internal/machine"
-	"github.com/spf13/cobra"
-)
-
-func newDialStdioCommand() *cobra.Command {
-	var socketPath string
-
-	cmd := &cobra.Command{
-		Use:    "dial-stdio",
-		Short:  "Proxy stdin/stdout to the Uncloud API socket",
-		Hidden: true,
-		RunE: func(cmd *cobra.Command, args []string) error {
-			return runDialStdio(cmd.Context(), socketPath, os.Stdin, os.Stdout)
-		},
-	}
-
-	cmd.Flags().StringVar(&socketPath, "socket", machine.DefaultUncloudSockPath,
-		"Path to the Uncloud API socket")
-
-	return cmd
-}
-
-// halfReadCloser is the read side of a half-duplex connection.
-type halfReadCloser interface {
-	io.Reader
-	CloseRead() error
-}
-
-// halfWriteCloser is the write side of a half-duplex connection.
-type halfWriteCloser interface {
-	io.Writer
-	CloseWrite() error
-}
-
-// halfReadCloserWrapper wraps an io.ReadCloser to implement halfReadCloser.
-type halfReadCloserWrapper struct {
-	io.ReadCloser
-}
-
-func (x *halfReadCloserWrapper) CloseRead() error {
-	return x.Close()
-}
-
-// halfWriteCloserWrapper wraps an io.WriteCloser to implement halfWriteCloser.
-type halfWriteCloserWrapper struct {
-	io.WriteCloser
-}
-
-func (x *halfWriteCloserWrapper) CloseWrite() error {
-	return x.Close()
-}
-
-func runDialStdio(ctx context.Context, socketPath string, stdin io.Reader, stdout io.Writer) error {
-	// Connect to the unix socket.
-	var dialer net.Dialer
-	conn, err := dialer.DialContext(ctx, "unix", socketPath)
-	if err != nil {
-		return fmt.Errorf("connect to socket %q: %w", socketPath, err)
-	}
-	defer conn.Close()
-
-	// Wrap stdin/stdout to support half-closing.
-	var stdinCloser halfReadCloser
-	if c, ok := stdin.(halfReadCloser); ok {
-		stdinCloser = c
-	} else if c, ok := stdin.(io.ReadCloser); ok {
-		stdinCloser = &halfReadCloserWrapper{c}
-	}
-
-	var stdoutCloser halfWriteCloser
-	if c, ok := stdout.(halfWriteCloser); ok {
-		stdoutCloser = c
-	} else if c, ok := stdout.(io.WriteCloser); ok {
-		stdoutCloser = &halfWriteCloserWrapper{c}
-	}
-
-	// Copy data bidirectionally between stdin/stdout and the socket.
-	stdin2socket := make(chan error, 1)
-	socket2stdout := make(chan error, 1)
-
-	// Copy from stdin to socket.
-	go func() {
-		_, err := io.Copy(conn, stdin)
-		stdin2socket <- err
-		// Close write side of connection after stdin is done.
-		if unixConn, ok := conn.(*net.UnixConn); ok {
-			unixConn.CloseWrite()
-		}
-		if stdinCloser != nil {
-			stdinCloser.CloseRead()
-		}
-	}()
-
-	// Copy from socket to stdout.
-	go func() {
-		_, err := io.Copy(stdout, conn)
-		socket2stdout <- err
-		// Close read side of connection after socket is done sending.
-		if unixConn, ok := conn.(*net.UnixConn); ok {
-			unixConn.CloseRead()
-		}
-		if stdoutCloser != nil {
-			stdoutCloser.CloseWrite()
-		}
-	}()
-
-	select {
-	case err = <-stdin2socket:
-		if err != nil {
-			return err
-		}
-		// wait for stdout
-		err = <-socket2stdout
-	case err = <-socket2stdout:
-		// return immediately, matching Docker's approach
-		// (stdin is never closed when TTY)
-	}
-	return err
-}
@@ -42,9 +42,6 @@ func main() {
 		"Directory for storing persistent machine state")
 	_ = cmd.MarkFlagDirname("data-dir")

-	// Add dial-stdio subcommand.
-	cmd.AddCommand(newDialStdioCommand())
-
 	// ctx is canceled when the daemon command is interrupted.
 	ctx, cancel := context.WithCancel(context.Background())

@@ -2,9 +2,7 @@
 *

 # Allow files and directories.
-!blog/
 !docs/
-!landing/
 !src/
 !static/
 !pkg/
@@ -5,5 +5,5 @@
 :8000 {
    root * /usr/share/caddy
    file_server
-    log
+    try_files {path} /index.html
 }
@@ -19,12 +19,9 @@ RUN npm ci
 ## Build the static site.
 RUN npm run build

-# Stage 3: Serve static Docusaurus site and landing page with Caddy.
+# Stage 3: Serve static site with Caddy.
 FROM caddy:2.10.0-alpine AS caddy
 ## Copy the Caddyfile.
 COPY ./Caddyfile /etc/caddy/Caddyfile
 ## Copy the Docusaurus build output.
 COPY --from=prod /opt/docusaurus/build /usr/share/caddy
-# Copy the landing page assets.
-COPY landing/images /usr/share/caddy/images
-COPY landing/index.html landing/style.css /usr/share/caddy/
@@ -0,0 +1,41 @@
+# Website
+
+This website is built using [Docusaurus](https://docusaurus.io/), a modern static website generator.
+
+### Installation
+
+```
+$ yarn
+```
+
+### Local Development
+
+```
+$ yarn start
+```
+
+This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.
+
+### Build
+
+```
+$ yarn build
+```
+
+This command generates static content into the `build` directory and can be served using any static contents hosting service.
+
+### Deployment
+
+Using SSH:
+
+```
+$ USE_SSH=true yarn deploy
+```
+
+Not using SSH:
+
+```
+$ GIT_USER=<Your GitHub username> yarn deploy
+```
+
+If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the `gh-pages` branch.
@@ -1,31 +1,39 @@
---
-title: How to connect Docker containers across multiple hosts with WireGuard
-description: Learn how to configure a WireGuard overlay network that lets Docker containers securely communicate
-  across multiple hosts. No exposed ports needed.
-slug: connect-docker-containers-across-hosts-wireguard
-image: ./wireguard-overlay.png
-authors: psviderski
-tags: [ docker, wireguard, networking, vpn ]
---
+# WireGuard overlay network for Docker containers

-You want your Docker containers to talk to each other, but they're running on different machines. Perhaps across
-different cloud providers or mixing cloud with on-prem. The usual approach of mapping services to host ports quickly
-becomes a pain. Worse, if they're on the public internet, you need to secure every exposed endpoint with TLS and auth.
+# How to connect Docker containers across multiple hosts using WireGuard

-What if your containers on different machines could communicate directly without exposing any ports? Using their private
-Docker IPs, as if they were on the same machine. Here's how you can use pure WireGuard and some clever networking tricks
-to make this work.
+# Connect Docker containers across multiple hosts with WireGuard
+
+You have Docker containers running on different Linux machines. You want container A on one machine to talk directly to
+container B on another machine using their private IPs. For example, to run your application and database containers on
+separate machines without exposing them publicly. Here's how you can use pure WireGuard and some networking tricks to
+make this work.
+
+I implemented this technique to enable cross-machine container communication in
+[Uncloud](https://github.com/psviderski/uncloud), an open source clustering and deployment tool for Docker.
+
+* [What we're building](#what-were-building)
+* [Prequisites](#prerequisites)
+* [Step 1: Configure Docker networks](#step-1-configure-docker-networks)
+* [Step 2: Connect Docker networks with WireGuard](#step-2-connect-docker-networks-with-wireguard)
+* [Step 3: Configure IP routing](#step-3-configure-ip-routing)
+* [Step 4: Testing](#step-4-testing)
+* [Step 5: Make the configuration persistent](#step-5-make-the-configuration-persistent)
+* [Scaling beyond two machines and limitations](#scaling-beyond-two-machines-and-limitations)
+* [Automating with Uncloud](#automating-with-uncloud)
+* [Alternative solutions](#alternative-solutions)
+* [Conclusion](#conclusion)

 ## What we're building

 Docker containers are typically connected to a [bridge network](https://docs.docker.com/engine/network/drivers/bridge/)
 on their host machine, which allows them to communicate with each other. A bridge network also provides isolation from
-containers not connected to it and other networks on the host. What we want to achieve is connecting these bridge
+containers not connected to it and other networks on the host. What we want to achieve is to connect these bridge
 networks across machines so that containers on different machines can communicate as if they were connected to the same
 local bridge network.

 The incantation we need is called a site-to-site VPN. Any solution would work. Moreover, if the machines are on the same
-local network, they're already connected and only lack the appropriate routing configuration. But I'll describe a more
+local network, they're already connected and only miss the appropriate routing configuration. But I'll describe a more
 versatile approach that works even when the machines are on different continents or behind NAT. WireGuard is the ideal
 solution for this use case: it's lightweight, [fast](https://www.wireguard.com/performance/), simple to configure,
 provides [strong security](https://www.wireguard.com/protocol/) and NAT traversal.
@@ -37,21 +45,19 @@ communicate with each other using their private IPs.

 I will use these two machines:

-* Machine 1: Debian 12 virtual machine in my homelab network in Australia, which is behind NAT
+* Machine 1: Debian 12 virtual machine in my homelab network in Australia which is behind NAT
 * Machine 2: Ubuntu 24.04 server from Hetzner in Finland that has a public IP

-![WireGuard overlay network](wireguard-overlay.png)
-
-<!-- truncate -->
+![wireguard-overlay.png](wireguard-overlay.png)

 ## Prerequisites

- Basic knowledge of [Docker networking](https://docs.docker.com/network/) and [WireGuard](https://www.wireguard.com/).
+* Basic knowledge of [Docker networking](https://docs.docker.com/network/) and [WireGuard](https://www.wireguard.com/).
  If you're new to these topics, you might want to read up on them first.
- At least two Linux machines with root access and Docker installed. They should be on the same network or be able to
-  communicate over the internet.
+* At least two Linux machines with root access and Docker installed. They should be on the same network or reachable
+  over the internet.

-## Step 1: Configure Docker networks
+# Step 1: Configure Docker networks

 Most of the commands in this guide require root privileges. You can run them with `sudo` or log in as root. I'll start
 root shells on both machines with `sudo -i` for convenience.
@@ -64,7 +70,7 @@ Therefore, let's create new Docker bridge networks on each machine with manually
 choose any subnets from
 the [private IPv4 address ranges](https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses)
 that do not overlap with each other or with your existing networks. I'll use `10.200.1.0/24` and `10.200.2.0/24`
-for Machine 1 and Machine 2, respectively. They don't even need to be sequential or be part of the same larger network.
+for Machine 1 and Machine 2 respectively. They don't even need to be sequential or be part of the same larger network.
 However, using a common parent network (like `10.200.0.0/16` in my case) can simplify firewall rules and make it easier
 to manage more machines later.

@@ -81,16 +87,16 @@ Starting with Docker 28.2.0 ([PR](https://github.com/moby/moby/pull/49832)), you
 host interfaces you
 allow [direct routing](https://docs.docker.com/engine/network/packet-filtering-firewalls/#direct-routing) to containers
 in bridge networks. This is done by specifying the `com.docker.network.bridge.trusted_host_interfaces` option when
-creating the network. In our case, we want to allow routing via the WireGuard interface `wg0` that will be created in
-the next step.
+creating the network. In our case, we want to allow routing via the WireGuard interface `wg0` that we be created in the
+next step.

-Provide this option even if you're using an older Docker version, as it'll be required if you upgrade Docker in the
+Provide this option even if you're using an older Docker version as it'll be required if you upgrade Docker in the
 future.

 ## Step 2: Connect Docker networks with WireGuard

-By default, WireGuard uses the UDP port 51820 for communication. To establish a tunnel, at least one of the machines
-needs to be able to reach the other's port over the internet or local network. Please make sure it's not blocked by a
+By default, WireGuard uses the UDP port 51280 for communication. To establish a tunnel, at least one of the machines
+need to be able to reach the other's port over the internet or local network. Please make sure it's not blocked by a
 firewall on both machines.

 For example, when using `iptables`, you can allow incoming UDP traffic on port 51820 with the following command:
@@ -122,7 +128,7 @@ PrivateKey = <replace with 'privatekey' file content from Machine 1>

 [Peer]
 PublicKey = <replace with 'publickey' file content from Machine 2>
-# IP ranges for which a peer will route traffic: Docker subnet on Machine 2
+# IP ranges for which a peer will route traffic - Docker subnet on Machine 2
 AllowedIPs = 10.200.2.0/24
 # Public IP of Machine 2
 Endpoint = 157.180.72.195:51820
@@ -139,7 +145,7 @@ PrivateKey = <replace with 'privatekey' file content from Machine 2>

 [Peer]
 PublicKey = <replace with 'publickey' file content from Machine 1>
-# IP ranges for which a peer will route traffic: Docker subnet on Machine 1
+# IP ranges for which a peer will route traffic - Docker subnet on Machine 1
 AllowedIPs = 10.200.1.0/24
 # Reachable endpoint of Machine 1
 # Endpoint =
@@ -156,14 +162,14 @@ In my case, Machine 1 is behind NAT in my private homelab network which is not r
 server (Machine 2). The bidirectional tunnel can still be established in this case but Machine 1 must initiate the
 connection.

