feat: make all confirmation forms accessible

feat: add support for Compose profiles

.dockerignore

@@ -4,6 +4,7 @@
 # Allow files and directories.
 !cmd/
 !internal/
+!pkg/
 !scripts/docker/
 !go.*
 

.gitignore

@@ -27,8 +27,9 @@ go.work.sum
 .env
 .idea/
 
-data
-dist/
+/data/
+/dist/
+/uc
 
 # Web
 node_modules/

.goreleaser.yaml

@@ -24,6 +24,8 @@ builds:
     goarch:
       - amd64
       - arm64
+    ldflags:
+      - -s -w -X github.com/psviderski/uncloud/internal/version.version={{ .Version }}
 
   - id: uncloudd
     main: ./cmd/uncloudd
@@ -35,6 +37,8 @@ builds:
     goarch:
       - amd64
       - arm64
+    ldflags:
+      - -s -w -X github.com/psviderski/uncloud/internal/version.version={{ .Version }}
 
 archives:
   - id: uncloud

Makefile

@@ -30,6 +30,16 @@ reset-dev:
 	ssh spy@192.168.40.176 "sudo systemctl stop uncloud && sudo rm -rf /var/lib/uncloud"
 	ssh ubuntu@152.67.101.197 "sudo systemctl stop uncloud && sudo rm -rf /var/lib/uncloud"
 
+demo-reset:
+	rm -fv ~/.config/uncloud/config.yaml
+	ssh ubuntu@152.67.101.197 "AUTO_CONFIRM=true sudo -E uncloud-uninstall && docker rmi caddy:2.9.1"
+	ssh root@5.223.45.199 "AUTO_CONFIRM=true sudo -E uncloud-uninstall"
+	ssh spy@192.168.40.243 "AUTO_CONFIRM=true sudo -E uncloud-uninstall"
+
+.PHONY: ucind-cluster
+ucind-cluster:
+	go run ./cmd/ucind cluster rm && go run ./cmd/ucind cluster create -m 3
+
 .PHONY: proto
 proto:
 	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative \

README.md

@@ -16,6 +16,14 @@ some machines go offline.
 Uncloud aims to be the solution for developers who want the flexibility of self-hosted infrastructure without the
 operational complexity of Kubernetes.
 
+## 🎬 Quick demo
+
+Deploy a highly available web app with automatic HTTPS across multiple regions and on-premises in just a couple minutes.
+
+<a href="https://uncloud.wistia.com/medias/k47uwt9uau?wvideo=k47uwt9uau">
+<img src="https://embed-ssl.wistia.com/deliveries/3cf7014a48b93afc556444bed3e39a8c.jpg?image_crop_resized=900x526&image_play_button_rounded=true&image_play_button_size=2x&image_play_button_color=18181Be0" alt="Uncloud demo" width="450" height="263" />
+</a>
+
 ## ✨ Features
 
 * **Deploy anywhere**: Combine cloud VMs, dedicated servers, and bare metal into a unified computing environment —
@@ -25,7 +33,10 @@ operational complexity of Kubernetes.
 * **No control plane**: Fully decentralized design eliminates single points of failure and reduces operational overhead.
 * **Imperative over declarative**: Favoring imperative operations over state reconciliation simplifies both the mental
   model and troubleshooting.
+* **Zero-downtime deployments**: Rolling updates with health checks and automatic rollback on failure.
 * **Service discovery**: Built-in DNS server resolves service names to container IPs.
+* **Managed DNS**: Automatic DNS records `*.<id>.cluster.uncloud.run` for services with public access via managed
+  [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service.
 * **Automatic HTTPS**: Built-in Caddy reverse proxy handles TLS certificate provisioning and renewal using Let's
   Encrypt.
 * **Docker-like CLI**: Familiar commands for managing both infrastructure and applications.
@@ -33,12 +44,11 @@ operational complexity of Kubernetes.
 
 Coming soon:
 
-* Project isolation through environments/namespaces
 * Infrastructure as Code using Docker Compose format
+* Project isolation through environments/namespaces
 * Persistent volumes and secrets management
 * Monitoring and log aggregation
 * Database deployment and management
-* Curated application catalog
 
 Here is a diagram of an Uncloud multi-provider cluster of 3 machines:
 
@@ -66,36 +76,45 @@ platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bar
 
 1. Install Uncloud CLI:
 
-```bash
-brew install psviderski/tap/uncloud
+   ```bash
+   brew install psviderski/tap/uncloud
 
-# or using curl (macOS/Linux)
-curl -fsS https://get.uncloud.run/install.sh | sh
-```
+   # or using curl (macOS/Linux)
+   curl -fsS https://get.uncloud.run/install.sh | sh
+   ```
 
 2. Initialize your first machine:
 
-```bash
-uc machine init root@your-server-ip
-```
+   ```bash
+   uc machine init root@your-server-ip
+   ```
 
-3. Create a DNS A record in your DNS provider (Cloudflare, Namecheap, etc.) that points `app.example.com` to your
+3. Deploy your app from a Docker image and publish its container port 8000 as HTTPS using `app.example.com` domain:
+
+   ```bash
+   uc run -p app.example.com:8000/https image/my-app
+   ```
+
+4. Create a DNS A record in your DNS provider (Cloudflare, Namecheap, etc.) that points `app.example.com` to your
    server's IP address. Allow a few minutes for DNS propagation.
-4. Deploy your app from a Docker image:
 
-```bash
-uc run -p app.example.com:8000/https my-app-image
-```
-
-That's it! Your app is now running and accessible at https://app.example.com ✨
+   That's it! Your app is now running and accessible at https://app.example.com ✨
 
 5. Clean up when you're done:
 
-```bash
-uc ls
-# Copy the service ID from the output and remove it:
-uc rm my-app-id
-```
+   ```bash
+   uc ls
+   # Copy the service name from the output and run the rm command:
+   uc rm my-app-name
+   ```
+
+   If you want to fully uninstall Uncloud on a machine, run:
+
+   ```bash
+   uncloud-uninstall
+   ```
+
+View the [user guide](docs/user_guide.md) for more information.
 
 ## ⚙️ How it works
 
@@ -105,7 +124,42 @@ under the hood to see what happens when you run certain commands.
 **When you initialize a new cluster on a machine:**
 
 ```bash
-uc machine init root@your-server-ip
+$ uc machine init --name oracle-vm ubuntu@152.67.101.197
+
+Downloading Uncloud install script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/install.sh
+⏳ Running Uncloud install script...
+✓ Docker is already installed.
+⏳ Installing Docker...
+...
+✓ Docker installed successfully.
+✓ Linux user and group 'uncloud' created.
+✓ Linux user 'ubuntu' added to group 'uncloud'.
+⏳ Installing Uncloud binaries...
+⏳ Downloading uncloudd binary: https://github.com/psviderski/uncloud/releases/latest/download/uncloudd_linux_arm64.tar.gz
+✓ uncloudd binary installed: /usr/local/bin/uncloudd
+⏳ Downloading uninstall script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/uninstall.sh
+✓ uncloud-uninstall script installed: /usr/local/bin/uncloud-uninstall
+✓ Systemd unit file created: /etc/systemd/system/uncloud.service
+Created symlink /etc/systemd/system/multi-user.target.wants/uncloud.service → /etc/systemd/system/uncloud.service.
+⏳ Downloading uncloud-corrosion binary: https://github.com/psviderski/corrosion/releases/latest/download/corrosion-aarch64-unknown-linux-gnu.tar.gz
+✓ uncloud-corrosion binary installed: /usr/local/bin/uncloud-corrosion
+✓ Systemd unit file created: /etc/systemd/system/uncloud-corrosion.service
+⏳ Starting Uncloud machine daemon (uncloud.service)...
+✓ Uncloud machine daemon started.
+✓ Uncloud installed on the machine successfully! 🎉
+Cluster "default" initialised with machine "oracle-vm"
+Waiting for the machine to be ready...
+
+Reserved cluster domain: xuw3xd.cluster.uncloud.run
+[+] Deploying service caddy 1/1
+ ✔ Container caddy-c47x on oracle-vm  Started                                                                                                                                          0.9s
+
+Updating cluster domain records in Uncloud DNS to point to machines running caddy service...
+[+] Verifying internet access to caddy service 1/1
+ ✔ Machine oracle-vm (152.67.101.197)  Reachable                                                                                                                                       0.1s
+
+DNS records updated to use only the internet-reachable machines running caddy service:
+  *.xuw3xd.cluster.uncloud.run  A → 152.67.101.197
 ```
 
 1. The CLI SSHs into the machine and installs Docker, the `uncloudd` machine daemon and
@@ -121,7 +175,42 @@ uc machine init root@your-server-ip
 **When you add another machine:**
 
 ```bash
-uc machine add ubuntu@second-server-ip
+$ uc machine add --name hetzner-server root@5.223.45.199
+Downloading Uncloud install script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/install.sh
+⏳ Running Uncloud install script...
+✓ Docker is already installed.
+✓ Linux user and group 'uncloud' created.
+⏳ Installing Uncloud binaries...
+⏳ Downloading uncloudd binary: https://github.com/psviderski/uncloud/releases/latest/download/uncloudd_linux_amd64.tar.gz
+✓ uncloudd binary installed: /usr/local/bin/uncloudd
+⏳ Downloading uninstall script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/uninstall.sh
+✓ uncloud-uninstall script installed: /usr/local/bin/uncloud-uninstall
+✓ Systemd unit file created: /etc/systemd/system/uncloud.service
+Created symlink /etc/systemd/system/multi-user.target.wants/uncloud.service → /etc/systemd/system/uncloud.service.
+⏳ Downloading uncloud-corrosion binary: https://github.com/psviderski/corrosion/releases/latest/download/corrosion-x86_64-unknown-linux-gnu.tar.gz
+✓ uncloud-corrosion binary installed: /usr/local/bin/uncloud-corrosion
+✓ Systemd unit file created: /etc/systemd/system/uncloud-corrosion.service
+⏳ Starting Uncloud machine daemon (uncloud.service)...
+✓ Uncloud machine daemon started.
+✓ Uncloud installed on the machine successfully! 🎉
+Machine "hetzner-server" added to cluster
+Waiting for the machine to be ready...
+
+[+] Deploying service caddy 1/1
+ ✔ Container caddy-d36c on hetzner-server  Started                                                                                                                                     1.0s
+
+Updating cluster domain records in Uncloud DNS to point to machines running caddy service...
+[+] Verifying internet access to caddy service 2/2
+ ✔ Machine hetzner-server (5.223.45.199)  Reachable                                                                                                                                    0.2s
+ ✔ Machine oracle-vm (152.67.101.197)     Reachable                                                                                                                                    0.1s
+
+DNS records updated to use only the internet-reachable machines running caddy service:
+  *.xuw3xd.cluster.uncloud.run  A → 152.67.101.197, 5.223.45.199
+
+$ uc machine ls
+NAME             STATE   ADDRESS         PUBLIC IP        WIREGUARD ENDPOINTS
+oracle-vm        Up      10.210.0.1/24   152.67.101.197   10.0.0.95:51820, 152.67.101.197:51820
+hetzner-server   Up      10.210.1.1/24   5.223.45.199     5.223.45.199:51820, [2a01:4ff:2f0:128b::1]:51820
 ```
 
 1. The second machine gets provisioned just like the first. A non-root SSH user will need `sudo` access.
@@ -140,7 +229,14 @@ and automatically establish a WireGuard tunnel with it.
 **When you run a service:**
 
 ```bash
-uc run -p app.example.com:8000/https my-app-image
+$ uc run -p app.example.com:8000/https image/my-app
+
+[+] Running service my-app-1b3b (replicated mode) 1/1
+ ✔ Container my-app-1b3b-tcex on oracle-vm  Started
+
+my-app-1b3b endpoints:
+ • https://app.example.com → :8000
+ • https://my-app-1b3b.xuw3xd.cluster.uncloud.run → :8000
 ```
 
 1. CLI picks a machine to run your container.

cmd/ucind/cluster/create.go

@@ -3,7 +3,7 @@ package cluster
 import (
 	"fmt"
 	"github.com/spf13/cobra"
-	"uncloud/internal/ucind"
+	"github.com/psviderski/uncloud/internal/ucind"
 )
 
 func NewCreateCommand() *cobra.Command {

cmd/ucind/cluster/remove.go

@@ -3,7 +3,7 @@ package cluster
 import (
 	"fmt"
 	"github.com/spf13/cobra"
-	"uncloud/internal/ucind"
+	"github.com/psviderski/uncloud/internal/ucind"
 )
 
 func NewRemoveCommand() *cobra.Command {

cmd/ucind/main.go

@@ -3,12 +3,13 @@ package main
 import (
 	"context"
 	"fmt"
-	"github.com/docker/docker/client"
-	"github.com/spf13/cobra"
 	"os"
 	"strings"
-	"uncloud/cmd/ucind/cluster"
-	"uncloud/internal/ucind"
+
+	"github.com/docker/docker/client"
+	"github.com/psviderski/uncloud/cmd/ucind/cluster"
+	"github.com/psviderski/uncloud/internal/ucind"
+	"github.com/spf13/cobra"
 )
 
 func main() {
@@ -44,9 +45,9 @@ func main() {
 	}
 
 	// TODO: allow to override using UNCLOUD_CONFIG env var.
-	cmd.PersistentFlags().StringVar(&configPath, "uncloud-config", "~/.config/uncloud/config.toml",
+	cmd.PersistentFlags().StringVar(&configPath, "uncloud-config", "~/.config/uncloud/config.yaml",
 		"path to the Uncloud configuration file.")
-	_ = cmd.MarkPersistentFlagFilename("uncloud-config", "toml")
+	_ = cmd.MarkPersistentFlagFilename("uncloud-config", "yaml", "yml")
 
 	cmd.AddCommand(
 		cluster.NewRootCommand(),

cmd/uncloud/caddy/deploy.go

@@ -4,22 +4,23 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/charmbracelet/huh"
-	"github.com/docker/cli/cli/streams"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/spf13/cobra"
 	"maps"
 	"slices"
 	"strings"
-	"uncloud/internal/cli"
-	"uncloud/internal/cli/client"
-	"uncloud/internal/machine/api/pb"
+
+	"github.com/docker/cli/cli/streams"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
 )
 
 type deployOptions struct {
-	image   string
-	machine string
-	cluster string
+	image    string
+	machines []string
+	context  string
 }
 
 func NewDeployCommand() *cobra.Command {
@@ -32,24 +33,25 @@ func NewDeployCommand() *cobra.Command {
 			"A rolling update is performed when updating existing containers to minimise disruption.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return deploy(cmd.Context(), uncli, opts)
+			return runDeploy(cmd.Context(), uncli, opts)
 		},
 	}
 
 	cmd.Flags().StringVar(&opts.image, "image", "",
 		"Caddy Docker image to deploy. (default caddy:LATEST_VERSION)")
-	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
-		"Machine names to deploy to (comma-separated). (default is all machines)")
+	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
+		"Machine names to deploy to. Can be specified multiple times or as a comma-separated "+
+			"list of machine names. (default is all machines)")
 	cmd.Flags().StringVarP(
-		&opts.cluster, "cluster", "c", "",
-		"Name of the cluster to deploy to. (default is the current cluster)",
+		&opts.context, "context", "c", "",
+		"Name of the cluster context to deploy to. (default is the current context)",
 	)
 
 	return cmd
 }
 
-func deploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.cluster)
+func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -57,7 +59,7 @@ func deploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 
 	svc, err := clusterClient.InspectService(ctx, client.CaddyServiceName)
 	if err != nil {
-		if !errors.Is(err, client.ErrNotFound) {
+		if !errors.Is(err, api.ErrNotFound) {
 			return fmt.Errorf("inspect caddy service: %w", err)
 		}
 		fmt.Printf("Service: %s (not running)\n", client.CaddyServiceName)
@@ -86,16 +88,10 @@ func deploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 	fmt.Println()
 	fmt.Println("Preparing a deployment plan...")
 
-	var filter client.MachineFilter
-	if opts.machine != "" {
-		machines := strings.Split(opts.machine, ",")
-		for i, m := range machines {
-			machines[i] = strings.TrimSpace(m)
-		}
-		filter = machineFilter(machines)
+	placement := api.Placement{
+		Machines: cli.ExpandCommaSeparatedValues(opts.machines),
 	}
-
-	d, err := clusterClient.NewCaddyDeployment(opts.image, filter)
+	d, err := clusterClient.NewCaddyDeployment(opts.image, placement)
 	if err != nil {
 		return fmt.Errorf("create caddy deployment: %w", err)
 	}
@@ -106,31 +102,18 @@ func deploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 
 	plan, err := d.Plan(ctx)
 	if err != nil {
-		if errors.Is(err, client.ErrNoMatchingMachines) {
-			return fmt.Errorf("no machines found matching: %s", opts.machine)
-		}
 		return fmt.Errorf("plan caddy deployment: %w", err)
 	}
 
 	if len(plan.Operations) == 0 {
-		if opts.machine != "" {
-			fmt.Printf("%s service is up to date on selected machines.\n", client.CaddyServiceName)
-		} else {
-			fmt.Printf("%s service is up to date.\n", client.CaddyServiceName)
-		}
+		fmt.Printf("%s service is up to date.\n", client.CaddyServiceName)
 	} else {
 		if svc.ID == "" {
-			if opts.machine != "" {
-				fmt.Println("This will run a Caddy container on selected machines.")
+			if len(opts.machines) > 0 {
+				fmt.Println("This will run a Caddy container on each selected machine.")
 			} else {
 				fmt.Println("This will run a Caddy container on each machine.")
 			}
-		} else {
-			if opts.machine != "" {
-				fmt.Println("This will perform a rolling update of Caddy containers on selected machines.")
-			} else {
-				fmt.Println("This will perform a rolling update of Caddy containers on each machine.")
-			}
 		}
 
 		// Initialise a machine and container name resolver to properly format the plan output.
@@ -144,7 +127,7 @@ func deploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 		fmt.Println(plan.Format(resolver))
 		fmt.Println()
 
-		confirmed, err := confirm()
+		confirmed, err := cli.Confirm()
 		if err != nil {
 			return fmt.Errorf("confirm deployment: %w", err)
 		}
@@ -170,7 +153,7 @@ func deploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 
 func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, progressOut *streams.Out) error {
 	if _, err := clusterClient.GetDomain(ctx); err != nil {
-		if errors.Is(err, client.ErrNotFound) {
+		if errors.Is(err, api.ErrNotFound) {
 			fmt.Println("Skipping DNS records update as no cluster domain is reserved (see 'uc dns').")
 			return nil
 		}
@@ -213,32 +196,3 @@ func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, prog
 
 	return nil
 }
-
-func confirm() (bool, error) {
-	var confirmed bool
-	form := huh.NewForm(
-		huh.NewGroup(
-			huh.NewConfirm().
-				Title(
-					"Do you want to continue?",
-				).
-				Affirmative("Yes!").
-				Negative("No").
-				Value(&confirmed),
-		),
-	)
-	if err := form.Run(); err != nil {
-		return false, err
-	}
-
-	return confirmed, nil
-}
-
-func machineFilter(machines []string) client.MachineFilter {
-	if len(machines) == 0 {
-		return nil
-	}
-	return func(m *pb.MachineInfo) bool {
-		return slices.Contains(machines, m.Name)
-	}
-}

cmd/uncloud/context/ls.go

@@ -0,0 +1,61 @@
+package context
+
+import (
+	"fmt"
+	"maps"
+	"os"
+	"slices"
+	"text/tabwriter"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/spf13/cobra"
+)
+
+func NewListCommand() *cobra.Command {
+	var clusterContext string
+
+	cmd := &cobra.Command{
+		Use:     "ls",
+		Aliases: []string{"list"},
+		Short:   "List available cluster contexts.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return list(uncli)
+		},
+	}
+
+	cmd.Flags().StringVarP(
+		&clusterContext, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+
+	return cmd
+}
+
+func list(uncli *cli.CLI) error {
+	if uncli.Config == nil {
+		return fmt.Errorf("context management is not available: Uncloud configuration file is not being used")
+	}
+
+	if len(uncli.Config.Contexts) == 0 {
+		fmt.Println("No contexts found")
+		return nil
+	}
+
+	contextNames := slices.Sorted(maps.Keys(uncli.Config.Contexts))
+	currentContext := uncli.Config.CurrentContext
+
+	tw := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
+	fmt.Fprintln(tw, "NAME\tCURRENT\tCONNECTIONS")
+
+	for _, name := range contextNames {
+		current := ""
+		if name == currentContext {
+			current = "*"
+		}
+		connCount := len(uncli.Config.Contexts[name].Connections)
+		fmt.Fprintf(tw, "%s\t%s\t%d\n", name, current, connCount)
+	}
+
+	return tw.Flush()
+}

cmd/uncloud/context/root.go

@@ -0,0 +1,25 @@
+package context
+
+import (
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/spf13/cobra"
+)
+
+func NewRootCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "ctx",
+		Aliases: []string{"context"},
+		Short:   "Switch between different cluster contexts. Contains subcommands to manage contexts.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return selectContext(uncli)
+		},
+	}
+
+	cmd.AddCommand(
+		NewListCommand(),
+		NewUseCommand(),
+	)
+
+	return cmd
+}

cmd/uncloud/context/use.go

@@ -0,0 +1,82 @@
+package context
+
+import (
+	"fmt"
+	"maps"
+	"slices"
+
+	"github.com/charmbracelet/huh"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/spf13/cobra"
+)
+
+func NewUseCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "use [CONTEXT]",
+		Short: "Switch to a different cluster context.",
+		Long: "Switch to a different cluster context. If no context is provided, " +
+			"a list of available contexts will be displayed for selection.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			if len(args) == 1 {
+				if err := uncli.SetCurrentContext(args[0]); err != nil {
+					return fmt.Errorf("failed to set the current cluster context to '%s': %w", args[0], err)
+				}
+				fmt.Printf("Current cluster context is now '%s'.\n", args[0])
+				return nil
+			}
+
+			return selectContext(uncli)
+		},
+	}
+
+	return cmd
+}
+
+func selectContext(uncli *cli.CLI) error {
+	if uncli.Config == nil {
+		return fmt.Errorf("context management is not available: Uncloud configuration file is not being used")
+	}
+	if len(uncli.Config.Contexts) == 0 {
+		return fmt.Errorf("no contexts found in Uncloud config (%s)", uncli.Config.Path())
+	}
+
+	contextNames := slices.Sorted(maps.Keys(uncli.Config.Contexts))
+
+	var selected string
+	form := huh.NewForm(
+		huh.NewGroup(
+			huh.NewSelect[string]().
+				Title("Select a cluster context").
+				Options(buildContextOptions(contextNames, uncli.Config.CurrentContext)...).
+				Value(&selected),
+		),
+	)
+	if err := form.Run(); err != nil {
+		return fmt.Errorf("select cluster context: %w", err)
+	}
+
+	if err := uncli.SetCurrentContext(selected); err != nil {
+		return fmt.Errorf("set current cluster context: %w", err)
+	}
+
+	fmt.Printf("Current cluster context is now '%s'.\n", selected)
+	return nil
+}
+
+func buildContextOptions(contexts []string, current string) []huh.Option[string] {
+	options := make([]huh.Option[string], len(contexts))
+
+	for i, ctx := range contexts {
+		opt := huh.NewOption(ctx, ctx)
+		if ctx == current {
+			opt.Key += " (current)"
+			opt = opt.Selected(true)
+		}
+
+		options[i] = opt
+	}
+
+	return options
+}

cmd/uncloud/deploy.go

@@ -0,0 +1,159 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	composecli "github.com/compose-spec/compose-go/v2/cli"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/psviderski/uncloud/pkg/client/compose"
+	"github.com/psviderski/uncloud/pkg/client/deploy"
+	"github.com/spf13/cobra"
+)
+
+type deployOptions struct {
+	files    []string
+	profiles []string
+	services []string
+
+	context string
+}
+
+// NewDeployCommand creates a new command to deploy services from a Compose file.
+func NewDeployCommand() *cobra.Command {
+	opts := deployOptions{}
+	cmd := &cobra.Command{
+		Use:   "deploy [FLAGS] [SERVICE...]",
+		Short: "Deploy services from a Compose file.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			if len(args) > 0 {
+				opts.services = args
+			}
+
+			return runDeploy(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringSliceVarP(&opts.files, "file", "f", nil,
+		"One or more Compose files to deploy services from. (default compose.yaml)")
+	cmd.Flags().StringSliceVarP(&opts.profiles, "profile", "p", nil,
+		"One or more Compose profiles to enable.")
+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context to deploy to (default is the current context)")
+	// TODO: Consider adding a filter flag to specify which machines to deploy to but keep the rest running.
+	//  Could be useful to test a new version on a subset of machines before rolling out to all.
+
+	return cmd
+}
+
+// projectOpts returns the project options for the Compose file(s).
+func projectOpts(opts deployOptions) []composecli.ProjectOptionsFn {
+	projectOpts := []composecli.ProjectOptionsFn{}
+
+	if len(opts.profiles) > 0 {
+		projectOpts = append(projectOpts, composecli.WithDefaultProfiles(opts.profiles...))
+	}
+
+	return projectOpts
+}
+
+// runDeploy parses the Compose file(s) and deploys the services.
+func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
+	projectOpts := projectOpts(opts)
+
+	project, err := compose.LoadProject(ctx, opts.files, projectOpts...)
+	if err != nil {
+		return fmt.Errorf("load compose file(s): %w", err)
+	}
+
+	if len(opts.services) > 0 {
+		// Includes service dependencies by default. This is the default docker compose behavior.
+		project, err = project.WithSelectedServices(opts.services)
+		if err != nil {
+			return fmt.Errorf("select services: %w", err)
+		}
+	}
+
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	composeDeploy, err := compose.NewDeployment(ctx, clusterClient, project)
+	if err != nil {
+		return fmt.Errorf("create compose deployment: %w", err)
+	}
+
+	plan, err := composeDeploy.Plan(ctx)
+	if err != nil {
+		return fmt.Errorf("plan deployment: %w", err)
+	}
+
+	if len(plan.Operations) == 0 {
+		fmt.Println("Services are up to date.")
+		return nil
+	}
+
+	fmt.Println("Deployment plan:")
+	if err = printPlan(ctx, clusterClient, plan); err != nil {
+		return fmt.Errorf("print deployment plan: %w", err)
+	}
+	fmt.Println()
+
+	confirmed, err := cli.Confirm()
+	if err != nil {
+		return fmt.Errorf("confirm deployment: %w", err)
+	}
+	if !confirmed {
+		fmt.Println("Cancelled. No changes were made.")
+		return nil
+	}
+
+	return progress.RunWithTitle(ctx, func(ctx context.Context) error {
+		if err := plan.Execute(ctx, clusterClient); err != nil {
+			return fmt.Errorf("deploy services: %w", err)
+		}
+		return nil
+	}, uncli.ProgressOut(), "Deploying services")
+}
+
+func printPlan(ctx context.Context, cli *client.Client, plan deploy.SequenceOperation) error {
+	for _, op := range plan.Operations {
+		svcPlan, ok := op.(*deploy.Plan)
+		if !ok {
+			fmt.Println("- " + op.Format(nil))
+			continue
+		}
+
+		svc, err := cli.InspectService(ctx, svcPlan.ServiceID)
+		if err != nil && !errors.Is(err, api.ErrNotFound) {
+			return fmt.Errorf("inspect service: %w", err)
+		}
+		// Initialise a machine and container name resolver to properly format the service plan output.
+		resolver, err := cli.ServiceOperationNameResolver(ctx, svc)
+		if err != nil {
+			return fmt.Errorf("create machine and container name resolver for service operations: %w", err)
+		}
+
+		fmt.Printf("- Deploy service [name=%s]\n", svcPlan.ServiceName)
+		fmt.Println(indent(svcPlan.Format(resolver), "  "))
+	}
+
+	return nil
+}
+
+func indent(text, prefix string) string {
+	lines := strings.Split(text, "\n")
+	for i, line := range lines {
+		lines[i] = prefix + line
+	}
+	return strings.Join(lines, "\n")
+}

cmd/uncloud/dns/release.go

@@ -4,15 +4,16 @@ import (
 	"context"
 	"errors"
 	"fmt"
+
+	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
-	"uncloud/internal/cli"
 )
 
 type releaseOptions struct {
-	cluster string
+	context string
 }
 
 func NewReleaseCommand() *cobra.Command {
@@ -28,15 +29,15 @@ func NewReleaseCommand() *cobra.Command {
 	}
 
 	cmd.Flags().StringVarP(
-		&opts.cluster, "cluster", "c", "",
-		"Name of the cluster. (default is the current cluster)",
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
 	)
 
 	return cmd
 }
 
 func release(ctx context.Context, uncli *cli.CLI, opts releaseOptions) error {
-	client, err := uncli.ConnectCluster(ctx, opts.cluster)
+	client, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/dns/reserve.go

@@ -4,18 +4,22 @@ import (
 	"context"
 	"errors"
 	"fmt"
+
+	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
-	"uncloud/internal/cli"
-	"uncloud/internal/machine/api/pb"
 )
 
 const DefaultUncloudDNSAPIEndpoint = "https://dns.uncloud.run/v1"
 
 type reserveOptions struct {
 	endpoint string
-	cluster  string
+	context  string
 }
 
 func NewReserveCommand() *cobra.Command {
@@ -33,21 +37,21 @@ func NewReserveCommand() *cobra.Command {
 	cmd.Flags().StringVar(&opts.endpoint, "endpoint", DefaultUncloudDNSAPIEndpoint,
 		"API endpoint for the Uncloud DNS service.")
 	cmd.Flags().StringVarP(
-		&opts.cluster, "cluster", "c", "",
-		"Name of the cluster. (default is the current cluster)",
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
 	)
 
 	return cmd
 }
 
 func reserve(ctx context.Context, uncli *cli.CLI, opts reserveOptions) error {
-	client, err := uncli.ConnectCluster(ctx, opts.cluster)
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
-	defer client.Close()
+	defer clusterClient.Close()
 
-	domain, err := client.ReserveDomain(ctx, &pb.ReserveDomainRequest{Endpoint: opts.endpoint})
+	domain, err := clusterClient.ReserveDomain(ctx, &pb.ReserveDomainRequest{Endpoint: opts.endpoint})
 	if err != nil {
 		if status.Convert(err).Code() == codes.AlreadyExists {
 			return errors.New("domain already reserved")
@@ -56,7 +60,16 @@ func reserve(ctx context.Context, uncli *cli.CLI, opts reserveOptions) error {
 	}
 
 	fmt.Printf("Reserved cluster domain: %s\n", domain.Name)
-	fmt.Println("Redeploy the Caddy service ('uc caddy deploy') to configure DNS records for the domain " +
-		"to route traffic to the services in the cluster.")
-	return nil
+
+	// Update cluster domain records in Uncloud DNS to point to machines running caddy service if it has been deployed.
+	if _, err = clusterClient.InspectService(ctx, client.CaddyServiceName); err != nil {
+		if errors.Is(err, api.ErrNotFound) {
+			fmt.Println("Deploy the Caddy reverse proxy service ('uc caddy deploy') to enable internet access " +
+				"to your services via the reserved or your custom domain.")
+			return nil
+		}
+		return fmt.Errorf("inspect caddy service: %w", err)
+	}
+
+	return caddy.UpdateDomainRecords(ctx, clusterClient, uncli.ProgressOut())
 }

cmd/uncloud/dns/show.go

@@ -4,13 +4,14 @@ import (
 	"context"
 	"errors"
 	"fmt"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/spf13/cobra"
-	"uncloud/internal/cli"
-	"uncloud/internal/cli/client"
 )
 
 type showOptions struct {
-	cluster string
+	context string
 }
 
 func NewShowCommand() *cobra.Command {
@@ -26,15 +27,15 @@ func NewShowCommand() *cobra.Command {
 	}
 
 	cmd.Flags().StringVarP(
-		&opts.cluster, "cluster", "c", "",
-		"Name of the cluster. (default is the current cluster)",
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
 	)
 
 	return cmd
 }
 
 func show(ctx context.Context, uncli *cli.CLI, opts showOptions) error {
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.cluster)
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -42,7 +43,7 @@ func show(ctx context.Context, uncli *cli.CLI, opts showOptions) error {
 
 	domain, err := clusterClient.GetDomain(ctx)
 	if err != nil {
-		if errors.Is(err, client.ErrNotFound) {
+		if errors.Is(err, api.ErrNotFound) {
 			return errors.New("no domain reserved")
 		}
 		return err

cmd/uncloud/machine/add.go

@@ -4,19 +4,19 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/netip"
+	"time"
+
 	"github.com/cenkalti/backoff/v4"
 	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/types/known/emptypb"
-	"net/netip"
-	"time"
-	"uncloud/cmd/uncloud/caddy"
-	"uncloud/internal/cli"
-	"uncloud/internal/cli/client"
-	"uncloud/internal/cli/config"
-	"uncloud/internal/machine/api/pb"
 )
 
 type addOptions struct {
@@ -24,7 +24,8 @@ type addOptions struct {
 	noCaddy  bool
 	publicIP string
 	sshKey   string
-	cluster  string
+	context  string
+	version  string
 }
 
 func NewAddCommand() *cobra.Command {
@@ -64,10 +65,15 @@ func NewAddCommand() *cobra.Command {
 		&opts.sshKey, "ssh-key", "i", "",
 		"path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
 	)
-	cmd.Flags().StringVarP(
-		&opts.cluster, "cluster", "c", "",
-		"Name of the cluster to add the machine to. (default is the current cluster)",
+	cmd.Flags().StringVar(
+		&opts.version, "version", "latest",
+		"Version of the Uncloud daemon to install on the machine.",
 	)
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context to add the machine to. (default is the current context)",
+	)
+
 	return cmd
 }
 
@@ -86,7 +92,13 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, o
 		publicIP = &ip
 	}
 
-	machineClient, err := uncli.AddMachine(ctx, remoteMachine, opts.cluster, opts.name, publicIP)
+	machineClient, err := uncli.AddMachine(ctx, cli.AddMachineOptions{
+		Context:       opts.context,
+		MachineName:   opts.name,
+		PublicIP:      publicIP,
+		RemoteMachine: remoteMachine,
+		Version:       opts.version,
+	})
 	if err != nil {
 		return err
 	}
@@ -98,24 +110,17 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, o
 
 	// Wait for the cluster to be initialised to be able to deploy the Caddy service.
 	fmt.Println("Waiting for the machine to be ready...")
+	fmt.Println()
 	if err = waitClusterInitialised(ctx, machineClient); err != nil {
 		return fmt.Errorf("wait for cluster to be initialised on machine: %w", err)
 	}
 
-	// Inspect the added machine to get its ID to create a filter for the Caddy deployment.
-	minfo, err := machineClient.Inspect(ctx, &emptypb.Empty{})
-	if err != nil {
-		return fmt.Errorf("inspect machine: %w", err)
-	}
-	filter := func(m *pb.MachineInfo) bool {
-		return m.Id == minfo.Id
-	}
 	// Deploy a Caddy service container to the added machine. If caddy service is already deployed on other machines,
 	// use the deployed image version. Otherwise, use the latest version.
 	caddyImage := ""
 	caddySvc, err := machineClient.InspectService(ctx, client.CaddyServiceName)
 	if err != nil {
-		if !errors.Is(err, client.ErrNotFound) {
+		if !errors.Is(err, api.ErrNotFound) {
 			return fmt.Errorf("inspect caddy service: %w", err)
 		}
 	} else {
@@ -134,7 +139,9 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, o
 		}
 	}
 
-	d, err := machineClient.NewCaddyDeployment(caddyImage, filter)
+	// TODO: scale the existing Caddy service to the new machine instead of running a new deployment
+	//  that may cause a small downtime.
+	d, err := machineClient.NewCaddyDeployment(caddyImage, api.Placement{})
 	if err != nil {
 		return fmt.Errorf("create caddy deployment: %w", err)
 	}
@@ -160,7 +167,7 @@ func waitClusterInitialised(ctx context.Context, client *client.Client) error {
 	), ctx)
 
 	check := func() error {
-		_, err := client.ListMachines(ctx)
+		_, err := client.ListMachines(ctx, nil)
 		if err == nil {
 			return nil
 		}

cmd/uncloud/machine/init.go

@@ -3,15 +3,17 @@ package machine
 import (
 	"context"
 	"fmt"
-	"github.com/docker/compose/v2/pkg/progress"
-	"github.com/spf13/cobra"
 	"net/netip"
-	"uncloud/cmd/uncloud/caddy"
-	"uncloud/cmd/uncloud/dns"
-	"uncloud/internal/cli"
-	"uncloud/internal/cli/config"
-	"uncloud/internal/machine/api/pb"
-	"uncloud/internal/machine/cluster"
+
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
+	"github.com/psviderski/uncloud/cmd/uncloud/dns"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/internal/machine/cluster"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
 )
 
 type initOptions struct {
@@ -22,15 +24,17 @@ type initOptions struct {
 	noDNS       bool
 	publicIP    string
 	sshKey      string
-	cluster     string
+	version     string
+	context     string
 }
 
 func NewInitCommand() *cobra.Command {
 	opts := initOptions{}
 	cmd := &cobra.Command{
 		Use:   "init [USER@HOST:PORT]",
-		Short: "Initialise a new cluster that consists of the local or remote machine.",
-		// TODO: include usage examples of initialising a local and remote machine.
+		Short: "Initialise a new cluster with a remote machine as the first member.",
+		// TODO: include usage examples of initialising a remote machine.
+		// TODO: support initialising a cluster on the local machine.
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
@@ -77,11 +81,15 @@ func NewInitCommand() *cobra.Command {
 	)
 	cmd.Flags().StringVarP(
 		&opts.sshKey, "ssh-key", "i", "",
-		"path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
+		"Path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
+	)
+	cmd.Flags().StringVar(
+		&opts.version, "version", "latest",
+		"Version of the Uncloud daemon to install on the machine.",
 	)
 	cmd.Flags().StringVarP(
-		&opts.cluster, "cluster", "c", "",
-		"Name of the cluster in the local config if initialising a remote machine.",
+		&opts.context, "context", "c", "default",
+		"Name of the created context for the initialised cluster in the Uncloud config.",
 	)
 
 	return cmd
@@ -106,8 +114,15 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 		}
 		publicIP = &ip
 	}
-
-	client, err := uncli.InitCluster(ctx, remoteMachine, opts.cluster, opts.name, netPrefix, publicIP)
+	
+	client, err := uncli.InitCluster(ctx, cli.InitClusterOptions{
+		Context:       opts.context,
+		MachineName:   opts.name,
+		Network:       netPrefix,
+		PublicIP:      publicIP,
+		RemoteMachine: remoteMachine,
+		Version:       opts.version,
+	})
 	if err != nil {
 		return err
 	}
@@ -121,6 +136,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 	// The creation of a deployment plan talks to cluster API. Since the API needs a few moments to become available
 	// after cluster initialisation, we keep the user informed during this wait.
 	fmt.Println("Waiting for the machine to be ready...")
+	fmt.Println()
 
 	if !opts.noDNS {
 		domain, err := client.ReserveDomain(ctx, &pb.ReserveDomainRequest{Endpoint: opts.dnsEndpoint})
@@ -131,7 +147,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 	}
 
 	if !opts.noCaddy {
-		d, err := client.NewCaddyDeployment("", nil)
+		d, err := client.NewCaddyDeployment("", api.Placement{})
 		if err != nil {
 			return fmt.Errorf("create caddy deployment: %w", err)
 		}

cmd/uncloud/machine/ls.go

@@ -3,29 +3,30 @@ package machine
 import (
 	"context"
 	"fmt"
-	"github.com/spf13/cobra"
 	"net/netip"
 	"os"
 	"strings"
 	"text/tabwriter"
-	"uncloud/internal/cli"
-	"uncloud/internal/machine/network"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/machine/network"
+	"github.com/spf13/cobra"
 )
 
 func NewListCommand() *cobra.Command {
-	var cluster string
+	var clusterContext string
 	cmd := &cobra.Command{
 		Use:     "ls",
 		Aliases: []string{"list"},
 		Short:   "List machines in a cluster.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli, cluster)
+			return list(cmd.Context(), uncli, clusterContext)
 		},
 	}
 	cmd.Flags().StringVarP(
-		&cluster, "cluster", "c", "",
-		"Name of the cluster. (default is the current cluster)",
+		&clusterContext, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
 	)
 	return cmd
 }
@@ -37,7 +38,7 @@ func list(ctx context.Context, uncli *cli.CLI, clusterName string) error {
 	}
 	defer client.Close()
 
