fix(push): always provide encoded empty auth config to work around panic in Docker

* Set machine id in service container ENV

* Add machine id to clone of the container's env map to avoid exposing serialization format

* fix: panic on setting UNCLOUD_MACHINE_ID env var when Env is nil in the spec

---------

Co-authored-by: Pasha Sviderski <me@psviderski.name>

.editorconfig

@@ -0,0 +1,20 @@
+# EditorConfig is awesome: https://editorconfig.org
+
+root = true
+
+# Default settings for all files
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+# Settings for Go files
+[*.go]
+indent_style = tab
+indent_size = 4
+
+# Settings for Bash scripts
+[*.sh]
+indent_style = space
+indent_size = 4

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: [psviderski]

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,36 @@
+---
+name: Bug Report
+about: Create a report to help us improve
+title: "[BUG] "
+labels: bug
+assignees: ""
+---
+
+**Describe the bug**
+
+<!-- A clear and concise description of what the bug is. -->
+
+**How to reproduce**
+
+<!-- Steps to reproduce the behavior:
+
+1. Run ...
+2. Do ...
+-->
+
+**Expected behavior**
+
+<!-- A clear and concise description of what you expected to happen. -->
+
+**Environment:**
+
+- Uncloud versions:
+  - Control (client) node (`uc --version`):
+  - Uncloud daemon (from the server) (`uncloudd --version`):
+- OS version (`uname -a`):
+  - Client (control node):
+  - Server:
+
+**Additional context**
+
+<!-- Add any other context about the problem here. -->

.github/copilot-instructions.md

@@ -0,0 +1 @@
+../AI.md

.github/workflows/go-tests.yml

@@ -0,0 +1,69 @@
+name: Go Tests
+on:
+  push:
+    branches:
+      - "main"
+      - "test/**"
+      - "release/**"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/**"
+      - "**.go"
+      - "**.proto"
+      - "go.*"
+      - "Makefile"
+      - "scripts/**"
+      - "test/**"
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: "1.25.1"
+
+      - name: Install dependencies
+        run: |
+          go mod tidy
+          git diff --exit-code ||
+            (echo "go.mod or go.sum has changed. Please run 'go mod tidy' and commit the changes." && exit 1)
+
+      - name: Run tests
+        run: |
+          make ucind-image
+          make test
+    timeout-minutes: 10
+
+  check-protobuf:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    strategy:
+      matrix:
+        # Run on more platforms so that mise lockfile checksums are checked/generated for all platforms.
+        # See https://github.com/jdx/mise/issues/4276 for details.
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install Mise
+        uses: jdx/mise-action@13abe502c30c1559a5c37dff303831bab82c9402 # v2.2.3
+        with:
+          version: "2025.9.6"
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Generate Protobuf files
+        run: |
+          make proto
+          # check if the generated files are up to date
+          git diff --exit-code ||
+            (echo "Generated protobuf files are not up to date. Please run 'make proto' and commit the changes." && exit 1)

.github/workflows/lint.yml

@@ -0,0 +1,39 @@
+name: Lint
+on:
+  push:
+    branches:
+      - "main"
+      - "test/**"
+      - "release/**"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "**.go"
+      - "go.*"
+permissions:
+  contents: read
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        with:
+          go-version: "1.25.1"
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        with:
+          version: v2.4.0
+
+      - name: Format code
+        run: |
+          make format
+          git diff --exit-code ||
+            (echo "Code is not formatted. Please run 'make format' and commit the changes." && exit 1)
+
+    timeout-minutes: 10

.gitignore

@@ -30,6 +30,7 @@ go.work.sum
 /data/
 /dist/
 /uc
+/tmp
 
 # Web
 node_modules/

.golangci.yaml

@@ -0,0 +1,42 @@
+version: "2"
+
+run:
+  concurrency: 4
+  tests: true
+  timeout: 5m
+
+linters:
+  default: none
+  enable:
+    - bodyclose
+    # - dogsled
+    - dupl
+    # - errcheck
+    - gochecknoinits
+    - goconst
+    # - gocritic
+    # - gocyclo
+    # - godot
+    # - gosec
+    # - govet
+    - ineffassign
+    - misspell
+    - nakedret
+    # - prealloc
+    # - revive
+    # - staticcheck
+    - unconvert
+    # - unparam
+    # - unused
+    - whitespace
+  exclusions:
+    rules:
+      - path: ^test/e2e
+        linters:
+          - goconst  # constants here add no value, so we skip goconst only for test/e2e.
+
+formatters:
+  enable:
+    - gofumpt
+    - goimports
+

.mise.lock

@@ -0,0 +1,97 @@
+[[tools."aqua:vektra/mockery"]]
+version = "3.5.3"
+backend = "aqua:vektra/mockery"
+
+[tools."aqua:vektra/mockery".platforms.linux-x64]
+checksum = "sha256:ebce416b0175338525246c376885a1579ca6cd4d4015140ba0c70e6b5339a39c"
+size = 5498859
+url = "https://github.com/vektra/mockery/releases/download/v3.5.3/mockery_3.5.3_Linux_x86_64.tar.gz"
+
+[tools."aqua:vektra/mockery".platforms.macos-arm64]
+checksum = "sha256:a3a94b14c7414e148f2252199ffc4a0108d311358f3d336cbe05bb73cb203704"
+size = 5238877
+url = "https://github.com/vektra/mockery/releases/download/v3.5.3/mockery_3.5.3_Darwin_arm64.tar.gz"
+
+[[tools.go]]
+version = "1.25.1"
+backend = "core:go"
+
+[tools.go.platforms.linux-x64]
+checksum = "sha256:7716a0d940a0f6ae8e1f3b3f4f36299dc53e31b16840dbd171254312c41ca12e"
+size = 59660846
+url = "https://dl.google.com/go/go1.25.1.linux-amd64.tar.gz"
+
+[tools.go.platforms.macos-arm64]
+checksum = "sha256:68deebb214f39d542e518ebb0598a406ab1b5a22bba8ec9ade9f55fb4dd94a6c"
+size = 57906702
+url = "https://dl.google.com/go/go1.25.1.darwin-arm64.tar.gz"
+
+[[tools.golangci-lint]]
+version = "2.4.0"
+backend = "aqua:golangci/golangci-lint"
+
+[tools.golangci-lint.platforms.linux-x64]
+checksum = "sha256:fae792524c04424c0ac369f5b8076f04b45cf29fc945a370e55d369a8dc11840"
+size = 14126779
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.4.0/golangci-lint-2.4.0-linux-amd64.tar.gz"
+
+[tools.golangci-lint.platforms.macos-arm64]
+checksum = "sha256:cd4dd53fa09b6646baff5fd22b8c64d91db02c21c7496df27992d75d34feec59"
+size = 13542526
+url = "https://github.com/golangci/golangci-lint/releases/download/v2.4.0/golangci-lint-2.4.0-darwin-arm64.tar.gz"
+
+[[tools.node]]
+version = "22.20.0"
+backend = "core:node"
+
+[tools.node.platforms.linux-x64]
+checksum = "sha256:eeaccb0378b79406f2208e8b37a62479c70595e20be6b659125eb77dd1ab2a29"
+size = 56645685
+url = "https://nodejs.org/dist/v22.20.0/node-v22.20.0-linux-x64.tar.gz"
+
+[tools.node.platforms.macos-arm64]
+checksum = "sha256:cc04a76a09f79290194c0646f48fec40354d88969bec467789a5d55dd097f949"
+size = 49838299
+url = "https://nodejs.org/dist/v22.20.0/node-v22.20.0-darwin-arm64.tar.gz"
+
+[[tools.protoc]]
+version = "27.3"
+backend = "aqua:protocolbuffers/protobuf/protoc"
+
+[tools.protoc.platforms.linux-x64]
+checksum = "blake3:8c2938accf7061164ea3968529a47ced1db4824ca553857f6903c68ae4347739"
+size = 3235873
+url = "https://github.com/protocolbuffers/protobuf/releases/download/v27.3/protoc-27.3-linux-x86_64.zip"
+
+[tools.protoc.platforms.macos-arm64]
+checksum = "blake3:650c2494c003e9fddd6f4164a0a36e31da51ae7e1e5208da8cb560a4fe886fcd"
+size = 2372763
+url = "https://github.com/protocolbuffers/protobuf/releases/download/v27.3/protoc-27.3-osx-aarch_64.zip"
+
+[[tools.protoc-gen-go]]
+version = "1.34.2"
+backend = "aqua:protocolbuffers/protobuf-go/protoc-gen-go"
+
+[tools.protoc-gen-go.platforms.linux-x64]
+checksum = "blake3:f765e393e0f0b25070c13848d88f5e6303e66090132afa1b753e981507a4174e"
+size = 1848331
+url = "https://github.com/protocolbuffers/protobuf-go/releases/download/v1.34.2/protoc-gen-go.v1.34.2.linux.amd64.tar.gz"
+
+[tools.protoc-gen-go.platforms.macos-arm64]
+checksum = "blake3:c237256a7f718ac4ccdc037ee30025a0b7c3f79300d7831ec59d76d782443fd5"
+size = 1784028
+url = "https://github.com/protocolbuffers/protobuf-go/releases/download/v1.34.2/protoc-gen-go.v1.34.2.darwin.arm64.tar.gz"
+
+[[tools.protoc-gen-go-grpc]]
+version = "1.5.1"
+backend = "aqua:grpc/grpc-go/protoc-gen-go-grpc"
+
+[tools.protoc-gen-go-grpc.platforms.linux-x64]
+checksum = "blake3:197739132f0408f017d0c83773ac1ace85c0572473fdd658ec6e4ccbf20e0552"
+size = 4859466
+url = "https://github.com/grpc/grpc-go/releases/download/cmd/protoc-gen-go-grpc/v1.5.1/protoc-gen-go-grpc.v1.5.1.linux.amd64.tar.gz"
+
+[tools.protoc-gen-go-grpc.platforms.macos-arm64]
+checksum = "blake3:3c668207565d23ea2cf006d699207e3a804ebb929a534bd38a3b4ff4e941e00c"
+size = 4565944
+url = "https://github.com/grpc/grpc-go/releases/download/cmd/protoc-gen-go-grpc/v1.5.1/protoc-gen-go-grpc.v1.5.1.darwin.arm64.tar.gz"

.mise.toml

@@ -1,5 +1,14 @@
+[settings]
+experimental = true
+
 [tools]
-go = "1.23"
+"aqua:vektra/mockery" = "3.5.3"
+go = "1.25.1"
+golangci-lint = "2.4.0"
+node = "22.20.0"
+protoc = "27.3"
+protoc-gen-go = "1.34.2"
+protoc-gen-go-grpc = "1.5.1"
 
 [env]
 _.file = ".env"

.mockery.yml

@@ -0,0 +1,4 @@
+packages:
+  github.com/psviderski/uncloud/internal/machine/caddyconfig:
+    interfaces:
+      CaddyfileValidator:

AI.md

@@ -0,0 +1,258 @@
+# AI.md - Uncloud Project Guide
+
+This document provides comprehensive information about the Uncloud project for AI assistants to understand the codebase, architecture, and development practices.
+
+## Project Overview
+
+**Uncloud** is a lightweight clustering and container orchestration tool that enables deployment and management of web applications across cloud VMs and bare metal servers. It creates a secure WireGuard mesh network between Docker hosts and provides automatic service discovery, load balancing, HTTPS ingress, and simple CLI commands for application management.
+
+### Key Characteristics
+
+- **Language**: Go
+- **Architecture**: Decentralized, no control plane
+- **Target**: Self-hosted infrastructure without Kubernetes complexity
+- **License**: View LICENSE file for details
+- **Status**: Active development, not yet ready for production
+
+## Core Features
+
+### 🏗️ Infrastructure
+
+- **Multi-machine deployment**: Combine cloud VMs, dedicated servers, and bare metal
+- **Zero-config networking**: Automatic WireGuard mesh with NAT traversal
+- **Decentralized design**: No central control plane, all machines are equal
+- **Service discovery**: Built-in DNS server resolves service names to container IPs
+
+### 🚀 Application Management
+
+- **Docker Compose compatibility**: Uses familiar Docker Compose format
+- **Zero-downtime deployments**: Rolling updates without service interruption
+- **Automatic HTTPS**: Caddy reverse proxy with Let's Encrypt integration
+- **Managed DNS**: Free `*.cluster.uncloud.run` subdomains via Uncloud DNS service
+- **Cross-machine scaling**: Run containers across multiple machines
+
+### 🔧 Developer Experience
+
+- **Docker-like CLI**: Familiar commands (`uc` binary)
+- **Imperative operations**: Direct commands vs. declarative state reconciliation
+- **Remote management**: Control entire infrastructure via SSH to any machine
+- **Minimal overhead**: ~150MB RAM footprint per machine
+
+## Architecture
+
+### Core Components
+
+1. **CLI (`uc`)** - Main user interface for cluster management
+2. **Daemon (`uncloudd`)** - Machine daemon running on each node
+3. **Corrosion** - Distributed SQLite database for cluster state (Fly.io project)
+4. **Caddy** - Reverse proxy for HTTPS termination and routing
+5. **WireGuard** - Secure mesh networking between machines
+
+### Network Architecture
+
+- Each machine gets unique subnet (e.g., `10.210.0.0/24`, `10.210.1.0/24`)
+- Containers get cluster-unique IPs for direct communication
+- Automatic peer discovery and key management
+- NAT traversal for machines behind firewalls
+
+### State Management
+
+- **CRDT-based distributed storage** using Corrosion
+- **Eventually consistent** state across all machines
+- **Gossip protocol** (Serf) for state propagation
+- **No quorum requirements** - partial network splits remain functional
+
+## Project Structure
+
+### Key Directories
+
+- **`cmd/`**: Contains main applications
+
+  - `uncloud/`: CLI tool with subcommands for machine, service, volume management
+  - `uncloudd/`: Daemon that runs on each machine
+  - `ucind/`: Development cluster management for testing
+
+- **`internal/`**: Internal implementation packages
+
+  - `cli/`: Command-line interface logic
+  - `machine/`: Machine lifecycle and state management
+  - `daemon/`: Daemon implementation and gRPC services
+  - `dns/`: Internal DNS server for service discovery
+
+- **`pkg/`**: Public API packages for external use
+
+  - `api/`: Core API types and definitions
+  - `client/`: Client libraries for interacting with Uncloud
+
+- **`experiment/`**: Experimental features and prototypes
+- **`scripts/`**: Installation and utility scripts
+- **`test/`**: Test suites and test infrastructure
+- **`website/`**: Documentation website (Docusaurus)
+
+  - `landing/`: Landing page
+  - `docs/`: User documentation
+
+- **`misc/`**: Design documents and guides
+
+## Key Technologies
+
+### Core Dependencies
+
+```go
+// Networking and orchestration
+github.com/docker/docker                   // Docker API client
+github.com/docker/compose/v2               // Docker Compose integration
+golang.zx2c4.com/wireguard                 // WireGuard implementation
+github.com/hashicorp/serf                  // Gossip protocol
+
+// State management
+github.com/ipfs/go-ds-crdt                 // CRDT distributed storage
+github.com/dgraph-io/badger/v3             // Embedded database
+
+// Web proxy
+github.com/caddyserver/caddy/v2            // HTTP server and reverse proxy
+
+// CLI and UX
+github.com/spf13/cobra                     // CLI framework
+github.com/charmbracelet/huh               // Interactive forms
+
+// gRPC and networking
+google.golang.org/grpc                     // gRPC framework
+github.com/siderolabs/grpc-proxy           // gRPC proxy for forwarding
+```
+
+## Development Workflow
+
+### Build and Development
+
+```bash
+# Build binaries
+go build -o uncloud ./cmd/uncloud
+go build -o uncloudd ./cmd/uncloudd
+```
+
+### Key Make Targets
+
+- `proto`: Generate protobuf code
+- `ucind-cluster`: Create development cluster
+- `update-dev`: Deploy to development machines
+- `demo-reset`: Reset demo environment
+- `fmt`: Format code
+- `test`: Run all tests
+- `lint`: Lint the code using golangci-lint
+- `lint-and-fix`: Lint the code and fix issues whenever possible
+
+## CLI Commands Structure
+
+The `uc` CLI provides these main command groups:
+
+### Machine Management
+
+```bash
+uc machine init <user@host>     # Initialize new cluster
+uc machine add <user@host>      # Add machine to cluster
+uc machine ls                   # List machines
+uc machine rm <name>            # Remove machine
+```
+
+### Service Management
+
+```bash
+uc run <image>                  # Run container from image
+uc deploy                       # Deploy from compose.yaml
+uc scale <service> <count>      # Scale service replicas
+uc ls                           # List services
+uc rm <service>                 # Remove service
+```
+
+### Context and Connectivity
+
+```bash
+uc context ls                   # List available contexts
+uc context use <name>           # Switch context
+```
+
+### Global Flags
+
+- `--connect`: Connect to remote machine directly, without a config file
+- `--uncloud-config`: Override config file path
+
+## Development Guidelines
+
+### Code Organization
+
+- **Package naming**: Use clear, descriptive names
+- **Error handling**: Wrap errors with context using `fmt.Errorf`
+- **Logging**: Use structured logging with levels
+- **gRPC**: Services defined in `internal/machine/api/pb/`
+
+### Testing
+
+- Test files and locations
+  - Unit tests alongside source files (`*_test.go`)
+  - Integration tests in `test/e2e/`
+  - Test fixtures in `test/fixtures/`
+- Use table driven tests whenever possible
+
+### Dependencies
+
+- Prefer standard library when possible
+- Pin versions in `go.mod`
+- Document rationale for external dependencies
+
+### Configuration
+
+- Support environment variables for key settings
+- Validate configuration early
+- Provide sensible defaults
+
+## Troubleshooting and Debugging
+
+### Common Issues
+
+- **Networking**: Check WireGuard status, iptables rules
+- **DNS**: Verify service discovery resolution
+- **Containers**: Use standard Docker debugging tools
+- **State sync**: Check Corrosion logs for replication issues
+
+### Debugging Tools
+
+- Standard Linux networking tools (`ping`, `traceroute`, `wireshark`)
+- Docker commands (`docker ps`, `docker logs`)
+- SSH access to machines for direct inspection
+- gRPC debugging tools
+
+### Logs and Monitoring
+
+- Systemd services (getting logs via `journalctl -u SERVICE_NAME`)
+  - `uncloud` -- Uncloud daemon
+  - `uncloud-corrosion` -- Corrosion process
+- Machine daemon logs
+- Container logs via Docker
+
+## File Patterns and Conventions
+
+### Important Files to Understand
+
+- `cmd/uncloud/main.go`: CLI entry point and command structure
+- `internal/cli/cli.go`: CLI implementation and configuration
+- `internal/machine/machine.go`: Core machine management
+- `pkg/api/`: Public API definitions
+- `misc/design.md`: Architecture and design philosophy
+- `README.md`: Repository README
+
+### Configuration Files
+
+- `go.mod/go.sum`: Go dependency management
+- `Makefile`: Build and development tasks
+- `Dockerfile`: Container build instructions forUncloud-in-Docker (used for testing)
+
+This document should help AI assistants understand the project structure, make informed suggestions, and contribute effectively to the Uncloud codebase.
+
+## Documentation
+
+Instructions when generating documentation:
+
+- Use conversational language – write as if you were speaking to a friend.
+- Keep sentences simple, optimize for clarity and understanding.
+- Place the subject before the action whenever possible. Example: prefer “The function loads data” over “Data is loaded by the function.”

CLAUDE.md

@@ -0,0 +1 @@
+./AI.md

Dockerfile

@@ -1,6 +1,6 @@
 ARG ALPINE_VERSION=3.20.3
 
-FROM golang:1.23.2-alpine AS uncloudd
+FROM golang:1.25.1-alpine AS uncloudd
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -17,13 +17,22 @@ RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd cmd/uncloudd/main
 
 
 FROM alpine:${ALPINE_VERSION} AS corrosion-download
-RUN wget -q -O /tmp/corrosion.tar.gz \
-      https://github.com/psviderski/corrosion/releases/latest/download/corrosion-aarch64-unknown-linux-gnu.tar.gz \
+ARG TARGETARCH
+
+RUN CORROSION_ARCH=$(case "${TARGETARCH}" in \
+      "amd64") echo "x86_64" ;; \
+      "arm64") echo "aarch64" ;; \
+      *) echo "Architecture '${TARGETARCH}' not supported" >&2 && exit 1 ;; \
+    esac) \
+    && wget -q -O /tmp/corrosion.tar.gz \
+      "https://github.com/psviderski/corrosion/releases/latest/download/corrosion-${CORROSION_ARCH}-unknown-linux-gnu.tar.gz" \
     && tar -xzf /tmp/corrosion.tar.gz -C /tmp \
     && install /tmp/corrosion /usr/local/bin/corrosion \
     && rm /tmp/corrosion.tar.gz /tmp/corrosion
 
-FROM chainguard/wolfi-base:latest AS corrosion
+# Beware that more modern images like chainguard/wolfi-base build glibc with flags that require newer CPU features,
+# e.g. x86-64-v2. So such image may fail with "Fatal glibc error: CPU does not support x86-64-v2" on older CPUs.
+FROM gcr.io/distroless/cc-debian12:latest AS corrosion
 COPY --from=corrosion-download /usr/local/bin/corrosion /usr/local/bin/corrosion
 CMD ["corrosion", "agent"]
 

Makefile

@@ -38,25 +38,83 @@ demo-reset:
 
 .PHONY: ucind-cluster
 ucind-cluster:
-	go run ./cmd/ucind cluster rm && go run ./cmd/ucind cluster create -m 3
+	go run ./cmd/ucind cluster rm && go run ./cmd/ucind cluster create -m $(if $(MACHINES_COUNT),$(MACHINES_COUNT),3)
 
 .PHONY: proto
 proto:
 	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative \
 		--proto_path=. --proto_path=internal/machine/api/vendor internal/machine/api/pb/*.proto
 
+.PHONY: proto-mise
+proto-mise:
+	mise exec -- protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative \
+		--proto_path=. --proto_path=internal/machine/api/vendor internal/machine/api/pb/*.proto
+
 .PHONY: corrosion-image
 corrosion-image:
 	docker build -t "$(CORROSION_IMAGE)" --target corrosion .
 