-If both of your machines are reachable from each other, you should specify the `Endpoint` option in both configs which
+If both of your machine are reachable from each other, you should specify the `Endpoint` option in both configs which
 will allow them to establish the connection without waiting for the other side to initiate it. If both of your machines
 are behind NAT, see [NAT to NAT Connections](https://github.com/pirate/wireguard-docs#NAT-to-NAT-Connections) for more
 information.

-Note also that we don't set the `Address` option in the configs because we don't want to assign any IP addresses to the
+Note also that we don't set `Address` option in the configs because we don't want to assign any IP addresses to the
 WireGuard interfaces. We want the tunnel to only encapsulate and transfer packets from the `multi-host` bridge networks
-and don't want either end of it to be the destination for the packets.
+and don't want any end of it to be the destination for the packets.

 As the key pairs are now specified in the configuration files, you can remove the `privatekey` and `publickey` files on
 both machines:
@@ -199,19 +205,14 @@ If you see the `latest handshake` time updating, it means the tunnel is working

 ## Step 3: Configure IP routing

-You've established the WireGuard tunnel, but packets between containers won't flow yet. You need to configure IP routing
-between the tunnel and the container networks.
-
 Docker daemon automatically enables IP forwarding in the kernel when it starts, so you don't need to manually configure
 `net.ipv4.ip_forward` with `sysctl`.

-The challenge is that Docker blocks traffic between external interfaces and container networks by default for security
-reasons. You need to explicitly allow WireGuard traffic from `wg0` interface to reach your containers via the
-`multi-host` bridge interface. Docker uses iptables, so you can allow this traffic by adding a rule to the `FORWARD`
-chain before any other Docker-managed rules that would drop it.
-
-Fortunately, Docker creates a special `DOCKER-USER` chain exactly for this purpose. It's processed before other
-Docker-managed chains, allowing you to add custom rules that won't be overridden by Docker.
+However, Docker blocks traffic between external interfaces and container networks by default for security. You need to
+explicitly allow WireGuard traffic from `wg0` interface to reach your containers via the `multi-host` bridge interface.
+Docker uses iptables, so you can allow this traffic by adding a rule to the `FORWARD` chain before any other
+Docker-managed rules that would drop it. Luckily, Docker creates a special `DOCKER-USER` chain exactly for this purpose
+that the `FORWARD` chain jumps to before jumping to any other Docker-managed chains.

 To create the required iptables rule, you need to find the bridge interface name for the `multi-host` network you
 created earlier. It's named `br-<short-network-id>`, where `<short-network-id>` is the first 12 characters of the
@@ -219,7 +220,7 @@ network ID.

 Add the iptables rule to allow traffic from `wg0` to `multi-host` bridge on Machine 1:

-```shell
+```bash
 $ docker network ls -f name=multi-host
 NETWORK ID     NAME         DRIVER    SCOPE
 661096b2a5d9   multi-host   bridge    local
@@ -228,14 +229,14 @@ $ iptables -I DOCKER-USER -i wg0 -o br-661096b2a5d9 -j ACCEPT

 Add the iptables rule to allow traffic from `wg0` to `multi-host` bridge on Machine 2:

-```shell
+```bash
 $ docker network ls -f name=multi-host
 NETWORK ID     NAME         DRIVER    SCOPE
 48f808048e7c   multi-host   bridge    local
 $ iptables -I DOCKER-USER -i wg0 -o br-48f808048e7c -j ACCEPT
 ```

-The traffic in the other direction (from `multi-host` bridge to `wg0`) is not blocked by Docker by default. But it still
+The traffic the other way around (from `multi-host` bridge to `wg0`) is not blocked by Docker by default. But it still
 won't be able to make it through the tunnel. The reason is that Docker creates a `MASQUERADE` rule in the `nat` table
 for every bridge network with option
 [`com.docker.network.bridge.enable_ip_masquerade`](https://docs.docker.com/engine/network/drivers/bridge/#options) set
@@ -245,13 +246,13 @@ to `true` (which is the default). In my case, the rule looks like this on Machin
 POSTROUTING -s 10.200.1.0/24 ! -o br-661096b2a5d9 -j MASQUERADE
 ```

-This essentially configures NAT for all external traffic coming from containers which is necessary for allowing them to
+This essentially configures NAT for all external traffic coming from containers which is necessary to allow them to
 access the internet and other external networks. However, it equally applies to the traffic going through the `wg0`
 interface. It tries to masquerade the source IP address of the packets with the IP address of the `wg0` interface and
 fails because the `wg0` interface doesn't have an IP. This results in the packets being
 [dropped](https://elixir.bootlin.com/linux/v6.15.5/source/net/netfilter/nf_nat_masquerade.c#L54-L58).

-You could assign an IP address to `wg0` but this would cause the following unwanted side effects:
+You cloud assign an IP address to `wg0` but this would cause the following unwanted side effects:

 - Containers from other Docker networks on the same machine could route through the tunnel to reach remote `multi-host`
  containers, violating Docker's network isolation model.
@@ -321,7 +322,7 @@ PING 10.200.2.2 (10.200.2.2): 56 data bytes
 64 bytes from 10.200.2.2: seq=2 ttl=62 time=297.285 ms
 ```

-Both hosts have IPs assigned to the `multi-host` bridges, `10.200.1.1` and `10.200.2.1` respectively, which should also
+Both hosts have IPs assigned to the `multi-host` bridges, `10.200.1.1` and `10.200.2.1` respectively which should aslo
 be reachable from the containers or hosts on both machines.

 You can see from the `ping` command the latency is quite high (~300 ms) in my case because the packets have to travel
@@ -343,12 +344,12 @@ be to use `PostUp` and `PostDown` options in the WireGuard configs to automatica
 starts/stops.

 Append the following lines to the `[Interface]` section in `/etc/wireguard/wg0.conf`. Make sure to replace
-`<network-id>` with your actual Docker network ID from [Step 3](#step-3-configure-ip-routing). The `%i` is replaced by
-WireGuard with the interface name (`wg0`).
+`<network-id>` with your actual Docker network ID from Step 3. The `%i` is replaced by WireGuard with the interface
+name (`wg0`).

 On Machine 1:

-```ini
+```shell
 [Interface]
 ...
 PostUp = iptables -I DOCKER-USER -i %i -o br-<network-id> -j ACCEPT; iptables -t nat -I POSTROUTING -s 10.200.1.0/24 -o %i -j RETURN
@@ -357,7 +358,7 @@ PostDown = iptables -D DOCKER-USER -i %i -o br-<network-id> -j ACCEPT; iptables

 On Machine 2:

-```ini
+```shell
 [Interface]
 ...
 PostUp = iptables -I DOCKER-USER -i %i -o br-<network-id> -j ACCEPT; iptables -t nat -I POSTROUTING -s 10.200.2.0/24 -o %i -j RETURN
@@ -367,7 +368,7 @@ PostDown = iptables -D DOCKER-USER -i %i -o br-<network-id> -j ACCEPT; iptables
 ### Start WireGuard on boot

 The `wireguard-tools` package provides a convenient systemd service to manage WireGuard interfaces. Since our iptables
-rules should have priority over Docker's rules, WireGuard must start after Docker.
+rules should have a priority over Docker's rules, WireGuard must start after Docker.

 Create a systemd drop-in configuration for this:

@@ -385,135 +386,54 @@ Then enable the WireGuard service to start on boot:
 ```shell
 systemctl enable wg-quick@wg0.service
 systemctl daemon-reload
-# Verify the unit includes the drop-in configuration
+# Verify the unit includes the drop-in configuration.
 systemctl cat wg-quick@wg0.service
 ```

-## Scaling beyond two machines
+## Scaling beyond two machines and limitations

-Adding a third machine means following the same steps as above on it and updating WireGuard configs on *all* existing
-machines. Each machine needs a `[Peer]` section for every other machine in the network. With 5 machines, that's 4 peer
-entries per config file or 20 peer configurations total that establish a full mesh topology.
-
-![WireGuard full mesh](wireguard-mesh.png)
-
-## Limitations
-
-### DNS resolution
-
-The main limitation of this setup is that containers can't find each other by name across machines. You need to use
-their IP addresses directly or implement a service discovery solution like Consul or CoreDNS.
-
-For small deployments, you can assign static IPs to containers and use those IPs in your app configuration. But service
-discovery is essential for larger and more dynamic deployments.
-
-### NAT traversal constraints
-
-For WireGuard connections to work, at least one machine in each pair must be publicly reachable. The connection fails if
-both machines are behind NAT. While solutions exist (STUN/TURN servers, UDP hole punching), they're beyond the scope of
-this guide.
-
-Common scenarios that work:
-
- ✅ Cloud VPS (public or private IP) ↔ Cloud VPS (public or private IP). Both can use private IPs only if they're in the
-  same cloud provider's network
- ✅ Homelab (behind NAT) ↔ Cloud VPS (public IP)
- ✅ Homelab (private IP) ↔ Homelab (private IP on the same local network)
- ❌ Homelab (behind NAT) ↔ Friend's homelab (behind NAT) — requires a relay server
+//Adding a third machine requires updating configs on all existing machines. This gets tedious fast... //WireGuard mesh
+and challenges to manually manage key pairs and distribute configs //Requirements for NAT traversal: at least one
+machine in each pair must be reachable by the other. The wireguard will fail to establish a connection if both machines
+are behind NAT without special tricks that are beyond the scope of this post. DNS resolution for container names across
+machines is not covered here, but you can use a service discovery tool like Consul.

 ## Automating with Uncloud

-As your setup grows, managing subnet allocation for Docker networks (ensuring each gets a unique range like
-`10.200.1.0/24`, `10.200.2.0/24`) and updating WireGuard configs manually may become tedious quickly.
+//I built Uncloud to handle all the heavy lifting automatically.

-I built [Uncloud](https://github.com/psviderski/uncloud), an open source clustering and deployment tool for Docker, to
-handle all the heavy lifting automatically. You can get the same result and much more with just a few commands.
-
-Initialise a new cluster on your first machine:
+You can initialise a cluster of machines by running the following commands:

 ```shell
-uc machine init user@machine1
+uc machine init user@machine1-ip
+uc machine add user@machine2-ip
+...
+uc machine add user@machineN-ip
 ```

-Add more machines to the cluster:
+//This will create `uncloud` Docker bridge network on each machine with `10.210.N.0/24` subnet by default and set up
+//WireGuard mesh network between them and make persistent across reboots.

-```shell
-uc machine add user@machine2
-uc machine add user@machine3
-```
-
-This is what these commands do:
-
- Create the `uncloud` Docker network on each machine with unique subnets (`10.210.0.0/24`, `10.210.1.0/24`, etc.).
- Generate WireGuard key pairs and distribute public keys across machines.
- Start a full mesh WireGuard network.
- Configure iptables rules for container communication.
- Make everything persistent across reboots.
-
-Beyond the network setup, you also get:
-
- Multi-machine [Docker Compose](https://docs.docker.com/reference/compose-file/) deployments with zero downtime.
- Built-in DNS server that resolves container IPs by their service names.
- Automatic HTTPS and reverse proxy configuration.
-
-Check out the [documentation](https://uncloud.run/docs) for more information.
+//Mention embedded DNS that resolves container IPs by their service names and multi-machine Docker Compose support.

 ## Alternative solutions

-Before settling on the WireGuard approach, I evaluated several alternatives. Note that I only considered lightweight
-solutions suitable for Docker. Kubernetes and its CNI ecosystem deserve a separate discussion.
+//I wanted to explore only lightweight solutions for Docker so not talking about Kubernetes and a numerous CNI
+//drivers. Let's leave this beast for another time.

 ### Docker Swarm overlay network

-Docker Swarm includes built-in [overlay networking](https://docs.docker.com/engine/network/drivers/overlay/). However,
-to use an overlay network, you need to run a [Swarm cluster](https://docs.docker.com/engine/swarm/) on all machines.
-This introduces additional complexity:
-
- Cluster nodes must
-  [maintain the quorum](https://docs.docker.com/engine/swarm/admin_guide/#maintain-the-quorum-of-managers). Losing
-  quorum impacts the functionality of overlay networks.
- Ports 2377, 7946, and 4789 must be exposed to untrusted networks (if connecting machines over the internet) for
-  cluster management, node communication, and VXLAN overlay traffic.
- VXLAN traffic is unencrypted by default, requiring additional
-  [hardening](https://docs.docker.com/engine/swarm/swarm-tutorial/#open-protocols-and-ports-between-the-hosts) with
-  IPSec and firewalls.
- Every node must be publicly reachable. VXLAN fails if machines are behind NAT.
-
-If these limitations are acceptable, an overlay network is a great option. Note that you can use an overlay network with
-regular containers without using any other Swarm features.
-
 ### Flannel

-[Flannel](https://github.com/flannel-io/flannel) is battle-tested in Kubernetes but can also be used with Docker. It
-supports multiple [backends](https://github.com/flannel-io/flannel/blob/master/Documentation/backends.md) including
-VXLAN and WireGuard.
-
-The main caveat is that Flannel requires running etcd as the datastore for coordination. Depending on your availability
-requirements, you may need to set up an etcd cluster with multiple nodes. This is not a problem if you're already using
-Kubernetes. But if you're just running a few Docker hosts, it might seem like overkill.
-
 ### Tailscale

-[Tailscale](https://tailscale.com/) makes WireGuard easy with automatic NAT traversal and key management, but it's not
-designed as a generic site-to-site VPN for connecting networks. Instead, it connects individual devices and provides
-identity-based access controls.
-
-The recommended approach for using [Tailscale with Docker](https://tailscale.com/kb/1282/docker) is to connect each
-individual container to a Tailscale network. This means deploying an additional Tailscale container alongside every
-application container.
-
-Tailscale's [subnet router](https://tailscale.com/kb/1019/subnets) feature might work to expose Docker networks similar
-to our setup, but I haven't tested this approach.
+//Not a generic site-to-site VPN, so the recommended approach is to use Tailscale on the container level. This way a
+//container that needs to talk across machines is configured as a Tailscale machine so it can connect to other Tailscale
+//machines. Maybe the subnet router feature can be used to connect Docker networks in a similar I described here, but
+//I haven't tested it.

 ## Conclusion

-That's it! Now you know how to securely connect Docker containers across multiple machines using WireGuard. The manual
-setup works great for a handful of machines that you don't need to change often, but configuration management becomes
-tedious as you scale.
+//Summarise what we've done.?

-If you don't want to mess with manual configuration, consider automation tools like Uncloud or evaluate if you need a
-full orchestration platform.
-
-Feel free to reach out if you have any questions or suggestions. You can find me on X
-at [@psviderski](https://x.com/psviderski) or check my GitHub profile [psviderski](https://github.com/psviderski/)
-for other contacts.
+If you like this article and my work, you can follow me on X [@psviderski](https://x.com/psviderski).
@@ -0,0 +1,8 @@
+services:
+  uncloud-docs:
+    image: ghcr.io/psviderski/uncloud-docs:latest
+    pull_policy: always
+    user: nobody
+    x-ports:
+      - docs.uncloud.run:8000/https
+    scale: 2
@@ -42,7 +42,7 @@ Some of the common use cases Uncloud is a great fit for:
 - **Dev/staging environments**: Spin up additional environments for development and testing that mirror production
  reusing the same Compose configuration.

-## What makes Uncloud special
+## What makes Uncloud different

 Here are the design decisions that make Uncloud stand out:

@@ -67,9 +67,9 @@ Docker containers running on different machines get **unique IP addresses** from
 The design and implementation were highly inspired by
 Talos [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/).

-### Managed DNS service (optional)
+### Managed DNS service

-Uncloud can provide **managed DNS records** like `<service-name>.<cluster-id>.uncld.dev` for your public
+Uncloud can provide **managed DNS records** like `<service-name>.<cluster-id>.cluster.uncloud.run` for your public
 services through free [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service. You can deploy a service and
 instantly access it from anywhere with a proper DNS name and HTTPS without any manual DNS configuration. This makes
 self-hosting much more accessible and simplifies the process of adding your own domain later.
@@ -99,7 +99,7 @@ containers by their service names, `curl` service endpoints, or analyse traffic

 ## Getting started

-Install Uncloud CLI and deploy your first app:
+Install Uncloud CLI and deploy your first app in minutes:

 * [Install Uncloud CLI](./2-getting-started/1-install-cli.md)
 * [Deploy demo app](./2-getting-started/2-deploy-demo-app.md)
@@ -89,23 +89,6 @@ For example, move it to `/usr/local/bin` which is a common location for user-ins
 sudo mv ./uc /usr/local/bin
 ```

-Follow the same steps to upgrade to the latest version in the future.
-
-## Debian
-
-On a Debian system, you can install Uncloud CLI from an unofficial
-[repository](https://debian.griffo.io/) maintained by
-[@dariogriffo](https://github.com/dariogriffo):
-
-```shell
-curl -sS https://debian.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/trusted.gpg.d/debian.griffo.io.gpg
-echo "deb https://debian.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | sudo tee /etc/apt/sources.list.d/debian.griffo.io.list
-apt install -y uncloud
-```
-
-Alternatively, you can download `.deb` packages directly from the repository
-[releases](https://github.com/dariogriffo/uncloud-debian/releases) page.
-
 ## Verify installation

 After installation, verify that `uc` command is working:
@@ -114,6 +97,22 @@ After installation, verify that `uc` command is working:
 uc --version
 ```

+## Linux (via package managers)
+
+### Debian
+
+Via unofficial repository packages created and maintained at [uncloud-debian](https://github.com/dariogriffo/uncloud-debian/) by @dariogriffo
+
+You can install uncloud the debian way by running:
+
+   ```sh
+   curl -sS https://debian.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/trusted.gpg.d/debian.griffo.io.gpg
+   echo "deb https://debian.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | sudo tee /etc/apt/sources.list.d/debian.griffo.io.list
+   apt install -y uncloud
+   ```
+
+or in the releases page of the repository [here](https://github.com/dariogriffo/uncloud-debian/releases)
+
 ## Next steps

 Now that you have `uc` installed, you're ready to:
@@ -4,21 +4,13 @@ In this guide, we'll deploy [Excalidraw](https://excalidraw.com) — a popular s
 Linux server. You'll learn the **basics of Uncloud** and see how simple it is to **run web apps** on your own
 infrastructure with secure internet access.

-:::info NOTE
-To give you a chance to play with Uncloud without even leaving your browser or needing your own servers, we're providing interactive tutorials and playgrounds on the [iximiuz Labs](https://labs.iximiuz.com/) platform.
-
-You can follow [this tutorial](https://labs.iximiuz.com/tutorials/uncloud-create-cluster-ebebf72b) which walks you through creating a new cluster with two machines and then deploying a simple web service to it.
-
-You can also launch the [Uncloud playground](https://labs.iximiuz.com/playgrounds/uncloud-cluster-64523f7c) where you can play with an already initialized Uncloud cluster.
-:::
-
 ## Prerequisites

 Before you begin, you'll need:

 - **Uncloud CLI** [installed](1-install-cli.md) on your local machine
- A **Ubuntu or Debian server** with **public IP address** and **SSH access** using a **private key** (as `root` or a
-  user with **passwordless** `sudo` privileges).
+- A **Ubuntu or Debian server** with **public IP address** and **SSH access** (as `root` or a user with `sudo`
+  privileges) using a **private key**.

 :::tip Need a server?

@@ -53,7 +45,7 @@ This command will:
 - Install the Uncloud daemon on your server
 - Create a Docker network for Uncloud-managed containers
 - Deploy [Caddy](https://caddyserver.com/) as your reverse proxy listening on host ports 80 and 443
- Reserve a free `xxxxxx.uncld.dev` subdomain via the Uncloud managed DNS service and point it to your
+- Reserve a free `xxxxxx.cluster.uncloud.run` subdomain via the Uncloud managed DNS service and point it to your
  server's IP

 All in about a minute!
@@ -152,7 +144,7 @@ Cluster initialised with machine 'machine-dc3c' and saved as context 'default' i
 Current cluster context is now 'default'.
 Waiting for the machine to be ready...

-Reserved cluster domain: 7za6s7.uncld.dev
+Reserved cluster domain: 7za6s7.cluster.uncloud.run
 [+] Deploying service caddy 7/2
 ✔ Container caddy-d7uk on machine-dc3c     Started                                            6.1s
   ✔ Image caddy:2.10.0 on machine-dc3c       Pulled                                           3.7s
@@ -162,7 +154,7 @@ Updating cluster domain records in Uncloud DNS to point to machines running cadd
 ✔ Machine machine-dc3c (157.180.72.195)  Reachable                                            0.7s

 DNS records updated to use only the internet-reachable machines running caddy service:
-  *.7za6s7.uncld.dev  A → 157.180.72.195
+  *.7za6s7.cluster.uncloud.run  A → 157.180.72.195
 ```

 </details>
@@ -185,7 +177,7 @@ You'll see the progress of the deployment and the public URL where you can acces
   ✔ Image excalidraw/excalidraw on machine-dc3c  Pulled                    4.7s

 excalidraw endpoints:
- • https://excalidraw.7za6s7.uncld.dev → :80
+ • https://excalidraw.7za6s7.cluster.uncloud.run → :80
 ```

 ## Verify your deployment
@@ -217,7 +209,7 @@ uc ls
 ```
 NAME         MODE         REPLICAS   ENDPOINTS
 caddy        global       1
-excalidraw   replicated   1          https://excalidraw.7za6s7.uncld.dev → :80
+excalidraw   replicated   1          https://excalidraw.7za6s7.cluster.uncloud.run → :80
 ```

 You can see `caddy` service listed here. That's your reverse proxy, running as a regular Uncloud service.
@@ -274,20 +266,10 @@ We've successfully converted our deployment created with `uc run` to a Compose f

 ## Use your own domain

-Want to use your own domain, for example, `excalidraw.example.com` instead of `excalidraw.7za6s7.uncld.dev`?
+Want to use your own domain, for example, `excalidraw.example.com` instead of `excalidraw.7za6s7.cluster.uncloud.run`?

 Add a CNAME record `excalidraw.example.com` in your DNS provider (Cloudflare, Namecheap, etc.) pointing to
-`excalidraw.7za6s7.uncld.dev`. Alternatively, you can add an A record pointing to your server's IP.
-
-:::info note
-
-These instructions set up your own domain **in addition to** the Uncloud managed DNS name
-`excalidraw.7za6s7.uncld.dev`.
-
-If you want to avoid the managed service altogether, add `--no-dns` to your `uc machine init` command, and point an A
-DNS record to your server(s)'s IP(s).
-
-:::
+`excalidraw.7za6s7.cluster.uncloud.run`. Alternatively, you can add an A record pointing to your server's IP.

 Then update the published port `80/https` in `compose.yaml` to use your domain:

@@ -315,8 +297,8 @@ Choose [y/N]: y
 Chose: Yes!

 [+] Deploying services 2/2
- ✔ Container excalidraw-0z12 on machine-dc3c  Started                       3.5s
- ✔ Container excalidraw-azpc on machine-dc3c  Removed                       3.4s
+ ✔ Container excalidraw-0z12 on machine-dc3c  Started                       3.5s 
+ ✔ Container excalidraw-azpc on machine-dc3c  Removed                       3.4s 
 ```

 Notice how Uncloud performed a **zero-downtime deployment** — it started the new container with the updated
@@ -326,126 +308,8 @@ Give it a moment for Caddy to obtain a TLS certificate, then visit https://excal

 ## Clean up

-When you're done experimenting, you can remove the `excalidraw` service or uninstall Uncloud completely.
+TBD