-	machines, err := client.ListMachines(ctx)
+	machines, err := client.ListMachines(ctx, nil)
 	if err != nil {
 		return fmt.Errorf("list machines: %w", err)
 	}

cmd/uncloud/machine/token.go

@@ -3,8 +3,8 @@ package machine
 import (
 	"fmt"
 	"github.com/spf13/cobra"
-	"uncloud/internal/daemon"
-	"uncloud/internal/machine"
+	"github.com/psviderski/uncloud/internal/daemon"
+	"github.com/psviderski/uncloud/internal/machine"
 )
 
 type tokenOptions struct {

cmd/uncloud/main.go

@@ -3,47 +3,80 @@ package main
 import (
 	"context"
 	"fmt"
-	"github.com/spf13/cobra"
-	"os"
+	"net/netip"
 	"strings"
-	"uncloud/cmd/uncloud/caddy"
-	"uncloud/cmd/uncloud/dns"
-	"uncloud/cmd/uncloud/machine"
-	"uncloud/cmd/uncloud/service"
-	"uncloud/internal/cli"
+
+	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
+	cmdcontext "github.com/psviderski/uncloud/cmd/uncloud/context"
+	"github.com/psviderski/uncloud/cmd/uncloud/dns"
+	"github.com/psviderski/uncloud/cmd/uncloud/machine"
+	"github.com/psviderski/uncloud/cmd/uncloud/service"
+	"github.com/psviderski/uncloud/cmd/uncloud/volume"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/psviderski/uncloud/internal/fs"
+	"github.com/psviderski/uncloud/internal/version"
+	"github.com/spf13/cobra"
 )
 
+type globalOptions struct {
+	configPath string
+	connect    string
+}
+
 func main() {
-	var configPath string
+	opts := globalOptions{}
 	cmd := &cobra.Command{
 		Use:           "uncloud",
 		Short:         "A CLI tool for managing Uncloud resources such as clusters, machines, and services.",
+		Version:       version.String(),
 		SilenceUsage:  true,
 		SilenceErrors: true,
 		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
-			if strings.HasPrefix(configPath, "~/") {
-				home, err := os.UserHomeDir()
-				if err != nil {
-					return fmt.Errorf("get user home directory to resolve %q: %w", configPath, err)
+			var conn *config.MachineConnection
+			if opts.connect != "" {
+				if strings.HasPrefix(opts.connect, "tcp://") {
+					addrPort, err := netip.ParseAddrPort(opts.connect[len("tcp://"):])
+					if err != nil {
+						return fmt.Errorf("parse TCP address: %w", err)
+					}
+					conn = &config.MachineConnection{
+						TCP: &addrPort,
+					}
+				} else {
+					dest := opts.connect
+					if strings.HasPrefix(dest, "ssh://") {
+						dest = dest[len("ssh://"):]
+					}
+					conn = &config.MachineConnection{
+						SSH: config.SSHDestination(dest),
+					}
 				}
-				configPath = strings.Replace(configPath, "~", home, 1)
 			}
 
-			uncli, err := cli.New(configPath)
+			configPath := fs.ExpandHomeDir(opts.configPath)
+			uncli, err := cli.New(configPath, conn)
 			if err != nil {
-				return fmt.Errorf("initialize CLI: %w", err)
+				return fmt.Errorf("initialise CLI: %w", err)
 			}
 			cmd.SetContext(context.WithValue(cmd.Context(), "cli", uncli))
 			return nil
 		},
 	}
+
+	cmd.PersistentFlags().StringVar(&opts.connect, "connect", "",
+		"Connect to a remote cluster machine without using the Uncloud configuration file.\n"+
+			"Format: [ssh://]user@host[:port] or tcp://host:port")
 	// TODO: allow to override using UNCLOUD_CONFIG env var.
-	cmd.PersistentFlags().StringVar(&configPath, "uncloud-config", "~/.config/uncloud/config.toml",
-		"path to the Uncloud configuration file.")
-	_ = cmd.MarkPersistentFlagFilename("uncloud-config", "toml")
+	cmd.PersistentFlags().StringVar(&opts.configPath, "uncloud-config", "~/.config/uncloud/config.yaml",
+		"Path to the Uncloud configuration file.")
+	_ = cmd.MarkPersistentFlagFilename("uncloud-config", "yaml", "yml")
+	// TODO: make --context a global flag and pass it as a value of the command context.
 
 	cmd.AddCommand(
+		NewDeployCommand(),
 		caddy.NewRootCommand(),
+		cmdcontext.NewRootCommand(),
 		dns.NewRootCommand(),
 		machine.NewRootCommand(),
 		service.NewRootCommand(),
@@ -52,6 +85,7 @@ func main() {
 		service.NewRmCommand(),
 		service.NewRunCommand(),
 		service.NewScaleCommand(),
+		volume.NewRootCommand(),
 	)
 	cobra.CheckErr(cmd.Execute())
 }

cmd/uncloud/service/inspect.go

@@ -3,14 +3,15 @@ package service
 import (
 	"context"
 	"fmt"
-	"github.com/docker/docker/pkg/stringid"
-	"github.com/docker/go-units"
 	"os"
 	"text/tabwriter"
 	"time"
 
+	"github.com/docker/docker/pkg/stringid"
+	"github.com/docker/go-units"
+
+	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/spf13/cobra"
-	"uncloud/internal/cli"
 )
 
 type inspectOptions struct {
@@ -31,8 +32,8 @@ func NewInspectCommand() *cobra.Command {
 		},
 	}
 	cmd.Flags().StringVarP(
-		&opts.cluster, "cluster", "c", "",
-		"Name of the cluster. (default is the current cluster)",
+		&opts.cluster, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
 	)
 	return cmd
 }
@@ -49,7 +50,7 @@ func inspect(ctx context.Context, uncli *cli.CLI, opts inspectOptions) error {
 		return fmt.Errorf("inspect service: %w", err)
 	}
 
-	machines, err := client.ListMachines(ctx)
+	machines, err := client.ListMachines(ctx, nil)
 	if err != nil {
 		return fmt.Errorf("list machines: %w", err)
 	}

cmd/uncloud/service/ls.go

@@ -3,14 +3,16 @@ package service
 import (
 	"context"
 	"fmt"
-	"github.com/spf13/cobra"
 	"os"
 	"strings"
 	"text/tabwriter"
-	"uncloud/internal/cli"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/spf13/cobra"
 )
 
 func NewListCommand() *cobra.Command {
+	// TODO(lhf): rename to context
 	var cluster string
 	cmd := &cobra.Command{
 		Use:     "ls",
@@ -22,8 +24,8 @@ func NewListCommand() *cobra.Command {
 		},
 	}
 	cmd.Flags().StringVarP(
-		&cluster, "cluster", "c", "",
-		"Name of the cluster. (default is the current cluster)",
+		&cluster, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
 	)
 	return cmd
 }

cmd/uncloud/service/rm.go

@@ -3,11 +3,10 @@ package service
 import (
 	"context"
 	"fmt"
-	"github.com/docker/cli/cli/streams"
+
 	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/spf13/cobra"
-	"os"
-	"uncloud/internal/cli"
 )
 
 type rmOptions struct {
@@ -29,8 +28,8 @@ func NewRmCommand() *cobra.Command {
 		},
 	}
 	cmd.Flags().StringVarP(
-		&opts.cluster, "cluster", "c", "",
-		"Name of the cluster. (default is the current cluster)",
+		&opts.cluster, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
 	)
 	return cmd
 }
@@ -48,7 +47,7 @@ func rm(ctx context.Context, uncli *cli.CLI, opts rmOptions) error {
 				return fmt.Errorf("remove service '%s': %w", s, err)
 			}
 			return nil
-		}, streams.NewOut(os.Stdout), "Removing service "+s)
+		}, uncli.ProgressOut(), "Removing service "+s)
 	}
 
 	return nil

cmd/uncloud/service/root.go

@@ -6,8 +6,9 @@ import (
 
 func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "service",
-		Short: "Manage services in an Uncloud cluster.",
+		Use:     "service",
+		Aliases: []string{"svc"},
+		Short:   "Manage services in an Uncloud cluster.",
 	}
 	cmd.AddCommand(
 		NewInspectCommand(),

cmd/uncloud/service/run.go

@@ -3,24 +3,36 @@ package service
 import (
 	"context"
 	"fmt"
-	"github.com/spf13/cobra"
-	"slices"
+	"os"
 	"strings"
-	"uncloud/internal/api"
-	"uncloud/internal/cli"
-	"uncloud/internal/cli/client"
-	"uncloud/internal/machine/api/pb"
+
+	dockeropts "github.com/docker/cli/opts"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/docker/docker/daemon/names"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/secret"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client/deploy"
+	"github.com/spf13/cobra"
 )
 
 type runOptions struct {
-	command  []string
-	image    string
-	machines []string
-	mode     string
-	name     string
-	publish  []string
-	replicas uint
-	volumes  []string
+	command           []string
+	cpu               dockeropts.NanoCPUs
+	entrypoint        string
+	entrypointChanged bool
+	env               []string
+	image             string
+	machines          []string
+	memory            dockeropts.MemBytes
+	mode              string
+	name              string
+	privileged        bool
+	publish           []string
+	pull              string
+	replicas          uint
+	user              string
+	volumes           []string
 
 	cluster string
 }
@@ -35,6 +47,7 @@ func NewRunCommand() *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
 
+			opts.entrypointChanged = cmd.Flag("entrypoint").Changed
 			opts.image = args[0]
 			if len(args) > 1 {
 				opts.command = args[1:]
@@ -44,115 +57,306 @@ func NewRunCommand() *cobra.Command {
 		},
 	}
 
+	cmd.Flags().VarP(&opts.cpu, "cpu", "",
+		"Maximum number of CPU cores a service container can use. Fractional values are allowed: "+
+			"0.5 for half a core or 2.25 for two and a quarter cores.")
+	cmd.Flags().StringVar(&opts.entrypoint, "entrypoint", "",
+		"Overwrite the default ENTRYPOINT of the image. Pass an empty string \"\" to reset it.")
+	cmd.Flags().StringSliceVarP(&opts.env, "env", "e", nil,
+		"Set an environment variable for service containers. Can be specified multiple times.\n"+
+			"Format: VAR=value or just VAR to use the value from the local environment.")
 	cmd.Flags().StringVar(&opts.mode, "mode", api.ServiceModeReplicated,
-		fmt.Sprintf("Replication mode of the service: either %q (a specified number of containers across "+
-			"the machines) or %q (one container on every machine).",
+		fmt.Sprintf("Replication mode of the service: either '%s' (a specified number of containers across "+
+			"the machines) or '%s' (one container on every machine).",
 			api.ServiceModeReplicated, api.ServiceModeGlobal))
 	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
-		"Placement constraint by machine name, limiting which machines the service can run on. Can be specified "+
+		"Placement constraint by machine names, limiting which machines the service can run on. Can be specified "+
 			"multiple times or as a comma-separated list of machine names. (default is any suitable machine)")
+	cmd.Flags().VarP(&opts.memory, "memory", "",
+		"Maximum amount of memory a service container can use. Value is a positive integer with optional unit suffix "+
+			"(b, k, m, g). Default unit is bytes if no suffix specified.\n"+
+			"Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)")
 	cmd.Flags().StringVarP(&opts.name, "name", "n", "",
 		"Assign a name to the service. A random name is generated if not specified.")
+	cmd.Flags().BoolVar(&opts.privileged, "privileged", false,
+		"Give extended privileges to service containers. This is a security risk and should be used with caution.")
 	cmd.Flags().StringSliceVarP(&opts.publish, "publish", "p", nil,
 		"Publish a service port to make it accessible outside the cluster. Can be specified multiple times.\n"+
 			"Format: [hostname:][load_balancer_port:]container_port[/protocol] or [host_ip:]:host_port:container_port[/protocol]@host\n"+
-			"Supported protocols: tcp, udp, http, https (default is tcp). If a hostname for http(s) port is not specified,\n"+
-			"service-name.cluster-domain will be used as the hostname.\n"+
+			"Supported protocols: tcp, udp, http, https (default is tcp). If a hostname for http(s) port is not specified\n"+
+			"and a cluster domain is reserved, service-name.cluster-domain will be used as the hostname.\n"+
 			"Examples:\n"+
 			"  -p 8080/https                  Publish port 8080 as HTTPS via load balancer with default service-name.cluster-domain hostname\n"+
 			"  -p app.example.com:8080/https  Publish port 8080 as HTTPS via load balancer with custom hostname\n"+
 			"  -p 9000:8080                   Publish port 8080 as TCP port 9000 via load balancer\n"+
 			"  -p 53:5353/udp@host            Bind UDP port 5353 to host port 53")
+	cmd.Flags().StringVar(&opts.pull, "pull", api.PullPolicyMissing,
+		fmt.Sprintf("Pull image from the registry before running service containers ('%s', '%s', '%s').",
+			api.PullPolicyAlways, api.PullPolicyMissing, api.PullPolicyNever))
 	cmd.Flags().UintVar(&opts.replicas, "replicas", 1,
 		"Number of containers to run for the service. Only valid for a replicated service.")
+	cmd.Flags().StringVarP(&opts.user, "user", "u", "",
+		"User name or UID and optionally group name or GID used for running the command inside service containers.\n"+
+			"Format: USER[:GROUP] or UID[:GID]. If not specified, the user is set to the default user of the image.")
 	cmd.Flags().StringSliceVarP(&opts.volumes, "volume", "v", nil,
-		"Bind mount a host file or directory into a service container using the format "+
-			"/host/path:/container/path[:ro]. Can be specified multiple times.")
+		"Mount a data volume or host path into service containers. Service containers will be scheduled on the machine(s) where\n"+
+			"the volume is located. Can be specified multiple times.\n"+
+			"Format: volume_name:/container/path[:ro|volume-nocopy] or /host/path:/container/path[:ro]\n"+
+			"Examples:\n"+
+			"  -v postgres-data:/var/lib/postgresql/data  Mount volume 'postgres-data' to /var/lib/postgresql/data in container\n"+
+			"  -v /data/uploads:/app/uploads         	 Bind mount /data/uploads host directory to /app/uploads in container\n"+
+			"  -v /host/path:/container/path:ro 		 Bind mount a host directory or file as read-only")
 
 	cmd.Flags().StringVarP(
-		&opts.cluster, "cluster", "c", "",
-		"Name of the cluster to run the service in. (default is the current cluster)",
+		&opts.cluster, "context", "c", "",
+		"Name of the cluster context to run the service in. (default is the current context)",
 	)
 
 	return cmd
 }
 
 func run(ctx context.Context, uncli *cli.CLI, opts runOptions) error {
+	spec, err := prepareServiceSpec(opts)
+	if err != nil {
+		return err
+	}
+
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.cluster)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	var resp api.RunServiceResponse
+	err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+		resp, err = clusterClient.RunService(ctx, spec)
+		if err != nil {
+			return fmt.Errorf("run service: %w", err)
+		}
+
+		return nil
+	}, uncli.ProgressOut(), fmt.Sprintf("Running service %s (%s mode)", spec.Name, spec.Mode))
+	if err != nil {
+		return err
+	}
+
+	svc, err := clusterClient.InspectService(ctx, resp.ID)
+	if err != nil {
+		return fmt.Errorf("inspect service: %w", err)
+	}
+
+	endpoints := svc.Endpoints()
+	if len(endpoints) > 0 {
+		fmt.Println()
+		fmt.Printf("%s endpoints:\n", svc.Name)
+		for _, endpoint := range endpoints {
+			fmt.Printf(" • %s\n", endpoint)
+		}
+	}
+
+	return nil
+}
+
+func prepareServiceSpec(opts runOptions) (api.ServiceSpec, error) {
+	var spec api.ServiceSpec
+
+	env, err := parseEnv(opts.env)
+	if err != nil {
+		return spec, err
+	}
+
 	switch opts.mode {
 	case api.ServiceModeReplicated, api.ServiceModeGlobal:
 	default:
-		return fmt.Errorf("invalid replication mode: %q", opts.mode)
+		return spec, fmt.Errorf("invalid replication mode: '%s'", opts.mode)
 	}
 
-	var machineFilter client.MachineFilter
-	if len(opts.machines) > 0 {
-		var machines []string
-		for _, value := range opts.machines {
-			if value == "" {
-				continue
-			}
-
-			mlist := strings.Split(value, ",")
-			for _, m := range mlist {
-				if m = strings.TrimSpace(m); m != "" {
-					machines = append(machines, m)
-				}
-			}
-		}
-
-		if len(machines) > 0 {
-			machineFilter = func(m *pb.MachineInfo) bool {
-				return slices.Contains(machines, m.Name)
-			}
-		}
+	switch opts.pull {
+	case api.PullPolicyAlways, api.PullPolicyMissing, api.PullPolicyNever:
+	default:
+		return spec, fmt.Errorf("invalid pull policy: '%s'", opts.pull)
 	}
 
 	ports := make([]api.PortSpec, len(opts.publish))
 	for i, publishPort := range opts.publish {
 		port, err := api.ParsePortSpec(publishPort)
 		if err != nil {
-			return fmt.Errorf("invalid service port '%s': %w", publishPort, err)
+			return spec, fmt.Errorf("invalid service port '%s': %w", publishPort, err)
 		}
 		ports[i] = port
 	}
-	// TODO: parse and validate opts.volumes to fail fast if invalid.
 
-	spec := api.ServiceSpec{
+	volumes, mounts, err := parseVolumeFlags(opts.volumes)
+	if err != nil {
+		return spec, err
+	}
+
+	placement := api.Placement{
+		Machines: cli.ExpandCommaSeparatedValues(opts.machines),
+	}
+
+	spec = api.ServiceSpec{
 		Container: api.ContainerSpec{
-			Command: opts.command,
-			Image:   opts.image,
-			Volumes: opts.volumes,
+			Command:    opts.command,
+			Env:        env,
+			Image:      opts.image,
+			Privileged: opts.privileged,
+			PullPolicy: opts.pull,
+			Resources: api.ContainerResources{
+				CPU:    opts.cpu.Value(),
+				Memory: opts.memory.Value(),
+			},
+			User:         opts.user,
+			VolumeMounts: mounts,
 		},
-		Mode:     opts.mode,
-		Name:     opts.name,
-		Ports:    ports,
-		Replicas: opts.replicas,
-	}
-	if err := spec.Validate(); err != nil {
-		return fmt.Errorf("invalid service configuration: %w", err)
+		Mode:      opts.mode,
+		Name:      opts.name,
+		Placement: placement,
+		Ports:     ports,
+		Replicas:  opts.replicas,
+		Volumes:   volumes,
 	}
 
-	client, err := uncli.ConnectCluster(ctx, opts.cluster)
-	if err != nil {
-		return fmt.Errorf("connect to cluster: %w", err)
-	}
-	defer client.Close()
-
-	resp, err := client.RunService(ctx, spec, machineFilter)
-	if err != nil {
-		return fmt.Errorf("run service: %w", err)
+	// Overwrite the default ENTRYPOINT of the image or reset it if an empty string is passed.
+	if opts.entrypoint != "" {
+		spec.Container.Entrypoint = []string{opts.entrypoint}
+	} else if opts.entrypointChanged {
+		spec.Container.Entrypoint = []string{""}
 	}
 
-	svc, err := client.InspectService(ctx, resp.ID)
-	if err != nil {
-		return fmt.Errorf("inspect service: %w", err)
+	if err = spec.Validate(); err != nil {
+		return spec, fmt.Errorf("invalid service configuration: %w", err)
 	}
 
-	fmt.Println()
-	fmt.Printf("%s endpoints:\n", svc.Name)
-	for _, endpoint := range svc.Endpoints() {
-		fmt.Printf(" • %s\n", endpoint)
+	// Generate a service name if not specified to be able to include it in the progress title.
+	if spec.Name == "" {
+		spec.Name, err = deploy.GenerateServiceName(spec.Container.Image)
+		if err != nil {
+			return spec, fmt.Errorf("generate service name: %w", err)
+		}
 	}
 
-	return nil
+	return spec, err
+}
+
+// parseEnv parses the environment variables from the command line arguments.
+// It supports two formats: "VAR=value" or just "VAR" to use the value from the local environment.
+func parseEnv(env []string) (api.EnvVars, error) {
+	envVars := make(api.EnvVars)
+	for _, e := range env {
+		key, value, hasValue := strings.Cut(e, "=")
+		if key == "" {
+			return nil, fmt.Errorf("invalid environment variable: '%s'", e)
+		}
+
+		if hasValue {
+			envVars[key] = value
+		} else {
+			if localEnvValue, ok := os.LookupEnv(key); ok {
+				envVars[key] = localEnvValue
+			}
+		}
+	}
+
+	return envVars, nil
+}
+
+// parseVolumeFlags parses volume flag values in Docker CLI format and returns VolumeSpecs and VolumeMounts.
+// It handles both named volumes (volume_name:/container/path[:ro|volume-nocopy])
+// and bind mounts (/host/path:/container/path[:ro]).
+func parseVolumeFlags(volumes []string) ([]api.VolumeSpec, []api.VolumeMount, error) {
+	specs := make([]api.VolumeSpec, 0, len(volumes))
+	mounts := make([]api.VolumeMount, 0, len(volumes))
+
+	// Track volume names to avoid duplicate specs.
+	seenVolumes := make(map[string]struct{})
+
+	for _, vol := range volumes {
+		spec, mount, err := parseVolumeFlagValue(vol)
+		if err != nil {
+			return nil, nil, fmt.Errorf("invalid volume mount '%s': %w", vol, err)
+		}
+
+		if _, ok := seenVolumes[spec.Name]; !ok {
+			specs = append(specs, spec)
+			seenVolumes[spec.Name] = struct{}{}
+		}
+
+		mounts = append(mounts, mount)
+	}
+
+	return specs, mounts, nil
+}
+
+func parseVolumeFlagValue(volume string) (api.VolumeSpec, api.VolumeMount, error) {
+	var spec api.VolumeSpec
+	var mount api.VolumeMount
+
+	parts := strings.Split(volume, ":")
+	switch len(parts) {
+	case 1:
+		return spec, mount, fmt.Errorf("invalid format, must contain at least one separator ':'")
+	case 2, 3:
+		// Format: (volume_name|/host/path):/container/path[:opts]
+		if !strings.HasPrefix(parts[1], "/") {
+			return spec, mount, fmt.Errorf("invalid container mount path: '%s', must be absolute path", parts[1])
+		}
+
+		mount.ContainerPath = parts[1]
+		volumeNoCopy := false
+
+		if len(parts) == 3 {
+			opts := strings.Split(parts[2], ",")
+			for _, opt := range opts {
+				switch opt {
+				case "ro", "readonly":
+					mount.ReadOnly = true
+				case "volume-nocopy":
+					volumeNoCopy = true
+				default:
+					return spec, mount, fmt.Errorf("invalid option: '%s'", opt)
+				}
+			}
+		}
+
+		if strings.HasPrefix(parts[0], "/") {
+			// Host path bind mount: /host/path:/container/path
+			suffix, err := secret.RandomAlphaNumeric(4)
+			if err != nil {
+				return spec, mount, fmt.Errorf("generate random suffix: %w", err)
+			}
+
+			spec = api.VolumeSpec{
+				Name: "bind-" + suffix,
+				Type: api.VolumeTypeBind,
+				BindOptions: &api.BindOptions{
+					HostPath:       parts[0],
+					CreateHostPath: true,
+				},
+			}
+		} else {
+			// Named volume mount: volume_name:/container/path
+			volumeName := parts[0]
+			if !names.RestrictedNamePattern.MatchString(volumeName) {
+				return spec, mount, fmt.Errorf("volume name '%s' includes invalid characters, only '%s' are allowed. "+
+					"If you intended to pass a host directory or file, use absolute path",
+					volumeName, names.RestrictedNameChars)
+			}
+
+			spec = api.VolumeSpec{
+				Name: volumeName,
+				Type: api.VolumeTypeVolume,
+				VolumeOptions: &api.VolumeOptions{
+					Name:   volumeName,
+					NoCopy: volumeNoCopy,
+				},
+			}
+		}
+
+		mount.VolumeName = spec.Name
+	default:
+		return spec, mount, fmt.Errorf("invalid format, must container at most 2 separators ':'")
+	}
+
+	return spec, mount, nil
 }

cmd/uncloud/service/scale.go

@@ -3,12 +3,13 @@ package service
 import (
 	"context"
 	"fmt"
+	"strconv"
+
 	"github.com/charmbracelet/huh"
 	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/spf13/cobra"
-	"strconv"
-	"uncloud/internal/api"
-	"uncloud/internal/cli"
 )
 
 type scaleOptions struct {
@@ -39,8 +40,8 @@ func NewScaleCommand() *cobra.Command {
 	}
 
 	cmd.Flags().StringVarP(
-		&opts.cluster, "cluster", "c", "",
-		"Name of the cluster. (default is the current cluster)",
+		&opts.cluster, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
 	)
 
 	return cmd
@@ -81,20 +82,10 @@ func scale(ctx context.Context, uncli *cli.CLI, opts scaleOptions) error {
 
 	// TODO: Check if all containers have the same spec. If not, prompt user to choose which one to scale.
 	//  This can happen if a service deployment failed midway and some containers were not updated.
-	// Derive the service spec from the first container.
-	spec, err := svc.Containers[0].Container.ServiceSpec()
-	if err != nil {
-		return fmt.Errorf("get service spec from container: %w", err)
-	}
-
+	spec := svc.Containers[0].Container.ServiceSpec
 	spec.Replicas = opts.replicas
-
-	deploy, err := clusterClient.NewDeployment(spec, nil)
-	if err != nil {
-		return fmt.Errorf("create deployment: %w", err)
-	}
-
-	plan, err := deploy.Plan(ctx)
+	deployment := clusterClient.NewDeployment(spec, nil)
+	plan, err := deployment.Plan(ctx)
 	if err != nil {
 		return fmt.Errorf("plan deployment: %w", err)
 	}
@@ -128,7 +119,7 @@ func scale(ctx context.Context, uncli *cli.CLI, opts scaleOptions) error {
 
 	title := fmt.Sprintf("Scaling service %s (%d → %d replicas)", svc.Name, currentReplicas, opts.replicas)
 	err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
-		if _, err = deploy.Run(ctx); err != nil {
+		if _, err = deployment.Run(ctx); err != nil {
 			return fmt.Errorf("deploy service: %w", err)
 		}
 		return nil
@@ -152,7 +143,7 @@ func confirm() (bool, error) {
 				Negative("No").
 				Value(&confirmed),
 		),
-	)
+	).WithAccessible(true)
 	if err := form.Run(); err != nil {
 		return false, err
 	}

cmd/uncloud/volume/create.go

@@ -0,0 +1,148 @@
+package volume
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/charmbracelet/huh"
+	"github.com/docker/docker/api/types/volume"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type createOptions struct {
+	driver     string
+	driverOpts []string
+	labels     []string
+	machine    string
+	context    string
+}
+
+func NewCreateCommand() *cobra.Command {
+	opts := createOptions{}
+
+	cmd := &cobra.Command{
+		Use:   "create [FLAGS] VOLUME_NAME",
+		Short: "Create a volume on a specific machine.",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			opts.driver = strings.TrimSpace(opts.driver)
+
+			volumeName := args[0]
+			if volumeName == "" {
+				return fmt.Errorf("volume name is required")
+			}
+
+			return create(cmd.Context(), uncli, volumeName, opts)
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.driver, "driver", "d", "local",
+		"Volume driver to use.")
+	cmd.Flags().StringSliceVarP(&opts.driverOpts, "opt", "o", nil,
+		"Driver specific options in the form of 'key=value' pairs. Can be specified multiple times.")
+	cmd.Flags().StringSliceVarP(&opts.labels, "label", "l", nil,
+		"Labels to assign to the volume in the form of 'key=value' pairs. Can be specified multiple times.")
+	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
+		"Name or ID of the machine to create the volume on.")
+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)")
+
+	return cmd
+}
+
+func create(ctx context.Context, uncli *cli.CLI, name string, opts createOptions) error {
+	client, err := uncli.ConnectCluster(ctx, opts.context)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	// Parse driver options.
+	driverOpts := make(map[string]string)
+	for _, opt := range opts.driverOpts {
+		k, v, ok := strings.Cut(opt, "=")
+		if !ok {
+			return fmt.Errorf("invalid driver option format: '%s' (expected key=value)", opt)
+		}
+		driverOpts[k] = v
+	}
+
+	// Parse labels.
+	labels := make(map[string]string)
+	for _, label := range opts.labels {
+		k, v, ok := strings.Cut(label, "=")
+		if !ok {
+			return fmt.Errorf("invalid label format: '%s' (expected key=value)", label)
+		}
+		labels[k] = v
+	}
+
+	// List machines and filter by the specified machine name or ID.
+	// If no machine is specified, prompt the user to select one.
+	machines, err := client.ListMachines(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("list machines: %w", err)
+	}
+	var selectedMachine *pb.MachineInfo
+
+	if opts.machine == "" {
+		if len(machines) == 1 {
+			selectedMachine = machines[0].Machine
+		} else {
+			if selectedMachine, err = promptSelectMachine(ctx, machines); err != nil {
+				return fmt.Errorf("select machine: %w", err)
+			}
+		}
+	} else {
+		m := machines.FindByNameOrID(opts.machine)
+		if m == nil {
+			return fmt.Errorf("machine '%s' not found", opts.machine)
+		}
+		selectedMachine = m.Machine
+	}
+
+	createOpts := volume.CreateOptions{
+		Name:       name,
+		Driver:     opts.driver,
+		DriverOpts: driverOpts,
+		Labels:     labels,
+	}
+	vol, err := client.CreateVolume(ctx, selectedMachine.Id, createOpts)
+	if err != nil {
+		return fmt.Errorf("create volume '%s' on machine '%s': %w", name, selectedMachine.Name, err)
+	}
+
+	fmt.Printf("Volume '%s' created on machine '%s'.\n", vol.Volume.Name, vol.MachineName)
+	return nil
+}
+
+func promptSelectMachine(ctx context.Context, machines api.MachineMembersList) (*pb.MachineInfo, error) {
+	options := make([]huh.Option[*pb.MachineInfo], len(machines))
+	for i, m := range machines {
+		options[i] = huh.NewOption(m.Machine.Name, m.Machine)
+	}
+	slices.SortFunc(options, func(a, b huh.Option[*pb.MachineInfo]) int {
+		return strings.Compare(a.Key, b.Key)
+	})
+
+	var selected *pb.MachineInfo
+	form := huh.NewForm(
+		huh.NewGroup(
+			huh.NewSelect[*pb.MachineInfo]().
+				Title("Select a machine to create the volume on (or specify with --machine flag)").
+				Options(options...).
+				Value(&selected),
+		),
+	)
+	if err := form.RunWithContext(ctx); err != nil {
+		return nil, err
+	}
+
+	return selected, nil
+}

cmd/uncloud/volume/inspect.go

@@ -0,0 +1,81 @@
+package volume
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type inspectOptions struct {
+	machine string
+	context string
+}
+
+func NewInspectCommand() *cobra.Command {
+	opts := inspectOptions{}
+
+	cmd := &cobra.Command{
+		Use:   "inspect [FLAGS] VOLUME_NAME",
+		Short: "Display detailed information on a volume.",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return inspect(cmd.Context(), uncli, args[0], opts)
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
+		"Name or ID of the machine where the volume is located. "+
+			"If not specified, the volume will be searched across all machines.")
+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)")
+
+	return cmd
+}
+
+func inspect(ctx context.Context, uncli *cli.CLI, name string, opts inspectOptions) error {
+	client, err := uncli.ConnectCluster(ctx, opts.context)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	filter := &api.VolumeFilter{
+		Names: []string{name},
+	}
+	if opts.machine != "" {
+		filter.Machines = []string{opts.machine}
+	}
+
+	volumes, err := client.ListVolumes(ctx, filter)
+	if err != nil {
+		return fmt.Errorf("list volumes: %w", err)
+	}
+
+	if len(volumes) == 0 {
+		if opts.machine != "" {
+			return fmt.Errorf("volume '%s' not found on machine '%s'", name, opts.machine)
+		}
+		return fmt.Errorf("volume '%s' not found on any machine", name)
+	}
+	if len(volumes) > 1 {
+		fmt.Printf("Volume '%s' found on multiple machines:\n", name)
+		for _, v := range volumes {
+			fmt.Printf(" • %s\n", v.MachineName)
+		}
+		return errors.New("specify --machine flag to choose which machine to use")
+	}
+
+	data, err := json.MarshalIndent(volumes[0], "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshal volume: %w", err)
+	}
+	fmt.Println(string(data))
+
+	return nil
+}

cmd/uncloud/volume/ls.go

@@ -0,0 +1,105 @@
+package volume
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"slices"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type listOptions struct {
+	machines []string
+	quiet    bool
+	context  string
+}
+
+func NewListCommand() *cobra.Command {
+	opts := listOptions{}
+
+	cmd := &cobra.Command{
+		Use:     "ls [FLAGS]",
+		Aliases: []string{"list"},
+		Short:   "List volumes across all machines in the cluster.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return list(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
+		"Filter volumes by machine name or ID. Can be specified multiple times or as a comma-separated list. "+
+			"(default is include all machines)")
+	cmd.Flags().BoolVarP(&opts.quiet, "quiet", "q", false,
+		"Only display volume names.")
+
+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)")
+
+	return cmd
+}
+
+func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
+	client, err := uncli.ConnectCluster(ctx, opts.context)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	// Apply machine filter if specified.
+	var filter *api.VolumeFilter
+	if len(opts.machines) > 0 {
+		machines := cli.ExpandCommaSeparatedValues(opts.machines)
+		filter = &api.VolumeFilter{
+			Machines: machines,
+		}
+	}
+
+	volumes, err := client.ListVolumes(ctx, filter)
+	if err != nil {
+		return fmt.Errorf("list volumes: %w", err)
+	}
+
+	if len(volumes) == 0 {
+		if !opts.quiet {
+			fmt.Println("No volumes found.")
+		}
+		return nil
+	}
+
+	// Sort the volumes by name first, then by machine name.
+	slices.SortFunc(volumes, func(a, b api.MachineVolume) int {
+		cmp := strings.Compare(a.Volume.Name, b.Volume.Name)
+		if cmp != 0 {
+			return cmp
+		}
+		return strings.Compare(a.MachineName, b.MachineName)
+	})
+
+	// If quiet mode, just print volume names.
+	if opts.quiet {
+		for _, v := range volumes {
+			fmt.Println(v.Volume.Name)
+		}
+		return nil
+	}
+
+	// Print the volumes in a table format.
+	tw := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
+	fmt.Fprintln(tw, "NAME\tDRIVER\tMACHINE")
+
+	for _, v := range volumes {
+		fmt.Fprintf(tw, "%s\t%s\t%s\n",
+			v.Volume.Name,
+			v.Volume.Driver,
+			v.MachineName,
+		)
+	}
+
+	return tw.Flush()
+}

cmd/uncloud/volume/rm.go

@@ -0,0 +1,111 @@
+package volume
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type removeOptions struct {
+	force    bool
+	machines []string
+	yes      bool
+	context  string
+}
+
+func NewRemoveCommand() *cobra.Command {
+	opts := removeOptions{}
+
+	cmd := &cobra.Command{
+		Use:     "rm [FLAGS] VOLUME_NAME [VOLUME_NAME...]",
+		Aliases: []string{"remove", "delete"},
+		Short:   "Remove one or more volumes.",
+		Long:    "Remove one or more volumes. You cannot remove a volume that is in use by a container.",
+		Args:    cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return remove(cmd.Context(), uncli, args, opts)
+		},
+	}
+
+	cmd.Flags().BoolVarP(&opts.force, "force", "f", false,
+		"Force the removal of one or more volumes.")
+	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
+		"Name or ID of the machine to remove one or more volumes from. "+
+			"Can be specified multiple times or as a comma-separated list.\n"+
+			"If not specified, the found volume(s) will be removed from all machines.")
+	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
+		"Do not prompt for confirmation before removing the volume(s).")
+
+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)")
+
+	return cmd
+}
+
+func remove(ctx context.Context, uncli *cli.CLI, names []string, opts removeOptions) error {
+	client, err := uncli.ConnectCluster(ctx, opts.context)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	filter := &api.VolumeFilter{
+		Names: names,
+	}
+
+	if len(opts.machines) > 0 {
+		machines := cli.ExpandCommaSeparatedValues(opts.machines)
+		filter.Machines = machines
+	}
+
+	volumes, err := client.ListVolumes(ctx, filter)
+	if err != nil {
+		return fmt.Errorf("list volumes: %w", err)
+	}
+
+	if len(volumes) == 0 {
+		if len(names) == 1 {
+			return fmt.Errorf("volume '%s' not found", names[0])
+		}
+		return fmt.Errorf("no volumes found matching the specified names")
+	}
+
+	// Confirm removal if not using --yes flag.
+	if !opts.yes {
+		fmt.Println("The following volumes will be removed:")
+		for _, v := range volumes {
+			fmt.Printf(" • '%s' on machine '%s'\n", v.Volume.Name, v.MachineName)
+		}
+
+		fmt.Println()
+		confirmed, err := cli.Confirm()
+		if err != nil {
+			return fmt.Errorf("confirm removal: %w", err)
+		}
+		if !confirmed {
+			fmt.Println("Cancelled. No volumes were removed.")
+			return nil
+		}
+	}
+
+	// Remove the volumes one by one collecting errors.
+	var removeErr error
+	for _, v := range volumes {
+		if err = client.RemoveVolume(ctx, v.MachineID, v.Volume.Name, opts.force); err != nil {
+			if !errors.Is(err, api.ErrNotFound) {
+				removeErr = errors.Join(removeErr, fmt.Errorf("failed to remove volume '%s' on machine '%s': %w",
+					v.Volume.Name, v.MachineName, err))
+			}
+			continue
+		}
+
+		fmt.Printf("Volume '%s' removed from machine '%s'.\n", v.Volume.Name, v.MachineName)
+	}
+
+	return removeErr
+}