-.PHONY: corrosion-image-push
-corrosion-image-push: corrosion-image
-	docker push "$(CORROSION_IMAGE)"
+.PHONY: corrosion-multiarch-image-push
+corrosion-multiarch-image-push:
+	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(CORROSION_IMAGE)" --target corrosion .
 
 .PHONY: ucind-image
 ucind-image:
 	docker build -t "$(UCIND_IMAGE)" --target ucind .
 
-.PHONY: ucind-image-push
-ucind-image-push: ucind-image
-	docker push "$(UCIND_IMAGE)"
+.PHONY: ucind-multiarch-image-push
+ucind-multiarch-image-push:
+	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(UCIND_IMAGE)" --target ucind .
+
+.PHONY: mocks
+mocks:
+	@mockery
+
+.PHONY: test
+test:
+ifeq ($(TEST_NAME),)
+	go test -count=1 -v ./...
+else
+	go test -race -count=1 -v -run ^$(TEST_NAME)$$ ./...
+endif
+
+.PHONY: test-e2e
+test-e2e:
+	go test -race -count=1 -v ./test/e2e
+
+.PHONY: test-clean
+test-clean:
+	@CONTAINERS=$$(docker ps --filter "name=ucind-test" -q); \
+	if [ -n "$$CONTAINERS" ]; then \
+		echo "Killing containers..."; \
+		docker kill $$CONTAINERS; \
+	fi; \
+	CONTAINERS_STOPPED=$$(docker ps -a --filter "name=ucind-test" -q); \
+	if [ -n "$$CONTAINERS_STOPPED" ]; then \
+		echo "Removing stopped containers..."; \
+		docker rm $$CONTAINERS_STOPPED; \
+	else \
+		echo "Nothing to clean."; \
+	fi
+
+.PHONY: vet
+vet:
+	go vet ./...
+
+.PHONY: format fmt
+format fmt:
+	GOOS=linux golangci-lint fmt
+
+LINT_TARGETS := lint lint-and-fix
+.PHONY: $(LINT_TARGETS) _lint
+$(LINT_TARGETS): _lint
+lint: ARGS=
+lint-and-fix: ARGS=--fix
+_lint:
+# Explicitly set OS to Linux to not skip *_linux.go files when running on macOS.
+# Uncloud daemon won't likely support OS other than Linux anytime soon, so for now we can rely on that.
+	GOOS=linux golangci-lint run $(ARGS)
+
+.PHONY: cli-docs
+cli-docs:
+	go run ./cmd/uncloud docs

README.md

@@ -1,28 +1,27 @@
 <div align="center">
-  <img src="./website/images/logo.svg" height="100" alt="Uncloud logo"/>
+  <img src="./website/landing/images/logo.svg" height="100" width="100" alt="Uncloud logo"/>
   <h1>Uncloud</h1>
   <p><strong>Docker simplicity. Multi-machine power.</strong></p>
+
+  <p>
+    <a href="https://uncloud.run/docs"><img src="https://img.shields.io/badge/Docs-blue.svg?style=for-the-badge&logo=gitbook&logoColor=white" alt="Documentation"></a>
+    <a href="https://discord.gg/eR35KQJhPu"><img src="https://img.shields.io/badge/discord-5865F2.svg?style=for-the-badge&logo=discord&logoColor=white" alt="Join Discord"></a>
+    <a href="https://x.com/psviderski"><img src="https://img.shields.io/badge/follow-black?style=for-the-badge&logo=X&logoColor=while" alt="Follow on X"></a>
+    <a href="https://github.com/sponsors/psviderski"><img src="https://img.shields.io/badge/Donate-EA4AAA.svg?style=for-the-badge&logo=githubsponsors&logoColor=white" alt="Donate"></a>
+  </p>
 </div>
 
 Uncloud is a lightweight clustering and container orchestration tool that lets you deploy and manage web apps across
-cloud VMs and bare metal with minimized cluster management overhead. It creates a secure WireGuard mesh network between
+cloud VMs and bare metal with minimised cluster management overhead. It creates a secure WireGuard mesh network between
 your Docker hosts and provides automatic service discovery, load balancing, ingress with HTTPS, and simple CLI commands
 to manage your apps.
 
 Unlike traditional orchestrators, there's no central control plane and quorum to maintain. Each machine maintains a
-synchronized copy of the cluster state through peer-to-peer communication, keeping cluster operations functional even if
+synchronised copy of the cluster state through peer-to-peer communication, keeping cluster operations functional even if
 some machines go offline.
 
-Uncloud aims to be the solution for developers who want the flexibility of self-hosted infrastructure without the
-operational complexity of Kubernetes.
-
-## 🎬 Quick demo
-
-Deploy a highly available web app with automatic HTTPS across multiple regions and on-premises in just a couple minutes.
-
-<a href="https://uncloud.wistia.com/medias/k47uwt9uau?wvideo=k47uwt9uau">
-<img src="https://embed-ssl.wistia.com/deliveries/3cf7014a48b93afc556444bed3e39a8c.jpg?image_crop_resized=900x526&image_play_button_rounded=true&image_play_button_size=2x&image_play_button_color=18181Be0" alt="Uncloud demo" width="450" height="263" />
-</a>
+Uncloud is the solution for developers who want the flexibility of self-hosted infrastructure without the operational
+complexity of Kubernetes.
 
 ## ✨ Features
 
@@ -36,7 +35,7 @@ Deploy a highly available web app with automatic HTTPS across multiple regions a
 * **Persistent storage**: Run stateful services with Docker volumes managed across machines.
 * **Zero-config private network**: Automatic WireGuard mesh with peer discovery and NAT traversal. Containers get unique
   IPs for direct cross-machine communication.
-* **No control plane**: Fully decentralized design eliminates single points of failure and reduces operational overhead.
+* **No control plane**: Fully decentralised design eliminates single points of failure and reduces operational overhead.
 * **Imperative over declarative**: Favoring imperative operations over state reconciliation simplifies both the mental
   model and troubleshooting.
 * **Managed DNS**: Automatic DNS records `*.<id>.cluster.uncloud.run` for services with public access via managed
@@ -46,15 +45,27 @@ Deploy a highly available web app with automatic HTTPS across multiple regions a
 * **Docker-like CLI**: Familiar commands for managing both infrastructure and applications.
 * **Remote management**: Control your entire infrastructure through SSH access to any single machine in the cluster.
 
-Coming soon:
+### 🚀 Coming soon
 
-* Project isolation through environments/namespaces
-* Configs and secrets management using providers such as HashiCorp Vault and 1Password
-* Monitoring and log aggregation
+* **[Unregistry](https://github.com/psviderski/unregistry) integration**: Push your Docker images directly to your
+  machines without an external registry. It will transfer only the missing layers, making it fast and efficient.
 
-Here is a diagram of an Uncloud multi-provider cluster of 3 machines:
+## 🎬 Quick demo
 
-![Diagram: multi-provider cluster of 3 machines](website/images/diagram.webp)
+The screenshot below demonstrates how I use Uncloud to deploy https://uncloud.run website to 2 remote machines from
+the [`compose.yaml`](website/compose.yaml) file on my local machine.
+
+It exposes the container port `8000/tcp` as HTTPS on the domain `uncloud.run`, served by the Caddy reverse proxy on the
+remote machines. All managed by Uncloud.
+
+![Uncloud compose deployment demo](.github/images/compose-deploy.jpg)
+
+Here is a more advanced use case. Deploy a highly available web app with automatic HTTPS across multiple regions and
+on-premises in just a couple minutes.
+
+<a href="https://uncloud.wistia.com/medias/k47uwt9uau?wvideo=k47uwt9uau">
+<img src="https://embed-ssl.wistia.com/deliveries/3cf7014a48b93afc556444bed3e39a8c.jpg?image_crop_resized=900x526&image_play_button_rounded=true&image_play_button_size=2x&image_play_button_color=18181Be0" alt="Uncloud demo" width="450" height="263" />
+</a>
 
 ## 💫 Why Uncloud?
 
@@ -64,14 +75,15 @@ believe there's a sweet spot in between — a pragmatic solution for the majorit
 scale. You should be able to:
 
 * **Own your infrastructure and data**: Whether driven by costs, compliance, or flexibility, run applications on any
-  combination of cloud VMs and personal hardware while maintaining the cloud-like experience you love.
-* **Stay simple**: Don't worry about control planes, highly-available clusters, or complex YAML configurations for
-  common use cases.
+  combination of cloud VMs and personal hardware while controlling your data and maintaining the cloud-like experience
+  you love.
+* **Stay simple as you grow**: Start with a single machine and add more whenever you need without changing your
+  workflow. No worrying about highly-available control planes or complex YAML configurations.
 * **Build with proven primitives**: Get production-grade networking, deployment primitives, service discovery, load
   balancing, and ingress with HTTPS out of the box without becoming a distributed systems expert.
-* **Support sustainable computing** 🌿: Minimize system overhead to maximize resources available for your applications.
+* **Support sustainable computing** 🌿: Minimise system overhead to maximise resources available for your applications.
 
-Uncloud's goal is to make deployment and management of containerized applications feel as seamless as using a cloud
+Uncloud's goal is to make deployment and management of containerised applications feel as seamless as using a cloud
 platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bare metal servers.
 
 ## 🚀 Quick start
@@ -85,7 +97,9 @@ platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bar
    curl -fsS https://get.uncloud.run/install.sh | sh
    ```
 
-2. Initialize your first machine:
+   See [Installation](https://uncloud.run/docs/getting-started/install-cli) for more options.
+
+2. Initialise your first machine:
 
    ```bash
    uc machine init root@your-server-ip
@@ -116,14 +130,20 @@ platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bar
    uncloud-uninstall
    ```
 
-View the [user guide](docs/user_guide.md) for more information.
+View the [Documentation](https://uncloud.run/docs) for more information.
 
 ## ⚙️ How it works
 
-Check out the [design document](docs/design.md) to understand Uncloud's design philosophy and goals. Here, let's peek
-under the hood to see what happens when you run certain commands.
+Check out the [design document](misc/design.md) to understand Uncloud's design philosophy and goals.
 