-### Remove the service
+## Next steps

-Remove the `excalidraw` service while keeping your Uncloud machine running for future deployments:
-
-```shell
-uc rm excalidraw
-```
-
-### Uninstall Uncloud
-
-If you want to completely uninstall Uncloud from your server and clean up everything it created, SSH into your server
-and run:
-
-```shell
-sudo uncloud-uninstall
-```
-
-This command will:
-
- Remove all Uncloud-managed containers (including Caddy)
- Remove the Uncloud-managed Docker and WireGuard networks
- Uninstall the Uncloud daemon from the server
-
-<details>
-<summary>💡 Expand to see example output</summary>
-
-```
-⚠️This script will uninstall Uncloud and remove ALL Uncloud managed containers on this machine.
-The following actions will be performed:
- Remove Uncloud systemd services
- Remove Uncloud binaries and data
- Remove Uncloud user and group
- Remove all Docker containers managed by Uncloud
- Remove Uncloud Docker network
- Remove Uncloud WireGuard interface
-Do you want to proceed with uninstallation? [y/N] y
-⏳ Stopping systemd services...
-Removed "/etc/systemd/system/multi-user.target.wants/uncloud.service".
-The unit files have no installation config (WantedBy=, RequiredBy=, UpheldBy=,
-Also=, or Alias= settings in the [Install] section, and DefaultInstance= for
-template units). This means they are not meant to be enabled or disabled using systemctl.
-
-Possible reasons for having these kinds of units are:
-• A unit may be statically enabled by being symlinked from another unit's
-  .wants/, .requires/, or .upholds/ directory.
-• A unit's purpose may be to act as a helper for some other unit which has
-  a requirement dependency on it.
-• A unit may be started when needed via activation (socket, path, timer,
-  D-Bus, udev, scripted systemctl call, ...).
-• In case of template units, the unit is meant to be enabled with some
-  instance name specified.
-✓ Systemd services stopped.
-⏳ Removing systemd service files...
-removed '/etc/systemd/system/uncloud.service'
-removed '/etc/systemd/system/uncloud-corrosion.service'
-✓ Systemd service files removed.
-⏳ Removing binaries...
-removed '/usr/local/bin/uncloudd'
-removed '/usr/local/bin/uncloud-corrosion'
-✓ Binaries removed.
-⏳ Removing data and run directories...
-removed '/var/lib/uncloud/machine.db-wal'
-removed '/var/lib/uncloud/caddy/caddy/autosave.json'
-removed directory '/var/lib/uncloud/caddy/caddy'
-removed '/var/lib/uncloud/caddy/caddy.json'
-removed directory '/var/lib/uncloud/caddy'
-removed '/var/lib/uncloud/machine.json'
-removed '/var/lib/uncloud/machine.db-shm'
-removed '/var/lib/uncloud/corrosion/admin.sock'
-removed '/var/lib/uncloud/corrosion/config.toml'
-removed '/var/lib/uncloud/corrosion/subscriptions/b4e825113f1143e5b27715b62193a9f8/sub.sqlite-wal'
-removed '/var/lib/uncloud/corrosion/subscriptions/b4e825113f1143e5b27715b62193a9f8/sub.sqlite-shm'
-removed '/var/lib/uncloud/corrosion/subscriptions/b4e825113f1143e5b27715b62193a9f8/sub.sqlite'
-removed directory '/var/lib/uncloud/corrosion/subscriptions/b4e825113f1143e5b27715b62193a9f8'
-removed '/var/lib/uncloud/corrosion/subscriptions/5e04cbb20a2743c382cfbd4949922351/sub.sqlite'
-removed directory '/var/lib/uncloud/corrosion/subscriptions/5e04cbb20a2743c382cfbd4949922351'
-removed directory '/var/lib/uncloud/corrosion/subscriptions'
-removed '/var/lib/uncloud/corrosion/schema.sql'
-removed '/var/lib/uncloud/corrosion/store.db'
-removed directory '/var/lib/uncloud/corrosion'
-removed '/var/lib/uncloud/machine.db'
-removed directory '/var/lib/uncloud'
-removed directory '/run/uncloud'
-✓ Data and run directories removed.
-⏳ Removing Linux user and group...
-✓ Linux user 'uncloud' removed.
-Linux group 'uncloud' does not exist or was already removed.
-⏳ Looking for Docker containers and network created by Uncloud...
-Found 4 Uncloud managed containers.
-⏳ Stopping Uncloud managed containers...
-20613f6046d0
-1f1a65b78e93
-4300bde4a2b0
-053fdd57ec56
-⏳ Removing Uncloud managed containers...
-20613f6046d0
-1f1a65b78e93
-4300bde4a2b0
-053fdd57ec56
-✓ Uncloud managed containers stopped and removed.
-⏳ Removing Docker network uncloud...
-uncloud
-✓ Docker network uncloud removed.
-⏳ Removing WireGuard interface uncloud...
-✓ WireGuard interface uncloud removed.
-⏳ Removing uninstall script...
-removed '/usr/local/bin/uncloud-uninstall'
-✓ Uninstall script removed.
-
-✅ Uncloud has been uninstalled successfully!
-Note: Docker installation was preserved. If you want to completely remove Docker as well, follow https://docs.docker.com/engine/install/ubuntu/#uninstall-docker-engine
-```
-
-</details>
-
-## Further reading
-
- **[Add more machines](../9-cli-reference/uc_machine_add.md)**: Scale horizontally by creating a cluster of machines
- **[Ingress & HTTP](../3-concepts/1-ingress/1-overview.md)**: Learn how Uncloud handles incoming traffic and how to
-  expose your services to the internet
- **[CLI reference](../9-cli-reference/uc.md)**: Explore all available commands and options
+TBD
@@ -10,12 +10,12 @@ import {themes as prismThemes} from 'prism-react-renderer';

 /** @type {import('@docusaurus/types').Config} */
 const config = {
-  title: 'Uncloud',
-  tagline: 'Self-host and scale web apps without Kubernetes complexity',
+  title: 'Uncloud Docs',
+  tagline: 'Dinosaurs are cool',
  favicon: 'img/favicon.png',

  // Set the production url of your site here
-  url: 'https://uncloud.run',
+  url: 'https://docs.uncloud.run',
  // Set the /<baseUrl>/ pathname under which your site is served
  // For GitHub pages deployment, it is often '/<projectName>/'
  baseUrl: '/',
@@ -54,30 +54,27 @@ const config = {
      ({
        docs: {
          // Remove this to remove the "edit this page" links.
-          editUrl: 'https://github.com/psviderski/uncloud/edit/main/website/',
+          editUrl: 'https://github.com/psviderski/uncloud/edit/main/docs/',
          // Serve the docs at the site's root.
-          // routeBasePath: '/',
+          routeBasePath: '/',
          showLastUpdateTime: true,
          sidebarPath: './sidebars.js',
        },
-        blog: {
-          blogDescription: 'Blog posts from the Uncloud team and community',
-          blogSidebarTitle: 'All posts',
-          blogSidebarCount: 'ALL',
-          showReadingTime: true,
-          feedOptions: {
-            type: ['rss', 'atom'],
-            xslt: true,
-          },
-          // Please change this to your repo.
-          // Remove this to remove the "edit this page" links.
-          // editUrl:
-          //   'https://github.com/facebook/docusaurus/tree/main/packages/create-docusaurus/templates/shared/',
-          // Useful options to enforce blogging best practices
-          onInlineTags: 'warn',
-          onInlineAuthors: 'warn',
-          onUntruncatedBlogPosts: 'warn',
-        },
+        // blog: {
+        //   showReadingTime: true,
+        //   feedOptions: {
+        //     type: ['rss', 'atom'],
+        //     xslt: true,
+        //   },
+        //   // Please change this to your repo.
+        //   // Remove this to remove the "edit this page" links.
+        //   editUrl:
+        //     'https://github.com/facebook/docusaurus/tree/main/packages/create-docusaurus/templates/shared/',
+        //   // Useful options to enforce blogging best practices
+        //   onInlineTags: 'warn',
+        //   onInlineAuthors: 'warn',
+        //   onUntruncatedBlogPosts: 'warn',
+        // },
        theme: {
          customCss: './src/css/custom.css',
        },
@@ -99,24 +96,12 @@ const config = {
      // Relative to your site's "static" directory. Cannot be SVGs. Can be external URLs too.
      image: 'img/social-card.png',
      navbar: {
-        title: 'Uncloud',
+        title: 'Uncloud Docs',
        logo: {
          alt: 'Uncloud Logo',
          src: 'img/logo.svg',
-          href: 'https://uncloud.run',
        },
        items: [
-          {
-            type: 'doc',
-            docId: 'overview',
-            label: 'Docs',
-            position: 'left',
-          },
-          {
-            to: 'blog',
-            label: 'Blog',
-            position: 'left',
-          },
          {
            type: 'search',
            position: 'right',
@@ -0,0 +1,45 @@
+{
+  "name": "docs",
+  "version": "0.0.0",
+  "private": true,
+  "scripts": {
+    "docusaurus": "docusaurus",
+    "start": "docusaurus start",
+    "build": "docusaurus build",
+    "swizzle": "docusaurus swizzle",
+    "deploy": "docusaurus deploy",
+    "clear": "docusaurus clear",
+    "serve": "docusaurus serve",
+    "write-translations": "docusaurus write-translations",
+    "write-heading-ids": "docusaurus write-heading-ids"
+  },
+  "dependencies": {
+    "@docusaurus/core": "3.7.0",
+    "@docusaurus/preset-classic": "3.7.0",
+    "@easyops-cn/docusaurus-search-local": "^0.49.2",
+    "@mdx-js/react": "^3.0.0",
+    "clsx": "^2.0.0",
+    "prism-react-renderer": "^2.3.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "@docusaurus/module-type-aliases": "3.7.0",
+    "@docusaurus/types": "3.7.0"
+  },
+  "browserslist": {
+    "production": [
+      ">0.5%",
+      "not dead",
+      "not op_mini all"
+    ],
+    "development": [
+      "last 3 chrome version",
+      "last 3 firefox version",
+      "last 5 safari version"
+    ]
+  },
+  "engines": {
+    "node": ">=18.0"
+  }
+}
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 80 80">
+    <g>
+        <rect x="0" y="0" width="80" height="80" rx="10" fill="#18181B"/>
+        <path d="M20 32 L20 48 L36 48 L36 32 M60 32 L45 32 L45 48 L60 48" stroke="white" stroke-width="6" fill="none"
+              stroke-linecap="square" stroke-linejoin="miter"/>
+    </g>
+</svg>
@@ -20,9 +20,9 @@ Uncloud stores its configuration in `~/.config/uncloud/config.yaml`. If you wish

 ### Initialisation

-Begin by initialising the first node in your cluster with `uc machine init [USER@HOST:PORT]`. If you do not have a need for Caddy reverse proxy, you may disable this feature with `--no-caddy`. If you want to avoid using uncloud's managed DNS service, add the `--no-dns` flag.
+Begin by initialising the first node in your cluster with `uc machine init [USER@HOST:PORT]`. If you do not have a need for Caddy reverse proxy, you may disable this feature with `--no-caddy`.

-This command will idempotently install Docker, uncloudd, uncloud-corrosion. If Caddy is enabled, it will set up a reverse proxy. If Uncloud DNS is enabled, it will create a DNS A record for the machine's public IP address under `*.[CLUSTER ID].uncld.dev`.
+This command will idempotently install Docker, uncloudd, uncloud-corrosion. If Caddy is enabled, it will set up a reverse proxy. If Uncloud DNS is enabled, it will create a DNS A record for the machine's public IP address under `*.[CLUSTER ID].cluster.uncloud.run`.

 If you wish to uninstall Uncloud and its components, run `uncloud-uninstall`.

@@ -37,7 +37,6 @@ Uncloud (uncloud.run) DNS can be managed with the `uc dns` subcommand.
 * To reserve a domain name, run `uc dns reserve`
 * To release a domain name, run `uc dns release`.
 * To see the domain name, run `uc dns show`
-* To avoid using the Uncloud managed DNS service, use the `--no-dns` flag on your `uc machine init` command.

 ### Running a service

@@ -3,11 +3,10 @@ package main
 import (
 	"context"
 	"fmt"
-	"log/slog"
-	"time"
-
 	"github.com/hashicorp/serf/serf"
 	crdt "github.com/ipfs/go-ds-crdt"
+	"log/slog"
+	"time"
 )

 // Implements the Broadcaster interface.
@@ -2,10 +2,9 @@ package main

 import (
 	"fmt"
+	"github.com/dgraph-io/badger/v3"
 	"log"
 	"time"
-
-	"github.com/dgraph-io/badger/v3"
 )

 func customTimeEncoder(t time.Time) string {
@@ -2,10 +2,9 @@ package main

 import (
 	"fmt"
+	"github.com/ipfs/go-log/v2"
 	"log/slog"
 	"os"
-
-	"github.com/ipfs/go-log/v2"
 )

 // ipfsLogger is an slog logger that implements the IPFS go-log StandardLogger interface.
@@ -2,13 +2,12 @@ package main

 import (
 	"fmt"
+	"github.com/docker/docker/libnetwork/networkdb"
 	"log/slog"
 	"os"
 	"os/signal"
 	"syscall"
 	"time"
-
-	"github.com/docker/docker/libnetwork/networkdb"
 )

 func main() {
@@ -4,13 +4,6 @@ import (
 	"context"
 	"flag"
 	"fmt"
-	"log/slog"
-	"net"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
-
 	"github.com/hashicorp/memberlist"
 	"github.com/hashicorp/serf/cmd/serf/command/agent"
 	"github.com/hashicorp/serf/serf"
@@ -18,6 +11,12 @@ import (
 	badger "github.com/ipfs/go-ds-badger3"
 	crdt "github.com/ipfs/go-ds-crdt"
 	"github.com/lmittmann/tint"
+	"log/slog"
+	"net"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
 )

 func createSerfAgentConfig(name, bindAddr, rpcAddr, profile string) *agent.Config {
@@ -50,9 +49,9 @@ func createSerfAgent(config *agent.Config) (*agent.Agent, error) {

 	serfConfig.MemberlistConfig.BindAddr = bindIP
 	serfConfig.MemberlistConfig.BindPort = bindPort
-	// serfConfig.MemberlistConfig.AdvertiseAddr = advertiseIP
-	// serfConfig.MemberlistConfig.AdvertisePort = advertisePort
-	// serfConfig.MemberlistConfig.SecretKey = encryptKey
+	//serfConfig.MemberlistConfig.AdvertiseAddr = advertiseIP
+	//serfConfig.MemberlistConfig.AdvertisePort = advertisePort
+	//serfConfig.MemberlistConfig.SecretKey = encryptKey
 	serfConfig.NodeName = config.NodeName
 	serfConfig.Tags = config.Tags
 	serfConfig.SnapshotPath = config.SnapshotPath
@@ -130,7 +129,7 @@ func main() {
 	logger := slog.New(tint.NewHandler(os.Stdout, &tint.Options{
 		AddSource: true,
 		Level:     slog.LevelDebug,
-		// Level:      slog.LevelInfo,
+		//Level:      slog.LevelInfo,
 		TimeFormat: time.RFC3339Nano,
 	}))
 	slog.SetDefault(logger)
@@ -165,7 +164,7 @@ func main() {

 	opts := crdt.DefaultOptions()
 	opts.Logger = newIPFSLogger(logger)
-	// opts.MultiHeadProcessing = true
+	//opts.MultiHeadProcessing = true
 	// TODO: debug why the heads count may grow on the receiving side if the event backlog is huge and the processing
 	//  is slow.
 	store, err := crdt.New(localStore, ds.NewKey("/"), syncer, broadcaster, opts)
@@ -173,7 +172,7 @@ func main() {
 		panic(err)
 	}