cmd/uncloud/volume/root.go

@@ -0,0 +1,19 @@
+package volume
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func NewRootCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "volume",
+		Short: "Manage volumes in an Uncloud cluster.",
+	}
+	cmd.AddCommand(
+		NewCreateCommand(),
+		NewInspectCommand(),
+		NewListCommand(),
+		NewRemoveCommand(),
+	)
+	return cmd
+}

cmd/uncloudd/main.go

@@ -2,14 +2,16 @@ package main
 
 import (
 	"context"
-	"github.com/spf13/cobra"
 	"log/slog"
 	"os"
 	"os/signal"
 	"syscall"
-	"uncloud/internal/daemon"
-	"uncloud/internal/log"
-	"uncloud/internal/machine"
+
+	"github.com/psviderski/uncloud/internal/daemon"
+	"github.com/psviderski/uncloud/internal/log"
+	"github.com/psviderski/uncloud/internal/machine"
+	"github.com/psviderski/uncloud/internal/version"
+	"github.com/spf13/cobra"
 )
 
 func main() {
@@ -22,6 +24,7 @@ func main() {
 	cmd := &cobra.Command{
 		Use:           "uncloudd",
 		Short:         "Uncloud machine daemon.",
+		Version:       version.String(),
 		SilenceUsage:  true,
 		SilenceErrors: true,
 		RunE: func(cmd *cobra.Command, args []string) error {

docs/user_guide.md

@@ -0,0 +1,59 @@
+# User Guide
+
+## Initialising a cluster
+
+To begin setting up a new Uncloud cluster, create the desired nodes. Ensure that their firewall allows the required ports.
+
+### Ports
+
+Nodes running Uncloud with a standard configuration must have the following inbound ports allowed in the firewall:
+
+* 51820/udp (WireGuard meshnet)
+* 22/tcp (default SSH management port)
+* 80/tcp (required for challenge if uncloud.run DNS is enabled, pass --no-dns during init to disable)
+
+In addition, any ports for any workloads you want to expose will need to be open.
+
+### Configuration
+
+Uncloud stores its configuration in `~/.config/uncloud/config.yaml`. If you wish to reinitialise a cluster, simply remove it from this config.
+
+### Initialisation
+
+Begin by initialising the first node in your cluster with `uc machine init [USER@HOST:PORT]`. If you do not have a need for Caddy reverse proxy, you may disable this feature with `--no-caddy`.
+
+This command will idempotently install Docker, uncloudd, uncloud-corrosion. If Caddy is enabled, it will set up a reverse proxy. If Uncloud DNS is enabled, it will create a DNS A record for the machine's public IP address under `*.[CLUSTER ID].cluster.uncloud.run`.
+
+If you wish to uninstall Uncloud and its components, run `uncloud-uninstall`.
+
+### Adding a node
+
+Just like the initialisation of the first node, a node can be added to the cluster with `uc machine add`.
+
+### DNS
+
+Uncloud (uncloud.run) DNS can be managed with the `uc dns` subcommand.
+
+* To reserve a domain name, run `uc dns reserve`
+* To release a domain name, run `uc dns release`.
+* To see the domain name, run `uc dns show`
+
+### Running a service
+
+Services on an Uncloud cluster can be managed with `uc service`.
+
+You can run a service with two replicas that expose port 80 like the following:
+
+```
+uc service run -p 80/http --replicas 2 nginxdemos/hello
+```
+
+This requires the Caddy reverse proxy to be deployed. If it wasn't previously, it can be deployed with `uc caddy deploy`.
+
+Since this doesn't specify a service name, a random one will be generated.
+
+The service can be deleted by its service name:
+
+```
+uc service rm hello-gsdo
+```

experiment/talos_discovery.go

@@ -11,7 +11,7 @@ import (
 	"go.uber.org/zap"
 	"net/netip"
 	"time"
-	"uncloud/internal/machine/network"
+	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
 const (

go.mod

@@ -1,4 +1,4 @@
-module uncloud
+module github.com/psviderski/uncloud
 
 go 1.23.0
 
@@ -11,7 +11,10 @@ require (
 	github.com/caddyserver/caddy/v2 v2.8.4
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/charmbracelet/huh v0.6.0
+	github.com/charmbracelet/lipgloss v0.13.0
+	github.com/compose-spec/compose-go/v2 v2.4.5
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
+	github.com/deckarep/golang-set/v2 v2.8.0
 	github.com/dgraph-io/badger/v3 v3.2103.5
 	github.com/distribution/reference v0.6.0
 	github.com/docker/cli v27.5.0+incompatible
@@ -19,6 +22,8 @@ require (
 	github.com/docker/docker v27.4.0-rc.2+incompatible
 	github.com/docker/go-connections v0.5.0
 	github.com/docker/go-units v0.5.0
+	github.com/goccy/go-yaml v1.17.1
+	github.com/google/go-cmp v0.7.0
 	github.com/google/go-containerregistry v0.20.2
 	github.com/hashicorp/memberlist v0.5.1
 	github.com/hashicorp/serf v0.10.1
@@ -29,7 +34,10 @@ require (
 	github.com/ipfs/go-ds-crdt v0.5.2
 	github.com/ipfs/go-ipld-format v0.6.0
 	github.com/ipfs/go-log/v2 v2.5.1
+	github.com/jmoiron/sqlx v1.4.0
 	github.com/lmittmann/tint v1.0.5
+	github.com/miekg/dns v1.1.65
+	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.0
 	github.com/siderolabs/discovery-api v0.1.4
 	github.com/siderolabs/discovery-client v0.1.9
@@ -39,15 +47,16 @@ require (
 	github.com/vishvananda/netlink v1.3.0
 	go.uber.org/zap v1.27.0
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/crypto v0.32.0
-	golang.org/x/net v0.34.0
-	golang.org/x/sync v0.10.0
-	golang.org/x/sys v0.29.0
+	golang.org/x/crypto v0.33.0
+	golang.org/x/net v0.35.0
+	golang.org/x/sync v0.11.0
+	golang.org/x/sys v0.31.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576
 	google.golang.org/grpc v1.68.1
 	google.golang.org/protobuf v1.36.3
+	modernc.org/sqlite v1.36.3
 )
 
 require (
@@ -77,13 +86,11 @@ require (
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charmbracelet/bubbles v0.20.0 // indirect
 	github.com/charmbracelet/bubbletea v1.1.1 // indirect
-	github.com/charmbracelet/lipgloss v0.13.0 // indirect
 	github.com/charmbracelet/x/ansi v0.3.2 // indirect
 	github.com/charmbracelet/x/exp/strings v0.0.0-20240919170804-a4978c8e603a // indirect
 	github.com/charmbracelet/x/term v0.2.0 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
 	github.com/cloudflare/cfssl v1.6.4 // indirect
-	github.com/compose-spec/compose-go/v2 v2.4.5 // indirect
 	github.com/containerd/console v1.0.4 // indirect
 	github.com/containerd/containerd v1.7.24 // indirect
 	github.com/containerd/containerd/api v1.7.19 // indirect
@@ -118,7 +125,7 @@ require (
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-sql-driver/mysql v1.7.1 // indirect
+	github.com/go-sql-driver/mysql v1.8.1 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.0.0 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
@@ -131,8 +138,7 @@ require (
 	github.com/google/btree v1.1.2 // indirect
 	github.com/google/cel-go v0.20.1 // indirect
 	github.com/google/flatbuffers v24.3.25+incompatible // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
-	github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad // indirect
+	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
@@ -192,7 +198,6 @@ require (
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mholt/acmez/v2 v2.0.3 // indirect
-	github.com/miekg/dns v1.1.62 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/minio/sha256-simd v1.0.1 // indirect
 	github.com/mitchellh/cli v1.1.5 // indirect
@@ -224,8 +229,8 @@ require (
 	github.com/multiformats/go-multistream v0.5.0 // indirect
 	github.com/multiformats/go-varint v0.0.7 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/onsi/ginkgo/v2 v2.22.0 // indirect
-	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pires/go-proxyproto v0.7.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
@@ -239,6 +244,7 @@ require (
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/quic-go/qpack v0.5.1 // indirect
 	github.com/quic-go/quic-go v0.48.2 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rs/xid v1.5.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
@@ -269,6 +275,9 @@ require (
 	github.com/urfave/cli v1.22.16 // indirect
 	github.com/vbatts/tar-split v0.11.6 // indirect
 	github.com/vishvananda/netns v0.0.4 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
 	go.etcd.io/bbolt v1.3.11 // indirect
 	go.opencensus.io v0.24.0 // indirect
@@ -294,11 +303,11 @@ require (
 	go.uber.org/zap/exp v0.2.0 // indirect
 	golang.org/x/crypto/x509roots/fallback v0.0.0-20240507223354-67b13616a595 // indirect
 	golang.org/x/exp v0.0.0-20241215155358-4a5509556b9e // indirect
-	golang.org/x/mod v0.22.0 // indirect
-	golang.org/x/term v0.28.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
+	golang.org/x/mod v0.23.0 // indirect
+	golang.org/x/term v0.29.0 // indirect
+	golang.org/x/text v0.22.0 // indirect
 	golang.org/x/time v0.8.0 // indirect
-	golang.org/x/tools v0.29.0 // indirect
+	golang.org/x/tools v0.30.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
@@ -306,4 +315,7 @@ require (
 	gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259 // indirect
 	howett.net/plist v1.0.0 // indirect
 	lukechampine.com/blake3 v1.3.0 // indirect
+	modernc.org/libc v1.61.13 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.8.2 // indirect
 )

go.sum

@@ -233,6 +233,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davidlazar/go-crypto v0.0.0-20200604182044-b73af7476f6c h1:pFUpOrbxDR6AkioZ1ySsx5yxlDQZ8stG2b88gTPxgJU=
 github.com/davidlazar/go-crypto v0.0.0-20200604182044-b73af7476f6c/go.mod h1:6UhI8N9EjYm1c2odKpFpAYeR8dsBeM7PtzQhRgxRr9U=
+github.com/deckarep/golang-set/v2 v2.8.0 h1:swm0rlPCmdWn9mESxKOjWk8hXSqoxOp+ZlfuyaAdFlQ=
+github.com/deckarep/golang-set/v2 v2.8.0/go.mod h1:VAky9rY/yGXJOLEDv3OMci+7wtDpOF4IN+y82NBOac4=
 github.com/decred/dcrd/crypto/blake256 v1.0.1 h1:7PltbUIQB7u/FfZ39+DGa/ShuMyJ5ilcvdfma9wOH6Y=
 github.com/decred/dcrd/crypto/blake256 v1.0.1/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 h1:rpfIENRNNilwHwZeG5+P150SMrnNEcHYvcCuK6dPZSg=
@@ -332,8 +334,8 @@ github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ4
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-sql-driver/mysql v1.3.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
-github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
-github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/go-stack/stack v1.6.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
@@ -341,6 +343,8 @@ github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZ
 github.com/go-viper/mapstructure/v2 v2.0.0 h1:dhn8MZ1gZ0mzeodTG3jt5Vj/o87xZKuNAprG2mQfMfc=
 github.com/go-viper/mapstructure/v2 v2.0.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/go-yaml/yaml v2.1.0+incompatible/go.mod h1:w2MrLa16VYP0jy6N7M5kHaCkaLENm+P+Tv+MfurjSw0=
+github.com/goccy/go-yaml v1.17.1 h1:LI34wktB2xEE3ONG/2Ar54+/HJVBriAGJ55PHls4YuY=
+github.com/goccy/go-yaml v1.17.1/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
@@ -395,8 +399,8 @@ github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.20.2 h1:B1wPJ1SN/S7pB+ZAimcciVD+r+yV/l/DSArMxlbwseo=
 github.com/google/go-containerregistry v0.20.2/go.mod h1:z38EKdKh4h7IP2gSfUUqEvalZBqs6AoLeWfUy34nQC8=
 github.com/google/go-tpm v0.9.0 h1:sQF6YqWMi+SCXpsmS3fd21oPy/vSddwZry4JnmltHVk=
@@ -408,8 +412,8 @@ github.com/google/go-tspi v0.3.0/go.mod h1:xfMGI3G0PhxCdNVcYr1C4C+EizojDg/TXuX5b
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
-github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad h1:a6HEuzUHeKH6hwfN/ZoQgRgVIWFJljSWa/zetS2WTvg=
-github.com/google/pprof v0.0.0-20241210010833-40e02aabc2ad/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/s2a-go v0.1.7 h1:60BLSyTrOV4/haCDW4zb1guZItoSq8foHCXrAnjBo/o=
 github.com/google/s2a-go v0.1.7/go.mod h1:50CgR4k1jNlWBu4UfS4AcfhVe1r6pdZPygJ3R8F0Qdw=
@@ -597,8 +601,8 @@ github.com/jinzhu/gorm v0.0.0-20170222002820-5409931a1bb8/go.mod h1:Vla75njaFJ8c
 github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d h1:jRQLvyVGL+iVtDElaEIDdKwpPqUIZJfzkNLV34htpEc=
 github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
 github.com/jinzhu/now v1.1.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
-github.com/jmoiron/sqlx v1.3.3 h1:j82X0bf7oQ27XeqxicSZsTU5suPwKElg3oyxNn43iTk=
-github.com/jmoiron/sqlx v1.3.3/go.mod h1:2BljVx/86SuTyjE+aPYlHCTNvZrnJXghYGpNiXLBMCQ=
+github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o=
+github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY=
 github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
 github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
@@ -639,8 +643,9 @@ github.com/lib/pq v0.0.0-20150723085316-0dad96c0b94f/go.mod h1:5WUZQaWbwv1U+lTRe
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.10.2 h1:AqzbZs4ZoCBp+GtejcpCpcxM3zlSMx29dXbUSeVtJb8=
 github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/libdns/libdns v0.2.2 h1:O6ws7bAfRPaBsgAYt8MDe2HcNBGC29hkZ9MX2eUSX3s=
 github.com/libdns/libdns v0.2.2/go.mod h1:4Bj9+5CQiNMVGf87wjX4CY3HQJypUHRuLvlsfsZqLWQ=
 github.com/libp2p/go-buffer-pool v0.1.0 h1:oK4mSFcQz7cTQIfqbe4MIj9gLW+mnanjyFtc6cdF0Y8=
@@ -701,6 +706,8 @@ github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh
 github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
 github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mattn/go-sqlite3 v1.6.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
+github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
+github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
 github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
@@ -714,8 +721,8 @@ github.com/mholt/acmez/v2 v2.0.3 h1:CgDBlEwg3QBp6s45tPQmFIBrkRIkBT4rW4orMM6p4sw=
 github.com/mholt/acmez/v2 v2.0.3/go.mod h1:pQ1ysaDeGrIMvJ9dfJMk5kJNkn7L2sb3UhyrX6Q91cw=
 github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
-github.com/miekg/dns v1.1.62 h1:cN8OuEF1/x5Rq6Np+h1epln8OiyPWV+lROx9LxcGgIQ=
-github.com/miekg/dns v1.1.62/go.mod h1:mvDlcItzm+br7MToIKqkglaGhlFMHJ9DTNNWONWXbNQ=
+github.com/miekg/dns v1.1.65 h1:0+tIPHzUW0GCge7IiK3guGP57VAw7hoPDfApjkMD1Fc=
+github.com/miekg/dns v1.1.65/go.mod h1:Dzw9769uoKVaLuODMDZz9M6ynFU6Em65csPuoi8G0ck=
 github.com/miekg/pkcs11 v1.0.2/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
 github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
@@ -809,6 +816,8 @@ github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOEL
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
+github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
@@ -925,6 +934,8 @@ github.com/quic-go/webtransport-go v0.8.0 h1:HxSrwun11U+LlmwpgM1kEqIqH90IT4N8auv
 github.com/quic-go/webtransport-go v0.8.0/go.mod h1:N99tjprW432Ut5ONql/aUhSLT0YVSlwHohQsuac9WaM=
 github.com/raulk/go-watchdog v1.3.0 h1:oUmdlHxdkXRJlwfG0O9omj8ukerm8MEQavSiDTEtBsk=
 github.com/raulk/go-watchdog v1.3.0/go.mod h1:fIvOnLbF0b0ZwkB9YU4mOW9Did//4vPZtDqv66NfsMU=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
@@ -1069,6 +1080,13 @@ github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0 h1:GDDkbFiaK8jsSD
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
 github.com/weppos/publicsuffix-go v0.15.1-0.20210511084619-b1f36a2d6c0b h1:FsyNrX12e5BkplJq7wKOLk0+C6LZ+KGXvuEcKUYm5ss=
 github.com/weppos/publicsuffix-go v0.15.1-0.20210511084619-b1f36a2d6c0b/go.mod h1:HYux0V0Zi04bHNwOHy4cXJVz/TQjYonnF6aoYhj+3QE=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
+github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -1178,8 +1196,8 @@ golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
-golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
+golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
+golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
 golang.org/x/crypto/x509roots/fallback v0.0.0-20240507223354-67b13616a595 h1:TgSqweA595vD0Zt86JzLv3Pb/syKg8gd5KMGGbJPYFw=
 golang.org/x/crypto/x509roots/fallback v0.0.0-20240507223354-67b13616a595/go.mod h1:kNa9WdvYnzFwC79zRpLRMJbdEFlhyM5RPFBBZp/wWH8=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1196,8 +1214,8 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
-golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM=
+golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1219,8 +1237,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
-golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
+golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
+golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.24.0 h1:KTBBxWqUa0ykRPLtV69rRto9TLXcqYkeswu48x/gvNE=
 golang.org/x/oauth2 v0.24.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
@@ -1234,8 +1252,8 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
+golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1283,8 +1301,8 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -1292,8 +1310,8 @@ golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
-golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
+golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
+golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -1304,8 +1322,8 @@ golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
 golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
 golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1327,8 +1345,8 @@ golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
-golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=
+golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
+golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1420,3 +1438,27 @@ k8s.io/klog/v2 v2.110.1 h1:U/Af64HJf7FcwMcXyKm2RPM22WZzyR7OSpYj5tg3cL0=
 k8s.io/klog/v2 v2.110.1/go.mod h1:YGtd1984u+GgbuZ7e08/yBuAfKLSO0+uR1Fhi6ExXjo=
 lukechampine.com/blake3 v1.3.0 h1:sJ3XhFINmHSrYCgl958hscfIa3bw8x4DqMP3u1YvoYE=
 lukechampine.com/blake3 v1.3.0/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1LM6k=
+modernc.org/cc/v4 v4.24.4 h1:TFkx1s6dCkQpd6dKurBNmpo+G8Zl4Sq/ztJ+2+DEsh0=
+modernc.org/cc/v4 v4.24.4/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v4 v4.23.16 h1:Z2N+kk38b7SfySC1ZkpGLN2vthNJP1+ZzGZIlH7uBxo=
+modernc.org/ccgo/v4 v4.23.16/go.mod h1:nNma8goMTY7aQZQNTyN9AIoJfxav4nvTnvKThAeMDdo=
+modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
+modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
+modernc.org/gc/v2 v2.6.3 h1:aJVhcqAte49LF+mGveZ5KPlsp4tdGdAOT4sipJXADjw=
+modernc.org/gc/v2 v2.6.3/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
+modernc.org/libc v1.61.13 h1:3LRd6ZO1ezsFiX1y+bHd1ipyEHIJKvuprv0sLTBwLW8=
+modernc.org/libc v1.61.13/go.mod h1:8F/uJWL/3nNil0Lgt1Dpz+GgkApWh04N3el3hxJcA6E=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.8.2 h1:cL9L4bcoAObu4NkxOlKWBWtNHIsnnACGF/TbqQ6sbcI=
+modernc.org/memory v1.8.2/go.mod h1:ZbjSvMO5NQ1A2i3bWeDiVMxIorXwdClKE/0SZ+BMotU=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.36.3 h1:qYMYlFR+rtLDUzuXoST1SDIdEPbX8xzuhdF90WsX1ss=
+modernc.org/sqlite v1.36.3/go.mod h1:ADySlx7K4FdY5MaJcEv86hTJ0PjedAloTUuif0YS3ws=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=

internal/api/service.go

@@ -1,165 +0,0 @@
-package api
-
-import (
-	"encoding/json"
-	"fmt"
-	"github.com/distribution/reference"
-	"maps"
-	"reflect"
-	"regexp"
-	"slices"
-	"uncloud/internal/machine/api/pb"
-)
-
-const (
-	ServiceModeReplicated = "replicated"
-	ServiceModeGlobal     = "global"
-)
-
-type ServiceSpec struct {
-	Container ContainerSpec
-	// Mode is the replication mode of the service. Default is ServiceModeReplicated if empty.
-	Mode string
-	Name string
-	// Ports defines what service ports to publish to make the service accessible outside the cluster.
-	Ports []PortSpec
-	// Replicas is the number of containers to run for the service. Only valid for a replicated service.
-	Replicas uint
-}
-
-func (s *ServiceSpec) Validate() error {
-	if err := s.Container.Validate(); err != nil {
-		return err
-	}
-
-	switch s.Mode {
-	case "", ServiceModeGlobal, ServiceModeReplicated:
-	default:
-		return fmt.Errorf("invalid mode: %q", s.Mode)
-	}
-
-	// TODO: validate there is no conflict between ports.
-	// TODO: return error if there are non-HTTP/HTTPS ingress ports that we don't support yet.
-
-	return nil
-}
-
-// Equals returns true if the service spec is equal to the given spec ignoring the number of replicas.
-func (s *ServiceSpec) Equals(spec ServiceSpec) bool {
-	// TODO: ignore order of ports.
-	sCopy := *s
-	// Ignore the number of replicas when comparing.
-	sCopy.Replicas = 0
-	spec.Replicas = 0
-	return reflect.DeepEqual(*s, spec)
-}
-
-var serviceIDRegexp = regexp.MustCompile("^[0-9a-f]{32}$")
-
-func ValidateServiceID(id string) bool {
-	return serviceIDRegexp.MatchString(id)
-}
-
-type ContainerSpec struct {
-	Command []string
-	Image   string
-	// Run a custom init inside the container. If nil, use the daemon's configured settings.
-	Init *bool
-	// List of volumes to bind mount into the container.
-	Volumes []string
-}
-
-func (s *ContainerSpec) Validate() error {
-	if _, err := reference.ParseDockerRef(s.Image); err != nil {
-		return fmt.Errorf("invalid image: %w", err)
-	}
-
-	return nil
-}
-
-type Service struct {
-	ID         string
-	Name       string
-	Mode       string
-	Containers []MachineContainer
-}
-
-type MachineContainer struct {
-	MachineID string
-	Container Container
-}
-
-// Endpoints returns the exposed HTTP and HTTPS endpoints of the service.
-func (s *Service) Endpoints() []string {
-	endpoints := make(map[string]struct{})
-
-	// Container specs may differ between containers in the same service, e.g. during a rolling update,
-	// so we need to collect all unique endpoints.
-	for _, ctr := range s.Containers {
-		ports, err := ctr.Container.ServicePorts()
-		if err != nil {
-			continue
-		}
-
-		for _, port := range ports {
-			protocol := ""
-			switch port.Protocol {
-			case ProtocolHTTP:
-				protocol = "http"
-			case ProtocolHTTPS:
-				protocol = "https"
-			default:
-				continue
-			}
-
-			if port.Hostname == "" {
-				// There shouldn't be http(s) ports without a hostname but just in case ignore them.
-				continue
-			}
-
-			endpoint := fmt.Sprintf("%s://%s", protocol, port.Hostname)
-			if port.PublishedPort != 0 {
-				// For non-standard ports (80/443), include the port in the URL.
-				if !(port.Protocol == ProtocolHTTP && port.PublishedPort == 80) &&
-					!(port.Protocol == ProtocolHTTPS && port.PublishedPort == 443) {
-					endpoint += fmt.Sprintf(":%d", port.PublishedPort)
-				}
-			}
-
-			endpoint += fmt.Sprintf(" → :%d", port.ContainerPort)
-			endpoints[endpoint] = struct{}{}
-		}
-	}
-
-	return slices.Sorted(maps.Keys(endpoints))
-}
-
-func ServiceFromProto(s *pb.Service) (Service, error) {
-	var err error
-	containers := make([]MachineContainer, len(s.Containers))
-	for i, sc := range s.Containers {
-		containers[i], err = machineContainerFromProto(sc)
-		if err != nil {
-			return Service{}, err
-		}
-	}
-
-	return Service{
-		ID:         s.Id,
-		Name:       s.Name,
-		Mode:       s.Mode,
-		Containers: containers,
-	}, nil
-}
-
-func machineContainerFromProto(sc *pb.Service_Container) (MachineContainer, error) {
-	var c Container
-	if err := json.Unmarshal(sc.Container, &c); err != nil {
-		return MachineContainer{}, fmt.Errorf("unmarshal container: %w", err)
-	}
-
-	return MachineContainer{
-		MachineID: sc.MachineId,
-		Container: c,
-	}, nil
-}

internal/cli/cli.go

@@ -4,90 +4,125 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/docker/cli/cli/streams"
 	"net/netip"
 	"os"
-	"uncloud/internal/cli/client"
-	"uncloud/internal/cli/client/connector"
-	"uncloud/internal/cli/config"
-	"uncloud/internal/fs"
-	"uncloud/internal/machine"
-	"uncloud/internal/machine/api/pb"
-	"uncloud/internal/sshexec"
 
 	"github.com/charmbracelet/huh"
+	"github.com/docker/cli/cli/streams"
+	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/psviderski/uncloud/internal/fs"
+	"github.com/psviderski/uncloud/internal/machine"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/internal/sshexec"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/psviderski/uncloud/pkg/client/connector"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
 )
 
-const defaultClusterName = "default"
+const defaultContextName = "default"
 
 type CLI struct {
-	config *config.Config
+	Config *config.Config
+	conn   *config.MachineConnection
 }
 
-func New(configPath string) (*CLI, error) {
+// New creates a new CLI instance with the given config path or remote machine connection.
+// If the connection is provided, the config is ignored for all operations which is useful for interacting with
+// a cluster without creating a config.
+func New(configPath string, conn *config.MachineConnection) (*CLI, error) {
+	if conn != nil {
+		return &CLI{conn: conn}, nil
+	}
+
 	cfg, err := config.NewFromFile(configPath)
 	if err != nil {
 		return nil, fmt.Errorf("read Uncloud config: %w", err)
 	}
+
 	return &CLI{
-		config: cfg,
+		Config: cfg,
 	}, nil
 }
 
-func (cli *CLI) CreateCluster(name string) error {
-	if _, ok := cli.config.Clusters[name]; ok {
-		return fmt.Errorf("cluster %q already exists", name)
+func (cli *CLI) CreateContext(name string) error {
+	if _, ok := cli.Config.Contexts[name]; ok {
+		return fmt.Errorf("context '%s' already exists", name)
 	}
-	cli.config.Clusters[name] = &config.Cluster{
+	cli.Config.Contexts[name] = &config.Context{
 		Name: name,
 	}
-	return cli.config.Save()
+	return cli.Config.Save()
 }
 
-func (cli *CLI) SetCurrentCluster(name string) error {
-	if _, ok := cli.config.Clusters[name]; !ok {
-		return client.ErrNotFound
+func (cli *CLI) SetCurrentContext(name string) error {
+	if _, ok := cli.Config.Contexts[name]; !ok {
+		return api.ErrNotFound
 	}
-	cli.config.CurrentCluster = name
-	return cli.config.Save()
+	cli.Config.CurrentContext = name
+	return cli.Config.Save()
 }
 
-func (cli *CLI) ConnectCluster(ctx context.Context, clusterName string) (*client.Client, error) {
-	if len(cli.config.Clusters) == 0 {
-		return nil, errors.New(
-			"no clusters found in the Uncloud config. " +
-				"Please initialise a cluster with `uncloud machine init` first",
+// ConnectCluster connects to a cluster using the given context name or the current context if not specified.
+// If the CLI was initialised with a machine connection, the config is ignored and the connection is used instead.
+func (cli *CLI) ConnectCluster(ctx context.Context, contextName string) (*client.Client, error) {
+	if cli.conn != nil {
+		return connectCluster(ctx, *cli.conn)
+	}
+
+	if len(cli.Config.Contexts) == 0 {
+		return nil, fmt.Errorf(
+			"no cluster contexts found in the Uncloud config (%s). "+
+				"Please initialise a cluster with 'uncloud machine init' first",
+			cli.Config.Path(),
 		)
 	}
-	if clusterName == "" {
+	if contextName == "" {
 		// If the cluster is not specified, use the current cluster if set.
-		if cli.config.CurrentCluster == "" {
-			return nil, errors.New(
-				"the current cluster is not set in the Uncloud config. " +
-					"Please specify a cluster with the --cluster flag or set current_cluster in the config",
-			)
-		}
-		if _, ok := cli.config.Clusters[cli.config.CurrentCluster]; !ok {
+		if cli.Config.CurrentContext == "" {
 			return nil, fmt.Errorf(
-				"current cluster %q not found in the config. "+
-					"Please specify a cluster with the --cluster flag or update current_cluster in the config",
-				cli.config.CurrentCluster,
+				"the current cluster context is not set in the Uncloud config (%s). "+
+					"Please specify the context with the '--context' flag or set 'current_context' in the config",
+				cli.Config.Path(),
 			)
 		}
-		clusterName = cli.config.CurrentCluster
+		if _, ok := cli.Config.Contexts[cli.Config.CurrentContext]; !ok {
+			return nil, fmt.Errorf(
+				"current cluster context '%s' not found in the Uncloud config (%s). "+
+					"Please specify the context with the '--context' flag or update 'current_context' in the config",
+				cli.Config.CurrentContext,
+				cli.Config.Path(),
+			)
+		}
+		contextName = cli.Config.CurrentContext
 	}
 
-	cfg, ok := cli.config.Clusters[clusterName]
+	cfg, ok := cli.Config.Contexts[contextName]
 	if !ok {
-		return nil, fmt.Errorf("cluster %q not found in the config", clusterName)
+		return nil, fmt.Errorf("cluster context '%s' not found in the Uncloud config (%s)",
+			contextName, cli.Config.Path())
 	}
 	if len(cfg.Connections) == 0 {
-		return nil, fmt.Errorf("no connection configurations found for cluster %q in the config", clusterName)
+		return nil, fmt.Errorf(
+			"no connection configurations found for cluster context '%s' in the Uncloud config (%s)",
+			contextName, cli.Config.Path(),
+		)
 	}
 
 	// TODO: iterate over all connections and try to connect to the cluster using the first successful connection.
 	conn := cfg.Connections[0]
+
+	c, err := connectCluster(ctx, conn)
+	if err != nil {
+		return nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
+	}
+
+	return c, nil
+}
+
+func connectCluster(ctx context.Context, conn config.MachineConnection) (*client.Client, error) {
 	if conn.SSH != "" {
 		user, host, port, err := conn.SSH.Parse()
 		if err != nil {
@@ -103,45 +138,42 @@ func (cli *CLI) ConnectCluster(ctx context.Context, clusterName string) (*client
 			KeyPath: keyPath,
 		}
 		return client.New(ctx, connector.NewSSHConnector(sshConfig))
-	} else if conn.TCP.IsValid() {
-		return client.New(ctx, connector.NewTCPConnector(conn.TCP))
+	} else if conn.TCP != nil && conn.TCP.IsValid() {
+		return client.New(ctx, connector.NewTCPConnector(*conn.TCP))
 	}
-	return nil, errors.New("no valid connection configuration found for the cluster")
+
+	return nil, errors.New("connection configuration is invalid")
+}
+
+type InitClusterOptions struct {
+	Context       string
+	MachineName   string
+	Network       netip.Prefix
+	PublicIP      *netip.Addr
+	RemoteMachine *RemoteMachine
+	Version       string
 }
 
 // InitCluster initialises a new cluster on a remote machine and returns a client to interact with the cluster.
 // The client should be closed after use by the caller.
-func (cli *CLI) InitCluster(
-	ctx context.Context,
-	remoteMachine *RemoteMachine,
-	clusterName,
-	machineName string,
-	netPrefix netip.Prefix,
-	publicIP *netip.Addr,
-) (*client.Client, error) {
-	if remoteMachine != nil {
-		return cli.initRemoteMachine(ctx, *remoteMachine, clusterName, machineName, netPrefix, publicIP)
+func (cli *CLI) InitCluster(ctx context.Context, opts InitClusterOptions) (*client.Client, error) {
+	if opts.RemoteMachine != nil {
+		return cli.initRemoteMachine(ctx, opts)
 	}
 	// TODO: implement local machine initialisation
 	return nil, fmt.Errorf("local machine initialisation is not implemented yet")
 }
 
-func (cli *CLI) initRemoteMachine(
-	ctx context.Context,
-	remoteMachine RemoteMachine,
-	clusterName,
-	machineName string,
-	netPrefix netip.Prefix,
-	publicIP *netip.Addr,
-) (*client.Client, error) {
-	if clusterName == "" {
-		clusterName = defaultClusterName
+func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions) (*client.Client, error) {
+	contextName := opts.Context
+	if contextName == "" {
+		contextName = defaultContextName
 	}
-	if _, ok := cli.config.Clusters[clusterName]; ok {
-		return nil, fmt.Errorf("cluster %q already exists", clusterName)
+	if _, ok := cli.Config.Contexts[contextName]; ok {
+		return nil, fmt.Errorf("cluster context '%s' already exists", contextName)
 	}
 
-	machineClient, err := cli.provisionRemoteMachine(ctx, remoteMachine)
+	machineClient, err := cli.provisionRemoteMachine(ctx, *opts.RemoteMachine, opts.Version)
 	if err != nil {
 		return nil, err
 	}
@@ -163,13 +195,24 @@ func (cli *CLI) initRemoteMachine(
 		}
 	}
 
-	req := &pb.InitClusterRequest{
-		MachineName: machineName,
-		Network:     pb.NewIPPrefix(netPrefix),
+	// Check machine meets all necessary system requirements before proceeding.
+	checkResp, err := machineClient.CheckPrerequisites(ctx, &emptypb.Empty{})
+	// TODO(lhf): remove Unimplemented check when v0.9.0 is released.
+	if err != nil {
+		if status.Convert(err).Code() != codes.Unimplemented {
+			return nil, fmt.Errorf("check machine prerequisites: %w", err)
+		}
+	} else if !checkResp.Satisfied {
+		return nil, fmt.Errorf("machine prerequisites not satisfied: %s", checkResp.Error)
 	}
-	if publicIP != nil {
-		if publicIP.IsValid() {
-			req.PublicIpConfig = &pb.InitClusterRequest_PublicIp{PublicIp: pb.NewIP(*publicIP)}
+
+	req := &pb.InitClusterRequest{
+		MachineName: opts.MachineName,
+		Network:     pb.NewIPPrefix(opts.Network),
+	}
+	if opts.PublicIP != nil {
+		if opts.PublicIP.IsValid() {
+			req.PublicIpConfig = &pb.InitClusterRequest_PublicIp{PublicIp: pb.NewIP(*opts.PublicIP)}
 		} else {
 			// Invalid or in other words zero IP means to automatically detect the public IP.
 			req.PublicIpConfig = &pb.InitClusterRequest_PublicIpAuto{PublicIpAuto: true}
@@ -180,42 +223,50 @@ func (cli *CLI) initRemoteMachine(
 	if err != nil {
 		return nil, fmt.Errorf("init cluster: %w", err)
 	}
-	fmt.Printf("Cluster %q initialised with machine %q\n", clusterName, resp.Machine.Name)
-
-	if err = cli.CreateCluster(clusterName); err != nil {
-		return nil, fmt.Errorf("save cluster to config: %w", err)
+	fmt.Printf("Cluster initialised with machine '%s' and saved as context '%s' in your local config (%s)\n",
+		resp.Machine.Name, contextName, cli.Config.Path())
+	if err = cli.CreateContext(contextName); err != nil {
+		return nil, fmt.Errorf("save cluster context to config: %w", err)
 	}
-	// Set the current cluster to the just created one if it is the only cluster in the config.
-	if len(cli.config.Clusters) == 1 {
-		if err = cli.SetCurrentCluster(clusterName); err != nil {
-			return nil, fmt.Errorf("set current cluster: %w", err)
-		}
+	if err = cli.SetCurrentContext(contextName); err != nil {
+		return nil, fmt.Errorf("set current cluster context: %w", err)
 	}
+	fmt.Printf("Current cluster context is now '%s'.\n", contextName)
 
-	// Save the machine's SSH connection details in the cluster config.
+	// Save the machine's SSH connection details in the context config.
 	connCfg := config.MachineConnection{
-		SSH:        config.NewSSHDestination(remoteMachine.User, remoteMachine.Host, remoteMachine.Port),
-		SSHKeyFile: remoteMachine.KeyPath,
+		SSH:        config.NewSSHDestination(opts.RemoteMachine.User, opts.RemoteMachine.Host, opts.RemoteMachine.Port),
+		SSHKeyFile: opts.RemoteMachine.KeyPath,
 	}
-	cli.config.Clusters[clusterName].Connections = append(cli.config.Clusters[clusterName].Connections, connCfg)
-	if err = cli.config.Save(); err != nil {
+	cli.Config.Contexts[contextName].Connections = append(cli.Config.Contexts[contextName].Connections, connCfg)
+	if err = cli.Config.Save(); err != nil {
 		return nil, fmt.Errorf("save config: %w", err)
 	}
 	return machineClient, nil
 }
 
+type AddMachineOptions struct {
+	Context       string
+	MachineName   string
+	PublicIP      *netip.Addr
+	RemoteMachine RemoteMachine
+	Version       string
+}
+
 // AddMachine provisions a remote machine and adds it to the cluster. It returns a client to interact with the machine
 // which should be closed after use by the caller.
-func (cli *CLI) AddMachine(
-	ctx context.Context, remoteMachine RemoteMachine, clusterName, machineName string, publicIP *netip.Addr,
-) (*client.Client, error) {
-	c, err := cli.ConnectCluster(ctx, clusterName)
+func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client.Client, error) {
+	contextName := opts.Context
+	if contextName == "" {
+		contextName = cli.Config.CurrentContext
+	}
+	c, err := cli.ConnectCluster(ctx, contextName)
 	if err != nil {
-		return nil, fmt.Errorf("connect to cluster: %w", err)
+		return nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
 	}
 	defer c.Close()
 
-	machineClient, err := cli.provisionRemoteMachine(ctx, remoteMachine)
+	machineClient, err := cli.provisionRemoteMachine(ctx, opts.RemoteMachine, opts.Version)
 	if err != nil {
 		return nil, err
 	}
@@ -236,6 +287,17 @@ func (cli *CLI) AddMachine(
 		}
 	}
 