-**When you initialize a new cluster on a machine:**
+Here is a diagram of an Uncloud multi-provider cluster of 3 machines:
+
+![Diagram: multi-provider cluster of 3 machines](website/landing/images/diagram.webp)
+
+<details>
+<summary>Peek under the hood to see what happens when you run certain commands.</summary>
+
+**When you initialise a new cluster on a machine:**
 
 ```bash
 $ uc machine init --name oracle-vm ubuntu@152.67.101.197
@@ -256,23 +276,61 @@ Look ma, no control plane or master nodes to maintain! Just a simple overlay net
 sync that lets machines work together. Want to check on things or make changes? Connect to any machine either implicitly
 using the CLI or directly over SSH. They all have the complete cluster state and can control everything. It's like each
 machine is a full backup of your control plane.
+</details>
 
 ## 🏗 Project status
 
 Uncloud is currently in active development and is **not ready for production use**. Features may change significantly
 and there may be breaking changes between releases.
 
-I'd love your input! Here's how you can contribute:
+We'd love your input! Here's how you can contribute:
 
 * 🐛 Found a bug? [Open an issue](https://github.com/psviderski/uncloud/issues)
-* 💡 Have ideas? [Join the discussion](https://github.com/psviderski/uncloud/discussions)
+* 💡 Have questions, ideas, or need help?
+    * Start a discussion or join an existing one in
+      the [Discussions](https://github.com/psviderski/uncloud/discussions).
+    * Join our [Discord community](https://discord.gg/eR35KQJhPu) where we discuss features, roadmap, implementation
+      details, and help each other out.
+
+## 🙏 Inspiration & Acknowledgements
+
+I'm grateful to the following projects that inspired Uncloud's design and implementation:
+
+* [Kamal](https://kamal-deploy.org/) — for proving that even in the declarative era of Kubernetes there is a place for
+  simple deployment tools that use imperative commands without complex orchestration. Kamal powers the multi-billion
+  dollar company [37signals](https://37signals.com/) where it was created, and that's truly inspiring!
+* [Fly.io](https://fly.io/) — for inspiring my vision for what self-hosted infrastructure should feel like, proving that
+  developer experience and powerful infrastructure can coexist beautifully.
+* [Tailscale](https://tailscale.com/) — for pioneering the vision of decentralised flat mesh networking with an amazing
+  user experience that feels like magic.
+* [Talos Linux](https://github.com/siderolabs/talos)
+  and [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/) — for the machine API design using
+  [grpc-proxy](https://github.com/siderolabs/grpc-proxy) and for its elegant approach to secure WireGuard-based overlay
+  networking with zero configuration.
+* [Docker Swarm Classic](https://github.com/docker-archive/classicswarm) and
+  [Rancher 1.x](http://rancher-com-website-main-elb-elb-1798790864.us-west-2.elb.amazonaws.com/docs/rancher/v1.6/en/)
+  — for showing the power of simplicity and pragmatism in container orchestration and that not every problem needs the
+  complexity of Kubernetes.
+
+Special thanks to the [Corrosion](https://github.com/superfly/corrosion) project by Fly.io for providing the distributed
+SQLite database used to share Uncloud's cluster state.
 
 ## 📫 Stay updated
 
-* [Subscribe](https://uncloud.run/#subscribe) to my newsletter to follow the progress, get early insights into new
+* Join our [Discord server](https://discord.gg/eR35KQJhPu) for real-time discussions, support, and updates.
+* Follow [@psviderski](https://x.com/psviderski) on X/Twitter.
+* Subscribe to [my newsletter](https://uncloud.run/#subscribe) to follow the progress, get early insights into new
   features, and be the first to know when it's ready for production use.
 * Watch this repository for releases.
-* Follow [@psviderski](https://x.com/psviderski) on X/Twitter.
+
+## 💖 Sponsors
+
+These companies and projects are helping Uncloud with their generous sponsorship and/or services:
+
+<!-- Sentry -->
+<a href="https://sentry.io/welcome/">
+  <img height="100" alt="Sentry" src="https://github.com/user-attachments/assets/6c1439c0-d20d-40dc-a669-c9aa94651dfa" />
+</a>
 
 ## ❤️ Contributors
 

cmd/ucind/cluster/create.go

@@ -2,8 +2,9 @@ package cluster
 
 import (
 	"fmt"
-	"github.com/spf13/cobra"
+
 	"github.com/psviderski/uncloud/internal/ucind"
+	"github.com/spf13/cobra"
 )
 
 func NewCreateCommand() *cobra.Command {

cmd/ucind/cluster/remove.go

@@ -2,8 +2,9 @@ package cluster
 
 import (
 	"fmt"
-	"github.com/spf13/cobra"
+
 	"github.com/psviderski/uncloud/internal/ucind"
+	"github.com/spf13/cobra"
 )
 
 func NewRemoveCommand() *cobra.Command {

cmd/ucind/cluster/root.go

@@ -13,7 +13,7 @@ func NewRootCommand() *cobra.Command {
 	}
 	cmd.AddCommand(
 		NewCreateCommand(),
-		//NewListCommand(),
+		// NewListCommand(),
 		NewRemoveCommand(),
 	)
 	return cmd

cmd/uncloud/build.go

@@ -0,0 +1,77 @@
+package main
+
+import (
+	"context"
+	"fmt"
+
+	composecli "github.com/compose-spec/compose-go/v2/cli"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/client/compose"
+	"github.com/spf13/cobra"
+)
+
+// NewBuildCommand creates a new command to build services from a Compose file.
+func NewBuildCommand() *cobra.Command {
+	opts := cli.BuildOptions{}
+	cmd := &cobra.Command{
+		Use:   "build [FLAGS] [SERVICE...]",
+		Short: "Build services from a Compose file.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			if len(args) > 0 {
+				opts.Services = args
+			}
+
+			return runBuild(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringSliceVarP(&opts.Files, "file", "f", nil,
+		"One or more Compose files to build (default compose.yaml)")
+	cmd.Flags().StringSliceVarP(&opts.Profiles, "profile", "p", nil,
+		"One or more Compose profiles to enable.")
+	cmd.Flags().BoolVarP(&opts.Push, "push", "P", false,
+		"Push built images to the registry after building. (default false)")
+	cmd.Flags().BoolVarP(&opts.NoCache, "no-cache", "n", false,
+		"Do not use cache when building images. (default false)")
+
+	return cmd
+}
+
+// TODO: deduplicate with a similar functino for deploy options
+// projectOpts returns the project options for the Compose file(s).
+func projectOptsFromBuildOpts(opts cli.BuildOptions) []composecli.ProjectOptionsFn {
+	projectOpts := []composecli.ProjectOptionsFn{}
+
+	if len(opts.Profiles) > 0 {
+		projectOpts = append(projectOpts, composecli.WithDefaultProfiles(opts.Profiles...))
+	}
+
+	return projectOpts
+}
+
+// runBuild parses the Compose file(s), builds the services, and pushes them if requested.
+func runBuild(ctx context.Context, uncli *cli.CLI, opts cli.BuildOptions) error {
+	projectOpts := projectOptsFromBuildOpts(opts)
+	project, err := compose.LoadProject(ctx, opts.Files, projectOpts...)
+	if err != nil {
+		return fmt.Errorf("load compose file(s): %w", err)
+	}
+
+	if len(opts.Services) > 0 {
+		project, err = project.WithSelectedServices(opts.Services)
+		if err != nil {
+			return fmt.Errorf("select services: %w", err)
+		}
+	}
+
+	servicesToBuild := cli.GetServicesThatNeedBuild(project)
+
+	if len(servicesToBuild) == 0 {
+		fmt.Println("No services to build.")
+		return nil
+	}
+
+	return cli.BuildServices(ctx, servicesToBuild, opts)
+}

cmd/uncloud/caddy/config.go

@@ -0,0 +1,76 @@
+package caddy
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/alecthomas/chroma/v2/quick"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type configOptions struct {
+	machine string
+	noColor bool
+	context string
+}
+
+func NewConfigCommand() *cobra.Command {
+	opts := configOptions{}
+
+	cmd := &cobra.Command{
+		Use:   "config",
+		Short: "Show the current Caddy configuration (Caddyfile).",
+		Long:  "Display the current Caddy configuration (Caddyfile) from the connected machine or a specified one.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return runConfig(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
+		"Name or ID of the machine to get the configuration from. (default is connected machine)")
+	cmd.Flags().BoolVar(&opts.noColor, "no-color", false,
+		"Disable syntax highlighting for the output.")
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+
+	return cmd
+}
+
+func runConfig(ctx context.Context, uncli *cli.CLI, opts configOptions) error {
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	if opts.machine != "" {
+		// If a specific machine is requested, use it to get the Caddy configuration.
+		ctx, _, err = api.ProxyMachinesContext(ctx, clusterClient, []string{opts.machine})
+		if err != nil {
+			return err
+		}
+	}
+
+	config, err := clusterClient.Caddy.GetConfig(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("get Caddy config: %w", err)
+	}
+
+	// Print the Caddyfile with syntax highlighting.
+	if opts.noColor {
+		fmt.Print(config.Caddyfile)
+	} else {
+		if err = quick.Highlight(os.Stdout, config.Caddyfile, "caddy", "terminal256", "monokai"); err != nil {
+			// If highlighting fails, fall back to plain output.
+			fmt.Print(config.Caddyfile)
+		}
+	}
+
+	return nil
+}

cmd/uncloud/caddy/deploy.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"maps"
+	"os"
 	"slices"
 	"strings"
 
@@ -18,9 +19,10 @@ import (
 )
 
 type deployOptions struct {
-	image    string
-	machines []string
-	context  string
+	caddyfile string
+	image     string
+	machines  []string
+	context   string
 }
 
 func NewDeployCommand() *cobra.Command {
@@ -37,6 +39,8 @@ func NewDeployCommand() *cobra.Command {
 		},
 	}
 
+	cmd.Flags().StringVar(&opts.caddyfile, "caddyfile", "",
+		"Path to a custom global Caddy config (Caddyfile) that will be prepended to the auto-generated Caddy config.")
 	cmd.Flags().StringVar(&opts.image, "image", "",
 		"Caddy Docker image to deploy. (default caddy:LATEST_VERSION)")
 	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
@@ -51,6 +55,15 @@ func NewDeployCommand() *cobra.Command {
 }
 
 func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
+	caddyfile := ""
+	if opts.caddyfile != "" {
+		data, err := os.ReadFile(opts.caddyfile)
+		if err != nil {
+			return fmt.Errorf("read Caddyfile: %w", err)
+		}
+		caddyfile = strings.TrimSpace(string(data))
+	}
+
 	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
@@ -91,7 +104,7 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 	placement := api.Placement{
 		Machines: cli.ExpandCommaSeparatedValues(opts.machines),
 	}
-	d, err := clusterClient.NewCaddyDeployment(opts.image, placement)
+	d, err := clusterClient.NewCaddyDeployment(opts.image, caddyfile, placement)
 	if err != nil {
 		return fmt.Errorf("create caddy deployment: %w", err)
 	}
@@ -152,7 +165,8 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 }
 
 func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, progressOut *streams.Out) error {
-	if _, err := clusterClient.GetDomain(ctx); err != nil {
+	domain, err := clusterClient.GetDomain(ctx)
+	if err != nil {
 		if errors.Is(err, api.ErrNotFound) {
 			fmt.Println("Skipping DNS records update as no cluster domain is reserved (see 'uc dns').")
 			return nil
@@ -164,7 +178,7 @@ func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, prog
 	// TODO: split the method into two: one to get the records and one to update them to ask for update confirmation.
 
 	var records []*pb.DNSRecord
-	err := progress.RunWithTitle(ctx, func(ctx context.Context) error {
+	err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
 		var err error
 		records, err = clusterClient.CreateIngressRecords(ctx, client.CaddyServiceName)
 		return err
@@ -172,18 +186,19 @@ func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, prog
 	if err != nil {
 		if errors.Is(err, client.ErrNoReachableMachines) {
 			fmt.Println()
-			fmt.Println("DNS records could not be updated as there are no internet-reachable machines running " +
-				"caddy containers.")
+			fmt.Printf("DNS records for domain '%s' could not be updated as there are no internet-reachable "+
+				"machines running caddy containers.\n", domain)
 			fmt.Println()
 			fmt.Println("Possible solutions:")
 			fmt.Println("- Ensure your machines have public IP addresses")
 			fmt.Println("- Use --public-ip flag when adding machines to override the automatically detected IPs")
 			fmt.Println("- Check firewall settings on your machines")
 			fmt.Println("- Configure port forwarding if behind NAT")
-			fmt.Println("- Retry Caddy deployment after resolving connectivity issues with 'uc caddy deploy'")
+			fmt.Println("- Retry Caddy deployment with 'uc caddy deploy' after resolving connectivity issues")
 			fmt.Println()
-			fmt.Println("Your services will not be accessible from the internet until at least one machine " +
-				"becomes reachable.")
+			fmt.Println("Your services won't be accessible from the internet until at least one machine " +
+				"becomes reachable. If you aren't planning to expose any services publicly, you can release " +
+				"the domain by running 'uc dns release'.")
 		}
 		return fmt.Errorf("failed to update DNS records pointing to caddy service: %w", err)
 	}

cmd/uncloud/caddy/root.go

@@ -10,6 +10,7 @@ func NewRootCommand() *cobra.Command {
 		Short: "Manage Caddy reverse proxy service.",
 	}
 	cmd.AddCommand(
+		NewConfigCommand(),
 		NewDeployCommand(),
 	)
 	return cmd

cmd/uncloud/context/ls.go

@@ -12,8 +12,6 @@ import (
 )
 
 func NewListCommand() *cobra.Command {
-	var clusterContext string
-
 	cmd := &cobra.Command{
 		Use:     "ls",
 		Aliases: []string{"list"},
@@ -24,11 +22,6 @@ func NewListCommand() *cobra.Command {
 		},
 	}
 
-	cmd.Flags().StringVarP(
-		&clusterContext, "context", "c", "",
-		"Name of the cluster context. (default is the current context)",
-	)
-
 	return cmd
 }
 
@@ -51,7 +44,7 @@ func list(uncli *cli.CLI) error {
 	for _, name := range contextNames {
 		current := ""
 		if name == currentContext {
-			current = "*"
+			current = "✓"
 		}
 		connCount := len(uncli.Config.Contexts[name].Connections)
 		fmt.Fprintf(tw, "%s\t%s\t%d\n", name, current, connCount)

cmd/uncloud/deploy.go

@@ -20,6 +20,9 @@ type deployOptions struct {
 	files    []string
 	profiles []string
 	services []string
+	noBuild  bool
+	recreate bool
+	yes      bool
 
 	context string
 }
@@ -31,6 +34,8 @@ func NewDeployCommand() *cobra.Command {
 		Use:   "deploy [FLAGS] [SERVICE...]",
 		Short: "Deploy services from a Compose file.",
 		RunE: func(cmd *cobra.Command, args []string) error {
+			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
+
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
 
 			if len(args) > 0 {
@@ -41,12 +46,20 @@ func NewDeployCommand() *cobra.Command {
 		},
 	}
 
-	cmd.Flags().StringSliceVarP(&opts.files, "file", "f", nil,
-		"One or more Compose files to deploy services from. (default compose.yaml)")
-	cmd.Flags().StringSliceVarP(&opts.profiles, "profile", "p", nil,
-		"One or more Compose profiles to enable.")
 	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
 		"Name of the cluster context to deploy to (default is the current context)")
+	cmd.Flags().StringSliceVarP(&opts.files, "file", "f", nil,
+		"One or more Compose files to deploy services from. (default compose.yaml)")
+	cmd.Flags().BoolVarP(&opts.noBuild, "no-build", "n", false,
+		"Do not build images before deploying services. (default false)")
+	cmd.Flags().StringSliceVarP(&opts.profiles, "profile", "p", nil,
+		"One or more Compose profiles to enable.")
+	cmd.Flags().BoolVar(&opts.recreate, "recreate", false,
+		"Recreate containers even if their configuration and image haven't changed.")
+	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
+		"Auto-confirm deployment plan. Should be explicitly set when running non-interactively,\n"+
+			"e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")
+
 	// TODO: Consider adding a filter flag to specify which machines to deploy to but keep the rest running.
 	//  Could be useful to test a new version on a subset of machines before rolling out to all.
 
@@ -81,13 +94,34 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 		}
 	}
 
+	servicesToBuild := cli.GetServicesThatNeedBuild(project)
+
+	if len(servicesToBuild) > 0 {
+		if opts.noBuild {
+			fmt.Println("Not building services as requested.")
+		} else {
+			buildOpts := cli.BuildOptions{
+				Push:    true,
+				NoCache: false,
+			}
+
+			if err := cli.BuildServices(ctx, servicesToBuild, buildOpts); err != nil {
+				return fmt.Errorf("build services: %w", err)
+			}
+		}
+	}
+
 	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
 	defer clusterClient.Close()
 
-	composeDeploy, err := compose.NewDeployment(ctx, clusterClient, project)
+	var strategy deploy.Strategy
+	if opts.recreate {
+		strategy = &deploy.RollingStrategy{ForceRecreate: true}
+	}
+	composeDeploy, err := compose.NewDeploymentWithStrategy(ctx, clusterClient, project, strategy)
 	if err != nil {
 		return fmt.Errorf("create compose deployment: %w", err)
 	}
@@ -108,13 +142,21 @@ func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
 	}
 	fmt.Println()
 
-	confirmed, err := cli.Confirm()
-	if err != nil {
-		return fmt.Errorf("confirm deployment: %w", err)
-	}
-	if !confirmed {
-		fmt.Println("Cancelled. No changes were made.")
-		return nil
+	// Ask for plan confirmation before proceeding with the deployment unless auto-confirmed with --yes.
+	if !opts.yes {
+		if !cli.IsStdinTerminal() {
+			return errors.New("cannot ask to confirm deployment plan in non-interactive mode, " +
+				"use --yes flag or set UNCLOUD_AUTO_CONFIRM=true to auto-confirm")
+		}
+
+		confirmed, err := cli.Confirm()
+		if err != nil {
+			return fmt.Errorf("confirm deployment: %w", err)
+		}
+		if !confirmed {
+			fmt.Println("Cancelled. No changes were made.")
+			return nil
+		}
 	}
 
 	return progress.RunWithTitle(ctx, func(ctx context.Context) error {

cmd/uncloud/docs.go

@@ -0,0 +1,122 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/cobra/doc"
+)
+
+const docsDir = "website/docs/9-cli-reference"
+
+type cmdWrapper struct {
+	cmd *cobra.Command
+}
+
+// NewDocsCommand creates a new hidden command to generate CLI reference docs.
+func NewDocsCommand() *cobra.Command {
+	wrapper := &cmdWrapper{}
+	cmd := &cobra.Command{
+		Use:                   "docs",
+		Short:                 "Generate Uncloud CLI reference docs",
+		SilenceUsage:          true,
+		DisableFlagsInUseLine: true,
+		Hidden:                true,
+		Args:                  cobra.NoArgs,
+		ValidArgsFunction:     cobra.NoFileCompletions,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			// Remove existing markdown files.
+			mdFiles, err := filepath.Glob(filepath.Join(docsDir, "*.md"))
+			if err != nil {
+				return fmt.Errorf("list existing CLI docs: %w", err)
+			}
+			for _, f := range mdFiles {
+				if err = os.Remove(f); err != nil {
+					return fmt.Errorf("remove '%s': %w", f, err)
+				}
+			}
+
+			// Generate new CLI reference docs.
+			wrapper.cmd.Root().DisableAutoGenTag = true
+			if err := doc.GenMarkdownTree(cmd.Root(), docsDir); err != nil {
+				return fmt.Errorf("generate CLI docs: %w", err)
+			}
+
+			// Remove *completion*.md files that contain malformatted code blocks that break Docusaurus.
+			mdFiles, err = filepath.Glob(filepath.Join(docsDir, "*completion*.md"))
+			if err != nil {
+				return fmt.Errorf("list generated CLI docs: %w", err)
+			}
+			for _, f := range mdFiles {
+				if err = os.Remove(f); err != nil {
+					return fmt.Errorf("remove '%s': %w", f, err)
+				}
+			}
+
+			// Post-process generated markdown files.
+			mdFiles, err = filepath.Glob(filepath.Join(docsDir, "*.md"))
+			if err != nil {
+				return fmt.Errorf("list generated CLI docs: %w", err)
+			}
+
+			for _, f := range mdFiles {
+				if err = postProcessMarkdown(f); err != nil {
+					return fmt.Errorf("post-process '%s': %w", f, err)
+				}
+			}
+
+			return nil
+		},
+	}
+
+	wrapper.cmd = cmd
+	return cmd
+}
+
+// postProcessMarkdown applies transformations to generated markdown files.
+func postProcessMarkdown(filename string) error {
+	data, err := os.ReadFile(filename)
+	if err != nil {
+		return err
+	}
+
+	content := string(data)
+
+	// Replace "SEE ALSO" with "See also".
+	content = strings.ReplaceAll(content, "SEE ALSO", "See also")
+	// Escape <id> to avoid Docusaurus treating it as an HTML tag.
+	content = strings.ReplaceAll(content, "<id>", "\\<id>")
+
+	// Remove broken links to completion docs.
+	if strings.Contains(content, "[uc completion") {
+		lines := strings.Split(content, "\n")
+		var filteredLines []string
+		for _, line := range lines {
+			if !strings.Contains(line, "[uc completion") {
+				filteredLines = append(filteredLines, line)
+			}
+		}
+		content = strings.Join(filteredLines, "\n")
+	}
+
+	// Adjust heading levels. Process from shortest to longest to avoid double replacements.
+	replacements := []struct {
+		old, new string
+	}{
+		{`(?m)^## `, `# `},
+		{`(?m)^### `, `## `},
+		{`(?m)^#### `, `### `},
+		{`(?m)^##### `, `#### `},
+	}
+
+	for _, r := range replacements {
+		re := regexp.MustCompile(r.old)
+		content = re.ReplaceAllString(content, r.new)
+	}
+
+	return os.WriteFile(filename, []byte(content), 0o644)
+}

cmd/uncloud/image/ls.go

@@ -0,0 +1,312 @@
+package image
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/lipgloss/table"
+	"github.com/containerd/platforms"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/go-units"
+	"github.com/muesli/termenv"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type listOptions struct {
+	machines   []string
+	nameFilter string
+	context    string
+}
+
+func NewListCommand() *cobra.Command {
+	opts := listOptions{}
+
+	cmd := &cobra.Command{
+		Use:     "ls [REPO:[TAG]]",
+		Aliases: []string{"list"},
+		Short:   "List images on machines in the cluster.",
+		Long:    "List images on machines in the cluster. By default, on all machines. Optionally filter by image name.",
+		Example: `  # List all images on all machines.
+  uc image ls
+
+  # List images on specific machine.
+  uc image ls -m machine1
+
+  # List images on multiple machines.
+  uc image ls -m machine1,machine2
+
+  # List images filtered by name (with any tag) on all machines.
+  uc image ls myapp
+
+  # List images filtered by name pattern on specific machine.
+  uc image ls "myapp:1.*" -m machine1`,