-	// ticker := time.NewTicker(10 * time.Millisecond)
+	//ticker := time.NewTicker(10 * time.Millisecond)
 	ticker := time.NewTicker(3 * time.Second)
 	go func() {
 		for {
@@ -4,19 +4,18 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"log/slog"
-
 	"github.com/hashicorp/serf/serf"
 	"github.com/ipfs/boxo/datastore/dshelp"
 	dag "github.com/ipfs/boxo/ipld/merkledag"
 	"github.com/ipfs/go-cid"
 	ds "github.com/ipfs/go-datastore"
 	ipld "github.com/ipfs/go-ipld-format"
+	"log/slog"
 )

 // Implements the DAGService interface.
 // TODO: implement SessionDAGService to optimize node fetching.
-// TODO: persistentSerfDAG?
+// TOOD: persistentSerfDAG?
 type dagSyncer struct {
 	// Persistent storage for the nodes.
 	store     ds.Datastore
@@ -51,7 +50,8 @@ func (d *dagSyncer) Get(ctx context.Context, cid cid.Cid) (ipld.Node, error) {
 	}
 	slog.Debug("Queried node from peers", "cid", cid, "deadline", query.Deadline())

-	for {
+	responded := false
+	for !responded {
 		select {
 		case resp, ok := <-query.ResponseCh():
 			if !ok {
@@ -63,6 +63,7 @@ func (d *dagSyncer) Get(ctx context.Context, cid cid.Cid) (ipld.Node, error) {
 				continue
 			}
 			slog.Debug("Received node from peer", "cid", cid, "peer", resp.From)
+			responded = true
 			query.Close()

 			node, err = nodeFromBytes(resp.Payload)
@@ -6,13 +6,12 @@ import (
 	"crypto/cipher"
 	"encoding/hex"
 	"fmt"
-	"net/netip"
-	"time"
-
-	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/siderolabs/discovery-api/api/v1alpha1/client/pb"
 	discovery "github.com/siderolabs/discovery-client/pkg/client"
 	"go.uber.org/zap"
+	"net/netip"
+	"time"
+	"github.com/psviderski/uncloud/internal/machine/network"
 )

 const (
@@ -1,30 +1,24 @@
 module github.com/psviderski/uncloud

-go 1.25
+go 1.23.0

 require (
-	github.com/BurntSushi/toml v1.5.0
+	github.com/BurntSushi/toml v1.4.0
 	github.com/Masterminds/semver v1.5.0
 	github.com/Masterminds/squirrel v1.5.4
-	github.com/alecthomas/chroma/v2 v2.20.0
 	github.com/caddyserver/caddy/v2 v2.8.4
 	github.com/cenkalti/backoff/v4 v4.3.0
-	github.com/charmbracelet/bubbles v0.21.0
-	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/huh v0.6.0
-	github.com/charmbracelet/huh/spinner v0.0.0-20251110114415-25888d17260b
-	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/compose-spec/compose-go/v2 v2.9.0
-	github.com/containerd/errdefs v1.0.0
-	github.com/containerd/platforms v1.0.0-rc.1
+	github.com/charmbracelet/lipgloss v0.13.0
+	github.com/compose-spec/compose-go/v2 v2.4.5
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 	github.com/deckarep/golang-set/v2 v2.8.0
 	github.com/dgraph-io/badger/v3 v3.2103.5
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v28.5.0+incompatible
-	github.com/docker/compose/v2 v2.40.0
-	github.com/docker/docker v28.5.0+incompatible
-	github.com/docker/go-connections v0.6.0
+	github.com/docker/cli v27.5.0+incompatible
+	github.com/docker/compose/v2 v2.31.0
+	github.com/docker/docker v27.4.0-rc.2+incompatible
+	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0
 	github.com/goccy/go-yaml v1.17.1
 	github.com/google/go-cmp v0.7.0
@@ -41,68 +35,45 @@ require (
 	github.com/jmoiron/sqlx v1.4.0
 	github.com/lmittmann/tint v1.0.5
 	github.com/miekg/dns v1.1.65
-	github.com/mitchellh/mapstructure v1.5.0
-	github.com/moby/term v0.5.2
-	github.com/muesli/termenv v0.16.0
+	github.com/moby/term v0.5.0
 	github.com/opencontainers/go-digest v1.0.0
-	github.com/opencontainers/image-spec v1.1.1
-	github.com/psviderski/unregistry v0.4.1
+	github.com/opencontainers/image-spec v1.1.0
 	github.com/siderolabs/discovery-api v0.1.4
 	github.com/siderolabs/discovery-client v0.1.9
 	github.com/siderolabs/grpc-proxy v0.5.1
-	github.com/spf13/cobra v1.10.1
-	github.com/stretchr/testify v1.11.1
-	github.com/vishvananda/netlink v1.3.1
+	github.com/spf13/cobra v1.8.1
+	github.com/stretchr/testify v1.10.0
+	github.com/vishvananda/netlink v1.3.0
 	go.uber.org/zap v1.27.0
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/crypto v0.41.0
-	golang.org/x/net v0.43.0
-	golang.org/x/sync v0.17.0
-	golang.org/x/sys v0.36.0
-	golang.org/x/term v0.34.0
+	golang.org/x/crypto v0.33.0
+	golang.org/x/net v0.35.0
+	golang.org/x/sync v0.11.0
+	golang.org/x/sys v0.31.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a
-	google.golang.org/grpc v1.74.2
-	google.golang.org/protobuf v1.36.9
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576
+	google.golang.org/grpc v1.68.1
+	google.golang.org/protobuf v1.36.3
 	modernc.org/sqlite v1.36.3
-	tags.cncf.io/container-device-interface v1.0.1
 )

 require (
-	cloud.google.com/go/kms v1.19.0 // indirect
-	cloud.google.com/go/longrunning v0.6.0 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
-	github.com/AlecAivazis/survey/v2 v2.3.7 // indirect
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
 	github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/DefangLabs/secret-detector v0.0.0-20250403165618-22662109213e // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.4.0 // indirect
+	github.com/Masterminds/semver/v3 v3.2.1 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/Microsoft/hcsshim v0.13.0 // indirect
-	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
+	github.com/OneOfOne/xxhash v1.2.8 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
-	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 // indirect
 	github.com/armon/go-metrics v0.4.1 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/aryann/difflib v0.0.0-20210328193216-ff5ff6dc229b // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.30.3 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.27.27 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.27 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.11 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.15 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.17 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.22.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.30.3 // indirect
-	github.com/aws/smithy-go v1.20.3 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.2.0 // indirect
@@ -112,86 +83,67 @@ require (
 	github.com/catppuccin/go v0.2.0 // indirect
 	github.com/cespare/xxhash v1.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
-	github.com/charmbracelet/x/ansi v0.10.1 // indirect
-	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
+	github.com/charmbracelet/bubbles v0.20.0 // indirect
+	github.com/charmbracelet/bubbletea v1.1.1 // indirect
+	github.com/charmbracelet/x/ansi v0.3.2 // indirect
 	github.com/charmbracelet/x/exp/strings v0.0.0-20240919170804-a4978c8e603a // indirect
-	github.com/charmbracelet/x/term v0.2.1 // indirect
+	github.com/charmbracelet/x/term v0.2.0 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
-	github.com/containerd/cgroups/v3 v3.0.5 // indirect
-	github.com/containerd/console v1.0.5 // indirect
-	github.com/containerd/containerd/api v1.9.0 // indirect
-	github.com/containerd/containerd/v2 v2.1.4 // indirect
-	github.com/containerd/continuity v0.4.5 // indirect
-	github.com/containerd/errdefs/pkg v0.3.0 // indirect
-	github.com/containerd/fifo v1.1.0 // indirect
+	github.com/cloudflare/cfssl v1.6.4 // indirect
+	github.com/containerd/console v1.0.4 // indirect
+	github.com/containerd/containerd v1.7.24 // indirect
+	github.com/containerd/containerd/api v1.7.19 // indirect
+	github.com/containerd/continuity v0.4.4 // indirect
+	github.com/containerd/errdefs v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/plugin v1.0.0 // indirect
+	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
-	github.com/containerd/ttrpc v1.2.7 // indirect
-	github.com/containerd/typeurl/v2 v2.2.3 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/containerd/ttrpc v1.2.5 // indirect
+	github.com/containerd/typeurl/v2 v2.2.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 // indirect
 	github.com/dgraph-io/badger v1.6.2 // indirect
 	github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
 	github.com/dgraph-io/ristretto v0.1.1 // indirect
 	github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
-	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
-	github.com/distribution/distribution/v3 v3.0.0 // indirect
-	github.com/dlclark/regexp2 v1.11.5 // indirect
-	github.com/docker/buildx v0.29.1 // indirect
-	github.com/docker/cli-docs-tool v0.10.0 // indirect
+	github.com/docker/buildx v0.18.0 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/docker/docker-credential-helpers v0.8.2 // indirect
 	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
-	github.com/fatih/color v1.18.0 // indirect
+	github.com/fatih/color v1.17.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fsnotify/fsevents v0.2.0 // indirect
 	github.com/fvbommel/sortorder v1.1.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
 	github.com/go-kit/kit v0.13.0 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-sql-driver/mysql v1.8.1 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.0.0 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gofrs/flock v0.12.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
-	github.com/golang/glog v1.2.5 // indirect
+	github.com/golang/glog v1.2.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/btree v1.1.2 // indirect
 	github.com/google/cel-go v0.20.1 // indirect
 	github.com/google/flatbuffers v24.3.25+incompatible // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
+	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/gorilla/websocket v1.5.3 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
-	github.com/hashicorp/go-immutable-radix/v2 v2.1.0 // indirect
 	github.com/hashicorp/go-msgpack v0.5.5 // indirect
 	github.com/hashicorp/go-msgpack/v2 v2.1.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -199,15 +151,13 @@ require (
 	github.com/hashicorp/go-syslog v1.0.0 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
-	github.com/hashicorp/golang-lru/arc/v2 v2.0.7 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/mdns v1.0.5 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
-	github.com/in-toto/in-toto-golang v0.9.0 // indirect
+	github.com/in-toto/in-toto-golang v0.5.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/inhies/go-bytesize v0.0.0-20220417184213-4913239db9cf // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
 	github.com/ipfs/go-block-format v0.2.0 // indirect
 	github.com/ipfs/go-ipfs-util v0.0.3 // indirect
@@ -225,12 +175,8 @@ require (
 	github.com/jackc/pgtype v1.14.0 // indirect
 	github.com/jackc/pgx/v4 v4.18.3 // indirect
 	github.com/jbenet/goprocess v0.1.4 // indirect
-	github.com/jonboulle/clockwork v0.5.0 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
 	github.com/josharian/native v1.1.0 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.9 // indirect
 	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
@@ -240,7 +186,6 @@ require (
 	github.com/libp2p/go-libp2p-pubsub v0.11.0 // indirect
 	github.com/libp2p/go-msgio v0.3.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/manifoldco/promptui v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -259,27 +204,21 @@ require (
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/buildkit v0.25.0 // indirect
+	github.com/moby/buildkit v0.17.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/go-archive v0.1.0 // indirect
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/patternmatcher v0.6.0 // indirect
-	github.com/moby/spdystream v0.5.0 // indirect
-	github.com/moby/sys/atomicwriter v0.1.0 // indirect
-	github.com/moby/sys/capability v0.4.0 // indirect
-	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
-	github.com/moby/sys/symlink v0.3.0 // indirect
-	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/user v0.3.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
+	github.com/muesli/termenv v0.15.3-0.20240618155329-98d742f6907a // indirect
 	github.com/multiformats/go-base32 v0.1.0 // indirect
 	github.com/multiformats/go-base36 v0.2.0 // indirect
 	github.com/multiformats/go-multiaddr v0.13.0 // indirect
@@ -290,130 +229,93 @@ require (
 	github.com/multiformats/go-multistream v0.5.0 // indirect
 	github.com/multiformats/go-varint v0.0.7 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/onsi/ginkgo/v2 v2.22.0 // indirect
-	github.com/opencontainers/runtime-spec v1.2.1 // indirect
-	github.com/opencontainers/selinux v1.12.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pires/go-proxyproto v0.7.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/polydawn/refmt v0.89.0 // indirect
 	github.com/posener/complete v1.2.3 // indirect
-	github.com/prometheus/client_golang v1.22.0 // indirect
+	github.com/prometheus/client_golang v1.20.5 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.62.0 // indirect
+	github.com/prometheus/common v0.61.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/quic-go/qpack v0.5.1 // indirect
 	github.com/quic-go/quic-go v0.48.2 // indirect
-	github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 // indirect
-	github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 // indirect
-	github.com/redis/go-redis/v9 v9.7.3 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rs/xid v1.5.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.6.0 // indirect
-	github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.4.0 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
 	github.com/siderolabs/gen v0.4.8 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/slackhq/nebula v1.6.1 // indirect
 	github.com/smallstep/certificates v0.26.1 // indirect
 	github.com/smallstep/nosql v0.6.1 // indirect
-	github.com/smallstep/pkcs7 v0.1.1 // indirect
+	github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect
 	github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d // indirect
 	github.com/smallstep/truststore v0.13.0 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
-	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/stoewer/go-strcase v1.2.0 // indirect
-	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/tailscale/tscert v0.0.0-20240517230440-bbccfbf48933 // indirect
 	github.com/theupdateframework/notary v0.7.0 // indirect
-	github.com/tilt-dev/fsnotify v1.4.8-0.20220602155310-fff9c274a375 // indirect
-	github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 // indirect
-	github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f // indirect
-	github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect
+	github.com/tonistiigi/dchapes-mode v0.0.0-20241001053921-ca0759fec205 // indirect
+	github.com/tonistiigi/fsutil v0.0.0-20241028165955-397af5306b5c // indirect
+	github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4 // indirect
 	github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect
 	github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect
-	github.com/urfave/cli v1.22.17 // indirect
-	github.com/vbatts/tar-split v0.12.1 // indirect
-	github.com/vishvananda/netns v0.0.5 // indirect
-	github.com/x448/float16 v0.8.4 // indirect
-	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	github.com/zclconf/go-cty v1.17.0 // indirect
+	github.com/urfave/cli v1.22.16 // indirect
+	github.com/vbatts/tar-split v0.11.6 // indirect
+	github.com/vishvananda/netns v0.0.4 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
-	go.etcd.io/bbolt v1.4.3 // indirect
+	go.etcd.io/bbolt v1.3.11 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/bridges/prometheus v0.57.0 // indirect
-	go.opentelemetry.io/contrib/exporters/autoexport v0.57.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.60.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
-	go.opentelemetry.io/otel v1.36.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/prometheus v0.54.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.32.0 // indirect
-	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0 // indirect
-	go.opentelemetry.io/otel/log v0.8.0 // indirect
-	go.opentelemetry.io/otel/metric v1.36.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
-	go.opentelemetry.io/otel/sdk/log v0.8.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.36.0 // indirect
-	go.opentelemetry.io/otel/trace v1.36.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
+	go.opentelemetry.io/otel v1.33.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect
+	go.opentelemetry.io/otel/metric v1.33.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.33.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.32.0 // indirect
+	go.opentelemetry.io/otel/trace v1.33.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.4.0 // indirect
 	go.step.sm/cli-utils v0.9.0 // indirect
 	go.step.sm/crypto v0.45.0 // indirect
 	go.step.sm/linkedca v0.20.1 // indirect
 	go.uber.org/automaxprocs v1.5.3 // indirect
-	go.uber.org/mock v0.6.0 // indirect
+	go.uber.org/mock v0.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap/exp v0.2.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto/x509roots/fallback v0.0.0-20240507223354-67b13616a595 // indirect
-	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
-	golang.org/x/mod v0.27.0 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/text v0.28.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
-	golang.org/x/tools v0.36.0 // indirect
+	golang.org/x/exp v0.0.0-20241215155358-4a5509556b9e // indirect
+	golang.org/x/mod v0.23.0 // indirect
+	golang.org/x/term v0.29.0 // indirect
+	golang.org/x/text v0.22.0 // indirect
+	golang.org/x/time v0.8.0 // indirect
+	golang.org/x/tools v0.30.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
-	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/ini.v1 v1.67.0 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
+	google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259 // indirect
 	howett.net/plist v1.0.0 // indirect
-	k8s.io/api v0.32.3 // indirect
-	k8s.io/apimachinery v0.32.3 // indirect
-	k8s.io/client-go v0.32.3 // indirect
-	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
 	lukechampine.com/blake3 v1.3.0 // indirect
 	modernc.org/libc v1.61.13 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.8.2 // indirect
-	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.2 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
 )
@@ -2,198 +2,175 @@ package cli