+	// Check machine meets all necessary system requirements before proceeding.
+	checkResp, err := machineClient.CheckPrerequisites(ctx, &emptypb.Empty{})
+	// TODO(lhf): remove Unimplemented check when v0.9.0 is released.
+	if err != nil {
+		if status.Convert(err).Code() != codes.Unimplemented {
+			return nil, fmt.Errorf("check machine prerequisites: %w", err)
+		}
+	} else if !checkResp.Satisfied {
+		return nil, fmt.Errorf("machine prerequisites not satisfied: %s", checkResp.Error)
+	}
+
 	tokenResp, err := machineClient.Token(ctx, &emptypb.Empty{})
 	if err != nil {
 		return nil, fmt.Errorf("get remote machine token: %w", err)
@@ -251,15 +313,15 @@ func (cli *CLI) AddMachine(
 		endpoints[i] = pb.NewIPPort(addrPort)
 	}
 	addReq := &pb.AddMachineRequest{
-		Name: machineName,
+		Name: opts.MachineName,
 		Network: &pb.NetworkConfig{
 			Endpoints: endpoints,
 			PublicKey: token.PublicKey,
 		},
 	}
-	if publicIP != nil {
-		if publicIP.IsValid() {
-			addReq.PublicIp = pb.NewIP(*publicIP)
+	if opts.PublicIP != nil {
+		if opts.PublicIP.IsValid() {
+			addReq.PublicIp = pb.NewIP(*opts.PublicIP)
 		} else if token.PublicIP.IsValid() {
 			// Invalid or in other words zero IP means to use an automatically detected public IP from the token.
 			addReq.PublicIp = pb.NewIP(token.PublicIP)
@@ -268,11 +330,11 @@ func (cli *CLI) AddMachine(
 
 	addResp, err := c.AddMachine(ctx, addReq)
 	if err != nil {
-		return nil, fmt.Errorf("add machine to cluster: %w", err)
+		return nil, fmt.Errorf("add machine to cluster (context '%s'): %w", contextName, err)
 	}
 
 	// List other machines in the cluster to include them in the join request.
-	machines, err := c.ListMachines(ctx)
+	machines, err := c.ListMachines(ctx, nil)
 	if err != nil {
 		return nil, fmt.Errorf("list cluster machines: %w", err)
 	}
@@ -292,18 +354,19 @@ func (cli *CLI) AddMachine(
 		return nil, fmt.Errorf("join cluster: %w", err)
 	}
 
-	fmt.Printf("Machine %q added to cluster\n", addResp.Machine.Name)
+	// TODO: fix empty context name when using the current context (contextName == "").
+	fmt.Printf("Machine '%s' added to the cluster (context '%s').\n", addResp.Machine.Name, contextName)
 
-	// Save the machine's SSH connection details in the cluster config.
+	// Save the machine's SSH connection details in the context config.
 	connCfg := config.MachineConnection{
-		SSH:        config.NewSSHDestination(remoteMachine.User, remoteMachine.Host, remoteMachine.Port),
-		SSHKeyFile: remoteMachine.KeyPath,
+		SSH:        config.NewSSHDestination(opts.RemoteMachine.User, opts.RemoteMachine.Host, opts.RemoteMachine.Port),
+		SSHKeyFile: opts.RemoteMachine.KeyPath,
 	}
-	if clusterName == "" {
-		clusterName = cli.config.CurrentCluster
+	if contextName == "" {
+		contextName = cli.Config.CurrentContext
 	}
-	cli.config.Clusters[clusterName].Connections = append(cli.config.Clusters[clusterName].Connections, connCfg)
-	if err = cli.config.Save(); err != nil {
+	cli.Config.Contexts[contextName].Connections = append(cli.Config.Contexts[contextName].Connections, connCfg)
+	if err = cli.Config.Save(); err != nil {
 		return nil, fmt.Errorf("save config: %w", err)
 	}
 
@@ -312,7 +375,10 @@ func (cli *CLI) AddMachine(
 
 // provisionRemoteMachine installs the Uncloud daemon and dependencies on the remote machine over SSH and returns
 // a machine API client to interact with the machine. The client should be closed after use by the caller.
-func (cli *CLI) provisionRemoteMachine(ctx context.Context, remoteMachine RemoteMachine) (*client.Client, error) {
+// The version parameter specifies the version of the Uncloud daemon to install. If empty, the latest version is used.
+func (cli *CLI) provisionRemoteMachine(
+	ctx context.Context, remoteMachine RemoteMachine, version string,
+) (*client.Client, error) {
 	// Provision the remote machine by installing the Uncloud daemon and dependencies over SSH.
 	sshClient, err := sshexec.Connect(remoteMachine.User, remoteMachine.Host, remoteMachine.Port, remoteMachine.KeyPath)
 	if err != nil {
@@ -323,7 +389,7 @@ func (cli *CLI) provisionRemoteMachine(ctx context.Context, remoteMachine Remote
 	}
 	exec := sshexec.NewRemote(sshClient)
 	// Install and run the Uncloud daemon and dependencies on the remote machine.
-	if err = provisionMachine(ctx, exec); err != nil {
+	if err = provisionMachine(ctx, exec, version); err != nil {
 		return nil, fmt.Errorf("provision machine: %w", err)
 	}
 
@@ -360,7 +426,7 @@ func (cli *CLI) promptResetMachine() error {
 				Negative("No").
 				Value(&confirm),
 		),
-	)
+	).WithAccessible(true)
 	if err := form.Run(); err != nil {
 		return fmt.Errorf("prompt user to confirm: %w", err)
 	}
@@ -369,7 +435,8 @@ func (cli *CLI) promptResetMachine() error {
 		return fmt.Errorf("remote machine is already initialised as a cluster member")
 	}
 	// TODO: implement resetting the remote machine.
-	return fmt.Errorf("resetting the remote machine is not implemented yet")
+	return fmt.Errorf("resetting the remote machine is not implemented yet. " +
+		"Please manually run 'uncloud-uninstall' on the remote machine to fully uninstall Uncloud from it")
 }
 
 // ProgressOut returns an output stream for progress writer.

internal/cli/client/caddy_test.go

@@ -1,69 +0,0 @@
-package client
-
-import (
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"testing"
-	"uncloud/internal/api"
-)
-
-func TestClient_NewCaddyDeployment(t *testing.T) {
-	t.Parallel()
-
-	cli := &Client{}
-
-	t.Run("latest image from Docker Hub", func(t *testing.T) {
-		t.Parallel()
-
-		deploy, err := cli.NewCaddyDeployment("", nil)
-		require.NoError(t, err)
-
-		assert.Equal(t, "caddy", deploy.Spec.Name)
-		assert.Equal(t, api.ServiceModeGlobal, deploy.Spec.Mode)
-		assert.Regexp(t, `^caddy:2\.\d+\.\d+$`, deploy.Spec.Container.Image)
-		expectedPorts := []api.PortSpec{
-			{
-				PublishedPort: 80,
-				ContainerPort: 80,
-				Protocol:      api.ProtocolTCP,
-				Mode:          api.PortModeHost,
-			},
-			{
-				PublishedPort: 443,
-				ContainerPort: 443,
-				Protocol:      api.ProtocolTCP,
-				Mode:          api.PortModeHost,
-			},
-		}
-		assert.Equal(t, expectedPorts, deploy.Spec.Ports)
-		// TODO:
-		//assert.Equal(t, alwaysPullImage, deploy.Spec.Container.PullPolicy)
-	})
-
-	t.Run("custom image", func(t *testing.T) {
-		t.Parallel()
-
-		image := "my-caddy:1.2.3"
-		deploy, err := cli.NewCaddyDeployment(image, nil)
-		require.NoError(t, err)
-
-		assert.Equal(t, "caddy", deploy.Spec.Name)
-		assert.Equal(t, api.ServiceModeGlobal, deploy.Spec.Mode)
-		assert.Equal(t, image, deploy.Spec.Container.Image)
-		expectedPorts := []api.PortSpec{
-			{
-				PublishedPort: 80,
-				ContainerPort: 80,
-				Protocol:      api.ProtocolTCP,
-				Mode:          api.PortModeHost,
-			},
-			{
-				PublishedPort: 443,
-				ContainerPort: 443,
-				Protocol:      api.ProtocolTCP,
-				Mode:          api.PortModeHost,
-			},
-		}
-		assert.Equal(t, expectedPorts, deploy.Spec.Ports)
-	})
-}

internal/cli/client/cluster.go

@@ -1,30 +0,0 @@
-package client
-
-import (
-	"context"
-	"google.golang.org/protobuf/types/known/emptypb"
-	"uncloud/internal/machine/api/pb"
-)
-
-func (cli *Client) InspectMachine(ctx context.Context, id string) (*pb.MachineMember, error) {
-	machines, err := cli.ListMachines(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	for _, m := range machines {
-		if m.Machine.Id == id || m.Machine.Name == id {
-			return m, nil
-		}
-	}
-
-	return nil, ErrNotFound
-}
-
-func (cli *Client) ListMachines(ctx context.Context) ([]*pb.MachineMember, error) {
-	resp, err := cli.ClusterClient.ListMachines(ctx, &emptypb.Empty{})
-	if err != nil {
-		return nil, err
-	}
-	return resp.Machines, nil
-}

internal/cli/client/resolver.go

@@ -1,116 +0,0 @@
-package client
-
-import (
-	"fmt"
-	"github.com/distribution/reference"
-	"strings"
-	"uncloud/internal/api"
-	"uncloud/internal/secret"
-)
-
-// ServiceSpecResolver transforms user-provided service specs into deployment-ready form.
-type ServiceSpecResolver struct {
-	ClusterDomain string
-}
-
-func NewServiceSpecResolver(clusterDomain string) *ServiceSpecResolver {
-	return &ServiceSpecResolver{ClusterDomain: clusterDomain}
-}
-
-// Resolve transforms a service spec into its fully resolved form ready for deployment.
-func (r *ServiceSpecResolver) Resolve(spec *api.ServiceSpec) error {
-	if err := spec.Validate(); err != nil {
-		return fmt.Errorf("invalid service spec: %w", err)
-	}
-
-	steps := []func(*api.ServiceSpec) error{
-		r.applyDefaults,
-		r.resolveServiceName,
-		r.expandIngressPorts,
-	}
-
-	for _, step := range steps {
-		if err := step(spec); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (r *ServiceSpecResolver) applyDefaults(spec *api.ServiceSpec) error {
-	if spec.Mode == "" {
-		spec.Mode = api.ServiceModeReplicated
-	}
-	// Ensure the replicated service has at least one replica.
-	if spec.Mode == api.ServiceModeReplicated && spec.Replicas == 0 {
-		spec.Replicas = 1
-	}
-
-	return nil
-}
-
-func (r *ServiceSpecResolver) resolveServiceName(spec *api.ServiceSpec) error {
-	if spec.Name != "" {
-		return nil
-	}
-
-	// Generate a random service name from the image when not provided.
-	img, err := reference.ParseDockerRef(spec.Container.Image)
-	if err != nil {
-		return fmt.Errorf("invalid image: %w", err)
-	}
-	// Get the image name without the repository and tag/digest parts.
-	imageName := reference.FamiliarName(img)
-	// Get the last part of the image name (path), e.g. "nginx" from "bitnami/nginx".
-	if i := strings.LastIndex(imageName, "/"); i != -1 {
-		imageName = imageName[i+1:]
-	}
-	// Append a random suffix to the image name to generate an optimistically unique service name.
-	suffix, err := secret.RandomAlphaNumeric(4)
-	if err != nil {
-		return fmt.Errorf("generate random suffix: %w", err)
-	}
-	spec.Name = fmt.Sprintf("%s-%s", imageName, suffix)
-
-	return nil
-}
-
-// expandIngressPorts processes HTTP(S) ingress ports in a service spec by:
-// 1. Setting a default hostname (service-name.cluster-domain) for ports without a hostname.
-// 2. Duplicating a port with a cluster domain hostname for ports with external domains.
-// This ensures every ingress port is accessible via the cluster domain, while preserving any custom domains specified
-// by the user.
-func (r *ServiceSpecResolver) expandIngressPorts(spec *api.ServiceSpec) error {
-	for i, port := range spec.Ports {
-		if port.Protocol != api.ProtocolHTTP && port.Protocol != api.ProtocolHTTPS {
-			continue
-		}
-
-		if port.Hostname == "" {
-			if r.ClusterDomain == "" {
-				return fmt.Errorf("cluster domain must be reserved to generate hostname for ingress port: %d/%s",
-					port.ContainerPort, port.Protocol)
-			}
-			// Assign the default hostname (service-name.cluster-domain).
-			spec.Ports[i].Hostname = fmt.Sprintf("%s.%s", spec.Name, r.ClusterDomain)
-		} else {
-			if r.ClusterDomain == "" {
-				// When no cluster domain is reserved, use only the provided hostname.
-				continue
-			}
-
-			if strings.HasSuffix(port.Hostname, "."+r.ClusterDomain) {
-				// If the hostname is already a cluster subdomain, use as is.
-				continue
-			}
-			// For external domains, duplicate the port with a service-name.cluster-domain hostname so the service
-			// can be accessed via both hostnames.
-			newPort := port
-			newPort.Hostname = fmt.Sprintf("%s.%s", spec.Name, r.ClusterDomain)
-			spec.Ports = append(spec.Ports, newPort)
-		}
-	}
-
-	return nil
-}

internal/cli/config/cluster.go

@@ -1,6 +0,0 @@
-package config
-
-type Cluster struct {
-	Name        string              `toml:"-"`
-	Connections []MachineConnection `toml:"connections"`
-}

internal/cli/config/config.go

@@ -2,14 +2,15 @@ package config
 
 import (
 	"fmt"
-	"github.com/BurntSushi/toml"
 	"os"
 	"path/filepath"
+
+	"github.com/goccy/go-yaml"
 )
 
 type Config struct {
-	Clusters       map[string]*Cluster `toml:"clusters"`
-	CurrentCluster string              `toml:"current_cluster"`
+	CurrentContext string              `yaml:"current_context"`
+	Contexts       map[string]*Context `yaml:"contexts"`
 
 	// path is the file path config is read from.
 	path string
@@ -18,10 +19,10 @@ type Config struct {
 func NewFromFile(path string) (*Config, error) {
 	_, err := os.Stat(path)
 	if err != nil && !os.IsNotExist(err) {
-		return nil, fmt.Errorf("check file permissions %q: %w", path, err)
+		return nil, fmt.Errorf("check file permissions '%s': %w", path, err)
 	}
 	c := &Config{
-		Clusters: map[string]*Cluster{},
+		Contexts: map[string]*Context{},
 		path:     path,
 	}
 	if os.IsNotExist(err) {
@@ -34,30 +35,37 @@ func NewFromFile(path string) (*Config, error) {
 	return c, nil
 }
 
+func (c *Config) Path() string {
+	return c.path
+}
+
 func (c *Config) Read() error {
-	_, err := toml.DecodeFile(c.path, c)
+	data, err := os.ReadFile(c.path)
 	if err != nil {
-		return fmt.Errorf("read config file %q: %w", c.path, err)
+		return fmt.Errorf("read config file '%s': %w", c.path, err)
 	}
+	if err = yaml.Unmarshal(data, c); err != nil {
+		return fmt.Errorf("parse config file '%s': %s", c.path, yaml.FormatError(err, true, true))
+	}
+
 	return nil
 }
 
 func (c *Config) Save() error {
 	dir, _ := filepath.Split(c.path)
 	if err := os.MkdirAll(dir, 0700); err != nil {
-		return fmt.Errorf("create config directory %q: %w", dir, err)
+		return fmt.Errorf("create config directory '%s': %w", dir, err)
 	}
 
 	f, err := os.OpenFile(c.path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
 	if err != nil {
-		return fmt.Errorf("write config file %q: %w", c.path, err)
+		return fmt.Errorf("write config file '%s': %w", c.path, err)
 	}
 
-	encoder := toml.NewEncoder(f)
-	encoder.Indent = ""
+	encoder := yaml.NewEncoder(f, yaml.Indent(2), yaml.IndentSequence(true))
 	if err = encoder.Encode(c); err != nil {
 		_ = f.Close()
-		return fmt.Errorf("encode config file %q: %w", c.path, err)
+		return fmt.Errorf("encode config file '%s': %w", c.path, err)
 	}
 	return f.Close()
 }

internal/cli/config/connection.go

@@ -5,7 +5,8 @@ import (
 	"net/netip"
 	"strconv"
 	"strings"
-	"uncloud/internal/secret"
+
+	"github.com/psviderski/uncloud/internal/secret"
 )
 
 const (
@@ -14,11 +15,13 @@ const (
 )
 
 type MachineConnection struct {
-	SSH        SSHDestination `toml:"ssh,omitempty"`
-	TCP        netip.AddrPort `toml:"tcp,omitempty"`
-	Host       string         `toml:"host,omitempty"`
-	PublicKey  secret.Secret  `toml:"public_key,omitempty"`
-	SSHKeyFile string         `toml:"ssh_key_file,omitempty"`
+	SSH        SSHDestination `yaml:"ssh,omitempty"`
+	SSHKeyFile string         `yaml:"ssh_key_file,omitempty"`
+	// TCP is the address and port of the machine's API server.
+	// The pointer is used to omit the field when not set. Otherwise, yaml marshalling includes an empty object.
+	TCP       *netip.AddrPort `yaml:"tcp,omitempty"`
+	Host      string          `yaml:"host,omitempty"`
+	PublicKey secret.Secret   `yaml:"public_key,omitempty"`
 }
 
 // SSHDestination represents an SSH destination string in the canonical form of "user@host:port".

internal/cli/config/context.go

@@ -0,0 +1,6 @@
+package config
+
+type Context struct {
+	Name        string              `yaml:"-"`
+	Connections []MachineConnection `yaml:"connections"`
+}

internal/cli/flags.go

@@ -0,0 +1,23 @@
+package cli
+
+import (
+	"strings"
+)
+
+// ExpandCommaSeparatedValues takes a slice of strings and expands any comma-separated values into individual elements.
+func ExpandCommaSeparatedValues(values []string) []string {
+	if len(values) == 0 {
+		return nil
+	}
+
+	var expanded []string
+	for _, value := range values {
+		for _, v := range strings.Split(value, ",") {
+			if v = strings.TrimSpace(v); v != "" {
+				expanded = append(expanded, v)
+			}
+		}
+	}
+
+	return expanded
+}

internal/cli/machine.go

@@ -4,7 +4,9 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"uncloud/internal/sshexec"
+	"strings"
+
+	"github.com/psviderski/uncloud/internal/sshexec"
 )
 
 // TODO: support pinning the script version to the CLI version.
@@ -17,36 +19,38 @@ type RemoteMachine struct {
 	KeyPath string
 }
 
-func installCmd(user string) string {
-	sudoPrefix := "sudo"
+func installCmd(user string, version string) string {
+	sudoPrefix := ""
+	var env []string
+
 	// Add the SSH user (non-root) to the uncloud group to allow access to the Uncloud daemon unix socket.
-	env := "UNCLOUD_GROUP_ADD_USER=" + user
-
-	curlBashCmd := fmt.Sprintf(
-		"curl -fsSL %s | %s %s bash", sshexec.Quote(installScriptURL), sudoPrefix, sshexec.Quote(env),
-	)
-
-	if user == "root" {
-		curlBashCmd = fmt.Sprintf(
-			"curl -fsSL %s | bash", sshexec.Quote(installScriptURL),
-		)
+	if user != "root" {
+		sudoPrefix = "sudo"
+		env = append(env, "UNCLOUD_GROUP_ADD_USER="+sshexec.Quote(user))
 	}
+	if version != "" {
+		env = append(env, "UNCLOUD_VERSION="+sshexec.Quote(version))
+	}
+
+	envCmd := strings.Join(env, " ")
+	curlBashCmd := fmt.Sprintf("curl -fsSL %s | %s %s bash", sshexec.Quote(installScriptURL), sudoPrefix, envCmd)
 
 	return curlBashCmd
 }
 
 // provisionMachine provisions the remote machine by downloading the Uncloud install script from GitHub and running it.
-func provisionMachine(ctx context.Context, exec sshexec.Executor) error {
+// If version is specified, it will be passed to the install script as UNCLOUD_VERSION environment variable.
+func provisionMachine(ctx context.Context, exec sshexec.Executor, version string) error {
 	user, err := exec.Run(ctx, "whoami")
 	if err != nil {
 		return fmt.Errorf("run whoami: %w", err)
 	}
 
-	installCmd := installCmd(user)
+	cmd := installCmd(user, version)
 
 	fmt.Println("Downloading Uncloud install script:", installScriptURL)
 
-	cmd := sshexec.QuoteCommand("bash", "-c", "set -o pipefail; "+installCmd)
+	cmd = sshexec.QuoteCommand("bash", "-c", "set -o pipefail; "+cmd)
 	if err = exec.Stream(ctx, cmd, os.Stdout, os.Stderr); err != nil {
 		return fmt.Errorf("download and run install script: %w", err)
 	}

internal/cli/machine_test.go

@@ -8,12 +8,29 @@ import (
 
 func TestInstallCmd(t *testing.T) {
 	t.Run("root", func(t *testing.T) {
-		cmd := installCmd("root")
+		cmd := installCmd("root", "")
 		assert.NotContains(t, cmd, "sudo")
+		assert.NotContains(t, cmd, "UNCLOUD_GROUP_ADD_USER")
+	})
+
+	// Test with version
+	t.Run("root with version", func(t *testing.T) {
+		cmd := installCmd("root", "v1.2.3")
+		assert.NotContains(t, cmd, "sudo")
+		assert.NotContains(t, cmd, "UNCLOUD_GROUP_ADD_USER")
+		assert.Contains(t, cmd, "UNCLOUD_VERSION=v1.2.3")
 	})
 
 	t.Run("nonroot", func(t *testing.T) {
-		cmd := installCmd("nonroot")
+		cmd := installCmd("nonroot", "")
 		assert.Contains(t, cmd, "sudo")
+		assert.Contains(t, cmd, "UNCLOUD_GROUP_ADD_USER=nonroot")
+	})
+
+	t.Run("nonroot with version", func(t *testing.T) {
+		cmd := installCmd("nonroot", "v1.2.3")
+		assert.Contains(t, cmd, "sudo")
+		assert.Contains(t, cmd, "UNCLOUD_GROUP_ADD_USER=nonroot")
+		assert.Contains(t, cmd, "UNCLOUD_VERSION=v1.2.3")
 	})
 }

internal/cli/prompt.go

@@ -0,0 +1,23 @@
+package cli
+
+import "github.com/charmbracelet/huh"
+
+func Confirm() (bool, error) {
+	var confirmed bool
+	form := huh.NewForm(
+		huh.NewGroup(
+			huh.NewConfirm().
+				Title(
+					"Do you want to continue?",
+				).
+				Affirmative("Yes!").
+				Negative("No").
+				Value(&confirmed),
+		),
+	).WithAccessible(true)
+	if err := form.Run(); err != nil {
+		return false, err
+	}
+
+	return confirmed, nil
+}

internal/daemon/daemon.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	systemd "github.com/coreos/go-systemd/daemon"
 	"log/slog"
-	"uncloud/internal/machine"
+	"github.com/psviderski/uncloud/internal/machine"
 )
 
 type Daemon struct {

internal/daemon/token.go

@@ -3,10 +3,10 @@ package daemon
 import (
 	"errors"
 	"fmt"
+	"github.com/psviderski/uncloud/internal/machine"
+	"github.com/psviderski/uncloud/internal/machine/network"
 	"net/netip"
 	"os"
-	"uncloud/internal/machine"
-	"uncloud/internal/machine/network"
 )
 
 // MachineToken returns the local machine's token that can be used for adding the machine to a cluster.

internal/log/handler.go

@@ -45,11 +45,19 @@ func (h *SlogTextHandler) Enabled(ctx context.Context, level slog.Level) bool {
 }
 
 func (h *SlogTextHandler) WithAttrs(attrs []slog.Attr) slog.Handler {
-	return h.TextHandler.WithAttrs(attrs)
+	return &SlogTextHandler{
+		TextHandler: h.TextHandler.WithAttrs(attrs).(*slog.TextHandler),
+		opts:        h.opts,
+		w:           h.w,
+	}
 }
 
 func (h *SlogTextHandler) WithGroup(name string) slog.Handler {
-	return h.TextHandler.WithGroup(name)
+	return &SlogTextHandler{
+		TextHandler: h.TextHandler.WithGroup(name).(*slog.TextHandler),
+		opts:        h.opts,
+		w:           h.w,
+	}
 }
 
 func (h *SlogTextHandler) Handle(ctx context.Context, r slog.Record) error {

internal/machine/api/pb/docker.proto

@@ -14,23 +14,37 @@ service Docker {
   rpc StopContainer(StopContainerRequest) returns (google.protobuf.Empty);
   rpc ListContainers(ListContainersRequest) returns (ListContainersResponse);
   rpc RemoveContainer(RemoveContainerRequest) returns (google.protobuf.Empty);
+
   rpc PullImage(PullImageRequest) returns (stream JSONMessage);
+  rpc InspectImage(InspectImageRequest) returns (InspectImageResponse);
+  // InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's
+  // Docker auth credentials if necessary.
+  rpc InspectRemoteImage(InspectRemoteImageRequest) returns (InspectRemoteImageResponse);
+
+  rpc CreateVolume(CreateVolumeRequest) returns (CreateVolumeResponse);
+  rpc ListVolumes(ListVolumesRequest) returns (ListVolumesResponse);
+  rpc RemoveVolume(RemoveVolumeRequest) returns (google.protobuf.Empty);
+
+  rpc CreateServiceContainer(CreateServiceContainerRequest) returns (CreateContainerResponse);
+  rpc InspectServiceContainer(InspectContainerRequest) returns (ServiceContainer);
+  rpc ListServiceContainers(ListServiceContainersRequest) returns (ListServiceContainersResponse);
+  rpc RemoveServiceContainer(RemoveContainerRequest) returns (google.protobuf.Empty);
 }
 
 message CreateContainerRequest {
-  // JSON serialized container.Config.
+  // JSON serialised container.Config.
   bytes config = 1;
-  // JSON serialized container.HostConfig.
+  // JSON serialised container.HostConfig.
   bytes host_config = 2;
-  // JSON serialized network.NetworkingConfig.
+  // JSON serialised network.NetworkingConfig.
   bytes network_config = 3;
-  // JSON serialized ocispec.Platform.
+  // JSON serialised ocispec.Platform.
   bytes platform = 4;
   string name = 5;
 }
 
 message CreateContainerResponse {
-  // JSON serialized container.CreateResponse.
+  // JSON serialised container.CreateResponse.
   bytes response = 1;
 }
 
@@ -39,51 +53,145 @@ message InspectContainerRequest {
 }
 
 message InspectContainerResponse {
-  // JSON serialized container.InspectResponse.
+  // JSON serialised container.InspectResponse.
   bytes response = 1;
 }
 
 message StartContainerRequest {
   string id = 1;
-  // JSON serialized container.StartOptions.
+  // JSON serialised container.StartOptions.
   bytes options = 2;
 }
 
 message StopContainerRequest {
   string id = 1;
-  // JSON serialized container.StopOptions.
+  // JSON serialised container.StopOptions.
   bytes options = 2;
 }
 
 message ListContainersRequest {
-  // JSON serialized container.ListOptions.
+  // JSON serialised container.ListOptions.
   bytes options = 1;
 }
 
-// ListContainersResponse structure allows broadcasting ListContainers requests to multiple machines.
 message ListContainersResponse {
+  // Must contain only one repeated messages field to allow broadcasting ListContainers requests to multiple machines.
   repeated MachineContainers messages = 1;
 }
 
 message MachineContainers {
   Metadata metadata = 1;
-  // JSON serialized []container.ContainerJSON.
+  // JSON serialised []container.InspectResponse.
   bytes containers = 2;
 }
 
 message RemoveContainerRequest {
   string id = 1;
-  // JSON serialized container.RemoveOptions.
+  // JSON serialised container.RemoveOptions.
   bytes options = 2;
 }
 
 message PullImageRequest {
   string image = 1;
-  // JSON serialized image.PullOptions.
+  // JSON serialised image.PullOptions.
   bytes options = 2;
 }
 
 message JSONMessage {
-  // JSON serialized jsonmessage.JSONMessage.
+  // JSON serialised jsonmessage.JSONMessage.
   bytes message = 1;
 }
+
+message InspectImageRequest {
+  string id = 1;
+}
+
+message InspectImageResponse {
+  // Must contain only one repeated messages field to allow broadcasting InspectImage requests to multiple machines.
+  repeated Image messages = 1;
+}
+
+message Image {
+  Metadata metadata = 1;
+  // JSON serialised types.ImageInspect.
+  bytes image = 2;
+}
+
+message InspectRemoteImageRequest {
+  string id = 1;
+}
+
+message InspectRemoteImageResponse {
+  // Must contain only one repeated messages field to allow broadcasting InspectRemoteImage requests to multiple machines.
+  repeated RemoteImage messages = 1;
+}
+
+message RemoteImage {
+  Metadata metadata = 1;
+  // Image reference in the canonical form with the digest.
+  string reference = 2;
+  // Raw JSON manifest from the registry.
+  bytes manifest = 3;
+}
+
+message CreateVolumeRequest {
+  // JSON serialised volume.CreateOptions.
+  bytes options = 1;
+}
+
+message CreateVolumeResponse {
+  // JSON serialised volume.Volume.
+  bytes volume = 1;
+}
+
+message ListVolumesRequest {
+  // JSON serialised volume.ListOptions.
+  bytes options = 1;
+}
+
+message ListVolumesResponse {
+  // Must contain only one repeated messages field to allow broadcasting ListVolumes requests to multiple machines.
+  repeated MachineVolumes messages = 1;
+}
+
+message MachineVolumes {
+  Metadata metadata = 1;
+  // JSON serialised volume.ListResponse.
+  bytes response = 2;
+}
+
+message RemoveVolumeRequest {
+  string id = 1;
+  bool force = 2;
+}
+
+message CreateServiceContainerRequest {
+  string service_id = 1;
+  // JSON serialised api.ServiceSpec.
+  bytes service_spec = 2;
+  string container_name = 3;
+}
+
+message ServiceContainer {
+  // JSON serialised container.InspectResponse.
+  bytes container = 1;
+  // JSON serialised api.ServiceSpec.
+  bytes service_spec = 2;
+}
+
+message ListServiceContainersRequest {
+  string service_id = 1;
+  // JSON serialised container.ListOptions.
+  bytes options = 2;
+}
+
+message ListServiceContainersResponse {
+  // Must contain only one repeated messages field to allow broadcasting ListServiceContainers requests
+  // to multiple machines.
+  repeated MachineServiceContainers messages = 1;
+}
+
+message MachineServiceContainers {
+  Metadata metadata = 1;
+  repeated ServiceContainer containers = 2;
+}

internal/machine/api/pb/docker_grpc.pb.go

@@ -20,13 +20,22 @@ import (
 const _ = grpc.SupportPackageIsVersion9
 
 const (
-	Docker_CreateContainer_FullMethodName  = "/api.Docker/CreateContainer"
-	Docker_InspectContainer_FullMethodName = "/api.Docker/InspectContainer"
-	Docker_StartContainer_FullMethodName   = "/api.Docker/StartContainer"
-	Docker_StopContainer_FullMethodName    = "/api.Docker/StopContainer"
-	Docker_ListContainers_FullMethodName   = "/api.Docker/ListContainers"
-	Docker_RemoveContainer_FullMethodName  = "/api.Docker/RemoveContainer"
-	Docker_PullImage_FullMethodName        = "/api.Docker/PullImage"
+	Docker_CreateContainer_FullMethodName         = "/api.Docker/CreateContainer"
+	Docker_InspectContainer_FullMethodName        = "/api.Docker/InspectContainer"
+	Docker_StartContainer_FullMethodName          = "/api.Docker/StartContainer"
+	Docker_StopContainer_FullMethodName           = "/api.Docker/StopContainer"
+	Docker_ListContainers_FullMethodName          = "/api.Docker/ListContainers"
+	Docker_RemoveContainer_FullMethodName         = "/api.Docker/RemoveContainer"
+	Docker_PullImage_FullMethodName               = "/api.Docker/PullImage"
+	Docker_InspectImage_FullMethodName            = "/api.Docker/InspectImage"
+	Docker_InspectRemoteImage_FullMethodName      = "/api.Docker/InspectRemoteImage"
+	Docker_CreateVolume_FullMethodName            = "/api.Docker/CreateVolume"
+	Docker_ListVolumes_FullMethodName             = "/api.Docker/ListVolumes"
+	Docker_RemoveVolume_FullMethodName            = "/api.Docker/RemoveVolume"
+	Docker_CreateServiceContainer_FullMethodName  = "/api.Docker/CreateServiceContainer"
+	Docker_InspectServiceContainer_FullMethodName = "/api.Docker/InspectServiceContainer"
+	Docker_ListServiceContainers_FullMethodName   = "/api.Docker/ListServiceContainers"
+	Docker_RemoveServiceContainer_FullMethodName  = "/api.Docker/RemoveServiceContainer"
 )
 
 // DockerClient is the client API for Docker service.
@@ -40,6 +49,17 @@ type DockerClient interface {
 	ListContainers(ctx context.Context, in *ListContainersRequest, opts ...grpc.CallOption) (*ListContainersResponse, error)
 	RemoveContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	PullImage(ctx context.Context, in *PullImageRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[JSONMessage], error)
+	InspectImage(ctx context.Context, in *InspectImageRequest, opts ...grpc.CallOption) (*InspectImageResponse, error)
+	// InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's
+	// Docker auth credentials if necessary.
+	InspectRemoteImage(ctx context.Context, in *InspectRemoteImageRequest, opts ...grpc.CallOption) (*InspectRemoteImageResponse, error)
+	CreateVolume(ctx context.Context, in *CreateVolumeRequest, opts ...grpc.CallOption) (*CreateVolumeResponse, error)
+	ListVolumes(ctx context.Context, in *ListVolumesRequest, opts ...grpc.CallOption) (*ListVolumesResponse, error)
+	RemoveVolume(ctx context.Context, in *RemoveVolumeRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	CreateServiceContainer(ctx context.Context, in *CreateServiceContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error)
+	InspectServiceContainer(ctx context.Context, in *InspectContainerRequest, opts ...grpc.CallOption) (*ServiceContainer, error)
+	ListServiceContainers(ctx context.Context, in *ListServiceContainersRequest, opts ...grpc.CallOption) (*ListServiceContainersResponse, error)
+	RemoveServiceContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 }
 
 type dockerClient struct {
@@ -129,6 +149,96 @@ func (c *dockerClient) PullImage(ctx context.Context, in *PullImageRequest, opts
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type Docker_PullImageClient = grpc.ServerStreamingClient[JSONMessage]
 
+func (c *dockerClient) InspectImage(ctx context.Context, in *InspectImageRequest, opts ...grpc.CallOption) (*InspectImageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InspectImageResponse)
+	err := c.cc.Invoke(ctx, Docker_InspectImage_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) InspectRemoteImage(ctx context.Context, in *InspectRemoteImageRequest, opts ...grpc.CallOption) (*InspectRemoteImageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InspectRemoteImageResponse)
+	err := c.cc.Invoke(ctx, Docker_InspectRemoteImage_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) CreateVolume(ctx context.Context, in *CreateVolumeRequest, opts ...grpc.CallOption) (*CreateVolumeResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateVolumeResponse)
+	err := c.cc.Invoke(ctx, Docker_CreateVolume_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) ListVolumes(ctx context.Context, in *ListVolumesRequest, opts ...grpc.CallOption) (*ListVolumesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListVolumesResponse)
+	err := c.cc.Invoke(ctx, Docker_ListVolumes_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) RemoveVolume(ctx context.Context, in *RemoveVolumeRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Docker_RemoveVolume_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) CreateServiceContainer(ctx context.Context, in *CreateServiceContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateContainerResponse)
+	err := c.cc.Invoke(ctx, Docker_CreateServiceContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) InspectServiceContainer(ctx context.Context, in *InspectContainerRequest, opts ...grpc.CallOption) (*ServiceContainer, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ServiceContainer)
+	err := c.cc.Invoke(ctx, Docker_InspectServiceContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) ListServiceContainers(ctx context.Context, in *ListServiceContainersRequest, opts ...grpc.CallOption) (*ListServiceContainersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListServiceContainersResponse)
+	err := c.cc.Invoke(ctx, Docker_ListServiceContainers_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) RemoveServiceContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Docker_RemoveServiceContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // DockerServer is the server API for Docker service.
 // All implementations must embed UnimplementedDockerServer
 // for forward compatibility.
@@ -140,6 +250,17 @@ type DockerServer interface {
 	ListContainers(context.Context, *ListContainersRequest) (*ListContainersResponse, error)
 	RemoveContainer(context.Context, *RemoveContainerRequest) (*emptypb.Empty, error)
 	PullImage(*PullImageRequest, grpc.ServerStreamingServer[JSONMessage]) error
+	InspectImage(context.Context, *InspectImageRequest) (*InspectImageResponse, error)
+	// InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's
+	// Docker auth credentials if necessary.
+	InspectRemoteImage(context.Context, *InspectRemoteImageRequest) (*InspectRemoteImageResponse, error)
+	CreateVolume(context.Context, *CreateVolumeRequest) (*CreateVolumeResponse, error)
+	ListVolumes(context.Context, *ListVolumesRequest) (*ListVolumesResponse, error)
+	RemoveVolume(context.Context, *RemoveVolumeRequest) (*emptypb.Empty, error)
+	CreateServiceContainer(context.Context, *CreateServiceContainerRequest) (*CreateContainerResponse, error)
+	InspectServiceContainer(context.Context, *InspectContainerRequest) (*ServiceContainer, error)
+	ListServiceContainers(context.Context, *ListServiceContainersRequest) (*ListServiceContainersResponse, error)
+	RemoveServiceContainer(context.Context, *RemoveContainerRequest) (*emptypb.Empty, error)
 	mustEmbedUnimplementedDockerServer()
 }
 
@@ -171,6 +292,33 @@ func (UnimplementedDockerServer) RemoveContainer(context.Context, *RemoveContain
 func (UnimplementedDockerServer) PullImage(*PullImageRequest, grpc.ServerStreamingServer[JSONMessage]) error {
 	return status.Errorf(codes.Unimplemented, "method PullImage not implemented")
 }
+func (UnimplementedDockerServer) InspectImage(context.Context, *InspectImageRequest) (*InspectImageResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InspectImage not implemented")
+}
+func (UnimplementedDockerServer) InspectRemoteImage(context.Context, *InspectRemoteImageRequest) (*InspectRemoteImageResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InspectRemoteImage not implemented")
+}
+func (UnimplementedDockerServer) CreateVolume(context.Context, *CreateVolumeRequest) (*CreateVolumeResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateVolume not implemented")
+}
+func (UnimplementedDockerServer) ListVolumes(context.Context, *ListVolumesRequest) (*ListVolumesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListVolumes not implemented")
+}
+func (UnimplementedDockerServer) RemoveVolume(context.Context, *RemoveVolumeRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveVolume not implemented")
+}
+func (UnimplementedDockerServer) CreateServiceContainer(context.Context, *CreateServiceContainerRequest) (*CreateContainerResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateServiceContainer not implemented")
+}
+func (UnimplementedDockerServer) InspectServiceContainer(context.Context, *InspectContainerRequest) (*ServiceContainer, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InspectServiceContainer not implemented")
+}
+func (UnimplementedDockerServer) ListServiceContainers(context.Context, *ListServiceContainersRequest) (*ListServiceContainersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListServiceContainers not implemented")
+}
+func (UnimplementedDockerServer) RemoveServiceContainer(context.Context, *RemoveContainerRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveServiceContainer not implemented")
+}
 func (UnimplementedDockerServer) mustEmbedUnimplementedDockerServer() {}
 func (UnimplementedDockerServer) testEmbeddedByValue()                {}
 