+		Args: cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if len(args) > 0 {
+				opts.nameFilter = args[0]
+			}
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return list(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
+		"Filter images by machine name or ID. Can be specified multiple times or as a comma-separated list. "+
+			"(default is include all machines)")
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+
+	return cmd
+}
+
+// imageRow represents a single image with its metadata for display.
+type imageRow struct {
+	id           string
+	name         string
+	platforms    string
+	createdHuman string
+	createdUnix  int64
+	size         string
+	inUse        string
+	store        string
+	machine      string
+}
+
+func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	// Get all machines to create ID to name mapping.
+	allMachines, err := clusterClient.ListMachines(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("list machines: %w", err)
+	}
+
+	machineIDToName := make(map[string]string)
+	for _, machineMember := range allMachines {
+		if machineMember.Machine != nil && machineMember.Machine.Id != "" && machineMember.Machine.Name != "" {
+			machineIDToName[machineMember.Machine.Id] = machineMember.Machine.Name
+		}
+	}
+
+	machines := cli.ExpandCommaSeparatedValues(opts.machines)
+
+	clusterImages, err := clusterClient.ListImages(ctx, api.ImageFilter{
+		Machines: machines,
+		Name:     opts.nameFilter,
+	})
+	if err != nil {
+		return fmt.Errorf("list images: %w", err)
+	}
+
+	// Collect all images from all machines.
+	var rows []imageRow
+
+	for _, machineImages := range clusterImages {
+		// Get machine name for better readability.
+		machineName := machineImages.Metadata.Machine
+		if m := allMachines.FindByNameOrID(machineName); m != nil {
+			machineName = m.Machine.Name
+		}
+
+		store := "docker"
+		if machineImages.ContainerdStore {
+			store = "containerd"
+		}
+
+		// Process each image for this machine.
+		for _, img := range machineImages.Images {
+			// Show the first 12 chars without 'sha256:' as the image ID like Docker does.
+			id := strings.TrimPrefix(img.ID, "sha256:")[:12]
+
+			name := "<none>"
+			if len(img.RepoTags) > 0 && img.RepoTags[0] != "<none>:<none>" {
+				name = img.RepoTags[0]
+			}
+
+			imgPlatforms, _ := imagePlatforms(img)
+			formattedPlatforms := formatPlatforms(imgPlatforms)
+
+			created := ""
+			createdAt := time.Unix(img.Created, 0)
+			if !createdAt.IsZero() {
+				created = units.HumanDuration(time.Now().UTC().Sub(createdAt)) + " ago"
+			}
+
+			size := units.HumanSizeWithPrecision(float64(img.Size), 3)
+
+			// Check if the image is in use by any containers. Only supported by Docker API >=1.51
+			inUse := "-"
+			if img.Containers != -1 { // -1 means the info is not available.
+				if img.Containers > 0 {
+					inUse = lipgloss.NewStyle().Foreground(lipgloss.Color("10")).Render("●")
+				} else {
+					inUse = lipgloss.NewStyle().Foreground(lipgloss.Color("8")).Render("○")
+				}
+			}
+
+			rows = append(rows, imageRow{
+				id:           id,
+				name:         name,
+				platforms:    formattedPlatforms,
+				createdHuman: created,
+				createdUnix:  img.Created,
+				size:         size,
+				inUse:        inUse,
+				store:        store,
+				machine:      machineName,
+			})
+		}
+	}
+
+	if len(rows) == 0 {
+		if opts.nameFilter != "" {
+			fmt.Printf("No images matching '%s' found.\n", opts.nameFilter)
+		} else {
+			fmt.Println("No images found.")
+		}
+		return nil
+	}
+
+	// Sort images by name, then by machine name.
+	sort.Slice(rows, func(i, j int) bool {
+		if rows[i].name != rows[j].name {
+			return rows[i].name < rows[j].name
+		}
+		return rows[i].machine < rows[j].machine
+	})
+
+	// Print the images in a table format.
+	fmt.Println(formatImageTable(rows))
+
+	return nil
+}
+
+// imagePlatforms returns a list of platforms supported by the image and a boolean indicating if it's multi-platform.
+func imagePlatforms(img image.Summary) ([]string, bool) {
+	var formattedPlatforms []string
+	multiPlatform := false
+
+	for _, m := range img.Manifests {
+		if m.Kind != image.ManifestKindImage || !m.Available {
+			continue
+		}
+
+		if m.ID != img.ID {
+			// There is an image manifest that has digest different from the main image digest.
+			// This means the image manifest is an index or a manifest list (multi-platform image).
+			multiPlatform = true
+		}
+		formattedPlatforms = append(formattedPlatforms, platforms.Format(m.ImageData.Platform))
+	}
+
+	slices.Sort(formattedPlatforms)
+
+	return formattedPlatforms, multiPlatform
+}
+
+func formatPlatforms(platforms []string) string {
+	if len(platforms) == 0 {
+		return "-"
+	}
+
+	platformStyle := lipgloss.NewStyle().
+		BorderForeground(lipgloss.Color("152")).
+		Foreground(lipgloss.Color("0")).
+		Background(lipgloss.Color("152"))
+	// Use fancy pill borders only if the output is a terminal with color support.
+	if lipgloss.ColorProfile() != termenv.Ascii {
+		platformStyle = platformStyle.Border(lipgloss.Border{Left: "", Right: ""}, false, true, false, true)
+	}
+
+	styledPlatforms := make([]string, len(platforms))
+	for i, p := range platforms {
+		styledPlatforms[i] = platformStyle.Render(p)
+	}
+
+	return strings.Join(styledPlatforms, " ")
+}
+
+func formatImageTable(rows []imageRow) string {
+	columns := []struct {
+		name string
+		hide bool
+	}{
+		{name: "IMAGE ID"},
+		{name: "NAME"},
+		{name: "PLATFORMS"},
+		{name: "CREATED"},
+		{name: "SIZE"},
+		{name: "IN USE"},
+		{name: "STORE"},
+		{name: "MACHINE"},
+	}
+
+	// Hide the "IN USE" column if none of the images have that info available.
+	inUseInfoAvailable := slices.ContainsFunc(rows, func(r imageRow) bool {
+		return r.inUse != "-"
+	})
+	if !inUseInfoAvailable {
+		// Hide "IN USE" column.
+		columns[5].hide = true
+	}
+
+	t := table.New().
+		// Remove the default border.
+		Border(lipgloss.Border{}).
+		BorderTop(false).
+		BorderBottom(false).
+		BorderLeft(false).
+		BorderRight(false).
+		BorderHeader(false).
+		BorderColumn(false).
+		StyleFunc(func(row, col int) lipgloss.Style {
+			if row == table.HeaderRow {
+				return lipgloss.NewStyle().Bold(true).PaddingRight(3)
+			}
+			// Regular style for data rows with padding.
+			return lipgloss.NewStyle().PaddingRight(3)
+		})
+
+	var headers []string
+	for _, col := range columns {
+		if !col.hide {
+			headers = append(headers, col.name)
+		}
+	}
+	t.Headers(headers...)
+
+	for _, row := range rows {
+		values := []string{
+			row.id,
+			row.name,
+			row.platforms,
+			row.createdHuman,
+			row.size,
+			row.inUse,
+			row.store,
+			row.machine,
+		}
+		var filteredValues []string
+		for i, v := range values {
+			if !columns[i].hide {
+				filteredValues = append(filteredValues, v)
+			}
+		}
+		t.Row(filteredValues...)
+	}
+
+	return t.String()
+}

cmd/uncloud/image/push.go

@@ -0,0 +1,100 @@
+package image
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/containerd/platforms"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
+)
+
+type pushOptions struct {
+	image    string
+	machines []string
+	context  string
+	platform string
+}
+
+func NewPushCommand() *cobra.Command {
+	opts := pushOptions{}
+
+	cmd := &cobra.Command{
+		Use:   "push IMAGE",
+		Short: "Upload a local Docker image to the cluster.",
+		Long: `Upload a local Docker image to the cluster transferring only the missing layers.
+The image is uploaded to the machine which CLI is connected to (default) or the specified machine(s).`,
+		Example: `  # Push image to the machine the CLI is connected to.
+  uc image push myapp:latest
+
+  # Push image to specific machine.
+  uc image push myapp:latest -m machine1
+
+  # Push image to multiple machines.
+  uc image push myapp:latest -m machine1,machine2,machine3
+
+  # Push image to all machines in the cluster.
+  uc image push myapp:latest -m all
+
+  # Push a specific platform of a multi-platform image.
+  uc image push myapp:latest --platform linux/amd64`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			opts.image = args[0]
+			return push(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
+		"Machine names to push the image to. Can be specified multiple times or as a comma-separated "+
+			"list of machine names.\n"+
+			"Use 'all' to push to all machines. (default is connected machine)")
+	cmd.Flags().StringVar(
+		&opts.platform, "platform", "",
+		"Push a specific platform of a multi-platform image (e.g., linux/amd64, linux/arm64).\n"+
+			"Local Docker must be configured to use containerd image store to support multi-platform images.",
+	)
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+
+	return cmd
+}
+
+func push(ctx context.Context, uncli *cli.CLI, opts pushOptions) error {
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	machines := cli.ExpandCommaSeparatedValues(opts.machines)
+	pushOpts := client.PushImageOptions{}
+
+	// Special handling for "all" keyword to push to all machines.
+	if len(machines) == 1 && machines[0] == "all" {
+		pushOpts.AllMachines = true
+	} else {
+		pushOpts.Machines = machines
+	}
+
+	if opts.platform != "" {
+		p, err := platforms.Parse(opts.platform)
+		if err != nil {
+			return fmt.Errorf("invalid platform '%s': %w", opts.platform, err)
+		}
+		pushOpts.Platform = &p
+	}
+
+	return progress.RunWithTitle(ctx, func(ctx context.Context) error {
+		if err = clusterClient.PushImage(ctx, opts.image, pushOpts); err != nil {
+			return fmt.Errorf("push image to cluster: %w", err)
+		}
+		return nil
+	}, uncli.ProgressOut(), fmt.Sprintf("Pushing image %s to cluster", opts.image))
+}

cmd/uncloud/image/root.go

@@ -0,0 +1,19 @@
+package image
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func NewRootCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "image",
+		Short: "Manage images on machines in the cluster.",
+	}
+
+	cmd.AddCommand(
+		NewListCommand(),
+		NewPushCommand(),
+	)
+
+	return cmd
+}

cmd/uncloud/images.go

@@ -0,0 +1,19 @@
+package main
+
+import (
+	"strings"
+
+	"github.com/psviderski/uncloud/cmd/uncloud/image"
+	"github.com/spf13/cobra"
+)
+
+// NewImagesCommand returns the 'image ls' command modified to work as 'images'.
+func NewImagesCommand() *cobra.Command {
+	listCmd := image.NewListCommand()
+	listCmd.Use = "images [IMAGE]"
+	// Remove 'list' alias since this command is already an alias.
+	listCmd.Aliases = nil
+	listCmd.Example = strings.ReplaceAll(listCmd.Example, "uc image ls", "uc images")
+
+	return listCmd
+}

cmd/uncloud/machine/add.go

@@ -20,12 +20,13 @@ import (
 )
 
 type addOptions struct {
-	name     string
-	noCaddy  bool
-	publicIP string
-	sshKey   string
-	context  string
-	version  string
+	name      string
+	noCaddy   bool
+	noInstall bool
+	publicIP  string
+	sshKey    string
+	context   string
+	version   string
 }
 
 func NewAddCommand() *cobra.Command {
@@ -41,7 +42,7 @@ func NewAddCommand() *cobra.Command {
 			if err != nil {
 				return fmt.Errorf("parse remote machine: %w", err)
 			}
-			remoteMachine := cli.RemoteMachine{
+			remoteMachine := &cli.RemoteMachine{
 				User:    user,
 				Host:    host,
 				Port:    port,
@@ -56,14 +57,20 @@ func NewAddCommand() *cobra.Command {
 		&opts.noCaddy, "no-caddy", false,
 		"Don't deploy Caddy reverse proxy service to the machine.",
 	)
+	cmd.Flags().BoolVar(
+		&opts.noInstall, "no-install", false,
+		"Skip installation of Docker, Uncloud daemon, and dependencies on the machine. "+
+			"Assumes they're already installed and running.",
+	)
 	cmd.Flags().StringVar(
 		&opts.publicIP, "public-ip", "auto",
 		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
-			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
+			fmt.Sprintf("blank '' or '%s' to disable ingress on this machine, or specify an IP address.", PublicIPNone),
 	)
 	cmd.Flags().StringVarP(
 		&opts.sshKey, "ssh-key", "i", "",
-		"path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
+		fmt.Sprintf("Path to SSH private key for remote login (if not already added to SSH agent). (default %q)",
+			cli.DefaultSSHKeyPath),
 	)
 	cmd.Flags().StringVar(
 		&opts.version, "version", "latest",
@@ -77,12 +84,12 @@ func NewAddCommand() *cobra.Command {
 	return cmd
 }
 
-func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, opts addOptions) error {
+func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine, opts addOptions) error {
 	var publicIP *netip.Addr
 	switch opts.publicIP {
 	case "auto":
 		publicIP = &netip.Addr{}
-	case "", "none":
+	case "", PublicIPNone:
 		publicIP = nil
 	default:
 		ip, err := netip.ParseAddr(opts.publicIP)
@@ -92,16 +99,18 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, o
 		publicIP = &ip
 	}
 
-	machineClient, err := uncli.AddMachine(ctx, cli.AddMachineOptions{
+	clusterClient, machineClient, err := uncli.AddMachine(ctx, cli.AddMachineOptions{
 		Context:       opts.context,
 		MachineName:   opts.name,
 		PublicIP:      publicIP,
 		RemoteMachine: remoteMachine,
+		SkipInstall:   opts.noInstall,
 		Version:       opts.version,
 	})
 	if err != nil {
 		return err
 	}
+	defer clusterClient.Close()
 	defer machineClient.Close()
 
 	if opts.noCaddy {
@@ -117,8 +126,11 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, o
 
 	// Deploy a Caddy service container to the added machine. If caddy service is already deployed on other machines,
 	// use the deployed image version. Otherwise, use the latest version.
+	// NOTE: We use the cluster client to inspect and scale the Caddy service because the newly added machine may have
+	// issues accessing the Machine API of existing machines in the cluster.
+	// See the issue for more details: https://github.com/psviderski/uncloud/issues/65.
 	caddyImage := ""
-	caddySvc, err := machineClient.InspectService(ctx, client.CaddyServiceName)
+	caddySvc, err := clusterClient.InspectService(ctx, client.CaddyServiceName)
 	if err != nil {
 		if !errors.Is(err, api.ErrNotFound) {
 			return fmt.Errorf("inspect caddy service: %w", err)
@@ -141,7 +153,7 @@ func add(ctx context.Context, uncli *cli.CLI, remoteMachine cli.RemoteMachine, o
 
 	// TODO: scale the existing Caddy service to the new machine instead of running a new deployment
 	//  that may cause a small downtime.
-	d, err := machineClient.NewCaddyDeployment(caddyImage, api.Placement{})
+	d, err := clusterClient.NewCaddyDeployment(caddyImage, "", api.Placement{})
 	if err != nil {
 		return fmt.Errorf("create caddy deployment: %w", err)
 	}

cmd/uncloud/machine/constants.go

@@ -0,0 +1,6 @@
+package machine
+
+const (
+	// PublicIPNone is the value used to indicate removal of public IP
+	PublicIPNone = "none"
+)

cmd/uncloud/machine/init.go

@@ -22,6 +22,7 @@ type initOptions struct {
 	network     string
 	noCaddy     bool
 	noDNS       bool
+	noInstall   bool
 	publicIP    string
 	sshKey      string
 	version     string
@@ -33,7 +34,20 @@ func NewInitCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "init [USER@HOST:PORT]",
 		Short: "Initialise a new cluster with a remote machine as the first member.",
-		// TODO: include usage examples of initialising a remote machine.
+		Long: "Initialise a new cluster by setting up a remote machine as the first member.\n" +
+			"This command creates a new context in your Uncloud config to manage the cluster.",
+		Example: `  # Initialise a new cluster with default settings.
+  uc machine init root@<your-server-ip>
+
+  # Initialise with a context name 'prod' in the Uncloud config (~/.config/uncloud/config.yaml) and machine name 'vps1'.
+  uc machine init root@<your-server-ip> -c prod -n vps1
+
+  # Initialise with a non-root user and custom SSH port and key.
+  uc machine init ubuntu@<your-server-ip>:2222 -i ~/.ssh/mykey
+
+  # Initialise without Caddy (no reverse proxy) and without an automatically managed domain name (xxxxxx.cluster.uncloud.run).
+  # You can deploy Caddy with 'uc caddy deploy' and reserve a domain with 'uc dns reserve' later.
+  uc machine init root@<your-server-ip> --no-caddy --no-dns`,
 		// TODO: support initialising a cluster on the local machine.
 		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -68,28 +82,34 @@ func NewInitCommand() *cobra.Command {
 	)
 	cmd.Flags().BoolVar(
 		&opts.noCaddy, "no-caddy", false,
-		"Don't deploy Caddy reverse proxy service to the machine.",
+		"Don't deploy Caddy reverse proxy service to the machine. You can deploy it later with 'uc caddy deploy'.",
 	)
 	cmd.Flags().BoolVar(
 		&opts.noDNS, "no-dns", false,
-		"Don't reserve a cluster domain in Uncloud DNS.",
+		"Don't reserve a cluster domain in Uncloud DNS. You can reserve it later with 'uc dns reserve'.",
+	)
+	cmd.Flags().BoolVar(
+		&opts.noInstall, "no-install", false,
+		"Skip installation of Docker, Uncloud daemon, and dependencies on the machine. "+
+			"Assumes they're already installed and running.",
 	)
 	cmd.Flags().StringVar(
 		&opts.publicIP, "public-ip", "auto",
 		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
-			"blank '' or 'none' to disable ingress on this machine, or specify an IP address.",
+			fmt.Sprintf("blank '' or '%s' to disable ingress on this machine, or specify an IP address.", PublicIPNone),
 	)
 	cmd.Flags().StringVarP(
 		&opts.sshKey, "ssh-key", "i", "",
-		"Path to SSH private key for SSH remote login. (default ~/.ssh/id_*)",
+		fmt.Sprintf("Path to SSH private key for remote login (if not already added to SSH agent). (default %q)",
+			cli.DefaultSSHKeyPath),
 	)
 	cmd.Flags().StringVar(
 		&opts.version, "version", "latest",
 		"Version of the Uncloud daemon to install on the machine.",
 	)
 	cmd.Flags().StringVarP(
-		&opts.context, "context", "c", "default",
-		"Name of the created context for the initialised cluster in the Uncloud config.",
+		&opts.context, "context", "c", cli.DefaultContextName,
+		"Name of the new context to be created in the Uncloud config to manage the cluster.",
 	)
 
 	return cmd
@@ -105,7 +125,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 	switch opts.publicIP {
 	case "auto":
 		publicIP = &netip.Addr{}
-	case "", "none":
+	case "", PublicIPNone:
 		publicIP = nil
 	default:
 		ip, err := netip.ParseAddr(opts.publicIP)
@@ -114,13 +134,13 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 		}
 		publicIP = &ip
 	}
-	
 	client, err := uncli.InitCluster(ctx, cli.InitClusterOptions{
 		Context:       opts.context,
 		MachineName:   opts.name,
 		Network:       netPrefix,
 		PublicIP:      publicIP,
 		RemoteMachine: remoteMachine,
+		SkipInstall:   opts.noInstall,
 		Version:       opts.version,
 	})
 	if err != nil {
@@ -147,7 +167,7 @@ func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteM
 	}
 
 	if !opts.noCaddy {
-		d, err := client.NewCaddyDeployment("", api.Placement{})
+		d, err := client.NewCaddyDeployment("", "", api.Placement{})
 		if err != nil {
 			return fmt.Errorf("create caddy deployment: %w", err)
 		}

cmd/uncloud/machine/ls.go

@@ -14,18 +14,18 @@ import (
 )
 
 func NewListCommand() *cobra.Command {
-	var clusterContext string
+	var contextName string
 	cmd := &cobra.Command{
 		Use:     "ls",
 		Aliases: []string{"list"},
 		Short:   "List machines in a cluster.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli, clusterContext)
+			return list(cmd.Context(), uncli, contextName)
 		},
 	}
 	cmd.Flags().StringVarP(
-		&clusterContext, "context", "c", "",
+		&contextName, "context", "c", "",
 		"Name of the cluster context. (default is the current context)",
 	)
 	return cmd
@@ -46,7 +46,7 @@ func list(ctx context.Context, uncli *cli.CLI, clusterName string) error {
 	// Print the list of machines in a table format.
 	tw := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
 	// Print header.
-	if _, err = fmt.Fprintln(tw, "NAME\tSTATE\tADDRESS\tPUBLIC IP\tWIREGUARD ENDPOINTS"); err != nil {
+	if _, err = fmt.Fprintln(tw, "NAME\tSTATE\tADDRESS\tPUBLIC IP\tWIREGUARD ENDPOINTS\tMACHINE ID"); err != nil {
 		return fmt.Errorf("write header: %w", err)
 	}
 	// Print rows.
@@ -68,7 +68,8 @@ func list(ctx context.Context, uncli *cli.CLI, clusterName string) error {
 		}
 
 		if _, err = fmt.Fprintf(
-			tw, "%s\t%s\t%s\t%s\t%s\n", m.Name, capitalise(member.State.String()), subnet, publicIP, strings.Join(endpoints, ", "),
+			tw, "%s\t%s\t%s\t%s\t%s\t%s\n", m.Name, capitalise(member.State.String()), subnet, publicIP,
+			strings.Join(endpoints, ", "), member.Machine.Id,
 		); err != nil {
 			return fmt.Errorf("write row: %w", err)
 		}

cmd/uncloud/machine/rename.go

@@ -0,0 +1,47 @@
+package machine
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/spf13/cobra"
+)
+
+func NewRenameCommand() *cobra.Command {
+	var contextName string
+	cmd := &cobra.Command{
+		Use:   "rename OLD_NAME NEW_NAME",
+		Short: "Rename a machine in the cluster.",
+		Long: `Rename a machine in the cluster.
+
+This command changes the name of an existing machine while preserving all other
+configuration including network settings, public IP, and cluster membership.`,
+		Args: cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return rename(cmd.Context(), uncli, contextName, args[0], args[1])
+		},
+	}
+	cmd.Flags().StringVarP(
+		&contextName, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+	return cmd
+}
+
+func rename(ctx context.Context, uncli *cli.CLI, contextName, oldName, newName string) error {
+	client, err := uncli.ConnectCluster(ctx, contextName)
+	if err != nil {
+		return err
+	}
+	defer client.Close()
+
+	machine, err := client.RenameMachine(ctx, oldName, newName)
+	if err != nil {
+		return fmt.Errorf("rename machine: %w", err)
+	}
+
+	fmt.Printf("Machine %q renamed to %q (ID: %s)\n", oldName, machine.Name, machine.Id)
+	return nil
+}

cmd/uncloud/machine/rm.go

@@ -0,0 +1,249 @@
+package machine
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+
+	"github.com/charmbracelet/lipgloss"
+	"github.com/charmbracelet/lipgloss/tree"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/docker/docker/api/types/container"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type removeOptions struct {
+	noReset bool
+	yes     bool
+	context string
+}
+
+func NewRmCommand() *cobra.Command {
+	opts := removeOptions{}
+
+	cmd := &cobra.Command{
+		Use:     "rm MACHINE",
+		Aliases: []string{"remove", "delete"},
+		Short:   "Remove a machine from a cluster and reset it.",