 import (
 	"context"
-	"errors"
+	"encoding/base64"
+	"encoding/json"
 	"fmt"
-	"strings"
+	"os"

-	"github.com/charmbracelet/lipgloss"
 	composetypes "github.com/compose-spec/compose-go/v2/types"
-	mapset "github.com/deckarep/golang-set/v2"
-	"github.com/docker/cli/cli/command"
-	"github.com/docker/cli/cli/flags"
-	composeapi "github.com/docker/compose/v2/pkg/api"
-	composev2 "github.com/docker/compose/v2/pkg/compose"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/psviderski/uncloud/pkg/client"
-	"github.com/psviderski/uncloud/pkg/client/compose"
+	"github.com/distribution/reference"
+	"github.com/docker/cli/cli/config"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/image"
+	dockerclient "github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/archive"
+	"github.com/docker/docker/pkg/jsonmessage"
+	"github.com/docker/docker/registry"
+	"github.com/moby/term"
 )

-// BuildServicesOptions contains options for building services in a Compose project.
-type BuildServicesOptions struct {
-	// BuildArgs sets build-time variables for services. Used in Dockerfiles that declare variables with ARG.
-	BuildArgs []string
-	// Check the build configuration for services without building them.
-	Check bool
-	// Deps enables to also build services declared as dependencies of the selected Services.
-	Deps bool
-	// NoCache disables the use of cache when building images.
-	NoCache bool
-	// Pull attempts to pull newer versions of the base images before building.
-	Pull bool
-	// Services specifies which services to build. If empty, all services with a build config are built.
+type BuildOptions struct {
+	Files    []string
+	Profiles []string
 	Services []string
-
-	// Push targets are mutually exclusive.
-	// PushCluster uploads the built images to cluster machines after building.
-	PushCluster bool
-	// PushRegistry uploads the built images to external registries after building.
-	PushRegistry bool
-
-	// Cluster-specific options (only used if PushCluster is true).
-	// Machines is a list of machine names or IDs to push the image to. If empty, images are pushed to all machines.
-	Machines []string
+	Push     bool
+	NoCache  bool
 }

-// BuildServices builds images for services in the Compose project.
-func (cli *CLI) BuildServices(ctx context.Context, project *composetypes.Project, opts BuildServicesOptions) error {
-	// Validate push targets.
-	if opts.PushCluster && opts.PushRegistry {
-		return fmt.Errorf("cannot specify both PushCluster and PushRegistry: choose one push target")
+// GetServicesThatNeedBuild returns a map of services that require building
+func GetServicesThatNeedBuild(project *composetypes.Project) map[string]composetypes.ServiceConfig {
+	servicesToBuild := make(map[string]composetypes.ServiceConfig, len(project.Services))
+	for serviceName, service := range project.Services {
+		if service.Build == nil {
+			continue
+		}
+		servicesToBuild[serviceName] = service
 	}
+	return servicesToBuild
+}

-	// Build service images using Compose implementation.
-	dockerCli, err := command.NewDockerCli()
+// BuildServices builds the services defined in the provided map.
+func BuildServices(ctx context.Context, servicesToBuild map[string]composetypes.ServiceConfig, opts BuildOptions) error {
+	fmt.Println("Building services...")
+
+	// Init docker client (can be local or remote, depending on DOCKER_HOST environment variable)
+	dockerCli, err := dockerclient.NewClientWithOpts(dockerclient.FromEnv, dockerclient.WithAPIVersionNegotiation())
 	if err != nil {
-		return fmt.Errorf("create docker client: %w", err)
+		return err
 	}
-	// Initialise the Docker CLI with default options.
-	if err = dockerCli.Initialize(flags.NewClientOptions()); err != nil {
-		return fmt.Errorf("initialise docker client: %w", err)
+	defer dockerCli.Close()
+
+	serviceImages := make(map[string]string, len(servicesToBuild))
+
+	// Build the services using the local docker client and compose libraries
+	for _, service := range servicesToBuild {
+		fmt.Printf("Building service: %s\n", service.Name)
+		imageName, err := buildSingleService(ctx, dockerCli, service, opts)
+		if err != nil {
+			return fmt.Errorf("build service %s: %w", service.Name, err)
+		}
+		serviceImages[service.Name] = imageName
+	}
+	fmt.Printf("Service images are built.\n")
+
+	if opts.Push {
+		err = pushServiceImages(ctx, dockerCli, serviceImages)
 	}

-	composeService := composev2.NewComposeService(dockerCli)
-	buildOpts := composeapi.BuildOptions{
-		Args:     composetypes.NewMappingWithEquals(opts.BuildArgs),
-		Check:    opts.Check,
-		Deps:     opts.Deps,
-		NoCache:  opts.NoCache,
-		Pull:     opts.Pull,
-		Push:     opts.PushRegistry,
-		Services: opts.Services,
+	return err
+}
+
+// buildSingleService builds a single service using the Docker client and Compose libraries.
+func buildSingleService(ctx context.Context, dockerCli *dockerclient.Client, service composetypes.ServiceConfig, opts BuildOptions) (string, error) {
+	if service.Build == nil {
+		return "", fmt.Errorf("service %s has no build configuration", service.Name)
+	}
+	if service.Image == "" {
+		return "", fmt.Errorf("service %s has no image specified; building services without image is not supported yet", service.Name)
 	}

-	if err = composeService.Build(ctx, project, buildOpts); err != nil {
+	buildContextPath := service.Build.Context
+	imageName := service.Image
+
+	// Create a tar archive of the build context
+	buildContext, err := archive.TarWithOptions(buildContextPath, &archive.TarOptions{})
+	if err != nil {
+		return "", fmt.Errorf("failed to create build context for service %s: %w", service.Name, err)
+	}
+
+	buildOptions := types.ImageBuildOptions{
+		// TODO: Support Dockerfiles outside the build context
+		// See https://github.com/docker/compose/blob/cf89fd1aa1328d5af77658ccc5a1e1b29981ae80/pkg/compose/build_classic.go#L92
+		Dockerfile: service.Build.Dockerfile,
+		Tags:       []string{imageName},
+		Remove:     true, // Remove intermediate containers
+		NoCache:    opts.NoCache,
+	}
+
+	buildResponse, err := dockerCli.ImageBuild(ctx, buildContext, buildOptions)
+	if err != nil {
+		return "", fmt.Errorf("failed to build image for service %s: %w", service.Name, err)
+	}
+	defer buildResponse.Body.Close()
+
+	// Display the build response
+	fd, isTerminal := term.GetFdInfo(os.Stdout)
+	if err := jsonmessage.DisplayJSONMessagesStream(buildResponse.Body, os.Stdout, fd, isTerminal, nil); err != nil {
+		return "", fmt.Errorf("failed to display build response for service %s: %w", service.Name, err)
+	}
+
+	return imageName, nil
+}
+
+// pushSingleServiceImage pushes a single service image.
+func pushSingleServiceImage(ctx context.Context, dockerCli *dockerclient.Client, serviceName string, imageName string) error {
+	ref, err := reference.ParseNormalizedNamed(imageName)
+	if err != nil {
 		return err
 	}

-	if !opts.PushCluster {
-		return nil
-	}
-
-	// Push built service images to cluster machines.
-	builtServices, err := ServicesThatNeedBuild(project, opts.Services, opts.Deps)
+	repoInfo, err := registry.ParseRepositoryInfo(ref)
 	if err != nil {
-		return fmt.Errorf("determine built services: %w", err)
-	}
-	if len(builtServices) == 0 {
-		// No services were built, nothing to push.
-		return nil
+		return err
 	}

-	// Add a line break after the build output.
-	fmt.Fprintln(cli.ProgressOut())
+	registryKey := repoInfo.Index.Name
+	if repoInfo.Index.Official {
+		registryKey = registry.IndexServer
+	}