@@ -311,6 +459,168 @@ func _Docker_PullImage_Handler(srv interface{}, stream grpc.ServerStream) error
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type Docker_PullImageServer = grpc.ServerStreamingServer[JSONMessage]
 
+func _Docker_InspectImage_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(InspectImageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).InspectImage(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_InspectImage_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).InspectImage(ctx, req.(*InspectImageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_InspectRemoteImage_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(InspectRemoteImageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).InspectRemoteImage(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_InspectRemoteImage_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).InspectRemoteImage(ctx, req.(*InspectRemoteImageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_CreateVolume_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateVolumeRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).CreateVolume(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_CreateVolume_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).CreateVolume(ctx, req.(*CreateVolumeRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_ListVolumes_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListVolumesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).ListVolumes(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_ListVolumes_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).ListVolumes(ctx, req.(*ListVolumesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_RemoveVolume_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveVolumeRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).RemoveVolume(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_RemoveVolume_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).RemoveVolume(ctx, req.(*RemoveVolumeRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_CreateServiceContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateServiceContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).CreateServiceContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_CreateServiceContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).CreateServiceContainer(ctx, req.(*CreateServiceContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_InspectServiceContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(InspectContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).InspectServiceContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_InspectServiceContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).InspectServiceContainer(ctx, req.(*InspectContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_ListServiceContainers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListServiceContainersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).ListServiceContainers(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_ListServiceContainers_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).ListServiceContainers(ctx, req.(*ListServiceContainersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_RemoveServiceContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).RemoveServiceContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_RemoveServiceContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).RemoveServiceContainer(ctx, req.(*RemoveContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // Docker_ServiceDesc is the grpc.ServiceDesc for Docker service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -342,6 +652,42 @@ var Docker_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "RemoveContainer",
 			Handler:    _Docker_RemoveContainer_Handler,
 		},
+		{
+			MethodName: "InspectImage",
+			Handler:    _Docker_InspectImage_Handler,
+		},
+		{
+			MethodName: "InspectRemoteImage",
+			Handler:    _Docker_InspectRemoteImage_Handler,
+		},
+		{
+			MethodName: "CreateVolume",
+			Handler:    _Docker_CreateVolume_Handler,
+		},
+		{
+			MethodName: "ListVolumes",
+			Handler:    _Docker_ListVolumes_Handler,
+		},
+		{
+			MethodName: "RemoveVolume",
+			Handler:    _Docker_RemoveVolume_Handler,
+		},
+		{
+			MethodName: "CreateServiceContainer",
+			Handler:    _Docker_CreateServiceContainer_Handler,
+		},
+		{
+			MethodName: "InspectServiceContainer",
+			Handler:    _Docker_InspectServiceContainer_Handler,
+		},
+		{
+			MethodName: "ListServiceContainers",
+			Handler:    _Docker_ListServiceContainers_Handler,
+		},
+		{
+			MethodName: "RemoveServiceContainer",
+			Handler:    _Docker_RemoveServiceContainer_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
 		{

internal/machine/api/pb/machine.pb.go

@@ -21,6 +21,63 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+type CheckPrerequisitesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Overall status of the checks.
+	Satisfied bool `protobuf:"varint,1,opt,name=satisfied,proto3" json:"satisfied,omitempty"`
+	// Error message if not satisfied (empty if all checks pass).
+	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
+}
+
+func (x *CheckPrerequisitesResponse) Reset() {
+	*x = CheckPrerequisitesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckPrerequisitesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckPrerequisitesResponse) ProtoMessage() {}
+
+func (x *CheckPrerequisitesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckPrerequisitesResponse.ProtoReflect.Descriptor instead.
+func (*CheckPrerequisitesResponse) Descriptor() ([]byte, []int) {
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CheckPrerequisitesResponse) GetSatisfied() bool {
+	if x != nil {
+		return x.Satisfied
+	}
+	return false
+}
+
+func (x *CheckPrerequisitesResponse) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
 type MachineInfo struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -35,7 +92,7 @@ type MachineInfo struct {
 func (x *MachineInfo) Reset() {
 	*x = MachineInfo{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -48,7 +105,7 @@ func (x *MachineInfo) String() string {
 func (*MachineInfo) ProtoMessage() {}
 
 func (x *MachineInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -61,7 +118,7 @@ func (x *MachineInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineInfo.ProtoReflect.Descriptor instead.
 func (*MachineInfo) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{0}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *MachineInfo) GetId() string {
@@ -106,7 +163,7 @@ type NetworkConfig struct {
 func (x *NetworkConfig) Reset() {
 	*x = NetworkConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -119,7 +176,7 @@ func (x *NetworkConfig) String() string {
 func (*NetworkConfig) ProtoMessage() {}
 
 func (x *NetworkConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -132,7 +189,7 @@ func (x *NetworkConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkConfig.ProtoReflect.Descriptor instead.
 func (*NetworkConfig) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{1}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *NetworkConfig) GetSubnet() *IPPrefix {
@@ -180,7 +237,7 @@ type InitClusterRequest struct {
 func (x *InitClusterRequest) Reset() {
 	*x = InitClusterRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -193,7 +250,7 @@ func (x *InitClusterRequest) String() string {
 func (*InitClusterRequest) ProtoMessage() {}
 
 func (x *InitClusterRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -206,7 +263,7 @@ func (x *InitClusterRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InitClusterRequest.ProtoReflect.Descriptor instead.
 func (*InitClusterRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{2}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *InitClusterRequest) GetMachineName() string {
@@ -271,7 +328,7 @@ type InitClusterResponse struct {
 func (x *InitClusterResponse) Reset() {
 	*x = InitClusterResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[3]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -284,7 +341,7 @@ func (x *InitClusterResponse) String() string {
 func (*InitClusterResponse) ProtoMessage() {}
 
 func (x *InitClusterResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[3]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -297,7 +354,7 @@ func (x *InitClusterResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InitClusterResponse.ProtoReflect.Descriptor instead.
 func (*InitClusterResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{3}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *InitClusterResponse) GetMachine() *MachineInfo {
@@ -319,7 +376,7 @@ type JoinClusterRequest struct {
 func (x *JoinClusterRequest) Reset() {
 	*x = JoinClusterRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[4]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -332,7 +389,7 @@ func (x *JoinClusterRequest) String() string {
 func (*JoinClusterRequest) ProtoMessage() {}
 
 func (x *JoinClusterRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[4]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -345,7 +402,7 @@ func (x *JoinClusterRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use JoinClusterRequest.ProtoReflect.Descriptor instead.
 func (*JoinClusterRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{4}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{5}
 }
 
 func (x *JoinClusterRequest) GetMachine() *MachineInfo {
@@ -373,7 +430,7 @@ type TokenResponse struct {
 func (x *TokenResponse) Reset() {
 	*x = TokenResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[5]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -386,7 +443,7 @@ func (x *TokenResponse) String() string {
 func (*TokenResponse) ProtoMessage() {}
 
 func (x *TokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[5]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -399,7 +456,7 @@ func (x *TokenResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TokenResponse.ProtoReflect.Descriptor instead.
 func (*TokenResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{5}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *TokenResponse) GetToken() string {
@@ -423,7 +480,7 @@ type Service struct {
 func (x *Service) Reset() {
 	*x = Service{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[6]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -436,7 +493,7 @@ func (x *Service) String() string {
 func (*Service) ProtoMessage() {}
 
 func (x *Service) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[6]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -449,7 +506,7 @@ func (x *Service) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Service.ProtoReflect.Descriptor instead.
 func (*Service) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{6}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *Service) GetId() string {
@@ -491,7 +548,7 @@ type InspectServiceRequest struct {
 func (x *InspectServiceRequest) Reset() {
 	*x = InspectServiceRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -504,7 +561,7 @@ func (x *InspectServiceRequest) String() string {
 func (*InspectServiceRequest) ProtoMessage() {}
 
 func (x *InspectServiceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -517,7 +574,7 @@ func (x *InspectServiceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InspectServiceRequest.ProtoReflect.Descriptor instead.
 func (*InspectServiceRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{7}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *InspectServiceRequest) GetId() string {
@@ -538,7 +595,7 @@ type InspectServiceResponse struct {
 func (x *InspectServiceResponse) Reset() {
 	*x = InspectServiceResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -551,7 +608,7 @@ func (x *InspectServiceResponse) String() string {
 func (*InspectServiceResponse) ProtoMessage() {}
 
 func (x *InspectServiceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -564,7 +621,7 @@ func (x *InspectServiceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InspectServiceResponse.ProtoReflect.Descriptor instead.
 func (*InspectServiceResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{8}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *InspectServiceResponse) GetService() *Service {
@@ -587,7 +644,7 @@ type Service_Container struct {
 func (x *Service_Container) Reset() {
 	*x = Service_Container{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -600,7 +657,7 @@ func (x *Service_Container) String() string {
 func (*Service_Container) ProtoMessage() {}
 
 func (x *Service_Container) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -613,7 +670,7 @@ func (x *Service_Container) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Service_Container.ProtoReflect.Descriptor instead.
 func (*Service_Container) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{6, 0}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{7, 0}
 }
 
 func (x *Service_Container) GetMachineId() string {
@@ -640,96 +697,106 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x24, 0x69, 0x6e, 0x74, 0x65, 0x72,
 	0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f,
 	0x70, 0x62, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
-	0x85, 0x01, 0x0a, 0x0b, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f,
-	0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-	0x6b, 0x12, 0x24, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x52, 0x08, 0x70,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x22, 0xae, 0x01, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x25, 0x0a, 0x06, 0x73, 0x75, 0x62,
-	0x6e, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x49, 0x50, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x52, 0x06, 0x73, 0x75, 0x62, 0x6e, 0x65, 0x74,
-	0x12, 0x2c, 0x0a, 0x0d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x69,
-	0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50,
-	0x52, 0x0c, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x49, 0x70, 0x12, 0x29,
-	0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x09,
-	0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x75, 0x62,
-	0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x70,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x22, 0xc3, 0x01, 0x0a, 0x12, 0x49, 0x6e, 0x69,
-	0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x20, 0x0a, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4e, 0x61, 0x6d,
-	0x65, 0x12, 0x27, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x72, 0x65, 0x66, 0x69,
-	0x78, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x26, 0x0a, 0x09, 0x70, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x48, 0x00, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63,
-	0x49, 0x70, 0x12, 0x26, 0x0a, 0x0e, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70, 0x5f,
-	0x61, 0x75, 0x74, 0x6f, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x0c, 0x70, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x42, 0x12, 0x0a, 0x10, 0x70, 0x75,
-	0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x41,
-	0x0a, 0x13, 0x49, 0x6e, 0x69, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2a, 0x0a, 0x07, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x07, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e,
-	0x65, 0x22, 0x79, 0x0a, 0x12, 0x4a, 0x6f, 0x69, 0x6e, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2a, 0x0a, 0x07, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x50, 0x0a, 0x1a, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x72, 0x65, 0x72, 0x65, 0x71, 0x75, 0x69,
+	0x73, 0x69, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a,
+	0x09, 0x73, 0x61, 0x74, 0x69, 0x73, 0x66, 0x69, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x09, 0x73, 0x61, 0x74, 0x69, 0x73, 0x66, 0x69, 0x65, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65,
+	0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f,
+	0x72, 0x22, 0x85, 0x01, 0x0a, 0x0b, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66,
+	0x6f, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
+	0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4e, 0x65, 0x74,
+	0x77, 0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77,
+	0x6f, 0x72, 0x6b, 0x12, 0x24, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x52,
+	0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x22, 0xae, 0x01, 0x0a, 0x0d, 0x4e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x25, 0x0a, 0x06, 0x73,
+	0x75, 0x62, 0x6e, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x49, 0x50, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x52, 0x06, 0x73, 0x75, 0x62, 0x6e,
+	0x65, 0x74, 0x12, 0x2c, 0x0a, 0x0d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x5f, 0x69, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x49, 0x50, 0x52, 0x0c, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x49, 0x70,
+	0x12, 0x29, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x6f, 0x72, 0x74,
+	0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x70,
+	0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x22, 0xc3, 0x01, 0x0a, 0x12, 0x49,
+	0x6e, 0x69, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x20, 0x0a, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4e, 0x61, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4e,
+	0x61, 0x6d, 0x65, 0x12, 0x27, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x72, 0x65,
+	0x66, 0x69, 0x78, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x26, 0x0a, 0x09,
+	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x48, 0x00, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c,
+	0x69, 0x63, 0x49, 0x70, 0x12, 0x26, 0x0a, 0x0e, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69,
+	0x70, 0x5f, 0x61, 0x75, 0x74, 0x6f, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x0c,
+	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x41, 0x75, 0x74, 0x6f, 0x42, 0x12, 0x0a, 0x10,
+	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x22, 0x41, 0x0a, 0x13, 0x49, 0x6e, 0x69, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2a, 0x0a, 0x07, 0x6d, 0x61, 0x63, 0x68, 0x69,
 	0x6e, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d,
 	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x07, 0x6d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x12, 0x37, 0x0a, 0x0e, 0x6f, 0x74, 0x68, 0x65, 0x72, 0x5f, 0x6d, 0x61, 0x63,
-	0x68, 0x69, 0x6e, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x0d, 0x6f,
-	0x74, 0x68, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x22, 0x25, 0x0a, 0x0d,
-	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a,
-	0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f,
-	0x6b, 0x65, 0x6e, 0x22, 0xc3, 0x01, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x36, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x74, 0x61,
-	0x69, 0x6e, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69,
-	0x6e, 0x65, 0x72, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x1a,
-	0x48, 0x0a, 0x09, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x1d, 0x0a, 0x0a,
-	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x63,
-	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09,
-	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x22, 0x27, 0x0a, 0x15, 0x49, 0x6e, 0x73,
-	0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
-	0x69, 0x64, 0x22, 0x40, 0x0a, 0x16, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x07,
-	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0c, 0x2e,
-	0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x73, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x32, 0xc0, 0x02, 0x0a, 0x07, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
-	0x12, 0x40, 0x0a, 0x0b, 0x49, 0x6e, 0x69, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12,
-	0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x69, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65,
-	0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49,
-	0x6e, 0x69, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x12, 0x3e, 0x0a, 0x0b, 0x4a, 0x6f, 0x69, 0x6e, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65,
-	0x72, 0x12, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4a, 0x6f, 0x69, 0x6e, 0x43, 0x6c, 0x75, 0x73,
-	0x74, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70,
-	0x74, 0x79, 0x12, 0x33, 0x0a, 0x05, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f,
+	0x69, 0x6e, 0x65, 0x22, 0x79, 0x0a, 0x12, 0x4a, 0x6f, 0x69, 0x6e, 0x43, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2a, 0x0a, 0x07, 0x6d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x07, 0x6d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x37, 0x0a, 0x0e, 0x6f, 0x74, 0x68, 0x65, 0x72, 0x5f, 0x6d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x10, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52,
+	0x0d, 0x6f, 0x74, 0x68, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x22, 0x25,
+	0x0a, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xc3, 0x01, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
+	0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x12, 0x36, 0x0a, 0x0a, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x2e, 0x43, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x65, 0x72, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
+	0x73, 0x1a, 0x48, 0x0a, 0x09, 0x43, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x12, 0x1d,
+	0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x1c, 0x0a,
+	0x09, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x09, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x22, 0x27, 0x0a, 0x15, 0x49,
+	0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x69, 0x64, 0x22, 0x40, 0x0a, 0x16, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26,
+	0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x0c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x32, 0x8f, 0x03, 0x0a, 0x07, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x12, 0x4d, 0x0a, 0x12, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x72, 0x65, 0x72, 0x65,
+	0x71, 0x75, 0x69, 0x73, 0x69, 0x74, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
+	0x1a, 0x1f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x72, 0x65, 0x72,
+	0x65, 0x71, 0x75, 0x69, 0x73, 0x69, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x40, 0x0a, 0x0b, 0x49, 0x6e, 0x69, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x12, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x69, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x49, 0x6e, 0x69, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x3e, 0x0a, 0x0b, 0x4a, 0x6f, 0x69, 0x6e, 0x43, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x12, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4a, 0x6f, 0x69, 0x6e, 0x43, 0x6c, 0x75,
+	0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f,
 	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d,
-	0x70, 0x74, 0x79, 0x1a, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x33, 0x0a, 0x07, 0x49, 0x6e, 0x73, 0x70, 0x65,
-	0x63, 0x74, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x10, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x49, 0x0a, 0x0e,
-	0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x1a,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76,
-	0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69,
-	0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61,
-	0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x70, 0x74, 0x79, 0x12, 0x33, 0x0a, 0x05, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x16, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45,
+	0x6d, 0x70, 0x74, 0x79, 0x1a, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x33, 0x0a, 0x07, 0x49, 0x6e, 0x73, 0x70,
+	0x65, 0x63, 0x74, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x10, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x49, 0x0a,
+	0x0e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12,
+	0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b,
+	0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70,
+	0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -744,48 +811,51 @@ func file_internal_machine_api_pb_machine_proto_rawDescGZIP() []byte {
 	return file_internal_machine_api_pb_machine_proto_rawDescData
 }
 
-var file_internal_machine_api_pb_machine_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_internal_machine_api_pb_machine_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_internal_machine_api_pb_machine_proto_goTypes = []any{
-	(*MachineInfo)(nil),            // 0: api.MachineInfo
-	(*NetworkConfig)(nil),          // 1: api.NetworkConfig
-	(*InitClusterRequest)(nil),     // 2: api.InitClusterRequest
-	(*InitClusterResponse)(nil),    // 3: api.InitClusterResponse
-	(*JoinClusterRequest)(nil),     // 4: api.JoinClusterRequest
-	(*TokenResponse)(nil),          // 5: api.TokenResponse
-	(*Service)(nil),                // 6: api.Service
-	(*InspectServiceRequest)(nil),  // 7: api.InspectServiceRequest
-	(*InspectServiceResponse)(nil), // 8: api.InspectServiceResponse
-	(*Service_Container)(nil),      // 9: api.Service.Container
-	(*IP)(nil),                     // 10: api.IP
-	(*IPPrefix)(nil),               // 11: api.IPPrefix
-	(*IPPort)(nil),                 // 12: api.IPPort
-	(*emptypb.Empty)(nil),          // 13: google.protobuf.Empty
+	(*CheckPrerequisitesResponse)(nil), // 0: api.CheckPrerequisitesResponse
+	(*MachineInfo)(nil),                // 1: api.MachineInfo
+	(*NetworkConfig)(nil),              // 2: api.NetworkConfig
+	(*InitClusterRequest)(nil),         // 3: api.InitClusterRequest
+	(*InitClusterResponse)(nil),        // 4: api.InitClusterResponse
+	(*JoinClusterRequest)(nil),         // 5: api.JoinClusterRequest
+	(*TokenResponse)(nil),              // 6: api.TokenResponse
+	(*Service)(nil),                    // 7: api.Service
+	(*InspectServiceRequest)(nil),      // 8: api.InspectServiceRequest
+	(*InspectServiceResponse)(nil),     // 9: api.InspectServiceResponse
+	(*Service_Container)(nil),          // 10: api.Service.Container
+	(*IP)(nil),                         // 11: api.IP
+	(*IPPrefix)(nil),                   // 12: api.IPPrefix
+	(*IPPort)(nil),                     // 13: api.IPPort
+	(*emptypb.Empty)(nil),              // 14: google.protobuf.Empty
 }
 var file_internal_machine_api_pb_machine_proto_depIdxs = []int32{
-	1,  // 0: api.MachineInfo.network:type_name -> api.NetworkConfig
-	10, // 1: api.MachineInfo.public_ip:type_name -> api.IP
-	11, // 2: api.NetworkConfig.subnet:type_name -> api.IPPrefix
-	10, // 3: api.NetworkConfig.management_ip:type_name -> api.IP
-	12, // 4: api.NetworkConfig.endpoints:type_name -> api.IPPort
-	11, // 5: api.InitClusterRequest.network:type_name -> api.IPPrefix
-	10, // 6: api.InitClusterRequest.public_ip:type_name -> api.IP
-	0,  // 7: api.InitClusterResponse.machine:type_name -> api.MachineInfo
-	0,  // 8: api.JoinClusterRequest.machine:type_name -> api.MachineInfo
-	0,  // 9: api.JoinClusterRequest.other_machines:type_name -> api.MachineInfo
-	9,  // 10: api.Service.containers:type_name -> api.Service.Container
-	6,  // 11: api.InspectServiceResponse.service:type_name -> api.Service
-	2,  // 12: api.Machine.InitCluster:input_type -> api.InitClusterRequest
-	4,  // 13: api.Machine.JoinCluster:input_type -> api.JoinClusterRequest
-	13, // 14: api.Machine.Token:input_type -> google.protobuf.Empty
-	13, // 15: api.Machine.Inspect:input_type -> google.protobuf.Empty
-	7,  // 16: api.Machine.InspectService:input_type -> api.InspectServiceRequest
-	3,  // 17: api.Machine.InitCluster:output_type -> api.InitClusterResponse
-	13, // 18: api.Machine.JoinCluster:output_type -> google.protobuf.Empty
-	5,  // 19: api.Machine.Token:output_type -> api.TokenResponse
-	0,  // 20: api.Machine.Inspect:output_type -> api.MachineInfo
-	8,  // 21: api.Machine.InspectService:output_type -> api.InspectServiceResponse
-	17, // [17:22] is the sub-list for method output_type
-	12, // [12:17] is the sub-list for method input_type
+	2,  // 0: api.MachineInfo.network:type_name -> api.NetworkConfig
+	11, // 1: api.MachineInfo.public_ip:type_name -> api.IP
+	12, // 2: api.NetworkConfig.subnet:type_name -> api.IPPrefix
+	11, // 3: api.NetworkConfig.management_ip:type_name -> api.IP
+	13, // 4: api.NetworkConfig.endpoints:type_name -> api.IPPort
+	12, // 5: api.InitClusterRequest.network:type_name -> api.IPPrefix
+	11, // 6: api.InitClusterRequest.public_ip:type_name -> api.IP
+	1,  // 7: api.InitClusterResponse.machine:type_name -> api.MachineInfo
+	1,  // 8: api.JoinClusterRequest.machine:type_name -> api.MachineInfo
+	1,  // 9: api.JoinClusterRequest.other_machines:type_name -> api.MachineInfo
+	10, // 10: api.Service.containers:type_name -> api.Service.Container
+	7,  // 11: api.InspectServiceResponse.service:type_name -> api.Service
+	14, // 12: api.Machine.CheckPrerequisites:input_type -> google.protobuf.Empty
+	3,  // 13: api.Machine.InitCluster:input_type -> api.InitClusterRequest
+	5,  // 14: api.Machine.JoinCluster:input_type -> api.JoinClusterRequest
+	14, // 15: api.Machine.Token:input_type -> google.protobuf.Empty
+	14, // 16: api.Machine.Inspect:input_type -> google.protobuf.Empty
+	8,  // 17: api.Machine.InspectService:input_type -> api.InspectServiceRequest
+	0,  // 18: api.Machine.CheckPrerequisites:output_type -> api.CheckPrerequisitesResponse
+	4,  // 19: api.Machine.InitCluster:output_type -> api.InitClusterResponse
+	14, // 20: api.Machine.JoinCluster:output_type -> google.protobuf.Empty
+	6,  // 21: api.Machine.Token:output_type -> api.TokenResponse
+	1,  // 22: api.Machine.Inspect:output_type -> api.MachineInfo
+	9,  // 23: api.Machine.InspectService:output_type -> api.InspectServiceResponse
+	18, // [18:24] is the sub-list for method output_type
+	12, // [12:18] is the sub-list for method input_type
 	12, // [12:12] is the sub-list for extension type_name
 	12, // [12:12] is the sub-list for extension extendee
 	0,  // [0:12] is the sub-list for field type_name
@@ -799,7 +869,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 	file_internal_machine_api_pb_common_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_internal_machine_api_pb_machine_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*MachineInfo); i {
+			switch v := v.(*CheckPrerequisitesResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -811,7 +881,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[1].Exporter = func(v any, i int) any {
-			switch v := v.(*NetworkConfig); i {
+			switch v := v.(*MachineInfo); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -823,7 +893,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[2].Exporter = func(v any, i int) any {
-			switch v := v.(*InitClusterRequest); i {
+			switch v := v.(*NetworkConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -835,7 +905,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[3].Exporter = func(v any, i int) any {
-			switch v := v.(*InitClusterResponse); i {
+			switch v := v.(*InitClusterRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -847,7 +917,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[4].Exporter = func(v any, i int) any {
-			switch v := v.(*JoinClusterRequest); i {
+			switch v := v.(*InitClusterResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -859,7 +929,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[5].Exporter = func(v any, i int) any {
-			switch v := v.(*TokenResponse); i {
+			switch v := v.(*JoinClusterRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -871,7 +941,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[6].Exporter = func(v any, i int) any {
-			switch v := v.(*Service); i {
+			switch v := v.(*TokenResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -883,7 +953,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[7].Exporter = func(v any, i int) any {
-			switch v := v.(*InspectServiceRequest); i {
+			switch v := v.(*Service); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -895,7 +965,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[8].Exporter = func(v any, i int) any {
-			switch v := v.(*InspectServiceResponse); i {
+			switch v := v.(*InspectServiceRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -907,6 +977,18 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[9].Exporter = func(v any, i int) any {
+			switch v := v.(*InspectServiceResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_internal_machine_api_pb_machine_proto_msgTypes[10].Exporter = func(v any, i int) any {
 			switch v := v.(*Service_Container); i {
 			case 0:
 				return &v.state
@@ -919,7 +1001,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 	}
-	file_internal_machine_api_pb_machine_proto_msgTypes[2].OneofWrappers = []any{
+	file_internal_machine_api_pb_machine_proto_msgTypes[3].OneofWrappers = []any{
 		(*InitClusterRequest_PublicIp)(nil),
 		(*InitClusterRequest_PublicIpAuto)(nil),
 	}
@@ -929,7 +1011,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_internal_machine_api_pb_machine_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   10,
+			NumMessages:   11,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

internal/machine/api/pb/machine.proto

@@ -8,6 +8,8 @@ import "google/protobuf/empty.proto";
 import "internal/machine/api/pb/common.proto";
 
 service Machine {
+  // CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
+  rpc CheckPrerequisites(google.protobuf.Empty) returns (CheckPrerequisitesResponse);
   rpc InitCluster(InitClusterRequest) returns (InitClusterResponse);
   rpc JoinCluster(JoinClusterRequest) returns (google.protobuf.Empty);
   rpc Token(google.protobuf.Empty) returns (TokenResponse);
@@ -29,6 +31,13 @@ message NetworkConfig {
   bytes public_key = 4;
 }
 
+message CheckPrerequisitesResponse {
+  // Overall status of the checks.
+  bool satisfied = 1;
+  // Error message if not satisfied (empty if all checks pass).
+  string error = 2;
+}
+
 message InitClusterRequest {
   string machineName = 1;
   IPPrefix network = 2;

internal/machine/api/pb/machine_grpc.pb.go

@@ -20,17 +20,19 @@ import (
 const _ = grpc.SupportPackageIsVersion9
 
 const (
-	Machine_InitCluster_FullMethodName    = "/api.Machine/InitCluster"
-	Machine_JoinCluster_FullMethodName    = "/api.Machine/JoinCluster"
-	Machine_Token_FullMethodName          = "/api.Machine/Token"
-	Machine_Inspect_FullMethodName        = "/api.Machine/Inspect"
-	Machine_InspectService_FullMethodName = "/api.Machine/InspectService"
+	Machine_CheckPrerequisites_FullMethodName = "/api.Machine/CheckPrerequisites"
+	Machine_InitCluster_FullMethodName        = "/api.Machine/InitCluster"
+	Machine_JoinCluster_FullMethodName        = "/api.Machine/JoinCluster"
+	Machine_Token_FullMethodName              = "/api.Machine/Token"
+	Machine_Inspect_FullMethodName            = "/api.Machine/Inspect"
+	Machine_InspectService_FullMethodName     = "/api.Machine/InspectService"
 )
 
 // MachineClient is the client API for Machine service.
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type MachineClient interface {
+	CheckPrerequisites(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*CheckPrerequisitesResponse, error)
 	InitCluster(ctx context.Context, in *InitClusterRequest, opts ...grpc.CallOption) (*InitClusterResponse, error)
 	JoinCluster(ctx context.Context, in *JoinClusterRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	Token(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*TokenResponse, error)
@@ -46,6 +48,16 @@ func NewMachineClient(cc grpc.ClientConnInterface) MachineClient {
 	return &machineClient{cc}
 }
 
+func (c *machineClient) CheckPrerequisites(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*CheckPrerequisitesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CheckPrerequisitesResponse)
+	err := c.cc.Invoke(ctx, Machine_CheckPrerequisites_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *machineClient) InitCluster(ctx context.Context, in *InitClusterRequest, opts ...grpc.CallOption) (*InitClusterResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(InitClusterResponse)
@@ -100,6 +112,7 @@ func (c *machineClient) InspectService(ctx context.Context, in *InspectServiceRe
 // All implementations must embed UnimplementedMachineServer
 // for forward compatibility.
 type MachineServer interface {
+	CheckPrerequisites(context.Context, *emptypb.Empty) (*CheckPrerequisitesResponse, error)
 	InitCluster(context.Context, *InitClusterRequest) (*InitClusterResponse, error)
 	JoinCluster(context.Context, *JoinClusterRequest) (*emptypb.Empty, error)
 	Token(context.Context, *emptypb.Empty) (*TokenResponse, error)
@@ -115,6 +128,9 @@ type MachineServer interface {
 // pointer dereference when methods are called.
 type UnimplementedMachineServer struct{}
 
+func (UnimplementedMachineServer) CheckPrerequisites(context.Context, *emptypb.Empty) (*CheckPrerequisitesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CheckPrerequisites not implemented")
+}
 func (UnimplementedMachineServer) InitCluster(context.Context, *InitClusterRequest) (*InitClusterResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method InitCluster not implemented")
 }
@@ -151,6 +167,24 @@ func RegisterMachineServer(s grpc.ServiceRegistrar, srv MachineServer) {
 	s.RegisterService(&Machine_ServiceDesc, srv)
 }
 
+func _Machine_CheckPrerequisites_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).CheckPrerequisites(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_CheckPrerequisites_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).CheckPrerequisites(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Machine_InitCluster_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(InitClusterRequest)
 	if err := dec(in); err != nil {
@@ -248,6 +282,10 @@ var Machine_ServiceDesc = grpc.ServiceDesc{
 	ServiceName: "api.Machine",
 	HandlerType: (*MachineServer)(nil),
 	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "CheckPrerequisites",
+			Handler:    _Machine_CheckPrerequisites_Handler,
+		},
 		{
 			MethodName: "InitCluster",
 			Handler:    _Machine_InitCluster_Handler,

internal/machine/api/proxy/backend.go

@@ -5,7 +5,7 @@ import (
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/proto"
-	"uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
 )
 
 // One2ManyResponder converts upstream responses into messages from upstreams, so that multiple

internal/machine/caddyfile/config.go

@@ -4,53 +4,57 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"github.com/caddyserver/caddy/v2"
-	"github.com/caddyserver/caddy/v2/caddyconfig"
-	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
-	"github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy"
 	"log/slog"
 	"maps"
 	"net"
 	"net/http"
 	"slices"
 	"strconv"
-	"uncloud/internal/api"
-	"uncloud/internal/machine/docker"
+
+	"github.com/caddyserver/caddy/v2"
+	"github.com/caddyserver/caddy/v2/caddyconfig"
+	"github.com/caddyserver/caddy/v2/modules/caddyhttp"
+	"github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy"
+	"github.com/psviderski/uncloud/pkg/api"
 )
 
-func GenerateConfig(containers []api.Container, verifyResponse string) (*caddy.Config, error) {
+func GenerateConfig(containers []api.ServiceContainer, verifyResponse string) (*caddy.Config, error) {
 	// Maps hostnames to lists of upstreams (container IP:port pairs).
 	httpHostUpstreams := make(map[string][]string)
 	httpsHostUpstreams := make(map[string][]string)
 	for _, ctr := range containers {
-		logger := slog.With("container", ctr.ID)
-		network, ok := ctr.NetworkSettings.Networks[docker.NetworkName]
-		if !ok {
-			// Container is not connected to the uncloud Docker network (could be host network).
-			continue
-		}
-		if network.IPAddress == "" {
-			logger.Error("Container has no IPv4 address.")
+		if !ctr.Healthy() {
 			continue
 		}
 
+		ip := ctr.UncloudNetworkIP()
+		if !ip.IsValid() {
+			// Container is not connected to the uncloud Docker network (could be host network).
+			continue
+		}
+		log := slog.With("container", ctr.ID)
+
 		ports, err := ctr.ServicePorts()
 		if err != nil {
-			logger.Error("Failed to parse service ports for container.", "err", err)
+			log.Error("Failed to parse service ports for container.", "err", err)
 			continue
 		}
 
 		for _, port := range ports {
+			if port.Mode != api.PortModeIngress {
+				continue
+			}
+
 			switch port.Protocol {
 			case api.ProtocolHTTP:
-				upstream := net.JoinHostPort(network.IPAddress, strconv.Itoa(int(port.ContainerPort)))
+				upstream := net.JoinHostPort(ip.String(), strconv.Itoa(int(port.ContainerPort)))
 				httpHostUpstreams[port.Hostname] = append(httpHostUpstreams[port.Hostname], upstream)
 			case api.ProtocolHTTPS:
-				upstream := net.JoinHostPort(network.IPAddress, strconv.Itoa(int(port.ContainerPort)))
+				upstream := net.JoinHostPort(ip.String(), strconv.Itoa(int(port.ContainerPort)))
 				httpsHostUpstreams[port.Hostname] = append(httpsHostUpstreams[port.Hostname], upstream)
 			default:
 				// TODO: implement L4 ingress routing for TCP and UDP.
-				logger.Error("Unsupported protocol for ingress port.", "port", port)
+				log.Error("Unsupported protocol for ingress port.", "port", port)
 				continue
 			}
 		}

internal/machine/caddyfile/config_test.go

@@ -1,51 +1,54 @@
 package caddyfile
 
 import (
+	"strings"
+	"testing"
+
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
+	"github.com/psviderski/uncloud/internal/machine/docker"
+	"github.com/psviderski/uncloud/pkg/api"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"strings"
-	"testing"
-	"uncloud/internal/api"
-	"uncloud/internal/machine/docker"
 )
 
 func TestGenerateConfig(t *testing.T) {
+	configWithoutServices := `{
+		"servers": {
+			"http": {
+				"listen": [":80"],
+				"routes": [{
+					"match": [{"path": ["/.uncloud-verify"]}],
+					"handle": [{
+						"body": "verification-response-body",
+						"handler": "static_response",
+						"status_code": 200
+					}]
+				}]
+			},
+			"https": {
+				"listen": [":443"]
+			}
+		}
+	}`
+
 	tests := []struct {
 		name       string
-		containers []api.Container
+		containers []api.ServiceContainer
 		want       string
 		wantErr    bool
 	}{
 		{
 			name:       "empty containers",
-			containers: []api.Container{},
-			want: `{
-                "servers": {
-                    "http": {
-                        "listen": [":80"],
-                        "routes": [{
-                            "match": [{"path": ["/.uncloud-verify"]}],
-                            "handle": [{
-								"body": "verification-response-body",
-								"handler": "static_response",
-								"status_code": 200
-							}]
-                        }]
-                    },
-                    "https": {
-                        "listen": [":443"]
-                    }
-				}
-			}`,
-			wantErr: false,
+			containers: []api.ServiceContainer{},
+			want:       configWithoutServices,
+			wantErr:    false,
 		},
 
 		{
 			name: "HTTP container",
-			containers: []api.Container{
+			containers: []api.ServiceContainer{
 				newContainer("10.210.0.2", "app.example.com:8080/http"),
 			},
 			want: `{
@@ -79,7 +82,7 @@ func TestGenerateConfig(t *testing.T) {
 		},
 		{
 			name: "load balancing multiple containers",
-			containers: []api.Container{
+			containers: []api.ServiceContainer{
 				newContainer("10.210.0.2", "app.example.com:8080/http"),
 				newContainer("10.210.0.3", "app.example.com:8080/http"),
 			},
@@ -117,7 +120,7 @@ func TestGenerateConfig(t *testing.T) {
 		},
 		{
 			name: "HTTPS container",
-			containers: []api.Container{
+			containers: []api.ServiceContainer{
 				newContainer("10.210.0.2", "secure.example.com:8000/https"),
 			},
 			want: `{
@@ -153,7 +156,7 @@ func TestGenerateConfig(t *testing.T) {
 		},
 		{
 			name: "mixed HTTP and HTTPS",
-			containers: []api.Container{
+			containers: []api.ServiceContainer{
 				newContainer("10.210.0.2",
 					"app.example.com:8080/http",
 					"web.example.com:8000/http"),
@@ -227,73 +230,74 @@ func TestGenerateConfig(t *testing.T) {
 		},
 		{
 			name: "container without uncloud network ignored",
-			containers: []api.Container{
+			containers: []api.ServiceContainer{
 				newContainerWithoutNetwork("ignored.example.com:8080/http"),
 			},
-			want: `{
-                "servers": {
-                    "http": {
-                        "listen": [":80"],
-                        "routes": [{
-                            "match": [{"path": ["/.uncloud-verify"]}],
-                            "handle": [{
-                                "body": "verification-response-body",
-                                "handler": "static_response",
-                                "status_code": 200
-                            }]
-                        }]
-                    },
-                    "https": {
-                        "listen": [":443"]
-                    }
-                }
-            }`,
+			want:    configWithoutServices,
 			wantErr: false,
 		},
 		{
 			name: "container with invalid port ignored",
-			containers: []api.Container{
+			containers: []api.ServiceContainer{
 				newContainer("10.210.0.2", "invalid-port"),
 			},
-			want: `{
-                "servers": {
-                    "http": {
-                        "listen": [":80"],
-                        "routes": [{
-                            "match": [{"path": ["/.uncloud-verify"]}],
-                            "handle": [{
-                                "body": "verification-response-body",
-                                "handler": "static_response",
-                                "status_code": 200
-                            }]
-                        }]
-                    },
-                    "https": {
-                        "listen": [":443"]
-                    }
-                }
-            }`,
+			want:    configWithoutServices,
 			wantErr: false,
 		},
 		{
-			name: "containers with unsupported protocols ignored",
-			containers: []api.Container{
+			name: "containers with unsupported protocols and host mode ignored",
+			containers: []api.ServiceContainer{
 				newContainer("10.210.0.2", "5000/tcp"),
 				newContainer("10.210.0.3", "5000/udp"),
 				newContainer("10.210.0.4", "80:8080/tcp@host"),
 			},
+			want:    configWithoutServices,
+			wantErr: false,
+		},
+		{
+			name: "restarting container ignored",
+			containers: []api.ServiceContainer{
+				newRestartingContainer("10.210.0.2", "app.example.com:8080/http"),
+			},
+			want:    configWithoutServices,
+			wantErr: false,
+		},
+		{
+			name: "stopped container ignored",
+			containers: []api.ServiceContainer{
+				newStoppedContainer("10.210.0.2", "app.example.com:8080/http"),
+			},
+			want:    configWithoutServices,
+			wantErr: false,
+		},
+		{
+			name: "mix of running, restarting, and stopped containers",
+			containers: []api.ServiceContainer{
+				newContainer("10.210.0.2", "app.example.com:8080/http"),
+				newRestartingContainer("10.210.0.3", "app.example.com:8080/http"),
+				newStoppedContainer("10.210.0.4", "app.example.com:8080/http"),
+			},
 			want: `{
                 "servers": {
                     "http": {
                         "listen": [":80"],
-                        "routes": [{
-                            "match": [{"path": ["/.uncloud-verify"]}],
-                            "handle": [{
-                                "body": "verification-response-body",
-                                "handler": "static_response",
-                                "status_code": 200
-                            }]
-                        }]
+                        "routes": [
+                            {
+                                "match": [{"host": ["app.example.com"]}],
+                                "handle": [{
+                                    "handler": "reverse_proxy",
+                                    "upstreams": [{"dial": "10.210.0.2:8080"}]
+                                }]
+                            },
+                            {
+                                "match": [{"path": ["/.uncloud-verify"]}],
+                                "handle": [{
+                                    "body": "verification-response-body",
+                                    "handler": "static_response",
+                                    "status_code": 200
+                                }]
+                            }
+                        ]
                     },
                     "https": {
                         "listen": [":443"]
@@ -322,44 +326,60 @@ func TestGenerateConfig(t *testing.T) {
 	}
 }
 