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return remove(cmd.Context(), uncli, args[0], opts)
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)")
+	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
+		"Do not prompt for confirmation before removing the machine.")
+	cmd.Flags().BoolVar(&opts.noReset, "no-reset", false,
+		"Do not reset the machine after removing it from the cluster. This will leave all containers and data intact.")
+
+	return cmd
+}
+
+func remove(ctx context.Context, uncli *cli.CLI, nameOrID string, opts removeOptions) error {
+	// TODO: automatically choose a connection to the machine that is not being removed.
+	client, err := uncli.ConnectCluster(ctx, opts.context)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	// Verify the machine exists and list all service containers on it including stopped ones.
+	mctx, machines, err := api.ProxyMachinesContext(ctx, client, []string{nameOrID})
+	if err != nil {
+		return err
+	}
+	if len(machines) == 0 {
+		return fmt.Errorf("machine '%s' not found in the cluster", nameOrID)
+	}
+	m := machines[0].Machine
+
+	// Verify if the machine being removed is the proxy machine we're connected to.
+	proxyMachine, err := client.MachineClient.Inspect(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("inspect proxy machine: %w", err)
+	}
+	if proxyMachine.Id == m.Id {
+		allMachines, err := client.ListMachines(ctx, nil)
+		if err != nil {
+			return fmt.Errorf("list machines: %w", err)
+		}
+		if len(allMachines) > 1 {
+			return errors.New("cannot remove the machine you are currently connected to. " +
+				"Please connect to another machine in the cluster and try again. " +
+				"Use --connect flag or update 'connections' for the cluster context in your Uncloud config")
+			// It's ok to remove the proxy machine if it's the last one in the cluster.
+		}
+	}
+
+	// TODO: mark the machine as being removed and unschedulable when this is possible to prevent new containers
+	//  from being scheduled on it while the removal is in progress.
+
+	reset := !opts.noReset
+	var containers []api.ServiceContainer
+	reachable := false
+	if reset {
+		// Check if the machine is up and has service containers.
+		listOpts := container.ListOptions{All: true}
+		machineContainers, err := client.Docker.ListServiceContainers(mctx, "", listOpts)
+		if err == nil {
+			reachable = true
+			containers = machineContainers[0].Containers
+			if len(containers) > 0 {
+				plural := ""
+				if len(containers) > 1 {
+					plural = "s"
+				}
+				fmt.Printf("Found %d service container%s on machine '%s':\n", len(containers), plural, m.Name)
+				fmt.Println(formatContainerTree(containers))
+				fmt.Println()
+				fmt.Println("This will remove all service containers from the machine, remove it from the cluster, " +
+					"and reset it to the uninitialised state.")
+			} else {
+				fmt.Printf("No service containers found on machine '%s'.\n", m.Name)
+				fmt.Println("This will remove the machine from the cluster and reset it to the uninitialised state.")
+			}
+		} else {
+			fmt.Printf("This will remove machine '%s' from the cluster without resetting it as it's unreachable.\n",
+				m.Name)
+		}
+	} else {
+		fmt.Printf("This will remove machine '%s' from the cluster without resetting it.\n", m.Name)
+	}
+
+	if !opts.yes {
+		confirmed, err := cli.Confirm()
+		if err != nil {
+			return fmt.Errorf("confirm removal: %w", err)
+		}
+		if !confirmed {
+			fmt.Println("Cancelled. Machine was not removed.")
+			return nil
+		}
+	}
+
+	if reset && len(containers) > 0 {
+		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+			return removeContainers(ctx, client, containers)
+		}, uncli.ProgressOut(), "Removing containers")
+		if err != nil {
+			return fmt.Errorf("remove containers: %w", err)
+		}
+		fmt.Println()
+	}
+
+	if _, err = client.RemoveMachine(ctx, &pb.RemoveMachineRequest{Id: m.Id}); err != nil {
+		return fmt.Errorf("remove machine from cluster: %w", err)
+	}
+	fmt.Printf("Machine '%s' removed from the cluster.\n", m.Name)
+
+	if reset && reachable {
+		_, err = client.MachineClient.Reset(mctx, &pb.ResetRequest{})
+		if err != nil {
+			fmt.Printf("WARNING: Failed to reset machine: %v\n", err)
+		} else {
+			fmt.Println("Machine reset initiated and will complete in the background.")
+		}
+	}
+
+	// TODO: remove the connection to the machine from the uncloud config if it exists. We need a way to associate
+	//  the machine with its connection in the config, e.g. by storing the machine name in the connection metadata.
+
+	// TODO: If Caddy was running on this machine and a cluster domain is reserved,
+	//  let the user know that the DNS records should be updated.
+
+	return nil
+}
+
+// formatContainerTree formats a list of containers grouped by service as a tree structure.
+func formatContainerTree(containers []api.ServiceContainer) string {
+	if len(containers) == 0 {
+		return ""
+	}
+
+	// Group containers by service.
+	serviceContainers := make(map[string][]api.ServiceContainer)
+	for _, ctr := range containers {
+		serviceName := ctr.ServiceName()
+		serviceContainers[serviceName] = append(serviceContainers[serviceName], ctr)
+	}
+
+	// Build tree output.
+	var output []string
+	serviceNames := slices.Sorted(maps.Keys(serviceContainers))
+	for _, serviceName := range serviceNames {
+		ctrs := serviceContainers[serviceName]
+		mode := ctrs[0].ServiceMode()
+
+		// Format a tree for the service with its containers.
+		plural := ""
+		if len(ctrs) > 1 {
+			plural = "s"
+		}
+		t := tree.Root(fmt.Sprintf("• %s (%s, %d container%s)", serviceName, mode, len(ctrs), plural)).
+			EnumeratorStyle(lipgloss.NewStyle().MarginLeft(2).MarginRight(1))
+
+		// Add containers as children.
+		for _, ctr := range ctrs {
+			state, _ := ctr.HumanState()
+			info := fmt.Sprintf("%s • %s • %s", ctr.Name, ctr.Config.Image, state)
+			t.Child(info)
+		}
+
+		output = append(output, t.String())
+	}
+
+	return strings.Join(output, "\n")
+}
+
+// removeContainers removes the given service containers from the machine.
+func removeContainers(ctx context.Context, client api.Client, containers []api.ServiceContainer) error {
+	if len(containers) == 0 {
+		return nil
+	}
+
+	wg := sync.WaitGroup{}
+	errCh := make(chan error)
+
+	for _, ctr := range containers {
+		wg.Add(1)
+		go func(c api.ServiceContainer) {
+			defer wg.Done()
+
+			// Gracefully stop the container before removing it.
+			err := client.StopContainer(ctx, c.ServiceID(), c.ID, container.StopOptions{})
+			if err != nil && !errors.Is(err, api.ErrNotFound) {
+				errCh <- fmt.Errorf("stop container '%s': %w", c.ID, err)
+			}
+
+			err = client.RemoveContainer(ctx, c.ServiceID(), c.ID, container.RemoveOptions{
+				// Remove anonymous volumes created by the container.
+				RemoveVolumes: true,
+			})
+			if err != nil && !errors.Is(err, api.ErrNotFound) {
+				errCh <- fmt.Errorf("remove container '%s': %w", c.ID, err)
+			}
+		}(ctr)
+	}
+
+	go func() {
+		wg.Wait()
+		close(errCh)
+	}()
+
+	var err error
+	for e := range errCh {
+		err = errors.Join(err, e)
+	}
+
+	return err
+}

cmd/uncloud/machine/root.go

@@ -6,13 +6,17 @@ import (
 
 func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "machine",
-		Short: "Manage machines in an Uncloud cluster.",
+		Use:     "machine",
+		Aliases: []string{"m"},
+		Short:   "Manage machines in an Uncloud cluster.",
 	}
 	cmd.AddCommand(
 		NewAddCommand(),
 		NewInitCommand(),
 		NewListCommand(),
+		NewRenameCommand(),
+		NewRmCommand(),
+		NewUpdateCommand(),
 		NewTokenCommand(),
 	)
 	return cmd

cmd/uncloud/machine/token.go

@@ -2,9 +2,10 @@ package machine
 
 import (
 	"fmt"
-	"github.com/spf13/cobra"
+
 	"github.com/psviderski/uncloud/internal/daemon"
 	"github.com/psviderski/uncloud/internal/machine"
+	"github.com/spf13/cobra"
 )
 
 type tokenOptions struct {

cmd/uncloud/machine/update.go

@@ -0,0 +1,128 @@
+package machine
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+	"github.com/spf13/cobra"
+)
+
+type updateOptions struct {
+	name     string
+	publicIP string
+	context  string
+}
+
+func NewUpdateCommand() *cobra.Command {
+	opts := updateOptions{}
+	cmd := &cobra.Command{
+		Use:   "update",
+		Short: "Update machine configuration in the cluster.",
+		Long: `Update machine configuration in the cluster.
+
+This command allows setting various machine properties including:
+- Machine name (--name)
+- Public IP address (--public-ip)
+
+At least one flag must be specified to perform an update operation.`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return update(cmd.Context(), uncli, cmd, opts, args[0])
+		},
+	}
+
+	cmd.Flags().StringVar(
+		&opts.name, "name", "",
+		"New name for the machine",
+	)
+	cmd.Flags().StringVar(
+		&opts.publicIP, "public-ip", "",
+		fmt.Sprintf("Public IP address of the machine for ingress configuration. Use '%s' or '' to remove the public IP.", PublicIPNone),
+	)
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", "",
+		"Name of the cluster context. (default is the current context)",
+	)
+
+	return cmd
+}
+
+func update(ctx context.Context, uncli *cli.CLI, cmd *cobra.Command, opts updateOptions, machineNameOrID string) error {
+	// Check if at least one flag was explicitly set
+	if !cmd.Flags().Changed("name") && !cmd.Flags().Changed("public-ip") {
+		return fmt.Errorf("at least one update flag must be specified (--name, --public-ip)")
+	}
+
+	client, err := uncli.ConnectCluster(ctx, opts.context)
+	if err != nil {
+		return err
+	}
+	defer client.Close()
+
+	// First, resolve the machine to get its ID
+	machine, err := client.InspectMachine(ctx, machineNameOrID)
+	if err != nil {
+		return fmt.Errorf("find machine: %w", err)
+	}
+
+	// Build the update request
+	req := &pb.UpdateMachineRequest{
+		MachineId: machine.Machine.Id,
+	}
+
+	if opts.name != "" {
+		req.Name = &opts.name
+	}
+
+	// Check if --public-ip flag was explicitly provided
+	if cmd.Flags().Changed("public-ip") {
+		if opts.publicIP == "" || opts.publicIP == PublicIPNone {
+			req.PublicIp = &pb.IP{} // Empty IP to signal removal
+		} else {
+			// Parse and validate the public IP
+			ip, err := netip.ParseAddr(opts.publicIP)
+			if err != nil {
+				return fmt.Errorf("invalid public IP address %q: %w", opts.publicIP, err)
+			}
+			req.PublicIp = pb.NewIP(ip)
+		}
+	}
+
+	// Perform the update operation
+	updatedMachine, err := client.UpdateMachine(ctx, req)
+	if err != nil {
+		return fmt.Errorf("update machine: %w", err)
+	}
+
+	// Report what was changed
+	changes := make([]string, 0)
+	if opts.name != "" {
+		changes = append(changes, fmt.Sprintf("name: %q -> %q", machine.Machine.Name, updatedMachine.Name))
+	}
+	if cmd.Flags().Changed("public-ip") {
+		oldIP := PublicIPNone
+		if machine.Machine.PublicIp != nil {
+			if addr, err := machine.Machine.PublicIp.ToAddr(); err == nil {
+				oldIP = addr.String()
+			}
+		}
+		newIP := PublicIPNone
+		if updatedMachine.PublicIp != nil {
+			if addr, err := updatedMachine.PublicIp.ToAddr(); err == nil {
+				newIP = addr.String()
+			}
+		}
+		changes = append(changes, fmt.Sprintf("public IP: %s -> %s", oldIP, newIP))
+	}
+
+	fmt.Printf("Machine %q (ID: %s) configuration updated:\n", updatedMachine.Name, updatedMachine.Id)
+	for _, change := range changes {
+		fmt.Printf("  %s\n", change)
+	}
+
+	return nil
+}

cmd/uncloud/main.go

@@ -9,6 +9,7 @@ import (
 	"github.com/psviderski/uncloud/cmd/uncloud/caddy"
 	cmdcontext "github.com/psviderski/uncloud/cmd/uncloud/context"
 	"github.com/psviderski/uncloud/cmd/uncloud/dns"
+	"github.com/psviderski/uncloud/cmd/uncloud/image"
 	"github.com/psviderski/uncloud/cmd/uncloud/machine"
 	"github.com/psviderski/uncloud/cmd/uncloud/service"
 	"github.com/psviderski/uncloud/cmd/uncloud/volume"
@@ -27,12 +28,15 @@ type globalOptions struct {
 func main() {
 	opts := globalOptions{}
 	cmd := &cobra.Command{
-		Use:           "uncloud",
-		Short:         "A CLI tool for managing Uncloud resources such as clusters, machines, and services.",
+		Use:           "uc",
+		Short:         "A CLI tool for managing Uncloud resources such as machines, services, and volumes.",
 		Version:       version.String(),
 		SilenceUsage:  true,
 		SilenceErrors: true,
 		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+			cli.BindEnvToFlag(cmd, "connect", "UNCLOUD_CONNECT")
+			cli.BindEnvToFlag(cmd, "uncloud-config", "UNCLOUD_CONFIG")
+
 			var conn *config.MachineConnection
 			if opts.connect != "" {
 				if strings.HasPrefix(opts.connect, "tcp://") {
@@ -65,19 +69,22 @@ func main() {
 	}
 
 	cmd.PersistentFlags().StringVar(&opts.connect, "connect", "",
-		"Connect to a remote cluster machine without using the Uncloud configuration file.\n"+
+		"Connect to a remote cluster machine without using the Uncloud configuration file. [$UNCLOUD_CONNECT]\n"+
 			"Format: [ssh://]user@host[:port] or tcp://host:port")
-	// TODO: allow to override using UNCLOUD_CONFIG env var.
 	cmd.PersistentFlags().StringVar(&opts.configPath, "uncloud-config", "~/.config/uncloud/config.yaml",
-		"Path to the Uncloud configuration file.")
+		"Path to the Uncloud configuration file. [$UNCLOUD_CONFIG]")
 	_ = cmd.MarkPersistentFlagFilename("uncloud-config", "yaml", "yml")
 	// TODO: make --context a global flag and pass it as a value of the command context.
 
 	cmd.AddCommand(
 		NewDeployCommand(),
+		NewDocsCommand(),
+		NewBuildCommand(),
+		NewImagesCommand(),
 		caddy.NewRootCommand(),
 		cmdcontext.NewRootCommand(),
 		dns.NewRootCommand(),
+		image.NewRootCommand(),
 		machine.NewRootCommand(),
 		service.NewRootCommand(),
 		service.NewInspectCommand(),

cmd/uncloud/service/inspect.go

@@ -9,20 +9,19 @@ import (
 
 	"github.com/docker/docker/pkg/stringid"
 	"github.com/docker/go-units"
-
 	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/spf13/cobra"
 )
 
 type inspectOptions struct {
 	service string
-	cluster string
+	context string
 }
 
 func NewInspectCommand() *cobra.Command {
 	opts := inspectOptions{}
 	cmd := &cobra.Command{
-		Use:   "inspect",
+		Use:   "inspect SERVICE",
 		Short: "Display detailed information on a service.",
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -32,14 +31,14 @@ func NewInspectCommand() *cobra.Command {
 		},
 	}
 	cmd.Flags().StringVarP(
-		&opts.cluster, "context", "c", "",
+		&opts.context, "context", "c", "",
 		"Name of the cluster context. (default is the current context)",
 	)
 	return cmd
 }
 
 func inspect(ctx context.Context, uncli *cli.CLI, opts inspectOptions) error {
-	client, err := uncli.ConnectCluster(ctx, opts.cluster)
+	client, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/service/ls.go

@@ -12,26 +12,25 @@ import (
 )
 
 func NewListCommand() *cobra.Command {
-	// TODO(lhf): rename to context
-	var cluster string
+	var contextName string
 	cmd := &cobra.Command{
 		Use:     "ls",
 		Aliases: []string{"list"},
 		Short:   "List services.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return list(cmd.Context(), uncli, cluster)
+			return list(cmd.Context(), uncli, contextName)
 		},
 	}
 	cmd.Flags().StringVarP(
-		&cluster, "context", "c", "",
+		&contextName, "context", "c", "",
 		"Name of the cluster context. (default is the current context)",
 	)
 	return cmd
 }
 
-func list(ctx context.Context, uncli *cli.CLI, clusterName string) error {
-	client, err := uncli.ConnectCluster(ctx, clusterName)
+func list(ctx context.Context, uncli *cli.CLI, contextName string) error {
+	client, err := uncli.ConnectCluster(ctx, contextName)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -61,19 +60,20 @@ func list(ctx context.Context, uncli *cli.CLI, clusterName string) error {
 			return fmt.Errorf("write header: %w", err)
 		}
 	}
-	if _, err = fmt.Fprintln(tw, "NAME\tMODE\tREPLICAS\tENDPOINTS"); err != nil {
+	if _, err = fmt.Fprintln(tw, "NAME\tMODE\tREPLICAS\tIMAGE\tENDPOINTS"); err != nil {
 		return fmt.Errorf("write header: %w", err)
 	}
 	for _, s := range services {
-		endpointsSlice := s.Endpoints()
-		endpoints := strings.Join(endpointsSlice, ", ")
+		images := strings.Join(s.Images(), ", ")
+		endpoints := strings.Join(s.Endpoints(), ", ")
 
 		if haveDuplicateNames {
 			if _, err = fmt.Fprintf(tw, "%s\t", s.ID); err != nil {
 				return fmt.Errorf("write row: %w", err)
 			}
 		}
-		if _, err = fmt.Fprintf(tw, "%s\t%s\t%d\t%s\n", s.Name, s.Mode, len(s.Containers), endpoints); err != nil {
+		if _, err = fmt.Fprintf(tw, "%s\t%s\t%d\t%s\t%s\n",
+			s.Name, s.Mode, len(s.Containers), images, endpoints); err != nil {
 			return fmt.Errorf("write row: %w", err)
 		}
 	}

cmd/uncloud/service/rm.go

@@ -11,7 +11,7 @@ import (
 
 type rmOptions struct {
 	services []string
-	cluster  string
+	context  string
 }
 
 func NewRmCommand() *cobra.Command {
@@ -28,14 +28,14 @@ func NewRmCommand() *cobra.Command {
 		},
 	}
 	cmd.Flags().StringVarP(
-		&opts.cluster, "context", "c", "",
+		&opts.context, "context", "c", "",
 		"Name of the cluster context. (default is the current context)",
 	)
 	return cmd
 }
 
 func rm(ctx context.Context, uncli *cli.CLI, opts rmOptions) error {
-	client, err := uncli.ConnectCluster(ctx, opts.cluster)
+	client, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -50,5 +50,5 @@ func rm(ctx context.Context, uncli *cli.CLI, opts rmOptions) error {
 		}, uncli.ProgressOut(), "Removing service "+s)
 	}
 
-	return nil
+	return err
 }

cmd/uncloud/service/run.go

@@ -17,6 +17,7 @@ import (
 )
 
 type runOptions struct {
+	caddyfile         string
 	command           []string
 	cpu               dockeropts.NanoCPUs
 	entrypoint        string
@@ -34,7 +35,7 @@ type runOptions struct {
 	user              string
 	volumes           []string
 
-	cluster string
+	context string
 }
 
 func NewRunCommand() *cobra.Command {
@@ -57,6 +58,9 @@ func NewRunCommand() *cobra.Command {
 		},
 	}
 
+	cmd.Flags().StringVar(&opts.caddyfile, "caddyfile", "",
+		"Path to a custom Caddy config (Caddyfile) for the service. "+
+			"Cannot be used together with non-@host published ports.")
 	cmd.Flags().VarP(&opts.cpu, "cpu", "",
 		"Maximum number of CPU cores a service container can use. Fractional values are allowed: "+
 			"0.5 for half a core or 2.25 for two and a quarter cores.")
@@ -82,13 +86,14 @@ func NewRunCommand() *cobra.Command {
 		"Give extended privileges to service containers. This is a security risk and should be used with caution.")
 	cmd.Flags().StringSliceVarP(&opts.publish, "publish", "p", nil,
 		"Publish a service port to make it accessible outside the cluster. Can be specified multiple times.\n"+
-			"Format: [hostname:][load_balancer_port:]container_port[/protocol] or [host_ip:]:host_port:container_port[/protocol]@host\n"+
+			"Format: [hostname:]container_port[/protocol] or [host_ip:]host_port:container_port[/protocol]@host\n"+
 			"Supported protocols: tcp, udp, http, https (default is tcp). If a hostname for http(s) port is not specified\n"+
 			"and a cluster domain is reserved, service-name.cluster-domain will be used as the hostname.\n"+
 			"Examples:\n"+
-			"  -p 8080/https                  Publish port 8080 as HTTPS via load balancer with default service-name.cluster-domain hostname\n"+
-			"  -p app.example.com:8080/https  Publish port 8080 as HTTPS via load balancer with custom hostname\n"+
-			"  -p 9000:8080                   Publish port 8080 as TCP port 9000 via load balancer\n"+
+			"  -p 8080/https                  Publish port 8080 as HTTPS via reverse proxy with default service-name.cluster-domain hostname\n"+
+			"  -p app.example.com:8080/https  Publish port 8080 as HTTPS via reverse proxy with custom hostname\n"+
+			// TODO: add support for publishing L4 tcp/udp ports.
+			//"  -p 9000:8080                   Publish port 8080 as TCP port 9000 via reverse proxy\n"+
 			"  -p 53:5353/udp@host            Bind UDP port 5353 to host port 53")
 	cmd.Flags().StringVar(&opts.pull, "pull", api.PullPolicyMissing,
 		fmt.Sprintf("Pull image from the registry before running service containers ('%s', '%s', '%s').",
@@ -108,7 +113,7 @@ func NewRunCommand() *cobra.Command {
 			"  -v /host/path:/container/path:ro 		 Bind mount a host directory or file as read-only")
 
 	cmd.Flags().StringVarP(
-		&opts.cluster, "context", "c", "",
+		&opts.context, "context", "c", "",
 		"Name of the cluster context to run the service in. (default is the current context)",
 	)
 
@@ -121,7 +126,7 @@ func run(ctx context.Context, uncli *cli.CLI, opts runOptions) error {
 		return err
 	}
 
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.cluster)
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -160,6 +165,15 @@ func run(ctx context.Context, uncli *cli.CLI, opts runOptions) error {
 func prepareServiceSpec(opts runOptions) (api.ServiceSpec, error) {
 	var spec api.ServiceSpec
 
+	caddyfile := ""
+	if opts.caddyfile != "" {
+		data, err := os.ReadFile(opts.caddyfile)
+		if err != nil {
+			return spec, fmt.Errorf("read Caddyfile: %w", err)
+		}
+		caddyfile = strings.TrimSpace(string(data))
+	}
+
 	env, err := parseEnv(opts.env)
 	if err != nil {
 		return spec, err
@@ -217,6 +231,12 @@ func prepareServiceSpec(opts runOptions) (api.ServiceSpec, error) {
 		Volumes:   volumes,
 	}
 
+	if caddyfile != "" {
+		spec.Caddy = &api.CaddySpec{
+			Config: caddyfile,
+		}
+	}
+
 	// Overwrite the default ENTRYPOINT of the image or reset it if an empty string is passed.
 	if opts.entrypoint != "" {
 		spec.Container.Entrypoint = []string{opts.entrypoint}

cmd/uncloud/service/scale.go

@@ -15,7 +15,7 @@ import (
 type scaleOptions struct {
 	service  string
 	replicas uint
-	cluster  string
+	context  string
 }
 
 func NewScaleCommand() *cobra.Command {
@@ -40,7 +40,7 @@ func NewScaleCommand() *cobra.Command {
 	}
 
 	cmd.Flags().StringVarP(
-		&opts.cluster, "context", "c", "",
+		&opts.context, "context", "c", "",
 		"Name of the cluster context. (default is the current context)",
 	)
 
@@ -57,7 +57,7 @@ func scale(ctx context.Context, uncli *cli.CLI, opts scaleOptions) error {
 		)
 	}
 
-	clusterClient, err := uncli.ConnectCluster(ctx, opts.cluster)
+	clusterClient, err := uncli.ConnectCluster(ctx, opts.context)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}

cmd/uncloud/volume/create.go

@@ -26,7 +26,7 @@ func NewCreateCommand() *cobra.Command {