-	clusterClient, err := cli.ConnectCluster(ctx)
+	// Load the Docker config file with auth details, if available
+	configFile := config.LoadDefaultConfigFile(os.Stderr)
+
+	authConfig, err := configFile.GetAuthConfig(registryKey)
 	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer clusterClient.Close()
-
-	// Push one service image at a time.
-	var errs []error
-	for _, s := range builtServices {
-		if s.Image == "" {
-			// Skip services without an image name (shouldn't happen for services with build config).
-			continue
-		}
-
-		// Push to the specified machines falling back to service x-machines.
-		// If none specified, push to *all* cluster machines.
-		var pushOpts client.PushImageOptions
-
-		if len(opts.Machines) > 0 {
-			pushOpts.Machines = opts.Machines
-		} else if machines, ok := s.Extensions[compose.MachinesExtensionKey].(compose.MachinesSource); ok {
-			pushOpts.Machines = machines
-		}
-
-		if len(pushOpts.Machines) == 0 {
-			pushOpts.AllMachines = true
-		}
-
-		boldStyle := lipgloss.NewStyle().Bold(true)
-		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-			if err = clusterClient.PushImage(ctx, s.Image, pushOpts); err != nil {
-				return fmt.Errorf("push image '%s' for service '%s': %w", s.Image, s.Name, err)
-			}
-			return nil
-		}, cli.ProgressOut(), fmt.Sprintf("Pushing image %s to cluster", boldStyle.Render(s.Image)))
-		// Collect errors to try pushing all images.
-		if err != nil {
-			errs = append(errs, err)
-		}
+		return err
 	}

-	return errors.Join(errs...)
+	authJSON, err := json.Marshal(authConfig)
+	if err != nil {
+		return fmt.Errorf("failed to marshal auth config for registry %s: %w", registryKey, err)
+	}
+
+	authStr := base64.URLEncoding.EncodeToString(authJSON)
+
+	pushOptions := image.PushOptions{
+		RegistryAuth: authStr,
+	}
+	pushResponse, err := dockerCli.ImagePush(ctx, imageName, pushOptions)
+	if err != nil {
+		return fmt.Errorf("failed to push image %s: %w", imageName, err)
+	}
+	defer pushResponse.Close()
+
+	fmt.Printf("Pushing image %s for service %s...\n", imageName, serviceName)
+
+	fd, isTerminal := term.GetFdInfo(os.Stdout)
+	if err := jsonmessage.DisplayJSONMessagesStream(pushResponse, os.Stdout, fd, isTerminal, nil); err != nil {
+		return fmt.Errorf("failed to display push response for image %s: %w", imageName, err)
+	}
+
+	fmt.Printf("Image %s pushed successfully.\n", imageName)
+	return nil
 }

-// ServicesThatNeedBuild returns a list of services that require building.
-// deps indicates whether to include services that are dependencies of the selected services.
-// Implementation is based on the logic from docker/compose/v2/pkg/compose/build.go.
-func ServicesThatNeedBuild(
-	project *composetypes.Project, selectedServices []string, deps bool,
-) ([]composetypes.ServiceConfig, error) {
-	servicesToBuild := make([]composetypes.ServiceConfig, 0, len(project.Services))
-
-	var policy composetypes.DependencyOption = composetypes.IgnoreDependencies
-	if deps {
-		policy = composetypes.IncludeDependencies
-	}
-
-	// Also include services used as build.additional_contexts with service: prefix.
-	selectedServices = includeAdditionalContextsServices(project, selectedServices)
-	// Some build dependencies we just introduced may not be enabled, enable them.
-	var err error
-	if project, err = project.WithServicesEnabled(selectedServices...); err != nil {
-		return nil, err
-	}
-	if project, err = project.WithSelectedServices(selectedServices); err != nil {
-		return nil, err
-	}
-
-	err = project.ForEachService(selectedServices, func(serviceName string, service *composetypes.ServiceConfig) error {
-		if service.Build != nil {
-			servicesToBuild = append(servicesToBuild, *service)
+// pushServiceImages pushes all built service images to the registry.
+func pushServiceImages(ctx context.Context, dockerCli *dockerclient.Client, serviceImages map[string]string) error {
+	fmt.Printf("Pushing images...\n")
+	for serviceName, imageName := range serviceImages {
+		if err := pushSingleServiceImage(ctx, dockerCli, serviceName, imageName); err != nil {
+			return fmt.Errorf("push image for service %s: %w", serviceName, err)
 		}
-		return nil
-	}, policy)
-	if err != nil {
-		return nil, err
 	}
-
-	return servicesToBuild, nil
-}
-
-// includeAdditionalContextsServices adds services referenced in build.additional_contexts to the list
-// of selected services.
-func includeAdditionalContextsServices(project *composetypes.Project, selectedServices []string) []string {
-	servicesWithDependencies := mapset.NewSet(selectedServices...)
-	for _, service := range selectedServices {
-		s, ok := project.Services[service]
-		if !ok {
-			s = project.DisabledServices[service]
-		}
-		if s.Build != nil {
-			for _, target := range s.Build.AdditionalContexts {
-				if name, found := strings.CutPrefix(target, composetypes.ServicePrefix); found {
-					servicesWithDependencies.Add(name)
-				}
-			}
-		}
-	}
-	if servicesWithDependencies.Cardinality() > len(selectedServices) {
-		return includeAdditionalContextsServices(project, servicesWithDependencies.ToSlice())
-	}
-
-	return servicesWithDependencies.ToSlice()
+	return nil
 }
@@ -2,13 +2,15 @@ package cli

 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/netip"
 	"os"
-	"slices"

+	"github.com/charmbracelet/huh"
 	"github.com/docker/cli/cli/streams"
 	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/psviderski/uncloud/internal/fs"
 	"github.com/psviderski/uncloud/internal/machine"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/sshexec"
@@ -20,24 +22,17 @@ import (
 	"google.golang.org/protobuf/types/known/emptypb"
 )

-const (
-	// DefaultSSHKeyPath is the fallback location for the SSH private key when provisioning remote machines.
-	// Used when no key is explicitly provided and SSH agent authentication fails.
-	DefaultSSHKeyPath  = "~/.ssh/id_ed25519"
-	DefaultContextName = "default"
-)
+const defaultContextName = "default"

 type CLI struct {
-	Config          *config.Config
-	conn            *config.MachineConnection
-	contextOverride string
+	Config *config.Config
+	conn   *config.MachineConnection
 }

 // New creates a new CLI instance with the given config path or remote machine connection.
 // If the connection is provided, the config is ignored for all operations which is useful for interacting with
 // a cluster without creating a config.
-// If a non-empty context name is given, it will override the current default.
-func New(configPath string, conn *config.MachineConnection, contextName string) (*CLI, error) {
+func New(configPath string, conn *config.MachineConnection) (*CLI, error) {
 	if conn != nil {
 		return &CLI{conn: conn}, nil
 	}
@@ -48,8 +43,7 @@ func New(configPath string, conn *config.MachineConnection, contextName string)
 	}

 	return &CLI{
-		Config:          cfg,
-		contextOverride: contextName,
+		Config: cfg,
 	}, nil
 }

@@ -71,30 +65,11 @@ func (cli *CLI) SetCurrentContext(name string) error {
 	return cli.Config.Save()
 }

-func (cli *CLI) GetContextOverrideOrCurrent() string {
-	contextName := cli.contextOverride
-	if contextName == "" {
-		contextName = cli.Config.CurrentContext
-	}
-	return contextName
-}
-
-// ConnectCluster connects to a cluster using the context override or the current context if not specified.
+// ConnectCluster connects to a cluster using the given context name or the current context if not specified.
 // If the CLI was initialised with a machine connection, the config is ignored and the connection is used instead.
-func (cli *CLI) ConnectCluster(ctx context.Context) (*client.Client, error) {
-	return cli.ConnectClusterWithOptions(ctx, ConnectOptions{
-		// Default to showing progress for CLI usage.
-		ShowProgress: true,
-	})
-}
-
-// ConnectClusterWithOptions connects to a cluster with the given options.
-// If the CLI was initialised with a machine connection, the config is ignored and the connection is used instead.
-// If the CLI has an override context, it is used instead of the current default.
-// Options are useful when using the CLI as a library where you may want to disable visual feedback.
-func (cli *CLI) ConnectClusterWithOptions(ctx context.Context, opts ConnectOptions) (*client.Client, error) {
+func (cli *CLI) ConnectCluster(ctx context.Context, contextName string) (*client.Client, error) {
 	if cli.conn != nil {
-		return ConnectCluster(ctx, *cli.conn, opts)
+		return connectCluster(ctx, *cli.conn)
 	}

 	if len(cli.Config.Contexts) == 0 {
@@ -104,8 +79,6 @@ func (cli *CLI) ConnectClusterWithOptions(ctx context.Context, opts ConnectOptio
 			cli.Config.Path(),
 		)
 	}
-
-	contextName := cli.contextOverride
 	if contextName == "" {
 		// If the cluster is not specified, use the current cluster if set.
 		if cli.Config.CurrentContext == "" {
@@ -138,32 +111,47 @@ func (cli *CLI) ConnectClusterWithOptions(ctx context.Context, opts ConnectOptio
 		)
 	}

-	// Try each connection in order until one succeeds.
-	var lastErr error
-	for _, conn := range cfg.Connections {
-		c, err := ConnectCluster(ctx, conn, opts)
-		if err == nil {
-			return c, nil
-		}
+	// TODO: iterate over all connections and try to connect to the cluster using the first successful connection.
+	conn := cfg.Connections[0]

-		lastErr = err
+	c, err := connectCluster(ctx, conn)
+	if err != nil {
+		return nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
 	}

-	return nil, fmt.Errorf("failed to connect to cluster context '%s': "+
-		"all connections (%d) in the Uncloud config (%s) failed; last error: %w",
-		contextName, len(cfg.Connections), cli.Config.Path(), lastErr)
+	return c, nil
+}
+
+func connectCluster(ctx context.Context, conn config.MachineConnection) (*client.Client, error) {
+	if conn.SSH != "" {
+		user, host, port, err := conn.SSH.Parse()
+		if err != nil {
+			return nil, fmt.Errorf("parse SSH connection %q: %w", conn.SSH, err)
+		}
+
+		keyPath := fs.ExpandHomeDir(conn.SSHKeyFile)
+
+		sshConfig := &connector.SSHConnectorConfig{
+			User:    user,
+			Host:    host,
+			Port:    port,
+			KeyPath: keyPath,
+		}
+		return client.New(ctx, connector.NewSSHConnector(sshConfig))
+	} else if conn.TCP != nil && conn.TCP.IsValid() {
+		return client.New(ctx, connector.NewTCPConnector(*conn.TCP))
+	}
+
+	return nil, errors.New("connection configuration is invalid")
 }

 type InitClusterOptions struct {
-	Context            string
-	MachineName        string
-	Network            netip.Prefix
-	PublicIP           *netip.Addr
-	RemoteMachine      *RemoteMachine
-	SkipInstall        bool
-	Version            string
-	AutoConfirm        bool
-	WireguardEndpoints []*pb.IPPort
+	Context       string
+	MachineName   string
+	Network       netip.Prefix
+	PublicIP      *netip.Addr
+	RemoteMachine *RemoteMachine
+	Version       string
 }

 // InitCluster initialises a new cluster on a remote machine and returns a client to interact with the cluster.
@@ -173,16 +161,19 @@ func (cli *CLI) InitCluster(ctx context.Context, opts InitClusterOptions) (*clie
 		return cli.initRemoteMachine(ctx, opts)
 	}
 	// TODO: implement local machine initialisation
-	return nil, fmt.Errorf("local machine initialisation is not implemented yet. Please specify a remote machine")
+	return nil, fmt.Errorf("local machine initialisation is not implemented yet")
 }

 func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions) (*client.Client, error) {
-	contextName, err := cli.newContextName(opts.Context)
-	if err != nil {
-		return nil, err
+	contextName := opts.Context
+	if contextName == "" {
+		contextName = defaultContextName
+	}
+	if _, ok := cli.Config.Contexts[contextName]; ok {
+		return nil, fmt.Errorf("cluster context '%s' already exists", contextName)
 	}

-	machineClient, err := provisionOrConnectRemoteMachine(ctx, opts.RemoteMachine, opts.SkipInstall, opts.Version)
+	machineClient, err := cli.provisionRemoteMachine(ctx, *opts.RemoteMachine, opts.Version)
 	if err != nil {
 		return nil, err
 	}
@@ -199,12 +190,7 @@ func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions)
 		return nil, fmt.Errorf("inspect machine: %w", err)
 	}
 	if minfo.Id != "" {
-		if !opts.AutoConfirm {
-			if err = promptResetMachine(); err != nil {
-				return nil, err
-			}
-		}
-		if err = resetAndWaitMachine(ctx, machineClient.MachineClient); err != nil {
+		if err = cli.promptResetMachine(); err != nil {
 			return nil, err
 		}
 	}
@@ -221,9 +207,8 @@ func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions)
 	}

 	req := &pb.InitClusterRequest{
-		MachineName:        opts.MachineName,
-		Network:            pb.NewIPPrefix(opts.Network),
-		WireguardEndpoints: opts.WireguardEndpoints,
+		MachineName: opts.MachineName,
+		Network:     pb.NewIPPrefix(opts.Network),
 	}
 	if opts.PublicIP != nil {
 		if opts.PublicIP.IsValid() {
@@ -250,21 +235,8 @@ func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions)