-func newContainer(ip string, ports ...string) api.Container {
+func newContainer(ip string, ports ...string) api.ServiceContainer {
 	portsLabel := strings.Join(ports, ",")
-	return api.Container{
-		ContainerJSON: types.ContainerJSON{
-			ContainerJSONBase: &types.ContainerJSONBase{},
-			NetworkSettings: &types.NetworkSettings{
-				Networks: map[string]*network.EndpointSettings{
-					docker.NetworkName: {
-						IPAddress: ip,
-					},
-				},
+	return api.ServiceContainer{Container: api.Container{ContainerJSON: types.ContainerJSON{
+		ContainerJSONBase: &types.ContainerJSONBase{
+			State: &types.ContainerState{
+				Running: true,
 			},
-			Config: &container.Config{
-				Labels: map[string]string{
-					api.LabelServicePorts: portsLabel,
+		},
+		NetworkSettings: &types.NetworkSettings{
+			Networks: map[string]*network.EndpointSettings{
+				docker.NetworkName: {
+					IPAddress: ip,
 				},
 			},
 		},
-	}
+		Config: &container.Config{
+			Labels: map[string]string{
+				api.LabelServicePorts: portsLabel,
+			},
+		},
+	}}}
 }
 
-func newContainerWithoutNetwork(ports ...string) api.Container {
+func newContainerWithoutNetwork(ports ...string) api.ServiceContainer {
 	portsLabel := strings.Join(ports, ",")
-	return api.Container{
-		ContainerJSON: types.ContainerJSON{
-			ContainerJSONBase: &types.ContainerJSONBase{},
-			NetworkSettings: &types.NetworkSettings{
-				Networks: map[string]*network.EndpointSettings{
-					"other-network": {
-						IPAddress: "172.17.0.2",
-					},
-				},
+	return api.ServiceContainer{Container: api.Container{ContainerJSON: types.ContainerJSON{
+		ContainerJSONBase: &types.ContainerJSONBase{
+			State: &types.ContainerState{
+				Running: true,
 			},
-			Config: &container.Config{
-				Labels: map[string]string{
-					api.LabelServicePorts: portsLabel,
+		},
+		NetworkSettings: &types.NetworkSettings{
+			Networks: map[string]*network.EndpointSettings{
+				"other-network": {
+					IPAddress: "172.17.0.2",
 				},
 			},
 		},
-	}
+		Config: &container.Config{
+			Labels: map[string]string{
+				api.LabelServicePorts: portsLabel,
+			},
+		},
+	}}}
+}
+
+func newRestartingContainer(ip string, ports ...string) api.ServiceContainer {
+	ctr := newContainer(ip, ports...)
+	ctr.Container.State.Restarting = true
+	return ctr
+}
+
+func newStoppedContainer(ip string, ports ...string) api.ServiceContainer {
+	ctr := newContainer(ip, ports...)
+	ctr.Container.State.Running = false
+	return ctr
 }

internal/machine/caddyfile/controller.go

@@ -7,9 +7,10 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
-	"uncloud/internal/api"
-	"uncloud/internal/fs"
-	"uncloud/internal/machine/store"
+
+	"github.com/psviderski/uncloud/internal/fs"
+	"github.com/psviderski/uncloud/internal/machine/store"
+	"github.com/psviderski/uncloud/pkg/api"
 )
 
 const (
@@ -89,15 +90,20 @@ func (c *Controller) Run(ctx context.Context) error {
 // filterAvailableContainers filters out containers from this machine that are likely unavailable. The availability
 // is determined by the cluster membership state of the machine that the container is running on.
 // TODO: implement machine membership check using Corrossion Admin client.
-func (c *Controller) filterAvailableContainers(containerRecords []store.ContainerRecord) ([]api.Container, error) {
-	containers := make([]api.Container, len(containerRecords))
+func (c *Controller) filterAvailableContainers(
+	containerRecords []store.ContainerRecord,
+) ([]api.ServiceContainer, error) {
+	containers := make([]api.ServiceContainer, len(containerRecords))
 	for i, cr := range containerRecords {
-		containers[i] = cr.Container
+		containers[i] = api.ServiceContainer{
+			Container: cr.Container,
+			// TODO: restore ServiceSpec from the container record once it's saved in the store.
+		}
 	}
 	return containers, nil
 }
 
-func (c *Controller) generateConfig(containers []api.Container) error {
+func (c *Controller) generateConfig(containers []api.ServiceContainer) error {
 	config, err := GenerateConfig(containers, c.verifyResponse)
 	if err != nil {
 		return err

internal/machine/cluster/cluster.go

@@ -11,11 +11,11 @@ import (
 	"log/slog"
 	"net/netip"
 	"time"
-	"uncloud/internal/corrosion"
-	"uncloud/internal/machine/api/pb"
-	"uncloud/internal/machine/network"
-	"uncloud/internal/machine/store"
-	"uncloud/internal/secret"
+	"github.com/psviderski/uncloud/internal/corrosion"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/internal/machine/network"
+	"github.com/psviderski/uncloud/internal/machine/store"
+	"github.com/psviderski/uncloud/internal/secret"
 )
 
 type Cluster struct {

internal/machine/cluster/dns.go

@@ -4,12 +4,12 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"github.com/psviderski/uncloud/internal/dns"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/internal/machine/store"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
-	"uncloud/internal/dns"
-	"uncloud/internal/machine/api/pb"
-	"uncloud/internal/machine/store"
 )
 
 // uncloudDNSKey is the key used to store the details of the reserved domain in the store.

internal/machine/cluster/machine.go

@@ -2,7 +2,7 @@ package cluster
 
 import (
 	"fmt"
-	"uncloud/internal/secret"
+	"github.com/psviderski/uncloud/internal/secret"
 )
 
 // NewMachineID generates a new unique machine ID.

internal/machine/corroservice/config.go

@@ -7,7 +7,7 @@ import (
 	"net/netip"
 	"os"
 	"path/filepath"
-	"uncloud/internal/fs"
+	"github.com/psviderski/uncloud/internal/fs"
 )
 
 const (

internal/machine/db.go

@@ -0,0 +1,51 @@
+package machine
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/jmoiron/sqlx"
+	_ "modernc.org/sqlite"
+)
+
+const DBFileName = "machine.db"
+
+// NewDB creates a new connection to machine SQLite database and runs schema migrations if necessary.
+func NewDB(path string) (*sqlx.DB, error) {
+	// Create the database file with 0600 permissions if it doesn't exist, or update permissions if exists.
+	if _, err := os.Stat(path); os.IsNotExist(err) {
+		file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0600)
+		if err != nil {
+			return nil, fmt.Errorf("create SQLite database '%s': %w", path, err)
+		}
+		file.Close()
+	} else {
+		if err = os.Chmod(path, 0600); err != nil {
+			return nil, fmt.Errorf("update SQLite database permissions '%s': %w", path, err)
+		}
+	}
+
+	// - Write-Ahead Logging (WAL) mode for better read/write performance.
+	// - Busy timeout (5s) to make concurrent writes wait on each other instead of failing immediately.
+	conn := path + "?_pragma=journal_mode=WAL&_pragma=synchronous=NORMAL&_pragma=busy_timeout=5000&_time_format=sqlite"
+	db, err := sqlx.Connect("sqlite", conn)
+	if err != nil {
+		return nil, fmt.Errorf("connect to SQLite database '%s': %w", conn, err)
+	}
+
+	schema := `
+	CREATE TABLE IF NOT EXISTS containers (
+	    id TEXT NOT NULL PRIMARY KEY,
+	    service_spec TEXT NOT NULL CHECK (json_valid(service_spec)),
+	    -- 'subsecond' modifier is used to store timestamps with millisecond precision.
+	    created_at TIMESTAMP NOT NULL DEFAULT (datetime('subsecond')),
+	    updated_at TIMESTAMP NOT NULL DEFAULT (datetime('subsecond'))
+	);
+    `
+
+	if _, err = db.Exec(schema); err != nil {
+		return nil, fmt.Errorf("create schema: %w", err)
+	}
+
+	return db, nil
+}

internal/machine/dns/resolver.go

@@ -0,0 +1,126 @@
+package dns
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"net/netip"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/psviderski/uncloud/internal/machine/store"
+	"github.com/psviderski/uncloud/pkg/api"
+)
+
+// ClusterResolver implements Resolver by tracking containers in the cluster and resolving service names
+// to their IP addresses.
+type ClusterResolver struct {
+	store *store.Store
+	// serviceIPs maps service names to container IPs.
+	serviceIPs map[string][]netip.Addr
+	// mu protects the serviceIPs map.
+	mu sync.RWMutex
+	// lastUpdate tracks when records were last updated.
+	lastUpdate time.Time
+	log        *slog.Logger
+}
+
+// NewClusterResolver creates a new cluster resolver using the cluster store.
+func NewClusterResolver(store *store.Store) *ClusterResolver {
+	return &ClusterResolver{
+		store:      store,
+		serviceIPs: make(map[string][]netip.Addr),
+		log:        slog.With("component", "dns-resolver"),
+	}
+}
+
+// Run starts watching for container changes and updates DNS records accordingly.
+func (r *ClusterResolver) Run(ctx context.Context) error {
+	containers, changes, err := r.store.SubscribeContainers(ctx)
+	if err != nil {
+		return fmt.Errorf("subscribe to container changes: %w", err)
+	}
+	r.log.Info("Subscribed to container changes in the cluster to keep DNS records updated.")
+
+	// TODO: implement machine membership check using Corrossion Admin client to filter available containers.
+	r.updateServiceIPs(containers)
+
+	for {
+		select {
+		case _, ok := <-changes:
+			if !ok {
+				return fmt.Errorf("containers subscription failed")
+			}
+			r.log.Debug("Cluster containers changed, updating DNS records.")
+
+			containers, err = r.store.ListContainers(ctx, store.ListOptions{})
+			if err != nil {
+				r.log.Error("Failed to list containers.", "err", err)
+				continue
+			}
+
+			// TODO: implement machine membership check using Corrossion Admin client to filter available containers.
+			r.updateServiceIPs(containers)
+		case <-ctx.Done():
+			return nil
+		}
+	}
+}
+
+// updateServiceIPs processes container records and updates the serviceIPs map.
+func (r *ClusterResolver) updateServiceIPs(containers []store.ContainerRecord) {
+	newServiceIPs := make(map[string][]netip.Addr, len(r.serviceIPs))
+
+	containersCount := 0
+	for _, record := range containers {
+		if !record.Container.Healthy() {
+			continue
+		}
+
+		ip := record.Container.UncloudNetworkIP()
+		if !ip.IsValid() {
+			// Container is not connected to the uncloud Docker network (could be host network).
+			continue
+		}
+
+		ctr := api.ServiceContainer{Container: record.Container}
+		if ctr.ServiceID() == "" || ctr.ServiceName() == "" {
+			// Container is not part of a service, skip it.
+			continue
+		}
+
+		// TODO: remove normalisation after implementing service name validation:
+		//.https://github.com/psviderski/uncloud/issues/53
+		serviceName := strings.ToLower(ctr.ServiceName())
+
+		newServiceIPs[serviceName] = append(newServiceIPs[serviceName], ip)
+		// Also add the service ID as a valid lookup.
+		newServiceIPs[ctr.ServiceID()] = append(newServiceIPs[ctr.ServiceID()], ip)
+		containersCount++
+	}
+
+	// Update the serviceIPs map atomically.
+	r.mu.Lock()
+	r.serviceIPs = newServiceIPs
+	r.mu.Unlock()
+
+	r.log.Debug("DNS records updated.", "services", len(newServiceIPs)/2, "containers", containersCount)
+}
+
+// Resolve returns IP addresses of the service containers.
+func (r *ClusterResolver) Resolve(serviceName string) []netip.Addr {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+
+	ips, ok := r.serviceIPs[serviceName]
+	if !ok || len(ips) == 0 {
+		return nil
+	}
+
+	// Return a copy of the IPs slice to prevent modification of the original.
+	ipsCopy := make([]netip.Addr, len(ips))
+	copy(ipsCopy, ips)
+
+	return ipsCopy
+}

internal/machine/dns/server.go

@@ -0,0 +1,342 @@
+package dns
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"math/rand/v2"
+	"net"
+	"net/netip"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+const (
+	// InternalDomain is the cluster internal domain for service discovery. All DNS queries ending with this suffix
+	// will be resolved using the internal DNS server.
+	InternalDomain = "internal."
+	// Port is the standard DNS port.
+	Port = 53
+	// maxConcurrentForwards is the maximum number of concurrent forwarded queries to upstream DNS servers.
+	// 1024 is the default used by the Docker internal DNS server.
+	maxConcurrentForwards = 1024
+	// forwardingTimeout is the timeout for forwarding a DNS query to an upstream server.
+	forwardingTimeout = 3 * time.Second
+)
+
+// Resolver is an interface for resolving service names to IP addresses.
+type Resolver interface {
+	// Resolve returns a list of IP addresses of the service containers.
+	// An empty list is returned if no service is found.
+	Resolve(serviceName string) []netip.Addr
+}
+
+// Server is an embedded internal DNS server for service discovery and forwarding external queries
+// to upstream DNS servers.
+type Server struct {
+	listenAddr      netip.Addr
+	resolver        Resolver
+	upstreamServers []netip.AddrPort
+
+	udpServer        *dns.Server
+	tcpServer        *dns.Server
+	inProgressReqs   sync.WaitGroup
+	forwardSemaphore chan struct{}
+	log              *slog.Logger
+}
+
+// NewServer creates a new DNS server with the given configuration.
+// If upstreams is nil, nameservers from /etc/resolv.conf will be used. An empty upstreams list means to only resolve
+// internal DNS queries and not forward any external queries.
+func NewServer(listenAddr netip.Addr, resolver Resolver, upstreams []netip.AddrPort) (*Server, error) {
+	if !listenAddr.IsValid() {
+		return nil, fmt.Errorf("invalid listen address: %s", listenAddr)
+	}
+	if resolver == nil {
+		return nil, fmt.Errorf("resolver must be provided")
+	}
+
+	// Load upstreams from /etc/resolv.conf and set fallback servers only if upstreams is not provided.
+	if upstreams == nil {
+		if nameservers, err := parseNameserversFromResolvConf(); err != nil {
+			slog.Warn("Failed to parse nameservers from /etc/resolv.conf.", "err", err)
+		} else {
+			for _, ns := range nameservers {
+				if ns.Compare(listenAddr) == 0 {
+					// Skip this internal DNS server address if it has been configured in /etc/resolv.conf
+					// to not create a forwarding loop.
+					continue
+				}
+				upstreams = append(upstreams, netip.AddrPortFrom(ns, Port))
+			}
+		}
+
+		// Fallback to common public DNS servers if no nameservers were found in /etc/resolv.conf.
+		if upstreams == nil {
+			upstreams = []netip.AddrPort{
+				netip.AddrPortFrom(netip.MustParseAddr("1.1.1.1"), Port), // Cloudflare DNS
+				netip.AddrPortFrom(netip.MustParseAddr("8.8.8.8"), Port), // Google DNS
+			}
+		}
+	}
+
+	return &Server{
+		listenAddr:       listenAddr,
+		resolver:         resolver,
+		upstreamServers:  upstreams,
+		forwardSemaphore: make(chan struct{}, maxConcurrentForwards),
+		log:              slog.With("component", "dns-server"),
+	}, nil
+}
+
+// Run starts the DNS server listening on both UDP and TCP ports. The server on TCP is not critical so it won't return
+// an error if it fails to start. The server will run until the context is canceled or an error occurs.
+func (s *Server) Run(ctx context.Context) error {
+	addr := net.JoinHostPort(s.listenAddr.String(), strconv.Itoa(Port))
+	s.udpServer = &dns.Server{
+		Addr:    addr,
+		Net:     "udp",
+		Handler: dns.HandlerFunc(s.handleRequest),
+	}
+	s.tcpServer = &dns.Server{
+		Addr:    addr,
+		Net:     "tcp",
+		Handler: dns.HandlerFunc(s.handleRequest),
+	}
+
+	errCh := make(chan error, 1) // Buffer size 1 is for UDP server error only.
+
+	go func() {
+		s.log.Info("Starting DNS server on UDP port.", "addr", addr, "upstreams", s.upstreamServers)
+		if err := s.udpServer.ListenAndServe(); err != nil {
+			errCh <- fmt.Errorf("listen and serve on %s/udp: %w", addr, err)
+		}
+	}()
+
+	go func() {
+		s.log.Info("Starting DNS server on TCP port.", "addr", addr, "upstreams", s.upstreamServers)
+		if err := s.tcpServer.ListenAndServe(); err != nil {
+			// TCP server is not critical, so log the error and continue.
+			slog.Warn("Failed to listen and serve DNS server on TCP port. "+
+				"TCP server is not critical and will be ignored.", "addr", addr, "err", err)
+		}
+	}()
+
+	select {
+	case err := <-errCh:
+		// Stop the servers if the UDP one fails.
+		s.stop()
+		return err
+	case <-ctx.Done():
+		s.log.Info("Stopping DNS server.")
+		return s.stop()
+	}
+}
+
+// stop gracefully shuts down the DNS server.
+func (s *Server) stop() error {
+	var udpErr, tcpErr error
+
+	if s.udpServer != nil {
+		udpErr = s.udpServer.Shutdown()
+	}
+	if s.tcpServer != nil {
+		tcpErr = s.tcpServer.Shutdown()
+	}
+
+	// Wait for all in-progress requests to finish.
+	s.inProgressReqs.Wait()
+
+	if udpErr != nil {
+		return fmt.Errorf("shutdown DNS server (UDP): %w", udpErr)
+	}
+
+	if tcpErr != nil {
+		return fmt.Errorf("shutdown DNS server (TCP): %w", tcpErr)
+	}
+
+	return nil
+}
+
+// handleRequest processes a DNS query and returns an appropriate response.
+func (s *Server) handleRequest(w dns.ResponseWriter, req *dns.Msg) {
+	s.inProgressReqs.Add(1)
+	defer s.inProgressReqs.Done()
+
+	if len(req.Question) == 0 {
+		resp := new(dns.Msg).SetRcode(req, dns.RcodeFormatError)
+		s.reply(w, req, resp)
+		return
+	}
+
+	// While the original DNS RFCs allow multiple questions, in practice it never works. So handle only the first one.
+	q := req.Question[0]
+	log := s.log.With("name", q.Name, "type", dns.TypeToString[q.Qtype])
+	log.Debug("Received DNS query.")
+
+	if !dns.IsSubDomain(InternalDomain, dns.CanonicalName(q.Name)) {
+		log.Debug("Forwarding non-internal DNS query to upstream DNS servers.")
+
+		// Use the same transport for the forwarded request as the original request.
+		resp, err := s.forwardRequest(req, w.LocalAddr().Network())
+		if err != nil {
+			log.Error("Failed to forward DNS query.", "err", err)
+			resp = new(dns.Msg).SetRcode(req, dns.RcodeServerFailure)
+		}
+
+		s.reply(w, req, resp)
+		return
+	}
+
+	// Handle the query for the internal domain.
+	resp := new(dns.Msg).SetReply(req)
+	resp.Authoritative = true
+	resp.RecursionAvailable = true
+
+	switch q.Qtype {
+	case dns.TypeA:
+		records := s.handleAQuery(q.Name)
+		if len(records) > 0 {
+			log.Debug("Found A records for internal DNS query.", "count", len(records))
+			resp.Answer = append(resp.Answer, records...)
+		} else {
+			log.Debug("No records found for internal DNS query.")
+			resp.SetRcode(req, dns.RcodeNameError)
+		}
+		// TODO: Handle other query types (SRV, TXT, etc.) as needed.
+	}
+
+	// Truncate the response if it exceeds the maximum size for the transport protocol.
+	maxSize := dns.MinMsgSize
+	if w.LocalAddr().Network() == "tcp" {
+		maxSize = dns.MaxMsgSize
+	} else {
+		// Retrieve the UDP buffer size from the EDNS0 record if present.
+		if opt := req.IsEdns0(); opt != nil {
+			if udpSize := int(opt.UDPSize()); udpSize > maxSize {
+				maxSize = udpSize
+			}
+		}
+	}
+	resp.Truncate(maxSize)
+
+	s.reply(w, req, resp)
+}
+
+func (s *Server) reply(w dns.ResponseWriter, req *dns.Msg, resp *dns.Msg) error {
+	if err := w.WriteMsg(resp); err != nil {
+		s.log.Error("Failed to write DNS response.", "err", err, "msg", resp)
+		// It may fail due to a malformed response message, e.g. exceeding the maximum size. In that case,
+		// attempt to send a server failure response instead so the client doesn't have to wait for a timeout.
+		if resp.Rcode != dns.RcodeServerFailure {
+			resp = new(dns.Msg).SetRcode(req, dns.RcodeServerFailure)
+			if err2 := w.WriteMsg(resp); err2 != nil {
+				s.log.Error("Failed to write DNS error response.", "err", err2, "msg", resp)
+			}
+		}
+		return err
+	}
+	return nil
+}
+
+// forwardRequest forwards a DNS query to system DNS servers
+func (s *Server) forwardRequest(req *dns.Msg, proto string) (*dns.Msg, error) {
+	if len(s.upstreamServers) == 0 {
+		return nil, errors.New("no upstream DNS servers configured")
+	}
+
+	// Apply concurrency control for forwarded queries.
+	select {
+	case s.forwardSemaphore <- struct{}{}:
+		defer func() {
+			<-s.forwardSemaphore
+		}()
+	default:
+		return nil, fmt.Errorf("too many concurrent forwarded queries (max: %d)", maxConcurrentForwards)
+	}
+
+	// Create DNS client with timeout and same transport as original request
+	client := &dns.Client{
+		Net:     proto,
+		Timeout: forwardingTimeout,
+	}
+
+	var lastErr error
+	for _, server := range s.upstreamServers {
+		resp, _, err := client.Exchange(req, server.String())
+		if err == nil {
+			return resp, nil
+		}
+		lastErr = err
+		s.log.Debug("Failed to forward DNS query to upstream server.", "server", server, "err", err)
+	}
+
+	return nil, lastErr
+}
+
+// handleAQuery processes an A query for the internal domain and returns A records for the requested name.
+// The internal domain suffix is already stripped from the name. An empty list is returned if no records are found.
+func (s *Server) handleAQuery(name string) []dns.RR {
+	serviceName := trimInternalDomain(name)
+	ips := s.resolver.Resolve(serviceName)
+	if len(ips) == 0 {
+		s.log.Debug("Failed to resolve service name.", "service", serviceName)
+		return nil
+	}
+	s.log.Debug("Resolved service name.", "service", serviceName, "ips", ips)
+
+	if len(ips) > 1 {
+		// TODO: sort by proximity to the requesting container/machine. For now, just shuffle the IPs.
+		rand.Shuffle(len(ips), func(i, j int) {
+			ips[i], ips[j] = ips[j], ips[i]
+		})
+	}
+
+	// Create A records for each IP.
+	records := make([]dns.RR, 0, len(ips))
+	for _, ip := range ips {
+		records = append(records, &dns.A{
+			Hdr: dns.RR_Header{
+				Name:   name,
+				Rrtype: dns.TypeA,
+				Class:  dns.ClassINET,
+				// TODO: should we increate the TTL to some reasonably small value like 5-30 seconds to allow
+				//  at least some caching?
+				Ttl: 0,
+			},
+			A: net.ParseIP(ip.String()),
+		})
+	}
+	return records
+}
+
+// parseNameserversFromResolvConf parses the nameservers from /etc/resolv.conf.
+func parseNameserversFromResolvConf() ([]netip.Addr, error) {
+	config, err := dns.ClientConfigFromFile("/etc/resolv.conf")
+	if err != nil {
+		return nil, err
+	}
+
+	var servers []netip.Addr
+	for _, server := range config.Servers {
+		if addr, err := netip.ParseAddr(server); err == nil {
+			servers = append(servers, addr)
+		}
+	}
+
+	return servers, nil
+}
+
+func trimInternalDomain(name string) string {
+	name = dns.CanonicalName(name)
+	if !dns.IsSubDomain(InternalDomain, name) {
+		return name
+	}
+
+	return strings.TrimSuffix(name, "."+InternalDomain)
+}

internal/machine/docker/client.go

@@ -3,18 +3,24 @@ package docker
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
+
+	"github.com/distribution/reference"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/volume"
 	"github.com/docker/docker/errdefs"
 	"github.com/docker/docker/pkg/jsonmessage"
+	regtypes "github.com/google/go-containerregistry/pkg/v1/types"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/pkg/api"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
-	"io"
-	"uncloud/internal/machine/api/pb"
 )
 
 // Client is a gRPC client for the Docker service that provides a similar interface to the Docker HTTP client.
@@ -72,10 +78,8 @@ func (c *Client) CreateContainer(
 		Name:          name,
 	})
 	if err != nil {
-		if s, ok := status.FromError(err); ok {
-			if s.Code() == codes.NotFound {
-				return resp, errdefs.NotFound(err)
-			}
+		if status.Convert(err).Code() == codes.NotFound {
+			return resp, errdefs.NotFound(err)
 		}
 		return resp, err
 	}
@@ -92,10 +96,8 @@ func (c *Client) InspectContainer(ctx context.Context, id string) (types.Contain
 
 	grpcResp, err := c.grpcClient.InspectContainer(ctx, &pb.InspectContainerRequest{Id: id})
 	if err != nil {
-		if s, ok := status.FromError(err); ok {
-			if s.Code() == codes.NotFound {
-				return resp, errdefs.NotFound(err)
-			}
+		if status.Convert(err).Code() == codes.NotFound {
+			return resp, errdefs.NotFound(err)
 		}
 		return resp, err
 	}
@@ -118,10 +120,8 @@ func (c *Client) StartContainer(ctx context.Context, id string, opts container.S
 		Options: optsBytes,
 	})
 	if err != nil {
-		if s, ok := status.FromError(err); ok {
-			if s.Code() == codes.NotFound {
-				return errdefs.NotFound(err)
-			}
+		if status.Convert(err).Code() == codes.NotFound {
+			return errdefs.NotFound(err)
 		}
 	}
 	return err
@@ -139,10 +139,8 @@ func (c *Client) StopContainer(ctx context.Context, id string, opts container.St
 		Options: optsBytes,
 	})
 	if err != nil {
-		if s, ok := status.FromError(err); ok {
-			if s.Code() == codes.NotFound {
-				return errdefs.NotFound(err)
-			}
+		if status.Convert(err).Code() == codes.NotFound {
+			return errdefs.NotFound(err)
 		}
 	}
 	return err
@@ -191,10 +189,8 @@ func (c *Client) RemoveContainer(ctx context.Context, id string, opts container.
 		Options: optsBytes,
 	})
 	if err != nil {
-		if s, ok := status.FromError(err); ok {
-			if s.Code() == codes.NotFound {
-				return errdefs.NotFound(err)
-			}
+		if status.Convert(err).Code() == codes.NotFound {
+			return errdefs.NotFound(err)
 		}
 	}
 	return err
@@ -237,3 +233,297 @@ func (c *Client) PullImage(ctx context.Context, image string) (<-chan PullImageM
 
 	return ch, nil
 }
+
+// InspectImage returns the image information for the given image ID. The request may be sent to multiple machines.
+func (c *Client) InspectImage(ctx context.Context, id string) ([]api.MachineImage, error) {
+	resp, err := c.grpcClient.InspectImage(ctx, &pb.InspectImageRequest{Id: id})
+	if err != nil {
+		// If the request was sent to only one machine, err is an actual error from the machine.
+		if status.Convert(err).Code() == codes.NotFound {
+			return nil, errdefs.NotFound(err)
+		}
+		return nil, err
+	}
+
+	notFoundCount := 0
+	for _, msg := range resp.Messages {
+		if msg.Metadata != nil && msg.Metadata.Status != nil && codes.Code(msg.Metadata.Status.Code) == codes.NotFound {
+			notFoundCount++
+		}
+	}
+	if len(resp.Messages) == notFoundCount {
+		return nil, errdefs.NotFound(fmt.Errorf("image not found: %s", id))
+	}
+
+	images := make([]api.MachineImage, len(resp.Messages))
+	for i, msg := range resp.Messages {
+		images[i].Metadata = msg.Metadata
+		if msg.Metadata != nil && msg.Metadata.Error != "" {
+			continue
+		}
+
+		if err = json.Unmarshal(msg.Image, &images[i].Image); err != nil {
+			return nil, fmt.Errorf("unmarshal image: %w", err)
+		}
+	}
+
+	return images, nil
+}
+
+// InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's Docker auth
+// credentials if necessary. If the response from a machine doesn't contain an error, the api.RemoteImage will either
+// contain an IndexManifest or an ImageManifest.
+func (c *Client) InspectRemoteImage(ctx context.Context, id string) ([]api.MachineRemoteImage, error) {
+	resp, err := c.grpcClient.InspectRemoteImage(ctx, &pb.InspectRemoteImageRequest{Id: id})
+	if err != nil {
+		return nil, err
+	}
+
+	images := make([]api.MachineRemoteImage, 0, len(resp.Messages))
+	var parseErr error
+	for _, msg := range resp.Messages {
+		mri, err := parseRemoteImageMessage(msg)
+		if err != nil {
+			parseErr = errors.Join(parseErr, err)
+			continue
+		}
+		images = append(images, mri)
+	}
+
+	return images, parseErr
+}
+
+type manifestMediaType struct {
+	MediaType regtypes.MediaType `json:"mediaType"`
+}
+
+func parseRemoteImageMessage(msg *pb.RemoteImage) (api.MachineRemoteImage, error) {
+	mri := api.MachineRemoteImage{
+		Metadata: msg.Metadata,
+	}
+	if msg.Metadata != nil && msg.Metadata.Error != "" {
+		return mri, nil
+	}
+
+	ref, err := reference.ParseNormalizedNamed(msg.Reference)
+	if err != nil {
+		// The reference is the string representation of a valid canonical reference from the server which
+		// is expected to be parseable.
+		return mri, fmt.Errorf("parse reference: %w", err)
+	}
+	if canonicalRef, ok := ref.(reference.Canonical); ok {
+		mri.Image.Reference = canonicalRef
+	} else {
+		return mri, fmt.Errorf("unexpected non-canonical image reference: %s", msg.Reference)
+	}
+
+	manifest := manifestMediaType{}
+	if err = json.Unmarshal(msg.Manifest, &manifest); err != nil {
+		return mri, fmt.Errorf("unmarshal manifest: %w", err)
+	}
+
+	switch {
+	case manifest.MediaType.IsIndex():
+		index := &ocispec.Index{}
+		if err = json.Unmarshal(msg.Manifest, index); err != nil {
+			return mri, fmt.Errorf("unmarshal index manifest: %w", err)
+		}
+		mri.Image.IndexManifest = index
+	case manifest.MediaType.IsImage():
+		image := &ocispec.Manifest{}
+		if err = json.Unmarshal(msg.Manifest, image); err != nil {
+			return mri, fmt.Errorf("unmarshal image manifest: %w", err)
+		}
+		mri.Image.ImageManifest = image
+	default:
+		return mri, fmt.Errorf("unexpected manifest media type: %s", manifest.MediaType)
+	}
+
+	return mri, nil
+}
+
+// CreateVolume creates a new volume with the given options.
+func (c *Client) CreateVolume(ctx context.Context, opts volume.CreateOptions) (volume.Volume, error) {
+	var vol volume.Volume
+
+	optsBytes, err := json.Marshal(opts)
+	if err != nil {
+		return vol, fmt.Errorf("marshal options: %w", err)
+	}
+
+	resp, err := c.grpcClient.CreateVolume(ctx, &pb.CreateVolumeRequest{Options: optsBytes})
+	if err != nil {
+		return vol, err
+	}
+
+	if err = json.Unmarshal(resp.Volume, &vol); err != nil {
+		return vol, fmt.Errorf("unmarshal volume: %w", err)
+	}
+
+	return vol, nil
+}
+
+// MachineVolumes represents a volume list response from a machine.
+type MachineVolumes struct {
+	Metadata *pb.Metadata
+	Response volume.ListResponse
+}
+
+// ListVolumes returns a list of all volumes matching the filter.
+func (c *Client) ListVolumes(ctx context.Context, opts volume.ListOptions) ([]MachineVolumes, error) {
+	optsBytes, err := json.Marshal(opts)
+	if err != nil {
+		return nil, fmt.Errorf("marshal options: %w", err)
+	}
+
+	resp, err := c.grpcClient.ListVolumes(ctx, &pb.ListVolumesRequest{Options: optsBytes})
+	if err != nil {
+		return nil, err
+	}
+
+	machineVolumes := make([]MachineVolumes, len(resp.Messages))
+	for i, msg := range resp.Messages {
+		machineVolumes[i].Metadata = msg.Metadata
+		if msg.Metadata != nil && msg.Metadata.Error != "" {
+			continue
+		}
+
+		if err = json.Unmarshal(msg.Response, &machineVolumes[i].Response); err != nil {
+			return nil, fmt.Errorf("unmarshal response: %w", err)
+		}
+	}
+
+	return machineVolumes, nil
+}
+
+// RemoveVolume removes a volume with the given ID.
+func (c *Client) RemoveVolume(ctx context.Context, id string, force bool) error {
+	_, err := c.grpcClient.RemoveVolume(ctx, &pb.RemoveVolumeRequest{
+		Id:    id,
+		Force: force,
+	})
+	if err != nil {
+		if status.Convert(err).Code() == codes.NotFound {
+			return errdefs.NotFound(err)
+		}
+	}
+
+	return err
+}
+
+// CreateServiceContainer creates a new container for the service with the given specifications.
+func (c *Client) CreateServiceContainer(
+	ctx context.Context, serviceID string, spec api.ServiceSpec, containerName string,
+) (container.CreateResponse, error) {
+	var resp container.CreateResponse
+
+	specBytes, err := json.Marshal(spec)
+	if err != nil {
+		return resp, fmt.Errorf("marshal service spec: %w", err)
+	}
+	grpcResp, err := c.grpcClient.CreateServiceContainer(ctx, &pb.CreateServiceContainerRequest{
+		ServiceId:     serviceID,
+		ServiceSpec:   specBytes,
+		ContainerName: containerName,
+	})
+	if err != nil {
+		if status.Convert(err).Code() == codes.NotFound {
+			return resp, errdefs.NotFound(err)
+		}
+		return resp, err
+	}
+
+	if err = json.Unmarshal(grpcResp.Response, &resp); err != nil {
+		return resp, fmt.Errorf("unmarshal gRPC response: %w", err)
+	}
+	return resp, nil
+}
+
+// InspectServiceContainer returns the container information and service specification that was used to create the
+// container with the given ID.
+func (c *Client) InspectServiceContainer(ctx context.Context, id string) (api.ServiceContainer, error) {
+	var resp api.ServiceContainer
+
+	grpcResp, err := c.grpcClient.InspectServiceContainer(ctx, &pb.InspectContainerRequest{Id: id})
+	if err != nil {
+		if status.Convert(err).Code() == codes.NotFound {
+			return resp, errdefs.NotFound(err)
+		}
+		return resp, err
+	}
+
+	if err = json.Unmarshal(grpcResp.Container, &resp.Container); err != nil {
+		return resp, fmt.Errorf("unmarshal container: %w", err)
+	}
+	if err = json.Unmarshal(grpcResp.ServiceSpec, &resp.ServiceSpec); err != nil {
+		return resp, fmt.Errorf("unmarshal service spec: %w", err)
+	}
+
+	return resp, nil
+}
+
+type MachineServiceContainers struct {
+	Metadata   *pb.Metadata
+	Containers []api.ServiceContainer
+}
+
+// ListServiceContainers returns all containers on requested machines that belong to the service with the given
+// name or ID. If serviceNameOrID is empty, all service containers are returned.
+func (c *Client) ListServiceContainers(
+	ctx context.Context, serviceNameOrID string, opts container.ListOptions,
+) ([]MachineServiceContainers, error) {
+	optsBytes, err := json.Marshal(opts)
+	if err != nil {
+		return nil, fmt.Errorf("marshal options: %w", err)
+	}
+
+	resp, err := c.grpcClient.ListServiceContainers(ctx, &pb.ListServiceContainersRequest{
+		ServiceId: serviceNameOrID,
+		Options:   optsBytes,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	machineContainers := make([]MachineServiceContainers, len(resp.Messages))
+	for i, msg := range resp.Messages {
+		machineContainers[i].Metadata = msg.Metadata
+		if msg.Metadata != nil && msg.Metadata.Error != "" {
+			continue
+		}
+
+		containers := make([]api.ServiceContainer, len(msg.Containers))
+		for j, sc := range msg.Containers {
+			if err = json.Unmarshal(sc.Container, &containers[j].Container); err != nil {
+				return nil, fmt.Errorf("unmarshal container: %w", err)
+			}
+			if err = json.Unmarshal(sc.ServiceSpec, &containers[j].ServiceSpec); err != nil {
+				return nil, fmt.Errorf("unmarshal service spec: %w", err)
+			}
+		}
+
+		machineContainers[i].Containers = containers
+	}
+
+	return machineContainers, nil
+}
+
+// RemoveServiceContainer stops (kills after grace period) and removes a service container with the given ID.
+// A service container is a container that has been created with CreateServiceContainer.
+func (c *Client) RemoveServiceContainer(ctx context.Context, id string, opts container.RemoveOptions) error {
+	optsBytes, err := json.Marshal(opts)
+	if err != nil {
+		return fmt.Errorf("marshal options: %w", err)
+	}
+
+	_, err = c.grpcClient.RemoveServiceContainer(ctx, &pb.RemoveContainerRequest{
+		Id:      id,
+		Options: optsBytes,
+	})
+	if err != nil {
+		if status.Convert(err).Code() == codes.NotFound {
+			return errdefs.NotFound(err)
+		}
+	}
+	return err
+}

internal/machine/docker/manager.go

@@ -8,10 +8,10 @@ import (
 	"github.com/docker/docker/api/types/events"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/client"
+	"github.com/psviderski/uncloud/internal/machine/store"
+	"github.com/psviderski/uncloud/pkg/api"
 	"log/slog"
 	"time"
-	"uncloud/internal/api"
-	"uncloud/internal/machine/store"
 )
 
 const (

internal/machine/docker/manager_linux.go

@@ -8,7 +8,7 @@ import (
 	"github.com/docker/docker/libnetwork/iptables"
 	"log/slog"
 	"net/netip"
-	"uncloud/internal/machine/network"
+	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
 // EnsureUncloudNetwork creates the Docker bridge network NetworkName with the provided machine subnet

internal/machine/docker/server.go

@@ -2,32 +2,63 @@ package docker
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/netip"
+	"regexp"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/distribution/reference"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/volume"
 	"github.com/docker/docker/client"
+	"github.com/docker/go-connections/nat"
+	"github.com/google/go-containerregistry/pkg/authn"
+	"github.com/google/go-containerregistry/pkg/name"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/jmoiron/sqlx"
+	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/internal/machine/dns"
+	"github.com/psviderski/uncloud/internal/secret"
+	"github.com/psviderski/uncloud/pkg/api"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
-	"io"
-	"uncloud/internal/machine/api/pb"
 )
 