 	opts := createOptions{}
 
 	cmd := &cobra.Command{
-		Use:   "create [FLAGS] VOLUME_NAME",
+		Use:   "create VOLUME_NAME",
 		Short: "Create a volume on a specific machine.",
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {

cmd/uncloud/volume/inspect.go

@@ -20,7 +20,7 @@ func NewInspectCommand() *cobra.Command {
 	opts := inspectOptions{}
 
 	cmd := &cobra.Command{
-		Use:   "inspect [FLAGS] VOLUME_NAME",
+		Use:   "inspect VOLUME_NAME",
 		Short: "Display detailed information on a volume.",
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {

cmd/uncloud/volume/ls.go

@@ -23,7 +23,7 @@ func NewListCommand() *cobra.Command {
 	opts := listOptions{}
 
 	cmd := &cobra.Command{
-		Use:     "ls [FLAGS]",
+		Use:     "ls",
 		Aliases: []string{"list"},
 		Short:   "List volumes across all machines in the cluster.",
 		RunE: func(cmd *cobra.Command, args []string) error {

cmd/uncloud/volume/rm.go

@@ -21,7 +21,7 @@ func NewRemoveCommand() *cobra.Command {
 	opts := removeOptions{}
 
 	cmd := &cobra.Command{
-		Use:     "rm [FLAGS] VOLUME_NAME [VOLUME_NAME...]",
+		Use:     "rm VOLUME_NAME [VOLUME_NAME...]",
 		Aliases: []string{"remove", "delete"},
 		Short:   "Remove one or more volumes.",
 		Long:    "Remove one or more volumes. You cannot remove a volume that is in use by a container.",

cmd/uncloudd/main.go

@@ -55,5 +55,4 @@ func main() {
 	}()
 
 	cobra.CheckErr(cmd.ExecuteContext(ctx))
-
 }

experiment/broadcaster.go

@@ -3,10 +3,11 @@ package main
 import (
 	"context"
 	"fmt"
-	"github.com/hashicorp/serf/serf"
-	crdt "github.com/ipfs/go-ds-crdt"
 	"log/slog"
 	"time"
+
+	"github.com/hashicorp/serf/serf"
+	crdt "github.com/ipfs/go-ds-crdt"
 )
 
 // Implements the Broadcaster interface.

experiment/explorer/explorer.go

@@ -2,9 +2,10 @@ package main
 
 import (
 	"fmt"
-	"github.com/dgraph-io/badger/v3"
 	"log"
 	"time"
+
+	"github.com/dgraph-io/badger/v3"
 )
 
 func customTimeEncoder(t time.Time) string {

experiment/logger.go

@@ -2,9 +2,10 @@ package main
 
 import (
 	"fmt"
-	"github.com/ipfs/go-log/v2"
 	"log/slog"
 	"os"
+
+	"github.com/ipfs/go-log/v2"
 )
 
 // ipfsLogger is an slog logger that implements the IPFS go-log StandardLogger interface.

experiment/networkdb/main.go

@@ -2,12 +2,13 @@ package main
 
 import (
 	"fmt"
-	"github.com/docker/docker/libnetwork/networkdb"
 	"log/slog"
 	"os"
 	"os/signal"
 	"syscall"
 	"time"
+
+	"github.com/docker/docker/libnetwork/networkdb"
 )
 
 func main() {

experiment/serf_crdt.go

@@ -4,6 +4,13 @@ import (
 	"context"
 	"flag"
 	"fmt"
+	"log/slog"
+	"net"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
 	"github.com/hashicorp/memberlist"
 	"github.com/hashicorp/serf/cmd/serf/command/agent"
 	"github.com/hashicorp/serf/serf"
@@ -11,12 +18,6 @@ import (
 	badger "github.com/ipfs/go-ds-badger3"
 	crdt "github.com/ipfs/go-ds-crdt"
 	"github.com/lmittmann/tint"
-	"log/slog"
-	"net"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
 )
 
 func createSerfAgentConfig(name, bindAddr, rpcAddr, profile string) *agent.Config {
@@ -49,9 +50,9 @@ func createSerfAgent(config *agent.Config) (*agent.Agent, error) {
 
 	serfConfig.MemberlistConfig.BindAddr = bindIP
 	serfConfig.MemberlistConfig.BindPort = bindPort
-	//serfConfig.MemberlistConfig.AdvertiseAddr = advertiseIP
-	//serfConfig.MemberlistConfig.AdvertisePort = advertisePort
-	//serfConfig.MemberlistConfig.SecretKey = encryptKey
+	// serfConfig.MemberlistConfig.AdvertiseAddr = advertiseIP
+	// serfConfig.MemberlistConfig.AdvertisePort = advertisePort
+	// serfConfig.MemberlistConfig.SecretKey = encryptKey
 	serfConfig.NodeName = config.NodeName
 	serfConfig.Tags = config.Tags
 	serfConfig.SnapshotPath = config.SnapshotPath
@@ -129,7 +130,7 @@ func main() {
 	logger := slog.New(tint.NewHandler(os.Stdout, &tint.Options{
 		AddSource: true,
 		Level:     slog.LevelDebug,
-		//Level:      slog.LevelInfo,
+		// Level:      slog.LevelInfo,
 		TimeFormat: time.RFC3339Nano,
 	}))
 	slog.SetDefault(logger)
@@ -164,7 +165,7 @@ func main() {
 
 	opts := crdt.DefaultOptions()
 	opts.Logger = newIPFSLogger(logger)
-	//opts.MultiHeadProcessing = true
+	// opts.MultiHeadProcessing = true
 	// TODO: debug why the heads count may grow on the receiving side if the event backlog is huge and the processing
 	//  is slow.
 	store, err := crdt.New(localStore, ds.NewKey("/"), syncer, broadcaster, opts)
@@ -172,7 +173,7 @@ func main() {
 		panic(err)
 	}
 
-	//ticker := time.NewTicker(10 * time.Millisecond)
+	// ticker := time.NewTicker(10 * time.Millisecond)
 	ticker := time.NewTicker(3 * time.Second)
 	go func() {
 		for {

experiment/syncer.go

@@ -4,18 +4,19 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log/slog"
+
 	"github.com/hashicorp/serf/serf"
 	"github.com/ipfs/boxo/datastore/dshelp"
 	dag "github.com/ipfs/boxo/ipld/merkledag"
 	"github.com/ipfs/go-cid"
 	ds "github.com/ipfs/go-datastore"
 	ipld "github.com/ipfs/go-ipld-format"
-	"log/slog"
 )
 
 // Implements the DAGService interface.
 // TODO: implement SessionDAGService to optimize node fetching.
-// TOOD: persistentSerfDAG?
+// TODO: persistentSerfDAG?
 type dagSyncer struct {
 	// Persistent storage for the nodes.
 	store     ds.Datastore
@@ -50,8 +51,7 @@ func (d *dagSyncer) Get(ctx context.Context, cid cid.Cid) (ipld.Node, error) {
 	}
 	slog.Debug("Queried node from peers", "cid", cid, "deadline", query.Deadline())
 
-	responded := false
-	for !responded {
+	for {
 		select {
 		case resp, ok := <-query.ResponseCh():
 			if !ok {
@@ -63,7 +63,6 @@ func (d *dagSyncer) Get(ctx context.Context, cid cid.Cid) (ipld.Node, error) {
 				continue
 			}
 			slog.Debug("Received node from peer", "cid", cid, "peer", resp.From)
-			responded = true
 			query.Close()
 
 			node, err = nodeFromBytes(resp.Payload)

experiment/talos_discovery.go

@@ -6,12 +6,13 @@ import (
 	"crypto/cipher"
 	"encoding/hex"
 	"fmt"
+	"net/netip"
+	"time"
+
+	"github.com/psviderski/uncloud/internal/machine/network"
 	"github.com/siderolabs/discovery-api/api/v1alpha1/client/pb"
 	discovery "github.com/siderolabs/discovery-client/pkg/client"
 	"go.uber.org/zap"
-	"net/netip"
-	"time"
-	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
 const (

go.mod

@@ -1,26 +1,29 @@
 module github.com/psviderski/uncloud
 
-go 1.23.0
-
-toolchain go1.23.2
+go 1.25
 
 require (
-	github.com/BurntSushi/toml v1.4.0
+	github.com/BurntSushi/toml v1.5.0
 	github.com/Masterminds/semver v1.5.0
 	github.com/Masterminds/squirrel v1.5.4
+	github.com/alecthomas/chroma/v2 v2.20.0
 	github.com/caddyserver/caddy/v2 v2.8.4
 	github.com/cenkalti/backoff/v4 v4.3.0
+	github.com/charmbracelet/bubbles v0.20.0
+	github.com/charmbracelet/bubbletea v1.3.9
 	github.com/charmbracelet/huh v0.6.0
-	github.com/charmbracelet/lipgloss v0.13.0
-	github.com/compose-spec/compose-go/v2 v2.4.5
+	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/compose-spec/compose-go/v2 v2.9.0
+	github.com/containerd/errdefs v1.0.0
+	github.com/containerd/platforms v1.0.0-rc.1
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 	github.com/deckarep/golang-set/v2 v2.8.0
 	github.com/dgraph-io/badger/v3 v3.2103.5
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v27.5.0+incompatible
-	github.com/docker/compose/v2 v2.31.0
-	github.com/docker/docker v27.4.0-rc.2+incompatible
-	github.com/docker/go-connections v0.5.0
+	github.com/docker/cli v28.5.0+incompatible
+	github.com/docker/compose/v2 v2.40.0
+	github.com/docker/docker v28.5.0+incompatible
+	github.com/docker/go-connections v0.6.0
 	github.com/docker/go-units v0.5.0
 	github.com/goccy/go-yaml v1.17.1
 	github.com/google/go-cmp v0.7.0
@@ -37,38 +40,44 @@ require (
 	github.com/jmoiron/sqlx v1.4.0
 	github.com/lmittmann/tint v1.0.5
 	github.com/miekg/dns v1.1.65
+	github.com/mitchellh/mapstructure v1.5.0
+	github.com/moby/term v0.5.2
+	github.com/muesli/termenv v0.16.0
 	github.com/opencontainers/go-digest v1.0.0
-	github.com/opencontainers/image-spec v1.1.0
+	github.com/opencontainers/image-spec v1.1.1
+	github.com/psviderski/unregistry v0.3.1
 	github.com/siderolabs/discovery-api v0.1.4
 	github.com/siderolabs/discovery-client v0.1.9
 	github.com/siderolabs/grpc-proxy v0.5.1
-	github.com/spf13/cobra v1.8.1
-	github.com/stretchr/testify v1.10.0
-	github.com/vishvananda/netlink v1.3.0
+	github.com/spf13/cobra v1.10.1
+	github.com/stretchr/testify v1.11.1
+	github.com/vishvananda/netlink v1.3.1
 	go.uber.org/zap v1.27.0
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/crypto v0.33.0
-	golang.org/x/net v0.35.0
-	golang.org/x/sync v0.11.0
-	golang.org/x/sys v0.31.0
+	golang.org/x/crypto v0.41.0
+	golang.org/x/net v0.43.0
+	golang.org/x/sync v0.17.0
+	golang.org/x/sys v0.36.0
+	golang.org/x/term v0.34.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576
-	google.golang.org/grpc v1.68.1
-	google.golang.org/protobuf v1.36.3
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a
+	google.golang.org/grpc v1.74.2
+	google.golang.org/protobuf v1.36.9
 	modernc.org/sqlite v1.36.3
 )
 
 require (
+	cloud.google.com/go/kms v1.19.0 // indirect
+	cloud.google.com/go/longrunning v0.6.0 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
 	github.com/AndreasBriese/bbloom v0.0.0-20190825152654-46b345b51c96 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.2.1 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/OneOfOne/xxhash v1.2.8 // indirect
+	github.com/Microsoft/hcsshim v0.13.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
 	github.com/armon/circbuf v0.0.0-20190214190532-5111143e8da2 // indirect
 	github.com/armon/go-metrics v0.4.1 // indirect
@@ -84,36 +93,40 @@ require (
 	github.com/catppuccin/go v0.2.0 // indirect
 	github.com/cespare/xxhash v1.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/bubbles v0.20.0 // indirect
-	github.com/charmbracelet/bubbletea v1.1.1 // indirect
-	github.com/charmbracelet/x/ansi v0.3.2 // indirect
+	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
+	github.com/charmbracelet/x/ansi v0.10.1 // indirect
+	github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect
 	github.com/charmbracelet/x/exp/strings v0.0.0-20240919170804-a4978c8e603a // indirect
-	github.com/charmbracelet/x/term v0.2.0 // indirect
+	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
-	github.com/cloudflare/cfssl v1.6.4 // indirect
-	github.com/containerd/console v1.0.4 // indirect
-	github.com/containerd/containerd v1.7.24 // indirect
-	github.com/containerd/containerd/api v1.7.19 // indirect
-	github.com/containerd/continuity v0.4.4 // indirect
-	github.com/containerd/errdefs v0.3.0 // indirect
+	github.com/containerd/cgroups/v3 v3.0.5 // indirect
+	github.com/containerd/console v1.0.5 // indirect
+	github.com/containerd/containerd/api v1.9.0 // indirect
+	github.com/containerd/containerd/v2 v2.1.4 // indirect
+	github.com/containerd/continuity v0.4.5 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/containerd/plugin v1.0.0 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
-	github.com/containerd/ttrpc v1.2.5 // indirect
-	github.com/containerd/typeurl/v2 v2.2.0 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
+	github.com/containerd/ttrpc v1.2.7 // indirect
+	github.com/containerd/typeurl/v2 v2.2.3 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 // indirect
 	github.com/dgraph-io/badger v1.6.2 // indirect
 	github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
 	github.com/dgraph-io/ristretto v0.1.1 // indirect
 	github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
-	github.com/docker/buildx v0.18.0 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/distribution/distribution/v3 v3.0.0 // indirect
+	github.com/dlclark/regexp2 v1.11.5 // indirect
+	github.com/docker/buildx v0.29.1 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.8.2 // indirect
-	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
+	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/fatih/color v1.17.0 // indirect
@@ -123,28 +136,30 @@ require (
 	github.com/go-kit/kit v0.13.0 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-sql-driver/mysql v1.8.1 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.0.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gofrs/flock v0.12.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/glog v1.2.2 // indirect
+	github.com/golang/glog v1.2.5 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/btree v1.1.2 // indirect
 	github.com/google/cel-go v0.20.1 // indirect
 	github.com/google/flatbuffers v24.3.25+incompatible // indirect
-	github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e // indirect
+	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.24.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
+	github.com/hashicorp/go-immutable-radix/v2 v2.1.0 // indirect
 	github.com/hashicorp/go-msgpack v0.5.5 // indirect
 	github.com/hashicorp/go-msgpack/v2 v2.1.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -152,12 +167,13 @@ require (
 	github.com/hashicorp/go-syslog v1.0.0 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
+	github.com/hashicorp/golang-lru/arc/v2 v2.0.7 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/mdns v1.0.5 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
-	github.com/in-toto/in-toto-golang v0.5.0 // indirect
+	github.com/in-toto/in-toto-golang v0.9.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
 	github.com/ipfs/go-block-format v0.2.0 // indirect
@@ -177,7 +193,7 @@ require (
 	github.com/jackc/pgx/v4 v4.18.3 // indirect
 	github.com/jbenet/goprocess v0.1.4 // indirect
 	github.com/josharian/native v1.1.0 // indirect
-	github.com/klauspost/compress v1.17.11 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.9 // indirect
 	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
@@ -198,27 +214,28 @@ require (
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mholt/acmez/v2 v2.0.3 // indirect
-	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/minio/sha256-simd v1.0.1 // indirect
 	github.com/mitchellh/cli v1.1.5 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-ps v1.0.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
-	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
-	github.com/moby/buildkit v0.17.2 // indirect
+	github.com/moby/buildkit v0.25.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/go-archive v0.1.0 // indirect
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/patternmatcher v0.6.0 // indirect
+	github.com/moby/sys/atomicwriter v0.1.0 // indirect
+	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/signal v0.7.1 // indirect
-	github.com/moby/term v0.5.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
-	github.com/muesli/termenv v0.15.3-0.20240618155329-98d742f6907a // indirect
 	github.com/multiformats/go-base32 v0.1.0 // indirect
 	github.com/multiformats/go-base36 v0.2.0 // indirect
 	github.com/multiformats/go-multiaddr v0.13.0 // indirect
@@ -231,25 +248,31 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/onsi/ginkgo/v2 v2.22.0 // indirect
+	github.com/opencontainers/runtime-spec v1.2.1 // indirect
+	github.com/opencontainers/selinux v1.12.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pires/go-proxyproto v0.7.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/polydawn/refmt v0.89.0 // indirect
 	github.com/posener/complete v1.2.3 // indirect
-	github.com/prometheus/client_golang v1.20.5 // indirect
+	github.com/prometheus/client_golang v1.22.0 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.61.0 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/quic-go/qpack v0.5.1 // indirect
 	github.com/quic-go/quic-go v0.48.2 // indirect
+	github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 // indirect
+	github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 // indirect
+	github.com/redis/go-redis/v9 v9.7.3 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/rs/xid v1.5.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 // indirect
 	github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect
-	github.com/secure-systems-lab/go-securesystemslib v0.4.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.6.0 // indirect
 	github.com/shibumi/go-pathspec v1.3.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/shurcooL/sanitized_anchor_name v1.0.0 // indirect
@@ -258,59 +281,70 @@ require (
 	github.com/slackhq/nebula v1.6.1 // indirect
 	github.com/smallstep/certificates v0.26.1 // indirect
 	github.com/smallstep/nosql v0.6.1 // indirect
-	github.com/smallstep/pkcs7 v0.0.0-20231024181729-3b98ecc1ca81 // indirect
+	github.com/smallstep/pkcs7 v0.1.1 // indirect
 	github.com/smallstep/scep v0.0.0-20231024192529-aee96d7ad34d // indirect
 	github.com/smallstep/truststore v0.13.0 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
-	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/stoewer/go-strcase v1.2.0 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/tailscale/tscert v0.0.0-20240517230440-bbccfbf48933 // indirect
-	github.com/theupdateframework/notary v0.7.0 // indirect
-	github.com/tonistiigi/dchapes-mode v0.0.0-20241001053921-ca0759fec205 // indirect
-	github.com/tonistiigi/fsutil v0.0.0-20241028165955-397af5306b5c // indirect
-	github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4 // indirect
+	github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 // indirect
+	github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f // indirect
+	github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect
 	github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect
 	github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect
-	github.com/urfave/cli v1.22.16 // indirect
-	github.com/vbatts/tar-split v0.11.6 // indirect
-	github.com/vishvananda/netns v0.0.4 // indirect
-	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
-	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	github.com/urfave/cli v1.22.17 // indirect
+	github.com/vbatts/tar-split v0.12.1 // indirect
+	github.com/vishvananda/netns v0.0.5 // indirect
+	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
-	go.etcd.io/bbolt v1.3.11 // indirect
+	go.etcd.io/bbolt v1.4.3 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.46.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
-	go.opentelemetry.io/otel v1.33.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v0.44.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect
-	go.opentelemetry.io/otel/metric v1.33.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.33.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.32.0 // indirect
-	go.opentelemetry.io/otel/trace v1.33.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.4.0 // indirect
+	go.opentelemetry.io/contrib/bridges/prometheus v0.57.0 // indirect
+	go.opentelemetry.io/contrib/exporters/autoexport v0.57.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.60.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.36.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.8.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.8.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.35.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 // indirect
+	go.opentelemetry.io/otel/exporters/prometheus v0.54.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.8.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.32.0 // indirect
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.32.0 // indirect
+	go.opentelemetry.io/otel/log v0.8.0 // indirect
+	go.opentelemetry.io/otel/metric v1.36.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
+	go.opentelemetry.io/otel/sdk/log v0.8.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.36.0 // indirect
+	go.opentelemetry.io/otel/trace v1.36.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
 	go.step.sm/cli-utils v0.9.0 // indirect
 	go.step.sm/crypto v0.45.0 // indirect
 	go.step.sm/linkedca v0.20.1 // indirect
 	go.uber.org/automaxprocs v1.5.3 // indirect
-	go.uber.org/mock v0.5.0 // indirect
+	go.uber.org/mock v0.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap/exp v0.2.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto/x509roots/fallback v0.0.0-20240507223354-67b13616a595 // indirect
-	golang.org/x/exp v0.0.0-20241215155358-4a5509556b9e // indirect
-	golang.org/x/mod v0.23.0 // indirect
-	golang.org/x/term v0.29.0 // indirect
-	golang.org/x/text v0.22.0 // indirect
-	golang.org/x/time v0.8.0 // indirect
-	golang.org/x/tools v0.30.0 // indirect
+	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
+	golang.org/x/mod v0.27.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	golang.org/x/tools v0.36.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
-	google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20241209162323-e6fa225c2576 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259 // indirect
 	howett.net/plist v1.0.0 // indirect

internal/cli/build.go

@@ -0,0 +1,177 @@
+package cli
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"os"
+
+	composetypes "github.com/compose-spec/compose-go/v2/types"
+	"github.com/distribution/reference"
+	"github.com/docker/cli/cli/config"
+	"github.com/docker/docker/api/types/build"
+	"github.com/docker/docker/api/types/image"
+	dockerclient "github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/archive"
+	"github.com/docker/docker/pkg/jsonmessage"
+	"github.com/docker/docker/registry"
+	"github.com/moby/term"
+)
+
+type BuildOptions struct {
+	Files    []string
+	Profiles []string
+	Services []string
+	Push     bool
+	NoCache  bool
+}
+
+// GetServicesThatNeedBuild returns a map of services that require building
+func GetServicesThatNeedBuild(project *composetypes.Project) map[string]composetypes.ServiceConfig {
+	servicesToBuild := make(map[string]composetypes.ServiceConfig, len(project.Services))
+	for serviceName, service := range project.Services {
+		if service.Build == nil {
+			continue
+		}
+		servicesToBuild[serviceName] = service
+	}
+	return servicesToBuild
+}
+
+// BuildServices builds the services defined in the provided map.
+func BuildServices(ctx context.Context, servicesToBuild map[string]composetypes.ServiceConfig, opts BuildOptions) error {
+	fmt.Println("Building services...")
+
+	// Init docker client (can be local or remote, depending on DOCKER_HOST environment variable)
+	dockerCli, err := dockerclient.NewClientWithOpts(dockerclient.FromEnv, dockerclient.WithAPIVersionNegotiation())