 	// Save the machine's SSH connection details in the context config.
 	connCfg := config.MachineConnection{
+		SSH:        config.NewSSHDestination(opts.RemoteMachine.User, opts.RemoteMachine.Host, opts.RemoteMachine.Port),
 		SSHKeyFile: opts.RemoteMachine.KeyPath,
-		MachineID:  resp.Machine.Id,
-	}
-	if opts.RemoteMachine.UseSSHCLI {
-		connCfg.SSHCLI = config.NewSSHDestination(
-			opts.RemoteMachine.User,
-			opts.RemoteMachine.Host,
-			opts.RemoteMachine.Port,
-		)
-	} else {
-		connCfg.SSH = config.NewSSHDestination(
-			opts.RemoteMachine.User,
-			opts.RemoteMachine.Host,
-			opts.RemoteMachine.Port,
-		)
 	}
 	cli.Config.Contexts[contextName].Connections = append(cli.Config.Contexts[contextName].Connections, connCfg)
 	if err = cli.Config.Save(); err != nil {
@@ -273,40 +245,12 @@ func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions)
 	return machineClient, nil
 }

-// newContextName returns a unique name for a new cluster context. If the provided name is not DefaultContextName,
-// and it's already taken, an error is returned. If the name is not provided or is DefaultContextName, the first
-// available name "default[-N]" is returned.
-func (cli *CLI) newContextName(name string) (string, error) {
-	if name == "" {
-		name = DefaultContextName
-	}
-
-	if _, exists := cli.Config.Contexts[name]; !exists {
-		return name, nil
-	}
-
-	// If non-default context already exists, error out.
-	if name != DefaultContextName {
-		return "", fmt.Errorf("cluster context '%s' already exists", name)
-	}
-
-	// The default context already exists, generate a numbered suffix to make it unique.
-	for i := 1; ; i++ {
-		name = fmt.Sprintf("%s-%d", DefaultContextName, i)
-		if _, exists := cli.Config.Contexts[name]; !exists {
-			return name, nil
-		}
-	}
-}
-
 type AddMachineOptions struct {
-	MachineName        string
-	PublicIP           *netip.Addr
-	RemoteMachine      *RemoteMachine
-	SkipInstall        bool
-	Version            string
-	AutoConfirm        bool
-	WireguardEndpoints []*pb.IPPort
+	Context       string
+	MachineName   string
+	PublicIP      *netip.Addr
+	RemoteMachine RemoteMachine
+	Version       string
 }

 // AddMachine provisions a remote machine and adds it to the cluster. It returns a cluster client and a machine client.
@@ -314,8 +258,11 @@ type AddMachineOptions struct {
 // cluster. The machine client is connected to the new machine and can be used to interact with it.
 // Both client should be closed after use by the caller.
 func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client.Client, *client.Client, error) {
-	contextName := cli.GetContextOverrideOrCurrent()
-	c, err := cli.ConnectCluster(ctx)
+	contextName := opts.Context
+	if contextName == "" {
+		contextName = cli.Config.CurrentContext
+	}
+	c, err := cli.ConnectCluster(ctx, contextName)
 	if err != nil {
 		return nil, nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
 	}
@@ -325,7 +272,7 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 		}
 	}()

-	machineClient, err := provisionOrConnectRemoteMachine(ctx, opts.RemoteMachine, opts.SkipInstall, opts.Version)
+	machineClient, err := cli.provisionRemoteMachine(ctx, opts.RemoteMachine, opts.Version)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -336,29 +283,12 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	}()

 	// Check if the machine is already initialised as a cluster member and prompt the user to reset it first.
-	// TODO: refactor to use client.InspectMachine.
 	minfo, err := machineClient.Inspect(ctx, &emptypb.Empty{})
 	if err != nil {
 		return nil, nil, fmt.Errorf("inspect machine: %w", err)
 	}
 	if minfo.Id != "" {
-		// Check if the machine is already a member of this cluster.
-		machines, err := c.ListMachines(ctx, nil)
-		if err != nil {
-			return nil, nil, fmt.Errorf("list cluster machines: %w", err)
-		}
-		if slices.ContainsFunc(machines, func(m *pb.MachineMember) bool {
-			return m.Machine.Id == minfo.Id
-		}) {
-			return nil, nil, fmt.Errorf("machine is already a member of this cluster (%s)", minfo.Name)
-		}
-
-		if !opts.AutoConfirm {
-			if err = promptResetMachine(); err != nil {
-				return nil, nil, err
-			}
-		}
-		if err = resetAndWaitMachine(ctx, machineClient.MachineClient); err != nil {
+		if err = cli.promptResetMachine(); err != nil {
 			return nil, nil, err
 		}
 	}
@@ -383,16 +313,10 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 		return nil, nil, fmt.Errorf("parse remote machine token: %w", err)
 	}

-	// Register the machine in the cluster using its public key and WireGuard endpoints from the token,
-	// or use the explicitly provided WireGuard endpoints if any.
-	var endpoints []*pb.IPPort
-	if len(opts.WireguardEndpoints) > 0 {
-		endpoints = opts.WireguardEndpoints
-	} else {
-		endpoints = make([]*pb.IPPort, len(token.Endpoints))
-		for i, addrPort := range token.Endpoints {
-			endpoints[i] = pb.NewIPPort(addrPort)
-		}
+	// Register the machine in the cluster using its public key and endpoints from the token.
+	endpoints := make([]*pb.IPPort, len(token.Endpoints))
+	for i, addrPort := range token.Endpoints {
+		endpoints[i] = pb.NewIPPort(addrPort)
 	}
 	addReq := &pb.AddMachineRequest{
 		Name: opts.MachineName,
@@ -415,19 +339,7 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 		return nil, nil, fmt.Errorf("add machine to cluster (context '%s'): %w", contextName, err)
 	}

-	// Get the current store DB version from the cluster to pass to the join request.
-	var storeDBVersion int64
-	inspectResp, err := c.MachineClient.InspectMachine(ctx, &emptypb.Empty{})
-	if err != nil {
-		// TODO(lhf): remove Unimplemented check when v0.17.0 is released.
-		if status.Convert(err).Code() != codes.Unimplemented {
-			return nil, nil, fmt.Errorf("inspect current cluster machine: %w", err)
-		}
-	} else {
-		storeDBVersion = inspectResp.Machines[0].StoreDbVersion
-	}
-
-	// Get the most up-to-date list of other machines in the cluster to include them in the join request.
+	// List other machines in the cluster to include them in the join request.
 	machines, err := c.ListMachines(ctx, nil)
 	if err != nil {
 		return nil, nil, fmt.Errorf("list cluster machines: %w", err)
@@ -441,9 +353,8 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client

 	// Configure the remote machine to join the cluster.
 	joinReq := &pb.JoinClusterRequest{
-		Machine:           addResp.Machine,
-		OtherMachines:     otherMachines,
-		MinStoreDbVersion: storeDBVersion,
+		Machine:       addResp.Machine,
+		OtherMachines: otherMachines,
 	}
 	if _, err = machineClient.JoinCluster(ctx, joinReq); err != nil {
 		return nil, nil, fmt.Errorf("join cluster: %w", err)
@@ -454,21 +365,11 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client

 	// Save the machine's SSH connection details in the context config.
 	connCfg := config.MachineConnection{
+		SSH:        config.NewSSHDestination(opts.RemoteMachine.User, opts.RemoteMachine.Host, opts.RemoteMachine.Port),
 		SSHKeyFile: opts.RemoteMachine.KeyPath,
-		MachineID:  addResp.Machine.Id,
 	}
-	if opts.RemoteMachine.UseSSHCLI {
-		connCfg.SSHCLI = config.NewSSHDestination(
-			opts.RemoteMachine.User,
-			opts.RemoteMachine.Host,
-			opts.RemoteMachine.Port,
-		)
-	} else {
-		connCfg.SSH = config.NewSSHDestination(
-			opts.RemoteMachine.User,
-			opts.RemoteMachine.Host,
-			opts.RemoteMachine.Port,
-		)
+	if contextName == "" {
+		contextName = cli.Config.CurrentContext
 	}
 	cli.Config.Contexts[contextName].Connections = append(cli.Config.Contexts[contextName].Connections, connCfg)
 	if err = cli.Config.Save(); err != nil {
@@ -478,70 +379,28 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	return c, machineClient, nil
 }

-// provisionOrConnectRemoteMachine installs the Uncloud daemon and dependencies on the remote machine over SSH and
-// returns a machine API client to interact with the machine. The client should be closed after use by the caller.
+// provisionRemoteMachine installs the Uncloud daemon and dependencies on the remote machine over SSH and returns
+// a machine API client to interact with the machine. The client should be closed after use by the caller.
 // The version parameter specifies the version of the Uncloud daemon to install. If empty, the latest version is used.
-// If skipInstall is true, the installation step is skipped, and it is assumed that the Uncloud daemon and dependencies
-// are already installed and running.
-// The remoteMachine.SSHKeyPath could be updated to the default SSH key path if it is not set and the SSH agent
-// authentication fails.
-func provisionOrConnectRemoteMachine(
-	ctx context.Context, remoteMachine *RemoteMachine, skipInstall bool, version string,
+func (cli *CLI) provisionRemoteMachine(
+	ctx context.Context, remoteMachine RemoteMachine, version string,
 ) (*client.Client, error) {
-	// Use SSH CLI
-	if remoteMachine.UseSSHCLI {
-		exec := sshexec.NewSSHCLIRemote(
-			remoteMachine.User,
-			remoteMachine.Host,
-			remoteMachine.Port,
-			remoteMachine.KeyPath,
-		)
-
-		if !skipInstall {
-			if err := provisionMachine(ctx, exec, version); err != nil {
-				return nil, fmt.Errorf("provision machine: %w", err)
-			}
-		}
-
-		sshConfig := &connector.SSHConnectorConfig{
-			User:    remoteMachine.User,
-			Host:    remoteMachine.Host,
-			Port:    remoteMachine.Port,
-			KeyPath: remoteMachine.KeyPath,
-		}
-		machineClient, err := client.New(ctx, connector.NewSSHCLIConnector(sshConfig))
-		if err != nil {
-			return nil, fmt.Errorf("connect to remote machine: %w", err)
-		}
-		return machineClient, nil
-	}
-
-	// Use Go SSH
+	// Provision the remote machine by installing the Uncloud daemon and dependencies over SSH.
 	sshClient, err := sshexec.Connect(remoteMachine.User, remoteMachine.Host, remoteMachine.Port, remoteMachine.KeyPath)
-	// If the SSH connection using SSH agent fails and no key path is provided, try to use the default SSH key.
-	if err != nil && remoteMachine.KeyPath == "" {
-		remoteMachine.KeyPath = DefaultSSHKeyPath
-		sshClient, err = sshexec.Connect(
-			remoteMachine.User, remoteMachine.Host, remoteMachine.Port, remoteMachine.KeyPath,
-		)
-	}
 	if err != nil {
 		return nil, fmt.Errorf(
 			"SSH login to remote machine %s: %w",
 			config.NewSSHDestination(remoteMachine.User, remoteMachine.Host, remoteMachine.Port), err,
 		)
 	}
-
-	if !skipInstall {
-		// Provision the remote machine by installing the Uncloud daemon and dependencies over SSH.
-		exec := sshexec.NewRemote(sshClient)
-		if err = provisionMachine(ctx, exec, version); err != nil {
-			return nil, fmt.Errorf("provision machine: %w", err)
-		}
+	exec := sshexec.NewRemote(sshClient)
+	// Install and run the Uncloud daemon and dependencies on the remote machine.
+	if err = provisionMachine(ctx, exec, version); err != nil {
+		return nil, fmt.Errorf("provision machine: %w", err)
 	}

 	var machineClient *client.Client
-	if remoteMachine.User == "root" || skipInstall {
+	if remoteMachine.User == "root" {
 		// Create a machine API client over the established SSH connection to the remote machine.
 		machineClient, err = client.New(ctx, connector.NewSSHConnectorFromClient(sshClient))
 	} else {
@@ -561,6 +420,31 @@ func provisionOrConnectRemoteMachine(
 	return machineClient, nil
 }

+func (cli *CLI) promptResetMachine() error {
+	var confirm bool
+	form := huh.NewForm(
+		huh.NewGroup(
+			huh.NewConfirm().
+				Title(
+					"The remote machine is already initialised as a cluster member. Do you want to reset it first?",
+				).
+				Affirmative("Yes!").
+				Negative("No").
+				Value(&confirm),
+		),
+	).WithAccessible(true)
+	if err := form.Run(); err != nil {
+		return fmt.Errorf("prompt user to confirm: %w", err)
+	}
+
+	if !confirm {
+		return fmt.Errorf("remote machine is already initialised as a cluster member")
+	}
+	// TODO: implement resetting the remote machine.
+	return fmt.Errorf("resetting the remote machine is not implemented yet. " +
+		"Please manually run 'uncloud-uninstall' on the remote machine to fully uninstall Uncloud from it")
+}
+
 // ProgressOut returns an output stream for progress writer.
 func (cli *CLI) ProgressOut() *streams.Out {
 	return streams.NewOut(os.Stdout)
--- a/Show More
+++ b/Show More