+var fullDockerIDRegex = regexp.MustCompile(`^[a-f0-9]{64}$`)
+
 // Server implements the gRPC Docker service that proxies requests to the Docker daemon.
 type Server struct {
 	pb.UnimplementedDockerServer
 	client *client.Client
+	db     *sqlx.DB
+	// internalDNSIP is a function that returns the IP address of the internal DNS server. It may return an empty
+	// address if the address is unknown (e.g. when the machine is not initialised yet).
+	internalDNSIP func() netip.Addr
 }
 
 // NewServer creates a new Docker gRPC server with the provided Docker client.
-func NewServer(cli *client.Client) *Server {
-	return &Server{client: cli}
+func NewServer(cli *client.Client, db *sqlx.DB, internalDNSIP func() netip.Addr) *Server {
+	return &Server{
+		client:        cli,
+		db:            db,
+		internalDNSIP: internalDNSIP,
+	}
 }
 
 // CreateContainer creates a new container based on the given configuration.
@@ -149,13 +180,17 @@ func (s *Server) ListContainers(ctx context.Context, req *pb.ListContainersReque
 	if err != nil {
 		return nil, status.Errorf(codes.Internal, err.Error())
 	}
-	containers := make([]types.ContainerJSON, len(containerSummaries))
-	for i, cs := range containerSummaries {
+	containers := make([]types.ContainerJSON, 0, len(containerSummaries))
+	for _, cs := range containerSummaries {
 		c, err := s.client.ContainerInspect(ctx, cs.ID)
 		if err != nil {
+			if client.IsErrNotFound(err) {
+				// The listed container may have been removed while we were inspecting other containers.
+				continue
+			}
 			return nil, status.Errorf(codes.Internal, "inspect container %s: %v", cs.ID, err)
 		}
-		containers[i] = c
+		containers = append(containers, c)
 	}
 
 	containersBytes, err := json.Marshal(containers)
@@ -239,3 +274,540 @@ func (s *Server) PullImage(req *pb.PullImageRequest, stream grpc.ServerStreaming
 		}
 	}
 }
+
+// InspectImage returns the image information for the given image ID.
+func (s *Server) InspectImage(ctx context.Context, req *pb.InspectImageRequest) (*pb.InspectImageResponse, error) {
+	resp, _, err := s.client.ImageInspectWithRaw(ctx, req.Id)
+	if err != nil {
+		if client.IsErrNotFound(err) {
+			return nil, status.Errorf(codes.NotFound, err.Error())
+		}
+		return nil, status.Errorf(codes.Internal, err.Error())
+	}
+
+	respBytes, err := json.Marshal(resp)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "marshal response: %v", err)
+	}
+
+	return &pb.InspectImageResponse{
+		Messages: []*pb.Image{
+			{
+				Image: respBytes,
+			},
+		},
+	}, nil
+}
+
+// InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's Docker auth
+// credentials if necessary.
+func (s *Server) InspectRemoteImage(
+	_ context.Context, req *pb.InspectRemoteImageRequest,
+) (*pb.InspectRemoteImageResponse, error) {
+	ref, err := name.ParseReference(req.Id)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "parse image: %v", err)
+	}
+
+	desc, err := remote.Get(ref, remote.WithAuthFromKeychain(authn.DefaultKeychain))
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "fetch image manifest: %v", err)
+	}
+
+	namedRef, err := reference.ParseNormalizedNamed(ref.String())
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "parse image: %v", err)
+	}
+
+	var canonicalRef reference.Canonical
+	if _, ok := namedRef.(reference.Canonical); ok {
+		canonicalRef = namedRef.(reference.Canonical)
+	} else {
+		if canonicalRef, err = reference.WithDigest(namedRef, digest.Digest(desc.Digest.String())); err != nil {
+			return nil, status.Errorf(codes.Internal, "add digest to image: %v", err)
+		}
+	}
+
+	return &pb.InspectRemoteImageResponse{
+		Messages: []*pb.RemoteImage{
+			{
+				Reference: reference.FamiliarString(canonicalRef),
+				Manifest:  desc.Manifest,
+			},
+		},
+	}, nil
+}
+
+// CreateVolume creates a new volume with the given options.
+func (s *Server) CreateVolume(ctx context.Context, req *pb.CreateVolumeRequest) (*pb.CreateVolumeResponse, error) {
+	var opts volume.CreateOptions
+	if err := json.Unmarshal(req.Options, &opts); err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "unmarshal options: %v", err)
+	}
+
+	vol, err := s.client.VolumeCreate(ctx, opts)
+	if err != nil {
+		return nil, status.Error(codes.Internal, err.Error())
+	}
+
+	volBytes, err := json.Marshal(vol)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "marshal volume: %v", err)
+	}
+
+	return &pb.CreateVolumeResponse{Volume: volBytes}, nil
+}
+
+// ListVolumes returns a list of all volumes matching the filter.
+func (s *Server) ListVolumes(ctx context.Context, req *pb.ListVolumesRequest) (*pb.ListVolumesResponse, error) {
+	var opts volume.ListOptions
+	if len(req.Options) > 0 {
+		if err := json.Unmarshal(req.Options, &opts); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "unmarshal options: %v", err)
+		}
+
+		// Handle filters separately because they implement custom JSON unmarshalling.
+		var raw map[string]json.RawMessage
+		if err := json.Unmarshal(req.Options, &raw); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "unmarshal options to raw map: %v", err)
+		}
+
+		if filtersBytes, ok := raw["Filters"]; ok {
+			args, err := filters.FromJSON(string(filtersBytes))
+			if err != nil {
+				return nil, status.Errorf(codes.InvalidArgument, "unmarshal filters: %v", err)
+			}
+			opts.Filters = args
+		}
+	}
+
+	resp, err := s.client.VolumeList(ctx, opts)
+	if err != nil {
+		return nil, status.Error(codes.Internal, err.Error())
+	}
+
+	respBytes, err := json.Marshal(resp)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "marshal response: %v", err)
+	}
+
+	return &pb.ListVolumesResponse{
+		Messages: []*pb.MachineVolumes{
+			{
+				Response: respBytes,
+			},
+		},
+	}, nil
+}
+
+// RemoveVolume removes a volume with the given ID.
+func (s *Server) RemoveVolume(ctx context.Context, req *pb.RemoveVolumeRequest) (*emptypb.Empty, error) {
+	if err := s.client.VolumeRemove(ctx, req.Id, req.Force); err != nil {
+		if client.IsErrNotFound(err) {
+			return nil, status.Error(codes.NotFound, err.Error())
+		}
+		return nil, status.Error(codes.Internal, err.Error())
+	}
+
+	return &emptypb.Empty{}, nil
+}
+
+// CreateServiceContainer creates a new container for the service with the given specifications.
+func (s *Server) CreateServiceContainer(
+	ctx context.Context, req *pb.CreateServiceContainerRequest,
+) (*pb.CreateContainerResponse, error) {
+	if !api.ValidateServiceID(req.ServiceId) {
+		return nil, status.Errorf(codes.InvalidArgument, "invalid service ID: '%s'", req.ServiceId)
+	}
+
+	var spec api.ServiceSpec
+	if err := json.Unmarshal(req.ServiceSpec, &spec); err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "unmarshal service spec: %v", err)
+	}
+	spec = spec.SetDefaults()
+	if err := spec.Validate(); err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "invalid service spec: %v", err)
+	}
+
+	containerName := req.ContainerName
+	if containerName == "" {
+		suffix, err := secret.RandomAlphaNumeric(4)
+		if err != nil {
+			return nil, fmt.Errorf("generate random suffix: %w", err)
+		}
+		containerName = fmt.Sprintf("%s-%s", spec.Name, suffix)
+	}
+
+	config := &container.Config{
+		Cmd:        spec.Container.Command,
+		Env:        spec.Container.Env.ToSlice(),
+		Entrypoint: spec.Container.Entrypoint,
+		Hostname:   containerName,
+		Image:      spec.Container.Image,
+		Labels: map[string]string{
+			api.LabelServiceID:   req.ServiceId,
+			api.LabelServiceName: spec.Name,
+			api.LabelServiceMode: spec.Mode,
+			api.LabelManaged:     "",
+		},
+		User: spec.Container.User,
+	}
+	if spec.Mode == "" {
+		config.Labels[api.LabelServiceMode] = api.ServiceModeReplicated
+	}
+
+	// TODO: do not set the ports as container labels once migrated to retrieve them from the spec in DB.
+	var err error
+	if len(spec.Ports) > 0 {
+		encodedPorts := make([]string, len(spec.Ports))
+		for i, p := range spec.Ports {
+			encodedPorts[i], err = p.String()
+			if err != nil {
+				return nil, fmt.Errorf("encode service port spec: %w", err)
+			}
+		}
+
+		config.Labels[api.LabelServicePorts] = strings.Join(encodedPorts, ",")
+	}
+
+	mounts, err := ToDockerMounts(spec.Volumes, spec.Container.VolumeMounts)
+	if err != nil {
+		return nil, err
+	}
+	if err = s.verifyDockerVolumesExist(ctx, mounts); err != nil {
+		return nil, err
+	}
+
+	portBindings := make(nat.PortMap)
+	for _, p := range spec.Ports {
+		if p.Mode != api.PortModeHost {
+			continue
+		}
+		port := nat.Port(fmt.Sprintf("%d/%s", p.ContainerPort, p.Protocol))
+		portBindings[port] = []nat.PortBinding{
+			{
+				HostPort: strconv.Itoa(int(p.PublishedPort)),
+			},
+		}
+		if p.HostIP.IsValid() {
+			portBindings[port][0].HostIP = p.HostIP.String()
+		}
+	}
+	hostConfig := &container.HostConfig{
+		Binds:        spec.Container.Volumes,
+		Init:         spec.Container.Init,
+		Mounts:       mounts,
+		PortBindings: portBindings,
+		Privileged:   spec.Container.Privileged,
+		Resources: container.Resources{
+			NanoCPUs:          spec.Container.Resources.CPU,
+			Memory:            spec.Container.Resources.Memory,
+			MemoryReservation: spec.Container.Resources.MemoryReservation,
+		},
+		// Always restart service containers if they exit or a machine restarts.
+		// For one-off containers and batch jobs we plan to use a different service type/mode.
+		RestartPolicy: container.RestartPolicy{
+			Name: container.RestartPolicyAlways,
+		},
+	}
+
+	// Configure the container to use the internal DNS server if it's available.
+	dnsIP := s.internalDNSIP()
+	if dnsIP.IsValid() {
+		hostConfig.DNS = []string{dnsIP.String()}
+		// Optimize DNS resolution for service discovery by appending the search domain to names without a dot.
+		// For example, the first attempt for "my-service" will be "my-service.internal".
+		hostConfig.DNSOptions = []string{"ndots:1"}
+		hostConfig.DNSSearch = []string{dns.InternalDomain}
+	}
+
+	if spec.Container.LogDriver != nil {
+		hostConfig.LogConfig = container.LogConfig{
+			Type:   spec.Container.LogDriver.Name,
+			Config: spec.Container.LogDriver.Options,
+		}
+	}
+
+	networkConfig := &network.NetworkingConfig{
+		EndpointsConfig: map[string]*network.EndpointSettings{
+			NetworkName: {},
+		},
+	}
+
+	resp, err := s.client.ContainerCreate(ctx, config, hostConfig, networkConfig, nil, containerName)
+	if err != nil {
+		if client.IsErrNotFound(err) {
+			return nil, status.Error(codes.NotFound, err.Error())
+		}
+		return nil, status.Error(codes.Internal, err.Error())
+	}
+
+	respBytes, err := json.Marshal(resp)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "marshal response: %v", err)
+	}
+
+	// Store the container spec in the database or remove the container with its anonymous volumes if storing fails.
+	removeContainer := func() {
+		_ = s.client.ContainerRemove(ctx, resp.ID, container.RemoveOptions{RemoveVolumes: true})
+	}
+
+	specBytes, err := json.Marshal(spec)
+	if err != nil {
+		removeContainer()
+		return nil, status.Errorf(codes.Internal, "marshal service spec: %v", err)
+	}
+
+	if _, err = s.db.ExecContext(ctx, `INSERT INTO containers (id, service_spec) VALUES ($1, $2)`,
+		resp.ID, string(specBytes)); err != nil {
+		removeContainer()
+		return nil, status.Errorf(codes.Internal, "store container in database: %v", err)
+	}
+
+	return &pb.CreateContainerResponse{Response: respBytes}, nil
+}
+
+func ToDockerMounts(volumes []api.VolumeSpec, mounts []api.VolumeMount) ([]mount.Mount, error) {
+	normalisedVolumes := make([]api.VolumeSpec, len(volumes))
+	for i, v := range volumes {
+		normalisedVolumes[i] = v.SetDefaults()
+	}
+
+	dockerMounts := make([]mount.Mount, 0, len(mounts))
+	for _, m := range mounts {
+		idx := slices.IndexFunc(normalisedVolumes, func(v api.VolumeSpec) bool {
+			return v.Name == m.VolumeName
+		})
+		if idx == -1 {
+			return nil, fmt.Errorf("volume mount references a volume that doesn't exist in the volumes spec: '%s'",
+				m.VolumeName)
+		}
+
+		vol := normalisedVolumes[idx]
+		if err := vol.Validate(); err != nil {
+			return nil, fmt.Errorf("invalid volume: %w", err)
+		}
+
+		dm := mount.Mount{
+			Type:     mount.Type(vol.Type),
+			Target:   m.ContainerPath,
+			ReadOnly: m.ReadOnly,
+		}
+
+		switch vol.Type {
+		case api.VolumeTypeBind:
+			dm.Source = vol.BindOptions.HostPath
+			dm.BindOptions = toDockerBindOptions(vol.BindOptions)
+		case api.VolumeTypeVolume:
+			dm.Source = vol.DockerVolumeName()
+			dm.VolumeOptions = &mount.VolumeOptions{
+				NoCopy:       vol.VolumeOptions.NoCopy,
+				Labels:       vol.VolumeOptions.Labels,
+				Subpath:      vol.VolumeOptions.SubPath,
+				DriverConfig: vol.VolumeOptions.Driver,
+			}
+		case api.VolumeTypeTmpfs:
+			dm.TmpfsOptions = vol.TmpfsOptions
+		default:
+			return nil, fmt.Errorf("unsupported volume type: '%s'", vol.Type)
+		}
+
+		dockerMounts = append(dockerMounts, dm)
+	}
+
+	return dockerMounts, nil
+}
+
+func toDockerBindOptions(opts *api.BindOptions) *mount.BindOptions {
+	if opts == nil {
+		return nil
+	}
+
+	dockerOpts := &mount.BindOptions{
+		Propagation:      opts.Propagation,
+		CreateMountpoint: opts.CreateHostPath,
+	}
+
+	switch opts.Recursive {
+	case "disabled":
+		dockerOpts.NonRecursive = true
+	case "writable":
+		dockerOpts.ReadOnlyNonRecursive = true
+	case "readonly":
+		dockerOpts.ReadOnlyForceRecursive = true
+	}
+
+	return dockerOpts
+}
+
+// verifyDockerVolumesExist checks if the Docker named volumes referenced in the mounts exist on the machine.
+func (s *Server) verifyDockerVolumesExist(ctx context.Context, mounts []mount.Mount) error {
+	for _, m := range mounts {
+		if m.Type != mount.TypeVolume {
+			continue
+		}
+
+		// TODO: non-local volume drivers should likely be handled differently (needs proper investigation).
+		if _, err := s.client.VolumeInspect(ctx, m.Source); err != nil {
+			if client.IsErrNotFound(err) {
+				return status.Errorf(codes.NotFound, "volume '%s' not found", m.Source)
+			}
+			return status.Errorf(codes.Internal, "inspect volume '%s': %v", m.Source, err.Error())
+		}
+		// TODO: check if the volume driver and options are the same as in the mount and fail if not.
+		//  Should we even ignore driver-specific options in the volume spec for externally managed volumes?
+		//  Instead, just inspect the existing volume and construct the mount from it.
+	}
+
+	return nil
+}
+
+// InspectServiceContainer returns the container information and service specification that was used to create the
+// container with the given ID.
+func (s *Server) InspectServiceContainer(
+	ctx context.Context, req *pb.InspectContainerRequest,
+) (*pb.ServiceContainer, error) {
+	ctr, err := s.client.ContainerInspect(ctx, req.Id)
+	if err != nil {
+		if client.IsErrNotFound(err) {
+			return nil, status.Errorf(codes.NotFound, err.Error())
+		}
+		return nil, status.Errorf(codes.Internal, err.Error())
+	}
+
+	ctrBytes, err := json.Marshal(ctr)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "marshal response: %v", err)
+	}
+
+	var specBytes []byte
+	err = s.db.QueryRowContext(ctx, `SELECT service_spec FROM containers WHERE id = $1`, ctr.ID).Scan(&specBytes)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, status.Errorf(codes.NotFound, "service spec not found for container: '%s'", ctr.ID)
+		}
+		return nil, status.Errorf(codes.Internal, "get service spec for container '%s' from machine database: %v",
+			ctr.ID, err)
+	}
+
+	return &pb.ServiceContainer{
+		Container:   ctrBytes,
+		ServiceSpec: specBytes,
+	}, nil
+}
+
+// ListServiceContainers returns all containers that belong to the service with the given name or ID.
+// If req.ServiceId is empty, all service containers are returned.
+func (s *Server) ListServiceContainers(
+	ctx context.Context, req *pb.ListServiceContainersRequest,
+) (*pb.ListServiceContainersResponse, error) {
+	var opts container.ListOptions
+	if len(req.Options) > 0 {
+		if err := json.Unmarshal(req.Options, &opts); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "unmarshal options: %v", err)
+		}
+
+		// Handle filters separately because they implement custom JSON unmarshalling.
+		var raw map[string]json.RawMessage
+		if err := json.Unmarshal(req.Options, &raw); err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "unmarshal options to raw map: %v", err)
+		}
+
+		if filtersBytes, ok := raw["Filters"]; ok {
+			args, err := filters.FromJSON(string(filtersBytes))
+			if err != nil {
+				return nil, status.Errorf(codes.InvalidArgument, "unmarshal filters: %v", err)
+			}
+			opts.Filters = args
+		} else {
+			opts.Filters = filters.NewArgs()
+		}
+	}
+	// Only uncloud-managed containers that belong to some service.
+	opts.Filters.Add("label", api.LabelServiceID)
+	opts.Filters.Add("label", api.LabelManaged)
+
+	containerSummaries, err := s.client.ContainerList(ctx, opts)
+	if err != nil {
+		return nil, status.Error(codes.Internal, err.Error())
+	}
+
+	containers := make([]*pb.ServiceContainer, 0, len(containerSummaries))
+	for _, cs := range containerSummaries {
+		if req.ServiceId != "" &&
+			cs.Labels[api.LabelServiceID] != req.ServiceId && cs.Labels[api.LabelServiceName] != req.ServiceId {
+			continue
+		}
+
+		ctr, err := s.client.ContainerInspect(ctx, cs.ID)
+		if err != nil {
+			if client.IsErrNotFound(err) {
+				// The listed container may have been removed while we were inspecting other containers.
+				continue
+			}
+			return nil, status.Errorf(codes.Internal, "inspect container %s: %v", cs.ID, err)
+		}
+		ctrBytes, err := json.Marshal(ctr)
+		if err != nil {
+			return nil, status.Errorf(codes.Internal, "marshal container: %v", err)
+		}
+
+		var specBytes []byte
+		err = s.db.QueryRowContext(ctx, `SELECT service_spec FROM containers WHERE id = $1`, ctr.ID).Scan(&specBytes)
+		if err != nil {
+			if errors.Is(err, sql.ErrNoRows) {
+				// If this happens, there is a bug in the code, or someone manually removed the container from the DB,
+				// or created a managed container out of band.
+				slog.Error("Service container not found in machine database.", "id", ctr.ID)
+				// Just ignore such a container to not fail the list operation as it's not easily recoverable.
+				continue
+			}
+			return nil, status.Errorf(codes.Internal, "get service spec for container '%s' from machine database: %v",
+				ctr.ID, err)
+		}
+
+		containers = append(containers, &pb.ServiceContainer{
+			Container:   ctrBytes,
+			ServiceSpec: specBytes,
+		})
+	}
+
+	return &pb.ListServiceContainersResponse{
+		Messages: []*pb.MachineServiceContainers{
+			{
+				Containers: containers,
+			},
+		},
+	}, nil
+}
+
+// RemoveServiceContainer stops (kills after grace period) and removes a service container with the given ID.
+// The difference between this method and RemoveContainer is that it also removes the container from the machine
+// database.
+func (s *Server) RemoveServiceContainer(ctx context.Context, req *pb.RemoveContainerRequest) (*emptypb.Empty, error) {
+	ctrID := req.Id
+	// If the ID is not a full Docker ID, inspect the container to get its full ID.
+	if !fullDockerIDRegex.MatchString(req.Id) {
+		ctr, err := s.client.ContainerInspect(ctx, req.Id)
+		if err != nil {
+			if client.IsErrNotFound(err) {
+				return nil, status.Error(codes.NotFound, err.Error())
+			}
+			return nil, status.Error(codes.Internal, err.Error())
+		}
+		ctrID = ctr.ID
+	}
+
+	resp, err := s.RemoveContainer(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+
+	if _, err = s.db.ExecContext(ctx, `DELETE FROM containers WHERE id = $1`, ctrID); err != nil {
+		slog.Error("Failed to remove container from machine database.", "err", err, "id", ctrID)
+		// Do not return an error because the container has already been removed from the Docker daemon.
+		// The orphaned db record will be ignored and eventually cleaned up by the garbage collector.
+	}
+
+	return resp, nil
+}

internal/machine/machine.go

@@ -5,14 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"github.com/docker/docker/client"
-	"github.com/docker/go-connections/sockets"
-	"github.com/siderolabs/grpc-proxy/proxy"
-	"golang.org/x/sync/errgroup"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/types/known/emptypb"
 	"log/slog"
 	"net"
 	"net/netip"
@@ -21,17 +13,28 @@ import (
 	"path/filepath"
 	"slices"
 	"strconv"
-	"uncloud/internal/corrosion"
-	"uncloud/internal/docker"
-	"uncloud/internal/fs"
-	"uncloud/internal/machine/api/pb"
-	apiproxy "uncloud/internal/machine/api/proxy"
-	"uncloud/internal/machine/caddyfile"
-	"uncloud/internal/machine/cluster"
-	"uncloud/internal/machine/corroservice"
-	machinedocker "uncloud/internal/machine/docker"
-	"uncloud/internal/machine/network"
-	"uncloud/internal/machine/store"
+
+	"github.com/docker/docker/client"
+	"github.com/docker/go-connections/sockets"
+	"github.com/psviderski/uncloud/internal/corrosion"
+	"github.com/psviderski/uncloud/internal/docker"
+	"github.com/psviderski/uncloud/internal/fs"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	apiproxy "github.com/psviderski/uncloud/internal/machine/api/proxy"
+	"github.com/psviderski/uncloud/internal/machine/caddyfile"
+	"github.com/psviderski/uncloud/internal/machine/cluster"
+	"github.com/psviderski/uncloud/internal/machine/corroservice"
+	"github.com/psviderski/uncloud/internal/machine/dns"
+	machinedocker "github.com/psviderski/uncloud/internal/machine/docker"
+	"github.com/psviderski/uncloud/internal/machine/network"
+	"github.com/psviderski/uncloud/internal/machine/store"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/siderolabs/grpc-proxy/proxy"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
 )
 
 const (
@@ -57,9 +60,11 @@ type Config struct {
 	// DockerClient manages system and user containers using the local Docker daemon.
 	DockerClient *client.Client
 
-	// CaddyfilePath specifies where the machine generates the Caddy reverse proxy configuration file for routing
-	// external traffic to service containers across the internal network. Default is DataDir/caddy/Caddyfile.
-	CaddyfilePath string
+	// CaddyConfigPath specifies where the machine generates the Caddy reverse proxy configuration file for routing
+	// external traffic to service containers across the internal network. Default is DataDir/caddy/caddy.json.
+	CaddyConfigPath string
+	// DNSUpstreams specifies the upstream DNS servers for the embedded internal DNS server.
+	DNSUpstreams []netip.AddrPort
 }
 
 // SetDefaults returns a new Config with default values set where not provided.
@@ -122,8 +127,8 @@ func (c *Config) SetDefaults() (*Config, error) {
 		}
 	}
 
-	if cfg.CaddyfilePath == "" {
-		cfg.CaddyfilePath = filepath.Join(cfg.DataDir, "caddy", "caddy.json")
+	if cfg.CaddyConfigPath == "" {
+		cfg.CaddyConfigPath = filepath.Join(cfg.DataDir, "caddy", "caddy.json")
 	}
 
 	return &cfg, nil
@@ -209,7 +214,12 @@ func NewMachine(config *Config) (*Machine, error) {
 	if err != nil {
 		return nil, fmt.Errorf("create Docker client: %w", err)
 	}
-	dockerServer := machinedocker.NewServer(dockerCli)
+
+	dbFilePath := filepath.Join(config.DataDir, DBFileName)
+	db, err := NewDB(dbFilePath)
+	if err != nil {
+		return nil, fmt.Errorf("init machine database: %w", err)
+	}
 
 	// Init a local gRPC proxy server that proxies requests to the local or remote machine API servers.
 	proxyDirector := apiproxy.NewDirector(config.MachineSockPath, APIPort)
@@ -227,11 +237,16 @@ func NewMachine(config *Config) (*Machine, error) {
 		initialised:      make(chan struct{}, 1),
 		store:            corroStore,
 		cluster:          c,
-		docker:           dockerServer,
 		localProxyServer: localProxyServer,
 		proxyDirector:    proxyDirector,
 	}
-	m.localMachineServer = newGRPCServer(m, c, dockerServer)
+
+	// Machine IP will only be available after the machine is initialised as a cluster member so wrap it in a function.
+	internalDNSIP := func() netip.Addr {
+		return m.IP()
+	}
+	m.docker = machinedocker.NewServer(dockerCli, db, internalDNSIP)
+	m.localMachineServer = newGRPCServer(m, c, m.docker)
 
 	if m.Initialised() {
 		m.initialised <- struct{}{}
@@ -262,6 +277,15 @@ func (m *Machine) Initialised() bool {
 	return m.state.ID != ""
 }
 
+// IP returns the machine IPv4 address in the cluster network which is the first address in the machine subnet.
+func (m *Machine) IP() netip.Addr {
+	if !m.Initialised() {
+		return netip.Addr{}
+	}
+
+	return network.MachineIP(m.state.Network.Subnet)
+}
+
 func (m *Machine) Run(ctx context.Context) error {
 	// Docker dependency is essential for the machine to function. Block until it's ready.
 	if err := docker.WaitDaemonReady(ctx, m.config.DockerClient); err != nil {
@@ -360,11 +384,17 @@ func (m *Machine) Run(ctx context.Context) error {
 
 					// Create a new Caddyfile controller for managing the Caddy reverse proxy configuration.
 					// It will also serve the current machine ID at /.uncloud-verify to verify Caddy reachability.
-					caddyfileCtrl, err := caddyfile.NewController(m.store, m.config.CaddyfilePath, m.state.ID)
+					caddyfileCtrl, err := caddyfile.NewController(m.store, m.config.CaddyConfigPath, m.state.ID)
 					if err != nil {
 						return fmt.Errorf("create Caddyfile controller: %w", err)
 					}
 
+					dnsResolver := dns.NewClusterResolver(m.store)
+					dnsServer, err := dns.NewServer(m.IP(), dnsResolver, m.config.DNSUpstreams)
+					if err != nil {
+						return fmt.Errorf("create embedded DNS server: %w", err)
+					}
+
 					ctrl, err = newNetworkController(
 						m.state,
 						m.store,
@@ -372,6 +402,8 @@ func (m *Machine) Run(ctx context.Context) error {
 						m.config.CorrosionService,
 						m.config.DockerClient,
 						caddyfileCtrl,
+						dnsServer,
+						dnsResolver,
 					)
 					if err != nil {
 						return fmt.Errorf("initialise network controller: %w", err)
@@ -512,6 +544,38 @@ func (m *Machine) configureCorrosion() error {
 	return nil
 }
 
+// CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
+func (m *Machine) CheckPrerequisites(ctx context.Context, _ *emptypb.Empty) (*pb.CheckPrerequisitesResponse, error) {
+	// Check DNS port (UDP) availability.
+	if err := checkDNSPortAvailable(); err != nil {
+		return &pb.CheckPrerequisitesResponse{
+			Satisfied: false,
+			Error:     err.Error(),
+		}, nil
+	}
+
+	return &pb.CheckPrerequisitesResponse{
+		Satisfied: true,
+	}, nil
+}
+
+// checkDNSPortAvailable verifies that DNS port 53/udp is available for Uncloud's embedded DNS service.
+func checkDNSPortAvailable() error {
+	addr := &net.UDPAddr{
+		IP:   net.IPv4(127, 0, 0, 210), // Use a unique loopback address to avoid conflicts.
+		Port: dns.Port,
+	}
+	conn, err := net.ListenUDP("udp", addr)
+	if err != nil {
+		return fmt.Errorf("DNS port %d/udp is already in use by another service: %w. Uncloud needs this port "+
+			"to run the embedded internal DNS service on WireGuard interface 'uncloud'. Please reconfigure "+
+			"any DNS servers (like dnsmasq, systemd-resolved, or named) that might be listening on all network "+
+			"interfaces (0.0.0.0) on the machine and try again", dns.Port, err)
+	}
+	conn.Close()
+	return nil
+}
+
 // InitCluster initialises a new cluster on the local machine with the provided network configuration.
 func (m *Machine) InitCluster(ctx context.Context, req *pb.InitClusterRequest) (*pb.InitClusterResponse, error) {
 	if m.Initialised() {
@@ -744,10 +808,11 @@ func (m *Machine) InspectService(
 		}
 	}
 
+	ctr := api.ServiceContainer{Container: records[0].Container}
 	svc := &pb.Service{
-		Id:         records[0].Container.ServiceID(),
-		Name:       records[0].Container.ServiceName(),
-		Mode:       records[0].Container.ServiceMode(),
+		Id:         ctr.ServiceID(),
+		Name:       ctr.ServiceName(),
+		Mode:       ctr.ServiceMode(),
 		Containers: containers,
 	}
 	return &pb.InspectServiceResponse{Service: svc}, nil

internal/machine/network.go

@@ -4,22 +4,24 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/cenkalti/backoff/v4"
-	"github.com/docker/docker/client"
-	"golang.org/x/sync/errgroup"
-	"google.golang.org/grpc"
 	"log/slog"
 	"net"
 	"net/netip"
 	"slices"
 	"strconv"
 	"time"
-	"uncloud/internal/machine/api/pb"
-	"uncloud/internal/machine/caddyfile"
-	"uncloud/internal/machine/corroservice"
-	"uncloud/internal/machine/docker"
-	"uncloud/internal/machine/network"
-	"uncloud/internal/machine/store"
+
+	"github.com/cenkalti/backoff/v4"
+	"github.com/docker/docker/client"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/internal/machine/caddyfile"
+	"github.com/psviderski/uncloud/internal/machine/corroservice"
+	"github.com/psviderski/uncloud/internal/machine/dns"
+	"github.com/psviderski/uncloud/internal/machine/docker"
+	"github.com/psviderski/uncloud/internal/machine/network"
+	"github.com/psviderski/uncloud/internal/machine/store"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc"
 )
 
 const (
@@ -38,8 +40,9 @@ type networkController struct {
 	dockerCli     *client.Client
 	caddyfileCtrl *caddyfile.Controller
 
-	// TODO: DNS server/resolver listening on the machine IP, e.g. 10.210.0.1:53. It can't listen on 127.0.X.X
-	//  like resolved does because it needs to be reachable from both the host and the containers.
+	// dnsServer is the embedded internal DNS server for the cluster listening on the machine IP.
+	dnsServer   *dns.Server
+	dnsResolver *dns.ClusterResolver
 }
 
 func newNetworkController(
@@ -49,6 +52,8 @@ func newNetworkController(
 	corroService corroservice.Service,
 	dockerCli *client.Client,
 	caddyfileCtrl *caddyfile.Controller,
+	dnsServer *dns.Server,
+	dnsResolver *dns.ClusterResolver,
 ) (
 	*networkController, error,
 ) {
@@ -68,6 +73,8 @@ func newNetworkController(
 		corroService:    corroService,
 		dockerCli:       dockerCli,
 		caddyfileCtrl:   caddyfileCtrl,
+		dnsServer:       dnsServer,
+		dnsResolver:     dnsResolver,
 	}, nil
 }
 
@@ -110,65 +117,73 @@ func (nc *networkController) Run(ctx context.Context) error {
 		},
 	)
 
+	errGroup.Go(func() error {
+		slog.Info("Starting embedded DNS resolver.")
+		if err := nc.dnsResolver.Run(ctx); err != nil {
+			return fmt.Errorf("embedded DNS resolver failed: %w", err)
+		}
+		return nil
+	})
+
+	errGroup.Go(func() error {
+		slog.Info("Starting embedded DNS server.")
+		if err := nc.dnsServer.Run(ctx); err != nil {
+			return fmt.Errorf("embedded DNS server failed: %w", err)
+		}
+		return nil
+	})
+
 	// Setup Docker network and synchronise containers to the cluster store.
-	errGroup.Go(
-		func() error {
-			return nc.prepareAndWatchDocker(ctx)
-		},
-	)
+	errGroup.Go(func() error {
+		return nc.prepareAndWatchDocker(ctx)
+	})
 
 	// Handle machine changes in the cluster. Handling machine and endpoint changes should be done
 	// in separate goroutines to avoid a deadlock when reconfiguring the network.
-	errGroup.Go(
-		func() error {
-			if err := nc.handleMachineChanges(ctx); err != nil {
-				return fmt.Errorf("handle new machines: %w", err)
-			}
-			return nil
-		},
-	)
+	errGroup.Go(func() error {
+		if err := nc.handleMachineChanges(ctx); err != nil {
+			return fmt.Errorf("handle new machines: %w", err)
+		}
+		return nil
+	})
 
 	// Watch for endpoint changes and update the machine state accordingly.
-	errGroup.Go(
-		func() error {
-			for {
-				select {
-				case e, ok := <-nc.endpointChanges:
-					if !ok {
-						// The channel was closed, stop watching for changes.
-						nc.endpointChanges = nil
-						return nil
-					}
-
-					nc.state.mu.Lock()
-					for i := range nc.state.Network.Peers {
-						if nc.state.Network.Peers[i].PublicKey.Equal(e.PublicKey) {
-							nc.state.Network.Peers[i].Endpoint = &e.Endpoint
-							break
-						}
-					}
-					if err := nc.state.Save(); err != nil {
-						slog.Error("Failed to save machine state.", "err", err)
-					}
-					nc.state.mu.Unlock()
-
-					slog.Debug("Preserved endpoint change in the machine state.",
-						"public_key", e.PublicKey, "endpoint", e.Endpoint)
-				case <-ctx.Done():
+	errGroup.Go(func() error {
+		for {
+			select {
+			case e, ok := <-nc.endpointChanges:
+				if !ok {
+					// The channel was closed, stop watching for changes.
+					nc.endpointChanges = nil
 					return nil
 				}
-			}
-		},
-	)
 
-	errGroup.Go(
-		func() error {
-			if err := nc.wgnet.Run(ctx); err != nil {
-				return fmt.Errorf("WireGuard network failed: %w", err)
+				nc.state.mu.Lock()
+				for i := range nc.state.Network.Peers {
+					if nc.state.Network.Peers[i].PublicKey.Equal(e.PublicKey) {
+						nc.state.Network.Peers[i].Endpoint = &e.Endpoint
+						break
+					}
+				}
+				if err := nc.state.Save(); err != nil {
+					slog.Error("Failed to save machine state.", "err", err)
+				}
+				nc.state.mu.Unlock()
+
+				slog.Debug("Preserved endpoint change in the machine state.",
+					"public_key", e.PublicKey, "endpoint", e.Endpoint)
+			case <-ctx.Done():
+				return nil
 			}
-			return nil
-		},
-	)
+		}
+	})
+
+	errGroup.Go(func() error {
+		if err := nc.wgnet.Run(ctx); err != nil {
+			return fmt.Errorf("WireGuard network failed: %w", err)
+		}
+		return nil
+	})
 
 	errGroup.Go(func() error {
 		slog.Info("Starting Caddyfile controller.")
@@ -180,16 +195,14 @@ func (nc *networkController) Run(ctx context.Context) error {
 	})
 