+	if err != nil {
+		return err
+	}
+	defer dockerCli.Close()
+
+	serviceImages := make(map[string]string, len(servicesToBuild))
+
+	// Build the services using the local docker client and compose libraries
+	for _, service := range servicesToBuild {
+		fmt.Printf("Building service: %s\n", service.Name)
+		imageName, err := buildSingleService(ctx, dockerCli, service, opts)
+		if err != nil {
+			return fmt.Errorf("build service %s: %w", service.Name, err)
+		}
+		serviceImages[service.Name] = imageName
+	}
+	fmt.Printf("Service images are built.\n")
+
+	if opts.Push {
+		err = pushServiceImages(ctx, dockerCli, serviceImages)
+	}
+
+	return err
+}
+
+// buildSingleService builds a single service using the Docker client and Compose libraries.
+func buildSingleService(ctx context.Context, dockerCli *dockerclient.Client, service composetypes.ServiceConfig, opts BuildOptions) (string, error) {
+	if service.Build == nil {
+		return "", fmt.Errorf("service %s has no build configuration", service.Name)
+	}
+	if service.Image == "" {
+		return "", fmt.Errorf("service %s has no image specified; building services without image is not supported yet",
+			service.Name)
+	}
+
+	buildContextPath := service.Build.Context
+	imageName := service.Image
+
+	// Create a tar archive of the build context
+	buildContext, err := archive.TarWithOptions(buildContextPath, &archive.TarOptions{})
+	if err != nil {
+		return "", fmt.Errorf("failed to create build context for service %s: %w", service.Name, err)
+	}
+
+	buildOptions := build.ImageBuildOptions{
+		// TODO: Support Dockerfiles outside the build context
+		// See https://github.com/docker/compose/blob/cf89fd1aa1328d5af77658ccc5a1e1b29981ae80/pkg/compose/build_classic.go#L92
+		Dockerfile: service.Build.Dockerfile,
+		Tags:       []string{imageName},
+		Remove:     true, // Remove intermediate containers
+		NoCache:    opts.NoCache,
+	}
+
+	buildResponse, err := dockerCli.ImageBuild(ctx, buildContext, buildOptions)
+	if err != nil {
+		return "", fmt.Errorf("failed to build image for service %s: %w", service.Name, err)
+	}
+	defer buildResponse.Body.Close()
+
+	// Display the build response
+	fd, isTerminal := term.GetFdInfo(os.Stdout)
+	if err := jsonmessage.DisplayJSONMessagesStream(buildResponse.Body, os.Stdout, fd, isTerminal, nil); err != nil {
+		return "", fmt.Errorf("failed to display build response for service %s: %w", service.Name, err)
+	}
+
+	return imageName, nil
+}
+
+// pushSingleServiceImage pushes a single service image.
+func pushSingleServiceImage(ctx context.Context, dockerCli *dockerclient.Client, serviceName string, imageName string) error {
+	ref, err := reference.ParseNormalizedNamed(imageName)
+	if err != nil {
+		return err
+	}
+
+	repoInfo, err := registry.ParseRepositoryInfo(ref)
+	if err != nil {
+		return err
+	}
+
+	registryKey := repoInfo.Index.Name
+	if repoInfo.Index.Official {
+		registryKey = registry.IndexServer
+	}
+
+	// Load the Docker config file with auth details, if available
+	configFile := config.LoadDefaultConfigFile(os.Stderr)
+
+	authConfig, err := configFile.GetAuthConfig(registryKey)
+	if err != nil {
+		return err
+	}
+
+	authJSON, err := json.Marshal(authConfig)
+	if err != nil {
+		return fmt.Errorf("failed to marshal auth config for registry %s: %w", registryKey, err)
+	}
+
+	authStr := base64.URLEncoding.EncodeToString(authJSON)
+
+	pushOptions := image.PushOptions{
+		RegistryAuth: authStr,
+	}
+	pushResponse, err := dockerCli.ImagePush(ctx, imageName, pushOptions)
+	if err != nil {
+		return fmt.Errorf("failed to push image %s: %w", imageName, err)
+	}
+	defer pushResponse.Close()
+
+	fmt.Printf("Pushing image %s for service %s...\n", imageName, serviceName)
+
+	fd, isTerminal := term.GetFdInfo(os.Stdout)
+	if err := jsonmessage.DisplayJSONMessagesStream(pushResponse, os.Stdout, fd, isTerminal, nil); err != nil {
+		return fmt.Errorf("failed to display push response for image %s: %w", imageName, err)
+	}
+
+	fmt.Printf("Image %s pushed successfully.\n", imageName)
+	return nil
+}
+
+// pushServiceImages pushes all built service images to the registry.
+func pushServiceImages(ctx context.Context, dockerCli *dockerclient.Client, serviceImages map[string]string) error {
+	fmt.Printf("Pushing images...\n")
+	for serviceName, imageName := range serviceImages {
+		if err := pushSingleServiceImage(ctx, dockerCli, serviceName, imageName); err != nil {
+			return fmt.Errorf("push image for service %s: %w", serviceName, err)
+		}
+	}
+	return nil
+}

internal/cli/cli.go

@@ -2,15 +2,13 @@ package cli
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"net/netip"
 	"os"
+	"slices"
 
-	"github.com/charmbracelet/huh"
 	"github.com/docker/cli/cli/streams"
 	"github.com/psviderski/uncloud/internal/cli/config"
-	"github.com/psviderski/uncloud/internal/fs"
 	"github.com/psviderski/uncloud/internal/machine"
 	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/sshexec"
@@ -22,7 +20,12 @@ import (
 	"google.golang.org/protobuf/types/known/emptypb"
 )
 
-const defaultContextName = "default"
+const (
+	// DefaultSSHKeyPath is the fallback location for the SSH private key when provisioning remote machines.
+	// Used when no key is explicitly provided and SSH agent authentication fails.
+	DefaultSSHKeyPath  = "~/.ssh/id_ed25519"
+	DefaultContextName = "default"
+)
 
 type CLI struct {
 	Config *config.Config
@@ -68,8 +71,18 @@ func (cli *CLI) SetCurrentContext(name string) error {
 // ConnectCluster connects to a cluster using the given context name or the current context if not specified.
 // If the CLI was initialised with a machine connection, the config is ignored and the connection is used instead.
 func (cli *CLI) ConnectCluster(ctx context.Context, contextName string) (*client.Client, error) {
+	return cli.ConnectClusterWithOptions(ctx, contextName, ConnectOptions{
+		// Default to showing progress for CLI usage.
+		ShowProgress: true,
+	})
+}
+
+// ConnectClusterWithOptions connects to a cluster using the given context name and options.
+// If the CLI was initialised with a machine connection, the config is ignored and the connection is used instead.
+// Options are useful when using the CLI as a library where you may want to disable visual feedback.
+func (cli *CLI) ConnectClusterWithOptions(ctx context.Context, contextName string, opts ConnectOptions) (*client.Client, error) {
 	if cli.conn != nil {
-		return connectCluster(ctx, *cli.conn)
+		return ConnectCluster(ctx, *cli.conn, opts)
 	}
 
 	if len(cli.Config.Contexts) == 0 {
@@ -111,38 +124,20 @@ func (cli *CLI) ConnectCluster(ctx context.Context, contextName string) (*client
 		)
 	}
 
-	// TODO: iterate over all connections and try to connect to the cluster using the first successful connection.
-	conn := cfg.Connections[0]
-
-	c, err := connectCluster(ctx, conn)
-	if err != nil {
-		return nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
-	}
-
-	return c, nil
-}
-
-func connectCluster(ctx context.Context, conn config.MachineConnection) (*client.Client, error) {
-	if conn.SSH != "" {
-		user, host, port, err := conn.SSH.Parse()
-		if err != nil {
-			return nil, fmt.Errorf("parse SSH connection %q: %w", conn.SSH, err)
+	// Try each connection in order until one succeeds.
+	var lastErr error
+	for _, conn := range cfg.Connections {
+		c, err := ConnectCluster(ctx, conn, opts)
+		if err == nil {
+			return c, nil
 		}
 
-		keyPath := fs.ExpandHomeDir(conn.SSHKeyFile)
-
-		sshConfig := &connector.SSHConnectorConfig{
-			User:    user,
-			Host:    host,
-			Port:    port,
-			KeyPath: keyPath,
-		}
-		return client.New(ctx, connector.NewSSHConnector(sshConfig))
-	} else if conn.TCP != nil && conn.TCP.IsValid() {
-		return client.New(ctx, connector.NewTCPConnector(*conn.TCP))
+		lastErr = err
 	}
 
-	return nil, errors.New("connection configuration is invalid")
+	return nil, fmt.Errorf("failed to connect to cluster context '%s': "+
+		"all connections (%d) in the Uncloud config (%s) failed; last error: %w",
+		contextName, len(cfg.Connections), cli.Config.Path(), lastErr)
 }
 
 type InitClusterOptions struct {
@@ -151,6 +146,7 @@ type InitClusterOptions struct {
 	Network       netip.Prefix
 	PublicIP      *netip.Addr
 	RemoteMachine *RemoteMachine
+	SkipInstall   bool
 	Version       string
 }
 
@@ -165,15 +161,12 @@ func (cli *CLI) InitCluster(ctx context.Context, opts InitClusterOptions) (*clie
 }
 
 func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions) (*client.Client, error) {
-	contextName := opts.Context
-	if contextName == "" {
-		contextName = defaultContextName
-	}
-	if _, ok := cli.Config.Contexts[contextName]; ok {
-		return nil, fmt.Errorf("cluster context '%s' already exists", contextName)
+	contextName, err := cli.newContextName(opts.Context)
+	if err != nil {
+		return nil, err
 	}
 
-	machineClient, err := cli.provisionRemoteMachine(ctx, *opts.RemoteMachine, opts.Version)
+	machineClient, err := provisionOrConnectRemoteMachine(ctx, opts.RemoteMachine, opts.SkipInstall, opts.Version)
 	if err != nil {
 		return nil, err
 	}
@@ -190,7 +183,7 @@ func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions)
 		return nil, fmt.Errorf("inspect machine: %w", err)
 	}
 	if minfo.Id != "" {
-		if err = cli.promptResetMachine(); err != nil {
+		if err = promptResetMachine(ctx, machineClient.MachineClient); err != nil {
 			return nil, err
 		}
 	}
@@ -245,30 +238,63 @@ func (cli *CLI) initRemoteMachine(ctx context.Context, opts InitClusterOptions)
 	return machineClient, nil
 }
 
+// newContextName returns a unique name for a new cluster context. If the provided name is not DefaultContextName,
+// and it's already taken, an error is returned. If the name is not provided or is DefaultContextName, the first
+// available name "default[-N]" is returned.
+func (cli *CLI) newContextName(name string) (string, error) {
+	if name == "" {
+		name = DefaultContextName
+	}
+
+	if _, exists := cli.Config.Contexts[name]; !exists {
+		return name, nil
+	}
+
+	// If non-default context already exists, error out.
+	if name != DefaultContextName {
+		return "", fmt.Errorf("cluster context '%s' already exists", name)
+	}
+
+	// The default context already exists, generate a numbered suffix to make it unique.
+	for i := 1; ; i++ {
+		name = fmt.Sprintf("%s-%d", DefaultContextName, i)
+		if _, exists := cli.Config.Contexts[name]; !exists {
+			return name, nil
+		}
+	}
+}
+
 type AddMachineOptions struct {
 	Context       string
 	MachineName   string
 	PublicIP      *netip.Addr
-	RemoteMachine RemoteMachine
+	RemoteMachine *RemoteMachine
+	SkipInstall   bool
 	Version       string
 }
 
-// AddMachine provisions a remote machine and adds it to the cluster. It returns a client to interact with the machine
-// which should be closed after use by the caller.
-func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client.Client, error) {
+// AddMachine provisions a remote machine and adds it to the cluster. It returns a cluster client and a machine client.
+// The cluster client is connected to the existing machine in the cluster. It was used to add the new machine to the
+// cluster. The machine client is connected to the new machine and can be used to interact with it.
+// Both client should be closed after use by the caller.
+func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client.Client, *client.Client, error) {
 	contextName := opts.Context
 	if contextName == "" {
 		contextName = cli.Config.CurrentContext
 	}
 	c, err := cli.ConnectCluster(ctx, contextName)
 	if err != nil {
-		return nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
+		return nil, nil, fmt.Errorf("connect to cluster (context '%s'): %w", contextName, err)
 	}
-	defer c.Close()
+	defer func() {
+		if err != nil {
+			c.Close()
+		}
+	}()
 
-	machineClient, err := cli.provisionRemoteMachine(ctx, opts.RemoteMachine, opts.Version)
+	machineClient, err := provisionOrConnectRemoteMachine(ctx, opts.RemoteMachine, opts.SkipInstall, opts.Version)
 	if err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 	defer func() {
 		if err != nil {
@@ -279,11 +305,22 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	// Check if the machine is already initialised as a cluster member and prompt the user to reset it first.
 	minfo, err := machineClient.Inspect(ctx, &emptypb.Empty{})
 	if err != nil {
-		return nil, fmt.Errorf("inspect machine: %w", err)
+		return nil, nil, fmt.Errorf("inspect machine: %w", err)
 	}
 	if minfo.Id != "" {
-		if err = cli.promptResetMachine(); err != nil {
-			return nil, err
+		// Check if the machine is already a member of this cluster.
+		machines, err := c.ListMachines(ctx, nil)
+		if err != nil {
+			return nil, nil, fmt.Errorf("list cluster machines: %w", err)
+		}
+		if slices.ContainsFunc(machines, func(m *pb.MachineMember) bool {
+			return m.Machine.Id == minfo.Id
+		}) {
+			return nil, nil, fmt.Errorf("machine is already a member of this cluster (%s)", minfo.Name)
+		}
+
+		if err = promptResetMachine(ctx, machineClient.MachineClient); err != nil {
+			return nil, nil, err
 		}
 	}
 
@@ -292,19 +329,19 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	// TODO(lhf): remove Unimplemented check when v0.9.0 is released.
 	if err != nil {
 		if status.Convert(err).Code() != codes.Unimplemented {
-			return nil, fmt.Errorf("check machine prerequisites: %w", err)
+			return nil, nil, fmt.Errorf("check machine prerequisites: %w", err)
 		}
 	} else if !checkResp.Satisfied {
-		return nil, fmt.Errorf("machine prerequisites not satisfied: %s", checkResp.Error)
+		return nil, nil, fmt.Errorf("machine prerequisites not satisfied: %s", checkResp.Error)
 	}
 
 	tokenResp, err := machineClient.Token(ctx, &emptypb.Empty{})
 	if err != nil {
-		return nil, fmt.Errorf("get remote machine token: %w", err)
+		return nil, nil, fmt.Errorf("get remote machine token: %w", err)
 	}
 	token, err := machine.ParseToken(tokenResp.Token)
 	if err != nil {
-		return nil, fmt.Errorf("parse remote machine token: %w", err)
+		return nil, nil, fmt.Errorf("parse remote machine token: %w", err)
 	}
 
 	// Register the machine in the cluster using its public key and endpoints from the token.
@@ -330,13 +367,13 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 
 	addResp, err := c.AddMachine(ctx, addReq)
 	if err != nil {
-		return nil, fmt.Errorf("add machine to cluster (context '%s'): %w", contextName, err)
+		return nil, nil, fmt.Errorf("add machine to cluster (context '%s'): %w", contextName, err)
 	}
 
-	// List other machines in the cluster to include them in the join request.
+	// Get the most up-to-date list of other machines in the cluster to include them in the join request.
 	machines, err := c.ListMachines(ctx, nil)
 	if err != nil {
-		return nil, fmt.Errorf("list cluster machines: %w", err)
+		return nil, nil, fmt.Errorf("list cluster machines: %w", err)
 	}
 	otherMachines := make([]*pb.MachineInfo, 0, len(machines)-1)
 	for _, m := range machines {
@@ -351,7 +388,7 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 		OtherMachines: otherMachines,
 	}
 	if _, err = machineClient.JoinCluster(ctx, joinReq); err != nil {
-		return nil, fmt.Errorf("join cluster: %w", err)
+		return nil, nil, fmt.Errorf("join cluster: %w", err)
 	}
 
 	// TODO: fix empty context name when using the current context (contextName == "").
@@ -367,34 +404,47 @@ func (cli *CLI) AddMachine(ctx context.Context, opts AddMachineOptions) (*client
 	}
 	cli.Config.Contexts[contextName].Connections = append(cli.Config.Contexts[contextName].Connections, connCfg)
 	if err = cli.Config.Save(); err != nil {
-		return nil, fmt.Errorf("save config: %w", err)
+		return nil, nil, fmt.Errorf("save config: %w", err)
 	}
 
-	return machineClient, nil
+	return c, machineClient, nil
 }
 
-// provisionRemoteMachine installs the Uncloud daemon and dependencies on the remote machine over SSH and returns
-// a machine API client to interact with the machine. The client should be closed after use by the caller.
+// provisionOrConnectRemoteMachine installs the Uncloud daemon and dependencies on the remote machine over SSH and
+// returns a machine API client to interact with the machine. The client should be closed after use by the caller.
 // The version parameter specifies the version of the Uncloud daemon to install. If empty, the latest version is used.
-func (cli *CLI) provisionRemoteMachine(
-	ctx context.Context, remoteMachine RemoteMachine, version string,
+// If skipInstall is true, the installation step is skipped, and it is assumed that the Uncloud daemon and dependencies
+// are already installed and running.
+// The remoteMachine.SSHKeyPath could be updated to the default SSH key path if it is not set and the SSH agent
+// authentication fails.
+func provisionOrConnectRemoteMachine(
+	ctx context.Context, remoteMachine *RemoteMachine, skipInstall bool, version string,
 ) (*client.Client, error) {
-	// Provision the remote machine by installing the Uncloud daemon and dependencies over SSH.
 	sshClient, err := sshexec.Connect(remoteMachine.User, remoteMachine.Host, remoteMachine.Port, remoteMachine.KeyPath)
+	// If the SSH connection using SSH agent fails and no key path is provided, try to use the default SSH key.
+	if err != nil && remoteMachine.KeyPath == "" {
+		remoteMachine.KeyPath = DefaultSSHKeyPath
+		sshClient, err = sshexec.Connect(
+			remoteMachine.User, remoteMachine.Host, remoteMachine.Port, remoteMachine.KeyPath,
+		)
+	}
 	if err != nil {
 		return nil, fmt.Errorf(
 			"SSH login to remote machine %s: %w",
 			config.NewSSHDestination(remoteMachine.User, remoteMachine.Host, remoteMachine.Port), err,
 		)
 	}
-	exec := sshexec.NewRemote(sshClient)
-	// Install and run the Uncloud daemon and dependencies on the remote machine.
-	if err = provisionMachine(ctx, exec, version); err != nil {
-		return nil, fmt.Errorf("provision machine: %w", err)
+
+	if !skipInstall {
+		// Provision the remote machine by installing the Uncloud daemon and dependencies over SSH.
+		exec := sshexec.NewRemote(sshClient)
+		if err = provisionMachine(ctx, exec, version); err != nil {
+			return nil, fmt.Errorf("provision machine: %w", err)
+		}
 	}
 
 	var machineClient *client.Client
-	if remoteMachine.User == "root" {
+	if remoteMachine.User == "root" || skipInstall {
 		// Create a machine API client over the established SSH connection to the remote machine.
 		machineClient, err = client.New(ctx, connector.NewSSHConnectorFromClient(sshClient))
 	} else {
@@ -414,31 +464,6 @@ func (cli *CLI) provisionRemoteMachine(
 	return machineClient, nil
 }
 
-func (cli *CLI) promptResetMachine() error {
-	var confirm bool
-	form := huh.NewForm(
-		huh.NewGroup(
-			huh.NewConfirm().
-				Title(
-					"The remote machine is already initialised as a cluster member. Do you want to reset it first?",
-				).
-				Affirmative("Yes!").
-				Negative("No").
-				Value(&confirm),
-		),
-	).WithAccessible(true)
-	if err := form.Run(); err != nil {
-		return fmt.Errorf("prompt user to confirm: %w", err)
-	}
-
-	if !confirm {
-		return fmt.Errorf("remote machine is already initialised as a cluster member")
-	}
-	// TODO: implement resetting the remote machine.
-	return fmt.Errorf("resetting the remote machine is not implemented yet. " +
-		"Please manually run 'uncloud-uninstall' on the remote machine to fully uninstall Uncloud from it")
-}
-
 // ProgressOut returns an output stream for progress writer.
 func (cli *CLI) ProgressOut() *streams.Out {
 	return streams.NewOut(os.Stdout)

internal/cli/config/config.go

@@ -53,11 +53,15 @@ func (c *Config) Read() error {
 
 func (c *Config) Save() error {
 	dir, _ := filepath.Split(c.path)
-	if err := os.MkdirAll(dir, 0700); err != nil {
+	// If dir is empty (e.g., when path is just a filename), use current directory
+	if dir == "" {
+		dir = "."
+	}
+	if err := os.MkdirAll(dir, 0o700); err != nil {
 		return fmt.Errorf("create config directory '%s': %w", dir, err)
 	}
 
-	f, err := os.OpenFile(c.path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
+	f, err := os.OpenFile(c.path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
 	if err != nil {
 		return fmt.Errorf("write config file '%s': %w", c.path, err)
 	}

internal/cli/config/config_test.go

@@ -0,0 +1,80 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestConfig_Save(t *testing.T) {
+	t.Parallel()
+
+	// Create a temporary directory for the test
+	tmpDir := t.TempDir()
+
+	// Change to temp directory so relative paths resolve correctly
+	originalDir, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("Failed to get current directory: %v", err)
+	}
+	defer func() {
+		if err := os.Chdir(originalDir); err != nil {
+			t.Logf("Failed to restore original directory: %v", err)
+		}
+	}()
+
+	tests := []struct {
+		name            string
+		configPath      string
+		contextName     string
+		expectFileAt    string // Expected file location for verification
+		useAbsolutePath bool   // Whether to use absolute path for expectFileAt
+	}{
+		{
+			name:        "relative path without prefix",
+			configPath:  "test-config.yaml",
+			contextName: "test",
+		},
+		{
+			name:        "relative path with prefix",
+			configPath:  "./test-config-2.yaml",
+			contextName: "test2",
+		},
+		{
+			name:        "absolute path",
+			configPath:  filepath.Join(tmpDir, "absolute-config.yaml"),
+			contextName: "test3",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			if err := os.Chdir(tmpDir); err != nil {
+				t.Fatalf("Failed to change to temp directory: %v", err)
+			}
+
+			cfg := &Config{
+				CurrentContext: tt.contextName,
+				Contexts: map[string]*Context{
+					tt.contextName: {
+						Name: tt.contextName,
+					},
+				},
+				path: tt.configPath,
+			}
+
+			// This should not fail when saving the config
+			err := cfg.Save()
+			if err != nil {
+				t.Errorf("Expected no error when saving config, got: %v", err)
+			}
+
+			// Verify the file was created
+			if _, err := os.Stat(tt.configPath); os.IsNotExist(err) {
+				t.Errorf("Config file was not created at expected path: %s", tt.configPath)
+			}
+		})
+	}
+}

internal/cli/config/connection.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"fmt"
 	"net"
 	"net/netip"
 	"strconv"
@@ -24,6 +25,15 @@ type MachineConnection struct {