 	// Wait for the context to be done and stop the network API server.
-	errGroup.Go(
-		func() error {
-			<-ctx.Done()
-			slog.Info("Stopping network API server.")
-			// TODO: implement timeout for graceful shutdown.
-			nc.server.GracefulStop()
-			slog.Info("Network API server stopped.")
-			return nil
-		},
-	)
+	errGroup.Go(func() error {
+		<-ctx.Done()
+		slog.Info("Stopping network API server.")
+		// TODO: implement timeout for graceful shutdown.
+		nc.server.GracefulStop()
+		slog.Info("Network API server stopped.")
+		return nil
+	})
 
 	return errGroup.Wait()
 }

internal/machine/network/config.go

@@ -2,10 +2,11 @@ package network
 
 import (
 	"fmt"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"net"
 	"net/netip"
-	"uncloud/internal/secret"
+
+	"github.com/psviderski/uncloud/internal/secret"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 )
 
 type Config struct {
@@ -13,7 +14,7 @@ type Config struct {
 	// in the subnet. Other IP addresses are allocated to containers running on the machine.
 	Subnet netip.Prefix
 	// ManagementIP is the IPv6 address assigned to the machine within the WireGuard network. This address is used
-	// for cluster management traffic, such as gRPC communication with the machine API server and Serf gossip.
+	// for cluster management traffic, such as gRPC communication with the machine API server and Corrosion gossip.
 	ManagementIP netip.Addr
 	PrivateKey   secret.Secret
 	PublicKey    secret.Secret
@@ -23,7 +24,7 @@ type Config struct {
 type PeerConfig struct {
 	Subnet *netip.Prefix `json:",omitempty"`
 	// ManagementIP is the IPv6 address assigned to the peer within the WireGuard network. This address is used
-	// for cluster management traffic, such as gRPC communication with the machine API server and Serf gossip.
+	// for cluster management traffic, such as gRPC communication with the machine API server and Corrosion gossip.
 	ManagementIP netip.Addr
 	Endpoint     *netip.AddrPort  `json:",omitempty"`
 	AllEndpoints []netip.AddrPort `json:",omitempty"`

internal/machine/network/ip.go

@@ -4,7 +4,8 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"uncloud/internal/secret"
+
+	"github.com/psviderski/uncloud/internal/secret"
 )
 
 // MachineIP returns the IP address of the machine which is the first address in the subnet.

internal/machine/network/tunnel/tunnel.go

@@ -9,7 +9,7 @@ import (
 	"net"
 	"net/netip"
 	"time"
-	"uncloud/internal/secret"
+	"github.com/psviderski/uncloud/internal/secret"
 )
 
 const (

internal/machine/network/wireguard.go

@@ -5,7 +5,7 @@ import (
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"net/netip"
 	"time"
-	"uncloud/internal/secret"
+	"github.com/psviderski/uncloud/internal/secret"
 )
 
 const (

internal/machine/network/wireguard_linux.go

@@ -17,7 +17,7 @@ import (
 	"slices"
 	"sync"
 	"time"
-	"uncloud/internal/secret"
+	"github.com/psviderski/uncloud/internal/secret"
 )
 
 type WireGuardNetwork struct {

internal/machine/state.go

@@ -6,7 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"sync"
-	"uncloud/internal/machine/network"
+	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
 const (

internal/machine/store/container.go

@@ -5,10 +5,10 @@ import (
 	"encoding/json"
 	"fmt"
 	sq "github.com/Masterminds/squirrel"
+	"github.com/psviderski/uncloud/pkg/api"
 	"log/slog"
 	"strings"
 	"time"
-	"uncloud/internal/api"
 )
 
 const (

internal/machine/store/store.go

@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"google.golang.org/protobuf/encoding/protojson"
 	"log/slog"
-	"uncloud/internal/corrosion"
-	"uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/internal/corrosion"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
 )
 
 var (

internal/machine/token.go

@@ -6,7 +6,7 @@ import (
 	"fmt"
 	"net/netip"
 	"strings"
-	"uncloud/internal/secret"
+	"github.com/psviderski/uncloud/internal/secret"
 )
 
 const (

internal/ucind/cluster.go

@@ -4,17 +4,18 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/netip"
+	"time"
+
 	"github.com/cenkalti/backoff/v4"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/api/types/network"
 	dockerclient "github.com/docker/docker/client"
+	"github.com/psviderski/uncloud/internal/machine"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/internal/machine/cluster"
 	"google.golang.org/protobuf/types/known/emptypb"
-	"net/netip"
-	"time"
-	"uncloud/internal/machine"
-	"uncloud/internal/machine/api/pb"
-	"uncloud/internal/machine/cluster"
 )
 
 const (
@@ -31,6 +32,29 @@ type CreateClusterOptions struct {
 	Machines int
 }
 
+func (c *Cluster) PopulateMachineIDs(ctx context.Context) error {
+	for i := range c.Machines {
+		if c.Machines[i].ID != "" {
+			continue
+		}
+
+		cli, err := c.Machines[i].Connect(ctx)
+		if err != nil {
+			return fmt.Errorf("connect to machine '%s': %w", c.Machines[i].Name, err)
+		}
+		//goland:noinspection GoDeferInLoop
+		defer cli.Close()
+
+		m, err := cli.Inspect(ctx, &emptypb.Empty{})
+		if err != nil {
+			return fmt.Errorf("inspect machine '%s': %w", c.Machines[i].Name, err)
+		}
+		c.Machines[i].ID = m.Id
+	}
+
+	return nil
+}
+
 func (p *Provisioner) CreateCluster(ctx context.Context, name string, opts CreateClusterOptions) (Cluster, error) {
 	var c Cluster
 
@@ -74,12 +98,15 @@ func (p *Provisioner) CreateCluster(ctx context.Context, name string, opts Creat
 	if err = p.initCluster(ctx, c.Machines); err != nil {
 		return c, err
 	}
+	if err = c.PopulateMachineIDs(ctx); err != nil {
+		return c, fmt.Errorf("populate machine IDs: %w", err)
+	}
 
 	if p.configUpdater != nil {
 		if err = p.configUpdater.AddCluster(c); err != nil {
 			return c, fmt.Errorf("add cluster to Uncloud config: %w", err)
 		}
-		fmt.Printf("Cluster '%s' added to Uncloud config.\n", c.Name)
+		fmt.Printf("Cluster '%s' added to Uncloud config as the current context.\n", name)
 	}
 
 	return c, nil
@@ -89,7 +116,7 @@ func (p *Provisioner) initCluster(ctx context.Context, machines []Machine) error
 	// Init a new cluster on the first machine.
 	initMachine := machines[0]
 
-	if err := p.WaitMachineReady(ctx, initMachine, 30*time.Second); err != nil {
+	if err := WaitMachineReady(ctx, initMachine, 30*time.Second); err != nil {
 		return fmt.Errorf("wait for machine %q to be ready: %w", initMachine.Name, err)
 	}
 
@@ -111,7 +138,7 @@ func (p *Provisioner) initCluster(ctx context.Context, machines []Machine) error
 
 	// Join the rest of the machines to the cluster.
 	for _, m := range machines[1:] {
-		if err = p.WaitMachineReady(ctx, m, 5*time.Second); err != nil {
+		if err = WaitMachineReady(ctx, m, 5*time.Second); err != nil {
 			return fmt.Errorf("wait for machine %q to be ready: %w", m.Name, err)
 		}
 
@@ -215,13 +242,17 @@ func (p *Provisioner) InspectCluster(ctx context.Context, name string) (Cluster,
 		c.Machines = append(c.Machines, m)
 	}
 
+	if err = c.PopulateMachineIDs(ctx); err != nil {
+		return c, fmt.Errorf("populate machine IDs: %w", err)
+	}
+
 	return c, nil
 }
 
 // WaitClusterReady waits for all machines in the cluster to be ready and UP.
 func (p *Provisioner) WaitClusterReady(ctx context.Context, c Cluster, timeout time.Duration) error {
 	firstMachine := c.Machines[0]
-	if err := p.WaitMachineReady(ctx, firstMachine, timeout); err != nil {
+	if err := WaitMachineReady(ctx, firstMachine, timeout); err != nil {
 		return fmt.Errorf("wait for machine '%s' to be ready: %w", firstMachine.Name, err)
 	}
 
@@ -238,7 +269,7 @@ func (p *Provisioner) WaitClusterReady(ctx context.Context, c Cluster, timeout t
 	), ctx)
 
 	checkMachinesUp := func() error {
-		machines, err := cli.ListMachines(ctx)
+		machines, err := cli.ListMachines(ctx, nil)
 		if err != nil {
 			return fmt.Errorf("list machines: %w", err)
 		}
@@ -278,7 +309,12 @@ func (p *Provisioner) RemoveCluster(ctx context.Context, name string) error {
 		return fmt.Errorf("list Docker containers with cluster name '%s': %w", name, err)
 	}
 	for _, c := range containers {
-		if err = p.dockerCli.ContainerRemove(ctx, c.ID, container.RemoveOptions{Force: true}); err != nil {
+		removeOpts := container.RemoveOptions{
+			// Remove anonymous volumes attached to the container (typically /var/lib/docker).
+			RemoveVolumes: true,
+			Force:         true,
+		}
+		if err = p.dockerCli.ContainerRemove(ctx, c.ID, removeOpts); err != nil {
 			return fmt.Errorf("remove Docker container '%s': %w", c.ID, err)
 		}
 	}

internal/ucind/config.go

@@ -2,7 +2,8 @@ package ucind
 
 import (
 	"fmt"
-	"uncloud/internal/cli/config"
+
+	"github.com/psviderski/uncloud/internal/cli/config"
 )
 
 type ConfigUpdater struct {
@@ -19,22 +20,22 @@ func (u *ConfigUpdater) AddCluster(c Cluster) error {
 		return fmt.Errorf("read Uncloud config: %w", err)
 	}
 
-	if _, ok := cfg.Clusters[c.Name]; ok {
-		return fmt.Errorf("cluster '%s' already exists", c.Name)
+	if _, ok := cfg.Contexts[c.Name]; ok {
+		return fmt.Errorf("cluster context '%s' already exists", c.Name)
 	}
 
-	clusterCfg := &config.Cluster{
+	clusterCfg := &config.Context{
 		Name:        c.Name,
 		Connections: make([]config.MachineConnection, len(c.Machines)),
 	}
 	for i, m := range c.Machines {
 		clusterCfg.Connections[i] = config.MachineConnection{
-			TCP: m.APIAddress,
+			TCP: &m.APIAddress,
 		}
 	}
 
-	cfg.Clusters[c.Name] = clusterCfg
-	cfg.CurrentCluster = c.Name
+	cfg.Contexts[c.Name] = clusterCfg
+	cfg.CurrentContext = c.Name
 
 	if err = cfg.Save(); err != nil {
 		return fmt.Errorf("save config: %w", err)
@@ -48,17 +49,17 @@ func (u *ConfigUpdater) RemoveCluster(name string) error {
 		return fmt.Errorf("read Uncloud config: %w", err)
 	}
 
-	if _, ok := cfg.Clusters[name]; !ok {
+	if _, ok := cfg.Contexts[name]; !ok {
 		return nil
 	}
 
-	delete(cfg.Clusters, name)
+	delete(cfg.Contexts, name)
 
-	if cfg.CurrentCluster == name {
-		cfg.CurrentCluster = ""
+	if cfg.CurrentContext == name {
+		cfg.CurrentContext = ""
 	}
-	if _, ok := cfg.Clusters["default"]; ok {
-		cfg.CurrentCluster = "default"
+	if _, ok := cfg.Contexts["default"]; ok {
+		cfg.CurrentContext = "default"
 	}
 
 	if err = cfg.Save(); err != nil {

internal/ucind/machine.go

@@ -4,19 +4,20 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io"
+	"net"
+	"net/netip"
+	"time"
+
 	"github.com/cenkalti/backoff/v4"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/image"
 	dockerclient "github.com/docker/docker/client"
 	"github.com/docker/go-connections/nat"
+	"github.com/psviderski/uncloud/internal/secret"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/psviderski/uncloud/pkg/client/connector"
 	"google.golang.org/protobuf/types/known/emptypb"
-	"io"
-	"net"
-	"net/netip"
-	"time"
-	"uncloud/internal/cli/client"
-	"uncloud/internal/cli/client/connector"
-	"uncloud/internal/secret"
 )
 
 const (
@@ -29,6 +30,7 @@ const (
 type Machine struct {
 	ClusterName   string
 	ContainerName string
+	ID            string
 	Name          string
 	APIAddress    netip.AddrPort
 }
@@ -185,7 +187,7 @@ func randomMachineName() (string, error) {
 }
 
 // WaitMachineReady waits for the machine API to respond.
-func (p *Provisioner) WaitMachineReady(ctx context.Context, m Machine, timeout time.Duration) error {
+func WaitMachineReady(ctx context.Context, m Machine, timeout time.Duration) error {
 	cli, err := m.Connect(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to machine over TCP '%s': %w", m.APIAddress, err)

internal/version/version.go

@@ -0,0 +1,7 @@
+package version
+
+var version string
+
+func String() string {
+	return version
+}

pkg/api/client.go

@@ -0,0 +1,81 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/volume"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"google.golang.org/grpc/metadata"
+)
+
+type Client interface {
+	ContainerClient
+	DNSClient
+	ImageClient
+	MachineClient
+	ServiceClient
+	VolumeClient
+}
+
+type ContainerClient interface {
+	CreateContainer(
+		ctx context.Context, serviceID string, spec ServiceSpec, machineID string,
+	) (container.CreateResponse, error)
+	InspectContainer(ctx context.Context, serviceNameOrID, containerNameOrID string) (MachineServiceContainer, error)
+	RemoveContainer(ctx context.Context, serviceNameOrID, containerNameOrID string, opts container.RemoveOptions) error
+	StartContainer(ctx context.Context, serviceNameOrID, containerNameOrID string) error
+	StopContainer(ctx context.Context, serviceNameOrID, containerNameOrID string, opts container.StopOptions) error
+}
+
+type DNSClient interface {
+	GetDomain(ctx context.Context) (string, error)
+}
+
+type ImageClient interface {
+	InspectImage(ctx context.Context, id string) ([]MachineImage, error)
+	InspectRemoteImage(ctx context.Context, id string) ([]MachineRemoteImage, error)
+}
+
+type MachineClient interface {
+	InspectMachine(ctx context.Context, id string) (*pb.MachineMember, error)
+	ListMachines(ctx context.Context, filter *MachineFilter) (MachineMembersList, error)
+}
+
+type ServiceClient interface {
+	RunService(ctx context.Context, spec ServiceSpec) (RunServiceResponse, error)
+	InspectService(ctx context.Context, id string) (Service, error)
+	RemoveService(ctx context.Context, id string) error
+}
+
+type VolumeClient interface {
+	CreateVolume(ctx context.Context, machineNameOrID string, opts volume.CreateOptions) (MachineVolume, error)
+	ListVolumes(ctx context.Context, filter *VolumeFilter) ([]MachineVolume, error)
+	RemoveVolume(ctx context.Context, machineNameOrID, volumeName string, force bool) error
+}
+
+// ProxyMachinesContext returns a new context that proxies gRPC requests to the specified machines.
+// If namesOrIDs is nil, all machines are included.
+func ProxyMachinesContext(
+	ctx context.Context, cli MachineClient, namesOrIDs []string,
+) (context.Context, MachineMembersList, error) {
+	machines, err := cli.ListMachines(ctx, nil)
+	if err != nil {
+		return nil, nil, fmt.Errorf("list machines: %w", err)
+	}
+
+	var proxiedMachines MachineMembersList
+	md := metadata.New(nil)
+	for _, m := range machines {
+		if len(namesOrIDs) == 0 ||
+			slices.Contains(namesOrIDs, m.Machine.Name) || slices.Contains(namesOrIDs, m.Machine.Id) {
+			proxiedMachines = append(proxiedMachines, m)
+			machineIP, _ := m.Machine.Network.ManagementIp.ToAddr()
+			md.Append("machines", machineIP.String())
+		}
+	}
+
+	return metadata.NewOutgoingContext(ctx, md), proxiedMachines, nil
+}

pkg/api/container.go

@@ -1,14 +1,20 @@
 package api
 
 import (
+	"encoding/json"
 	"fmt"
-	"github.com/docker/docker/api/types"
-	"github.com/docker/go-units"
+	"net/netip"
 	"strings"
 	"time"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/go-units"
 )
 
 const (
+	// DockerNetworkName is the name of the Docker network used by uncloud. Keep the value in sync with NetworkName
+	// in internal/machine/docker/manager.go.
+	DockerNetworkName = "uncloud"
 	LabelManaged      = "uncloud.managed"
 	LabelServiceID    = "uncloud.service.id"
 	LabelServiceName  = "uncloud.service.name"
@@ -20,70 +26,6 @@ type Container struct {
 	types.ContainerJSON
 }
 
-// NameWithoutSlash returns the container name without the leading slash.
-// TODO: modify Name in original ContainerJSON structure when inspecting a Docker container and get rid of this method.
-func (c *Container) NameWithoutSlash() string {
-	return c.Name[1:]
-}
-
-// ServiceID returns the ID of the service this container belongs to.
-func (c *Container) ServiceID() string {
-	return c.Config.Labels[LabelServiceID]
-}
-
-// ServiceName returns the name of the service this container belongs to.
-func (c *Container) ServiceName() string {
-	return c.Config.Labels[LabelServiceName]
-}
-
-// ServiceMode returns the replication mode of the service this container belongs to.
-func (c *Container) ServiceMode() string {
-	return c.Config.Labels[LabelServiceMode]
-}
-
-// ServicePorts returns the ports this container publishes as part of its service.
-func (c *Container) ServicePorts() ([]PortSpec, error) {
-	encoded, ok := c.Config.Labels[LabelServicePorts]
-	if !ok {
-		return nil, nil
-	}
-	if strings.TrimSpace(encoded) == "" {
-		return nil, nil
-	}
-
-	publishPorts := strings.Split(encoded, ",")
-	ports := make([]PortSpec, len(publishPorts))
-	for i, p := range publishPorts {
-		port, err := ParsePortSpec(strings.TrimSpace(p))
-		if err != nil {
-			return nil, err
-		}
-		ports[i] = port
-	}
-
-	return ports, nil
-}
-
-// ServiceSpec constructs a service spec from the container's configuration.
-func (c *Container) ServiceSpec() (ServiceSpec, error) {
-	ports, err := c.ServicePorts()
-	if err != nil {
-		return ServiceSpec{}, fmt.Errorf("get service ports: %w", err)
-	}
-
-	return ServiceSpec{
-		Container: ContainerSpec{
-			Command: c.Config.Cmd,
-			Image:   c.Config.Image,
-			Init:    c.HostConfig.Init,
-			Volumes: c.HostConfig.Binds,
-		},
-		Mode:  c.ServiceMode(),
-		Name:  c.ServiceName(),
-		Ports: ports,
-	}, nil
-}
-
 // Healthy determines if the container is running and healthy.
 // A running container with no health check configured is considered healthy.
 func (c *Container) Healthy() bool {
@@ -152,8 +94,82 @@ func (c *Container) HumanState() (string, error) {
 		c.State.ExitCode, units.HumanDuration(time.Now().UTC().Sub(finishedAt))), nil
 }
 
+// UncloudNetworkIP returns the IP address of the container in the uncloud Docker network.
+func (c *Container) UncloudNetworkIP() netip.Addr {
+	network, ok := c.NetworkSettings.Networks[DockerNetworkName]
+	if !ok {
+		// Container is not connected to the uncloud Docker network (could be host network).
+		return netip.Addr{}
+	}
+
+	ip, err := netip.ParseAddr(network.IPAddress)
+	if err != nil {
+		return netip.Addr{}
+	}
+
+	return ip
+}
+
+func (c *Container) UnmarshalJSON(data []byte) error {
+	// A temporary type that's identical to Container but doesn't have the UnmarshalJSON method.
+	type ContainerAlias Container
+
+	var temp ContainerAlias
+	if err := json.Unmarshal(data, &temp); err != nil {
+		return err
+	}
+
+	*c = Container(temp)
+	c.Name = strings.TrimPrefix(c.Name, "/")
+
+	return nil
+}
+
+type ServiceContainer struct {
+	Container
+	ServiceSpec ServiceSpec
+}
+
+// ServiceID returns the ID of the service this container belongs to.
+func (c *ServiceContainer) ServiceID() string {
+	return c.Config.Labels[LabelServiceID]
+}
+
+// ServiceName returns the name of the service this container belongs to.
+func (c *ServiceContainer) ServiceName() string {
+	return c.Config.Labels[LabelServiceName]
+}
+
+// ServiceMode returns the replication mode of the service this container belongs to.
+func (c *ServiceContainer) ServiceMode() string {
+	return c.Config.Labels[LabelServiceMode]
+}
+
+// ServicePorts returns the ports this container publishes as part of its service.
+func (c *ServiceContainer) ServicePorts() ([]PortSpec, error) {
+	encoded, ok := c.Config.Labels[LabelServicePorts]
+	if !ok {
+		return nil, nil
+	}
+	if strings.TrimSpace(encoded) == "" {
+		return nil, nil
+	}
+
+	publishPorts := strings.Split(encoded, ",")
+	ports := make([]PortSpec, len(publishPorts))
+	for i, p := range publishPorts {
+		port, err := ParsePortSpec(strings.TrimSpace(p))
+		if err != nil {
+			return nil, err
+		}
+		ports[i] = port
+	}
+
+	return ports, nil
+}
+
 // ConflictingServicePorts returns a list of service ports that conflict with the given ports.
-func (c *Container) ConflictingServicePorts(ports []PortSpec) ([]PortSpec, error) {
+func (c *ServiceContainer) ConflictingServicePorts(ports []PortSpec) ([]PortSpec, error) {
 	svcPorts, err := c.ServicePorts()
 	if err != nil {
 		return nil, fmt.Errorf("get service ports: %w", err)

pkg/api/container_test.go

@@ -1,60 +1,15 @@
 package api
 
 import (
+	"net/netip"
+	"testing"
+
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"net/netip"
-	"reflect"
-	"testing"
 )
 
-func TestContainer_ServiceSpec(t *testing.T) {
-	t.Parallel()
-
-	init := true
-	ctr := &Container{ContainerJSON: types.ContainerJSON{
-		ContainerJSONBase: &types.ContainerJSONBase{
-			HostConfig: &container.HostConfig{
-				Binds: []string{"/host/path:/container/path"},
-				Init:  &init,
-			},
-		},
-		Config: &container.Config{
-			Cmd:   []string{"/app/server"},
-			Image: "app:latest",
-			Labels: map[string]string{
-				LabelServiceID:    "test-service-id",
-				LabelServiceName:  "test-service-name",
-				LabelServicePorts: "app.example.com:8000/https",
-			},
-		},
-	}}
-
-	expectedSpec := ServiceSpec{
-		Container: ContainerSpec{
-			Command: []string{"/app/server"},
-			Image:   "app:latest",
-			Init:    &init,
-			Volumes: []string{"/host/path:/container/path"},
-		},
-		Name: "test-service-name",
-		Ports: []PortSpec{
-			{
-				Hostname:      "app.example.com",
-				ContainerPort: 8000,
-				Protocol:      ProtocolHTTPS,
-				Mode:          PortModeIngress,
-			},
-		},
-	}
-
-	spec, err := ctr.ServiceSpec()
-	require.NoError(t, err)
-	assert.True(t, reflect.DeepEqual(spec, expectedSpec))
-}
-
 func TestContainer_Healthy(t *testing.T) {
 	t.Parallel()
 
@@ -325,13 +280,13 @@ func TestContainer_ConflictingServicePorts(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			ctr := &Container{ContainerJSON: types.ContainerJSON{
+			ctr := &ServiceContainer{Container: Container{ContainerJSON: types.ContainerJSON{
 				Config: &container.Config{
 					Labels: map[string]string{
 						LabelServicePorts: tt.containerPorts,
 					},
 				},
-			}}
+			}}}
 
 			got, err := ctr.ConflictingServicePorts(tt.checkPorts)
 			if tt.wantErr {

pkg/api/error.go

@@ -0,0 +1,5 @@
+package api
+
+import "errors"
+
+var ErrNotFound = errors.New("not found")

pkg/api/image.go

@@ -0,0 +1,28 @@
+package api
+
+import (
+	"github.com/distribution/reference"
+	"github.com/docker/docker/api/types"
+	v1 "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+)
+
+type MachineImage struct {
+	Metadata *pb.Metadata
+	Image    types.ImageInspect
+}
+
+// MachineRemoteImage represents an image in a remote registry fetched by a particular machine.
+type MachineRemoteImage struct {
+	Metadata *pb.Metadata
+	Image    RemoteImage
+}
+
+// RemoteImage represents an image in a remote registry. The canonical reference includes the image digest.
+// Either IndexManifest or ImageManifest must be set depending on whether the reference points to an index
+// (multi-platform image) or a single-platform image.
+type RemoteImage struct {
+	Reference     reference.Canonical
+	IndexManifest *v1.Index
+	ImageManifest *v1.Manifest
+}

pkg/api/machine.go

@@ -0,0 +1,38 @@
+package api
+
+import "github.com/psviderski/uncloud/internal/machine/api/pb"
+
+// MachineFilter defines criteria to filter machines in ListMachines.
+type MachineFilter struct {
+	// Available filters machines that are not DOWN.
+	Available bool
+	// NamesOrIDs filters machines by their names or IDs.
+	NamesOrIDs []string
+}
+
+type MachineMembersList []*pb.MachineMember
+
+func (m MachineMembersList) FindByManagementIP(ip string) *pb.MachineMember {
+	for _, machine := range m {
+		addr, err := machine.Machine.Network.ManagementIp.ToAddr()
+		if err != nil {
+			continue
+		}
+
+		if addr.String() == ip {
+			return machine
+		}
+	}
+
+	return nil
+}
+
+func (m MachineMembersList) FindByNameOrID(nameOrID string) *pb.MachineMember {
+	for _, machine := range m {
+		if machine.Machine.Id == nameOrID || machine.Machine.Name == nameOrID {
+			return machine
+		}
+	}
+
+	return nil
+}

pkg/api/placement.go

@@ -0,0 +1,8 @@
+package api
+
+// Placement defines the placement constraints for service containers.
+type Placement struct {
+	// Machines is a list of machine names or IDs where service containers are allowed to be deployed.
+	// If empty, containers can be deployed to any available machine in the cluster.
+	Machines []string `json:",omitempty"`
+}

pkg/api/port.go

@@ -3,6 +3,7 @@ package api
 import (
 	"fmt"
 	"net/netip"
+	"slices"
 	"strconv"
 	"strings"
 )
@@ -261,3 +262,31 @@ func validateHostname(hostname string) error {
 	}
 	return nil
 }
+
+// PortsEqual returns true if the two port sets are equal. The order of the ports is not important.
+func PortsEqual(a, b []PortSpec) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	var err error
+	aSerialised := make([]string, len(a))
+	bSerialised := make([]string, len(b))
+
+	for i := range a {
+		aSerialised[i], err = a[i].String()
+		if err != nil {
+			return false
+		}
+
+		bSerialised[i], err = b[i].String()
+		if err != nil {
+			return false
+		}
+	}
+
+	slices.Sort(aSerialised)
+	slices.Sort(bSerialised)
+
+	return slices.Equal(aSerialised, bSerialised)
+}

pkg/api/resources.go

@@ -0,0 +1,16 @@
+package api
+
+const (
+	MilliCore = 1_000_000
+	Core      = 1000 * MilliCore
+)
+
+type ContainerResources struct {
+	// CPU is the maximum amount of CPU nanocores (1000000000 = 1 CPU core) the container can use.
+	CPU int64
+	// Memory is the maximum amount of memory (in bytes) the container can use.
+	Memory int64
+	// MemoryReservation is the minimum amount of memory (in bytes) the container needs to run efficiently.
+	// TODO: implement a placement constraint that checks available memory on machines.
+	MemoryReservation int64
+}

pkg/api/service.go

@@ -0,0 +1,369 @@
+package api
+
+import (
+	"encoding/json"
+	"fmt"
+	"maps"
+	"regexp"
+	"slices"
+
+	"github.com/distribution/reference"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+)
+
+const (
+	ServiceModeReplicated = "replicated"
+	ServiceModeGlobal     = "global"
+
+	// PullPolicyAlways means the image is always pulled from the registry.
+	PullPolicyAlways = "always"
+	// PullPolicyMissing means the image is pulled from the registry only if it's not available on the machine where
+	// a container is started. This is the default pull policy.
+	// TODO: make each machine aware of the images on other machines and it possible to pull from them.
+	// 	Pull from the registry only if the image is missing on all machines.
+	PullPolicyMissing = "missing"
+	// PullPolicyNever means the image is never pulled from the registry. A service with this pull policy can only be
+	// deployed to machines where the image is already available.
+	// TODO: see the TODO above for PullPolicyMissing. Pull from other machines in the cluster if available.
+	PullPolicyNever = "never"
+)
+
+var serviceIDRegexp = regexp.MustCompile("^[0-9a-f]{32}$")
+
+func ValidateServiceID(id string) bool {
+	return serviceIDRegexp.MatchString(id)
+}
+
+// ServiceSpec defines the desired state of a service.
+// ATTENTION: after changing this struct, verify if deploy.EvalContainerSpecChange needs to be updated.
+type ServiceSpec struct {
+	Container ContainerSpec
+	// Mode is the replication mode of the service. Default is ServiceModeReplicated if empty.
+	Mode string
+	Name string
+	// Placement defines the placement constraints for the service.
+	Placement Placement
+	// Ports defines what service ports to publish to make the service accessible outside the cluster.
+	Ports []PortSpec
+	// Replicas is the number of containers to run for the service. Only valid for a replicated service.
+	Replicas uint `json:",omitempty"`
+	// Volumes is list of data volumes that can be mounted into the container.
+	Volumes []VolumeSpec
+}
+
+func (s *ServiceSpec) Volume(name string) (VolumeSpec, bool) {
+	for _, v := range s.Volumes {
+		if v.Name == name {
+			return v, true
+		}
+	}
+	return VolumeSpec{}, false
+}
+
+// MountedDockerVolumes returns the list of volumes of VolumeTypeVolume type that are mounted into the container.
+func (s *ServiceSpec) MountedDockerVolumes() []VolumeSpec {
+	volumes := make(map[string]VolumeSpec)
+	for _, m := range s.Container.VolumeMounts {
+		if v, ok := s.Volume(m.VolumeName); ok && v.Type == VolumeTypeVolume {
+			volumes[v.Name] = v
+		}
+	}
+
+	return slices.Collect(maps.Values(volumes))
+}
+
+func (s *ServiceSpec) SetDefaults() ServiceSpec {
+	spec := s.Clone()
+
+	if spec.Mode == "" {
+		spec.Mode = ServiceModeReplicated
+	}
+	// Ensure the replicated service has at least one replica.
+	if spec.Mode == ServiceModeReplicated && spec.Replicas == 0 {
+		spec.Replicas = 1
+	}
+	spec.Container = spec.Container.SetDefaults()
+
+	for i, v := range spec.Volumes {
+		spec.Volumes[i] = v.SetDefaults()
+	}
+
+	return spec
+}
+
+func (s *ServiceSpec) Validate() error {
+	if err := s.Container.Validate(); err != nil {
+		return err
+	}
+
+	switch s.Mode {
+	case "", ServiceModeGlobal, ServiceModeReplicated:
+	default:
+		return fmt.Errorf("invalid mode: %q", s.Mode)
+	}
+
+	// TODO: validate the service name is a valid DNS label.
+
+	for _, p := range s.Ports {
+		if (p.Mode == "" || p.Mode == PortModeIngress) &&
+			p.Protocol != ProtocolHTTP && p.Protocol != ProtocolHTTPS {
+			return fmt.Errorf("unsupported protocol for ingress port %d: %s", p.ContainerPort, p.Protocol)
+		}
+	}
+
+	// TODO: validate there is no conflict between ports.
+
+	volumeNames := make(map[string]struct{})
+	for _, v := range s.Volumes {
+		if err := v.Validate(); err != nil {
+			return fmt.Errorf("invalid volume: %w", err)
+		}
+		if _, ok := volumeNames[v.Name]; ok {
+			return fmt.Errorf("duplicate volume name: '%s'", v.Name)
+		}
+		volumeNames[v.Name] = struct{}{}
+	}
+
+	for _, m := range s.Container.VolumeMounts {
+		if !slices.ContainsFunc(s.Volumes, func(v VolumeSpec) bool {
+			return v.Name == m.VolumeName
+		}) {
+			return fmt.Errorf("volume mount references a volume that doesn't exist in the service spec: '%s'",
+				m.VolumeName)
+		}
+	}
+
+	return nil
+}
+
+func (s *ServiceSpec) Clone() ServiceSpec {
+	spec := *s
+
+	if s.Ports != nil {
+		spec.Ports = make([]PortSpec, len(s.Ports))
+		copy(spec.Ports, s.Ports)
+	}
+	spec.Container = s.Container.Clone()
+
+	if s.Volumes != nil {
+		spec.Volumes = make([]VolumeSpec, len(s.Volumes))
+		for i, v := range s.Volumes {
+			spec.Volumes[i] = v.Clone()
+		}
+	}
+
+	return spec
+}
+
+// ContainerSpec defines the desired state of a container in a service.
+// ATTENTION: after changing this struct, verify if deploy.EvalContainerSpecChange needs to be updated.
+type ContainerSpec struct {
+	// Command overrides the default CMD of the image to be executed when running a container.
+	Command []string
+	// Entrypoint overrides the default ENTRYPOINT of the image.
+	Entrypoint []string
+	// Env defines the environment variables to set inside the container.
+	Env   EnvVars
+	Image string
+	// Run a custom init inside the container. If nil, use the daemon's configured settings.
+	Init *bool
+	// LogDriver overrides the default logging driver for the container. Each Docker daemon can have its own default.
+	LogDriver *LogDriver
+	// Privileged gives extended privileges to the container. This is a security risk and should be used with caution.
+	Privileged bool
+	// PullPolicy determines when to pull the image from the registry or use the image already available in the cluster.
+	// Default is PullPolicyMissing if empty.
+	PullPolicy string
+	// Resource allocation for the container.
+	Resources ContainerResources
+	// User overrides the default user of the image used to run the container. Format: user|UID[:group|GID].
+	User string
+	// VolumeMounts specifies how volumes are mounted into the container filesystem.
+	// Each mount references a volume defined in ServiceSpec.Volumes.
+	VolumeMounts []VolumeMount
+	// Volumes is list of data volumes to mount into the container.
+	// TODO(lhf): delete all usage, has been replaced with []VolumeMounts.
+	Volumes []string
+}
+
+// SetDefaults returns a copy of the container spec with default values set.
+func (s *ContainerSpec) SetDefaults() ContainerSpec {
+	spec := s.Clone()
+	if spec.PullPolicy == "" {
+		spec.PullPolicy = PullPolicyMissing
+	}
+
+	return spec
+}
+
+func (s *ContainerSpec) Validate() error {
+	if _, err := reference.ParseDockerRef(s.Image); err != nil {
+		return fmt.Errorf("invalid image '%s': %w", s.Image, err)
+	}
+
+	for _, m := range s.VolumeMounts {
+		if err := m.Validate(); err != nil {
+			return fmt.Errorf("invalid volume mount: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func (s *ContainerSpec) Equals(spec ContainerSpec) bool {
+	orig := s.SetDefaults()
+	spec = spec.SetDefaults()
+
+	slices.Sort(orig.Volumes)
+	slices.Sort(spec.Volumes)
+
+	sortVolumeMounts(orig.VolumeMounts)
+	sortVolumeMounts(spec.VolumeMounts)
+
+	return cmp.Equal(orig, spec, cmpopts.EquateEmpty())
+}
+
+func (s *ContainerSpec) Clone() ContainerSpec {
+	spec := *s
+
+	if s.Command != nil {
+		spec.Command = make([]string, len(s.Command))
+		copy(spec.Command, s.Command)
+	}
+	if s.Entrypoint != nil {
+		spec.Entrypoint = make([]string, len(s.Entrypoint))
+		copy(spec.Entrypoint, s.Entrypoint)
+	}
+	if s.LogDriver != nil {
+		logDriver := *s.LogDriver
+		if s.LogDriver.Options != nil {
+			logDriver.Options = maps.Clone(s.LogDriver.Options)
+		}
+		spec.LogDriver = &logDriver
+	}
+	if s.Volumes != nil {
+		spec.Volumes = make([]string, len(s.Volumes))
+		copy(spec.Volumes, s.Volumes)
+	}
+	if s.VolumeMounts != nil {
+		spec.VolumeMounts = make([]VolumeMount, len(s.VolumeMounts))
+		copy(spec.VolumeMounts, s.VolumeMounts)
+	}
+
+	return spec
+}
+
+type EnvVars map[string]string
+
+// ToSlice converts the environment variables to a slice of strings in the format "key=value".
+func (e EnvVars) ToSlice() []string {
+	env := make([]string, 0, len(e))
+	for k, v := range e {
+		if k == "" {
+			continue
+		}
+		env = append(env, fmt.Sprintf("%s=%s", k, v))
+	}
+	return env
+}
+
+type LogDriver struct {
+	// Name of the logging driver to use.
+	Name string
+	// Options is the configuration options to pass to the logging driver.
+	Options map[string]string
+}
+
+type RunServiceResponse struct {
+	ID   string
+	Name string
+}
+
+type Service struct {
+	ID         string
+	Name       string
+	Mode       string
+	Containers []MachineServiceContainer
+}
+
+type MachineServiceContainer struct {
+	MachineID string
+	Container ServiceContainer
+}
+
+// Endpoints returns the exposed HTTP and HTTPS endpoints of the service.
+func (s *Service) Endpoints() []string {
+	endpoints := make(map[string]struct{})
+
+	// Container specs may differ between containers in the same service, e.g. during a rolling update,
+	// so we need to collect all unique endpoints.
+	for _, ctr := range s.Containers {
+		ports, err := ctr.Container.ServicePorts()
+		if err != nil {
+			continue
+		}
+
+		for _, port := range ports {
+			protocol := ""
+			switch port.Protocol {
+			case ProtocolHTTP:
+				protocol = "http"
+			case ProtocolHTTPS:
+				protocol = "https"
+			default:
+				continue
+			}
+
+			if port.Hostname == "" {
+				// There shouldn't be http(s) ports without a hostname but just in case ignore them.
+				continue
+			}
+
+			endpoint := fmt.Sprintf("%s://%s", protocol, port.Hostname)
+			if port.PublishedPort != 0 {
+				// For non-standard ports (80/443), include the port in the URL.
+				if !(port.Protocol == ProtocolHTTP && port.PublishedPort == 80) &&
+					!(port.Protocol == ProtocolHTTPS && port.PublishedPort == 443) {
+					endpoint += fmt.Sprintf(":%d", port.PublishedPort)
+				}
+			}
+
+			endpoint += fmt.Sprintf(" → :%d", port.ContainerPort)
+			endpoints[endpoint] = struct{}{}
+		}
+	}
+
+	return slices.Sorted(maps.Keys(endpoints))
+}
+
+func ServiceFromProto(s *pb.Service) (Service, error) {
+	var err error
+	containers := make([]MachineServiceContainer, len(s.Containers))
+	for i, sc := range s.Containers {
+		containers[i], err = machineContainerFromProto(sc)
+		if err != nil {
+			return Service{}, err
+		}
+	}
+
+	return Service{
+		ID:         s.Id,
+		Name:       s.Name,
+		Mode:       s.Mode,
+		Containers: containers,
+	}, nil
+}
+
+func machineContainerFromProto(sc *pb.Service_Container) (MachineServiceContainer, error) {
+	var c Container
+	if err := json.Unmarshal(sc.Container, &c); err != nil {
+		return MachineServiceContainer{}, fmt.Errorf("unmarshal container: %w", err)
+	}
+
+	return MachineServiceContainer{
+		MachineID: sc.MachineId,
+		Container: ServiceContainer{Container: c},
+	}, nil
+}