 	PublicKey secret.Secret   `yaml:"public_key,omitempty"`
 }
 
+func (c MachineConnection) String() string {
+	if c.SSH != "" {
+		return string(c.SSH)
+	} else if c.TCP != nil && c.TCP.IsValid() {
+		return fmt.Sprintf("tcp://%s", c.TCP)
+	}
+	return "unknown connection"
+}
+
 // SSHDestination represents an SSH destination string in the canonical form of "user@host:port".
 // The default user "root" and port 22 can be omitted.
 type SSHDestination string

internal/cli/connect.go

@@ -0,0 +1,189 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/charmbracelet/bubbles/spinner"
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/psviderski/uncloud/internal/fs"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/psviderski/uncloud/pkg/client/connector"
+)
+
+// ConnectOptions configures the behavior of cluster connection attempts.
+type ConnectOptions struct {
+	// Whether to show connection progress spinner if stdout is a terminal or progress logs if not.
+	ShowProgress bool
+}
+
+func ConnectCluster(ctx context.Context, conn config.MachineConnection, opts ConnectOptions) (*client.Client, error) {
+	if opts.ShowProgress {
+		return connectClusterWithProgress(ctx, conn)
+	}
+	return connectCluster(ctx, conn)
+}
+
+// connectClusterWithProgress connects to the cluster while displaying a progress spinner.
+// If the stdout is not a terminal, it falls back to simple progress logs to stderr.
+func connectClusterWithProgress(ctx context.Context, conn config.MachineConnection) (*client.Client, error) {
+	// If stdout is not a terminal, fall back to simple progress logs.
+	if !IsStdoutTerminal() {
+		fmt.Fprintln(os.Stderr, "Connecting to", conn.String())
+		cli, err := connectCluster(ctx, conn)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, "Connection failed:", err)
+		} else {
+			fmt.Fprintln(os.Stderr, "Connected to cluster.")
+		}
+		return cli, err
+	}
+
+	// Run the connection TUI model.
+	p := tea.NewProgram(newConnectModel(ctx, conn))
+	model, err := p.Run()
+	if err != nil {
+		return nil, fmt.Errorf("run connection TUI: %w", err)
+	}
+
+	m := model.(connectModel)
+	return m.result.client, m.result.err
+}
+
+func connectCluster(ctx context.Context, conn config.MachineConnection) (*client.Client, error) {
+	if conn.SSH != "" {
+		user, host, port, err := conn.SSH.Parse()
+		if err != nil {
+			return nil, fmt.Errorf("parse SSH connection %q: %w", conn.SSH, err)
+		}
+
+		keyPath := fs.ExpandHomeDir(conn.SSHKeyFile)
+
+		sshConfig := &connector.SSHConnectorConfig{
+			User:    user,
+			Host:    host,
+			Port:    port,
+			KeyPath: keyPath,
+		}
+		return client.New(ctx, connector.NewSSHConnector(sshConfig))
+	} else if conn.TCP != nil && conn.TCP.IsValid() {
+		return client.New(ctx, connector.NewTCPConnector(*conn.TCP))
+	}
+
+	return nil, errors.New("connection configuration is invalid")
+}
+
+// connectModel is a TUI model for connecting to a cluster with a progress spinner.
+type connectModel struct {
+	ctx     context.Context
+	conn    config.MachineConnection
+	spinner spinner.Model
+	// showSpinner controls whether the spinner is visible (delayed to avoid flashing).
+	showSpinner bool
+	// done indicates whether the connection attempt has completed (successfully or with error).
+	done bool
+	// result holds the result of the connection attempt.
+	result connectResultMsg
+}
+
+type connectResultMsg struct {
+	client *client.Client
+	err    error
+}
+
+// showSpinnerMsg is sent after a delay to show the spinner.
+type showSpinnerMsg struct{}
+
+func newConnectModel(ctx context.Context, conn config.MachineConnection) connectModel {
+	s := spinner.New()
+	s.Spinner = spinner.MiniDot
+	s.Style = lipgloss.NewStyle().Foreground(lipgloss.Color("3")) // the same yellow as in compose progress
+
+	return connectModel{
+		ctx:     ctx,
+		conn:    conn,
+		spinner: s,
+	}
+}
+
+func (m connectModel) Init() tea.Cmd {
+	return tea.Batch(
+		m.spinner.Tick,
+		m.connect(),
+		m.delayShowSpinner(),
+	)
+}
+
+func (m connectModel) connect() tea.Cmd {
+	return func() tea.Msg {
+		cli, err := connectCluster(m.ctx, m.conn)
+		return connectResultMsg{
+			client: cli,
+			err:    err,
+		}
+	}
+}
+
+// delayShowSpinner returns a command that sends a message to show the spinner after a delay.
+// This avoids flashing the spinner if the connection is fast.
+func (m connectModel) delayShowSpinner() tea.Cmd {
+	return tea.Tick(500*time.Millisecond, func(t time.Time) tea.Msg {
+		return showSpinnerMsg{}
+	})
+}
+
+func (m connectModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	select {
+	case <-m.ctx.Done():
+		m.result.err = m.ctx.Err()
+		m.done = true
+		return m, tea.Quit
+	default:
+	}
+
+	switch msg := msg.(type) {
+	case connectResultMsg:
+		m.result = msg
+		m.done = true
+		return m, tea.Quit
+
+	case showSpinnerMsg:
+		// Only show spinner if connection hasn't completed yet.
+		if !m.done {
+			m.showSpinner = true
+		}
+		return m, nil
+
+	case spinner.TickMsg:
+		var cmd tea.Cmd
+		m.spinner, cmd = m.spinner.Update(msg)
+		return m, cmd
+
+	case tea.KeyMsg:
+		if msg.Type == tea.KeyCtrlC {
+			m.result.err = fmt.Errorf("connection cancelled")
+			m.done = true
+			return m, tea.Quit
+		}
+	}
+
+	return m, nil
+}
+
+func (m connectModel) View() string {
+	// Don't show anything if done or spinner not yet visible.
+	if m.done || !m.showSpinner {
+		return ""
+	}
+
+	style := lipgloss.NewStyle().Foreground(lipgloss.Color("153"))
+	return fmt.Sprintf("%s %s\n",
+		m.spinner.View(),
+		fmt.Sprintf("Connecting to %s", style.Render(m.conn.String())),
+	)
+}

internal/cli/flags.go

@@ -1,7 +1,11 @@
 package cli
 
 import (
+	"log"
+	"os"
 	"strings"
+
+	"github.com/spf13/cobra"
 )
 
 // ExpandCommaSeparatedValues takes a slice of strings and expands any comma-separated values into individual elements.
@@ -21,3 +25,12 @@ func ExpandCommaSeparatedValues(values []string) []string {
 
 	return expanded
 }
+
+// BindEnvToFlag assigns the value of an environment variable to the given command flag if the flag has not been set.
+func BindEnvToFlag(cmd *cobra.Command, flagName, envVar string) {
+	if value := os.Getenv(envVar); value != "" && !cmd.Flags().Changed(flagName) {
+		if err := cmd.Flags().Set(flagName, value); err != nil {
+			log.Fatalf("Failed to bind environment variable '%s' to flag '%s': %v", envVar, flagName, err)
+		}
+	}
+}

internal/cli/machine.go

@@ -5,12 +5,20 @@ import (
 	"fmt"
 	"os"
 	"strings"
+	"time"
 
+	"github.com/cenkalti/backoff/v4"
+	"github.com/charmbracelet/huh"
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"github.com/psviderski/uncloud/internal/sshexec"
+	"google.golang.org/protobuf/types/known/emptypb"
 )
 
-// TODO: support pinning the script version to the CLI version.
-const installScriptURL = "https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/install.sh"
+const (
+	// TODO: support pinning the script version to the CLI version.
+	installScriptURL = "https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/install.sh"
+	rootUser         = "root"
+)
 
 type RemoteMachine struct {
 	User    string
@@ -24,7 +32,7 @@ func installCmd(user string, version string) string {
 	var env []string
 
 	// Add the SSH user (non-root) to the uncloud group to allow access to the Uncloud daemon unix socket.
-	if user != "root" {
+	if user != rootUser {
 		sudoPrefix = "sudo"
 		env = append(env, "UNCLOUD_GROUP_ADD_USER="+sshexec.Quote(user))
 	}
@@ -46,6 +54,26 @@ func provisionMachine(ctx context.Context, exec sshexec.Executor, version string
 		return fmt.Errorf("run whoami: %w", err)
 	}
 
+	if user != rootUser {
+		// 'sudo -n' is not used because it fails with 'sudo: a password is required' when the user has no password
+		// in /etc/shadow even though it may have valid sudo access.
+		out, err := exec.Run(ctx, "sudo true")
+		if err != nil {
+			if strings.Contains(out, "password is required") {
+				return fmt.Errorf(
+					"user '%[1]s' requires a password for sudo, but Uncloud needs passwordless sudo or root access "+
+						"to install and configure the uncloudd daemon on the remote machine.\n\n"+
+						"Possible solutions:\n"+
+						"1. Use root user or a user with passwordless sudo instead.\n"+
+						"2. Configure passwordless sudo for the user '%[1]s' by running on the remote machine:\n"+
+						"   echo '%[1]s ALL=(ALL) NOPASSWD:ALL' | sudo tee /etc/sudoers.d/%[1]s",
+					user)
+			}
+			return fmt.Errorf("sudo command failed for user '%s': %w. "+
+				"Please ensure the user has sudo privileges or use root user instead", user, err)
+		}
+	}
+
 	cmd := installCmd(user, version)
 
 	fmt.Println("Downloading Uncloud install script:", installScriptURL)
@@ -56,3 +84,56 @@ func provisionMachine(ctx context.Context, exec sshexec.Executor, version string
 	}
 	return nil
 }
+
+func promptResetMachine(ctx context.Context, machineClient pb.MachineClient) error {
+	var confirm bool
+	form := huh.NewForm(
+		huh.NewGroup(
+			huh.NewConfirm().
+				Title(
+					"The remote machine is already initialised as a cluster member. Do you want to reset it first?\n" +
+						"This will:\n" +
+						"- Remove all service containers from the machine\n" +
+						"- Reset the machine to the uninitialised state",
+				).
+				Affirmative("Yes!").
+				Negative("No").
+				Value(&confirm),
+		),
+	).WithAccessible(true)
+	if err := form.Run(); err != nil {
+		return fmt.Errorf("prompt user to confirm: %w", err)
+	}
+
+	if !confirm {
+		return fmt.Errorf("remote machine is already initialised as a cluster member")
+	}
+
+	if _, err := machineClient.Reset(ctx, &pb.ResetRequest{}); err != nil {
+		return fmt.Errorf("reset remote machine: %w. You can also manually run 'uncloud-uninstall' "+
+			"on the remote machine to fully uninstall Uncloud from it", err)
+	}
+	fmt.Println("Resetting the remote machine...")
+	if err := waitMachineReady(ctx, machineClient, 1*time.Minute); err != nil {
+		return fmt.Errorf("wait for machine to be ready after reset: %w", err)
+	}
+
+	return nil
+}
+
+// waitMachineReady waits for the machine to be ready to serve requests.
+func waitMachineReady(ctx context.Context, machineClient pb.MachineClient, timeout time.Duration) error {
+	boff := backoff.WithContext(backoff.NewExponentialBackOff(
+		backoff.WithMaxInterval(1*time.Second),
+		backoff.WithMaxElapsedTime(timeout),
+	), ctx)
+
+	inspect := func() error {
+		_, err := machineClient.Inspect(ctx, &emptypb.Empty{})
+		if err != nil {
+			return fmt.Errorf("inspect machine: %w", err)
+		}
+		return nil
+	}
+	return backoff.Retry(inspect, boff)
+}

internal/cli/prompt.go

@@ -1,6 +1,11 @@
 package cli
 
-import "github.com/charmbracelet/huh"
+import (
+	"os"
+
+	"github.com/charmbracelet/huh"
+	"golang.org/x/term"
+)
 
 func Confirm() (bool, error) {
 	var confirmed bool
@@ -21,3 +26,13 @@ func Confirm() (bool, error) {
 
 	return confirmed, nil
 }
+
+// IsStdinTerminal checks if the standard input is a terminal (TTY).
+func IsStdinTerminal() bool {
+	return term.IsTerminal(int(os.Stdin.Fd()))
+}
+
+// IsStdoutTerminal checks if the standard output is a terminal (TTY).
+func IsStdoutTerminal() bool {
+	return term.IsTerminal(int(os.Stdout.Fd()))
+}

internal/corrosion/client.go

@@ -5,14 +5,15 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
-	"github.com/cenkalti/backoff/v4"
-	"golang.org/x/net/http2"
 	"log/slog"
 	"net"
 	"net/http"
 	"net/netip"
 	"net/url"
 	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"golang.org/x/net/http2"
 )
 
 const (

internal/corrosion/subscribe.go

@@ -6,11 +6,12 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"github.com/cenkalti/backoff/v4"
 	"io"
 	"log/slog"
 	"net/http"
 	"strconv"
+
+	"github.com/cenkalti/backoff/v4"
 )
 
 type ChangeType string

internal/daemon/daemon.go

@@ -3,8 +3,9 @@ package daemon
 import (
 	"context"
 	"fmt"
-	systemd "github.com/coreos/go-systemd/daemon"
 	"log/slog"
+
+	systemd "github.com/coreos/go-systemd/daemon"
 	"github.com/psviderski/uncloud/internal/machine"
 )
 

internal/daemon/token.go

@@ -3,10 +3,11 @@ package daemon
 import (
 	"errors"
 	"fmt"
-	"github.com/psviderski/uncloud/internal/machine"
-	"github.com/psviderski/uncloud/internal/machine/network"
 	"net/netip"
 	"os"
+
+	"github.com/psviderski/uncloud/internal/machine"
+	"github.com/psviderski/uncloud/internal/machine/network"
 )
 
 // MachineToken returns the local machine's token that can be used for adding the machine to a cluster.

internal/docker/client.go

@@ -4,12 +4,17 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"github.com/cenkalti/backoff/v4"
-	"github.com/docker/docker/client"
 	"log/slog"
 	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"github.com/docker/docker/client"
 )
 
+type Client struct {
+	*client.Client
+}
+
 // WaitDaemonReady waits for the Docker daemon to start and be ready to serve requests.
 func WaitDaemonReady(ctx context.Context, cli *client.Client) error {
 	// Retry to ping the Docker daemon until it's ready or the context is canceled.

internal/docker/container.go

@@ -0,0 +1,70 @@
+package docker
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/containerd/errdefs"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/go-connections/nat"
+)
+
+// CreateContainerWithImagePull creates a container. If the image is missing, it pulls the image first.
+func (cli *Client) CreateContainerWithImagePull(
+	ctx context.Context, name string, config *container.Config, hostConfig *container.HostConfig,
+) (container.CreateResponse, error) {
+	resp, err := cli.ContainerCreate(ctx, config, hostConfig, nil, nil, name)
+	if err == nil || !errdefs.IsNotFound(err) {
+		return resp, err
+	}
+
+	pullCh, err := cli.PullImage(ctx, config.Image, image.PullOptions{})
+	if err != nil {
+		return resp, fmt.Errorf("pull image: %w", err)
+	}
+
+	// Drain the pull channel until it's closed (image is fully pulled) or an error occurs.
+	// If the context is canceled during the pull, the channel will receive a context cancellation error.
+	for msg := range pullCh {
+		if msg.Err != nil {
+			return resp, fmt.Errorf("pull image: %w", msg.Err)
+		}
+	}
+
+	// Create container again after image pull.
+	if resp, err = cli.ContainerCreate(ctx, config, hostConfig, nil, nil, name); err != nil {
+		return resp, err
+	}
+
+	return resp, nil
+}
+
+// WaitPortPublished waits for a container port to be published on the host which happens asynchronously.
+func (cli *Client) WaitPortPublished(ctx context.Context, containerID string, port nat.Port) ([]nat.PortBinding, error) {
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	for {
+		c, err := cli.ContainerInspect(ctx, containerID)
+		if err != nil {
+			return nil, fmt.Errorf("inspect container: %w", err)
+		}
+
+		binding, ok := c.NetworkSettings.Ports[port]
+		if ok && len(binding) > 0 {
+			return binding, nil
+		}
+
+		select {
+		case <-time.After(10 * time.Millisecond):
+		case <-ctx.Done():
+			if errors.Is(ctx.Err(), context.DeadlineExceeded) {
+				return nil, errors.New("timeout")
+			}
+			return nil, ctx.Err()
+		}
+	}
+}

internal/docker/image.go

@@ -0,0 +1,132 @@
+package docker
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+
+	dockercommand "github.com/docker/cli/cli/command"
+	dockerconfig "github.com/docker/cli/cli/config"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types/registry"
+	"github.com/docker/docker/pkg/jsonmessage"
+)
+
+type PullPushImageMessage struct {
+	Message jsonmessage.JSONMessage
+	Err     error
+}
+
+// PullImage pulls an image and returns a channel to receive progress messages.
+func (cli *Client) PullImage(
+	ctx context.Context, image string, opts image.PullOptions,
+) (<-chan PullPushImageMessage, error) {
+	if opts.RegistryAuth == "" {
+		// Try to retrieve the authentication token for the image from the default local Docker config file.
+		if encodedAuth, err := RetrieveLocalDockerRegistryAuth(image); err == nil {
+			opts.RegistryAuth = encodedAuth
+		}
+	}
+
+	respBody, err := cli.ImagePull(ctx, image, opts)
+	if err != nil {
+		return nil, err
+	}
+
+	ch := make(chan PullPushImageMessage)
+	go processPullPushImageResp(ctx, respBody, ch)
+
+	return ch, nil
+}
+
+// PushImage pushes an image and returns a channel to receive progress messages.
+func (cli *Client) PushImage(
+	ctx context.Context, image string, opts image.PushOptions,
+) (<-chan PullPushImageMessage, error) {
+	if opts.RegistryAuth == "" {
+		// Try to retrieve the authentication token for the image from the default local Docker config file.
+		encodedAuth, _ := RetrieveLocalDockerRegistryAuth(image)
+		if encodedAuth == "" {
+			// If no credentials are found, provide an encoded empty auth config to work around the bug in Docker:
+			// https://github.com/moby/moby/issues/50729
+			var err error
+			if encodedAuth, err = registry.EncodeAuthConfig(registry.AuthConfig{}); err != nil {
+				return nil, fmt.Errorf("encode empty auth config: %w", err)
+			}
+		}
+		opts.RegistryAuth = encodedAuth
+	}
+
+	respBody, err := cli.ImagePush(ctx, image, opts)
+	if err != nil {
+		return nil, err
+	}
+
+	ch := make(chan PullPushImageMessage)
+	go processPullPushImageResp(ctx, respBody, ch)
+
+	return ch, nil
+}
+
+// processPullPushImageResp decodes JSON messages from the image pull/push response body and
+// sends them to the provided channel.
+func processPullPushImageResp(ctx context.Context, respBody io.ReadCloser, ch chan<- PullPushImageMessage) {
+	defer respBody.Close()
+	defer close(ch)
+
+	decoder := json.NewDecoder(respBody)
+	for {
+		var jm jsonmessage.JSONMessage
+		if err := decoder.Decode(&jm); err != nil {
+			if errors.Is(err, io.EOF) {
+				return
+			}
+			ch <- PullPushImageMessage{Err: fmt.Errorf("decode image pull/push message: %w", err)}
+			return
+		}
+
+		msg := PullPushImageMessage{Message: jm}
+		if jm.Error != nil {
+			msg.Err = errors.New(jm.Error.Message)
+		}
+
+		select {
+		case <-ctx.Done():
+			ch <- PullPushImageMessage{Err: ctx.Err()}
+			return
+		default:
+			ch <- msg
+		}
+	}
+}
+
+// RetrieveLocalDockerRegistryAuth retrieves the authentication token for the specified image from the local Docker
+// config file. It returns the encoded authentication token if it contains any credentials, or an empty string if
+// no credentials are found.
+func RetrieveLocalDockerRegistryAuth(image string) (string, error) {
+	// Try to retrieve the authentication token for the image from the default local Docker config file.
+	dockerConfig := dockerconfig.LoadDefaultConfigFile(os.Stderr)
+	encodedAuth, err := dockercommand.RetrieveAuthTokenFromImage(dockerConfig, image)
+	if err != nil {
+		return "", err
+	}
+	// The encodedAuth can be a base64-encoded "{}" (empty JSON object) or include a server address but no credentials.
+	// Return encodedAuth only if it contains any credentials.
+	auth, err := registry.DecodeAuthConfig(encodedAuth)
+	if err != nil {
+		return "", fmt.Errorf("decode auth config: %w", err)
+	}
+
+	if auth.Username == "" &&
+		auth.Password == "" &&
+		auth.Auth == "" &&
+		auth.IdentityToken == "" &&
+		auth.RegistryToken == "" {
+		return "", nil
+	}
+
+	return encodedAuth, nil
+}

internal/machine/api/pb/caddy.pb.go

@@ -0,0 +1,176 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.34.2
+// 	protoc        v5.27.3
+// source: internal/machine/api/pb/caddy.proto
+
+package pb
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type GetCaddyConfigResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The generated Caddyfile content.
+	Caddyfile string `protobuf:"bytes,1,opt,name=caddyfile,proto3" json:"caddyfile,omitempty"`
+	// Timestamp when the config was last modified.
+	ModifiedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=modified_at,json=modifiedAt,proto3" json:"modified_at,omitempty"`
+}
+
+func (x *GetCaddyConfigResponse) Reset() {
+	*x = GetCaddyConfigResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_machine_api_pb_caddy_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetCaddyConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetCaddyConfigResponse) ProtoMessage() {}
+
+func (x *GetCaddyConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_machine_api_pb_caddy_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetCaddyConfigResponse.ProtoReflect.Descriptor instead.
+func (*GetCaddyConfigResponse) Descriptor() ([]byte, []int) {
+	return file_internal_machine_api_pb_caddy_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GetCaddyConfigResponse) GetCaddyfile() string {
+	if x != nil {
+		return x.Caddyfile
+	}
+	return ""
+}
+
+func (x *GetCaddyConfigResponse) GetModifiedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ModifiedAt
+	}
+	return nil
+}
+
+var File_internal_machine_api_pb_caddy_proto protoreflect.FileDescriptor
+
+var file_internal_machine_api_pb_caddy_proto_rawDesc = []byte{
+	0x0a, 0x23, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x61, 0x64, 0x64, 0x79, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x61, 0x70, 0x69, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74,
+	0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x73, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x43,
+	0x61, 0x64, 0x64, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x61, 0x64, 0x64, 0x79, 0x66, 0x69, 0x6c, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x61, 0x64, 0x64, 0x79, 0x66, 0x69, 0x6c, 0x65,
+	0x12, 0x3b, 0x0a, 0x0b, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x52, 0x0a, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x41, 0x74, 0x32, 0x49, 0x0a,
+	0x05, 0x43, 0x61, 0x64, 0x64, 0x79, 0x12, 0x40, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1b, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x47, 0x65, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b,
+	0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70,
+	0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_internal_machine_api_pb_caddy_proto_rawDescOnce sync.Once
+	file_internal_machine_api_pb_caddy_proto_rawDescData = file_internal_machine_api_pb_caddy_proto_rawDesc
+)
+
+func file_internal_machine_api_pb_caddy_proto_rawDescGZIP() []byte {
+	file_internal_machine_api_pb_caddy_proto_rawDescOnce.Do(func() {
+		file_internal_machine_api_pb_caddy_proto_rawDescData = protoimpl.X.CompressGZIP(file_internal_machine_api_pb_caddy_proto_rawDescData)
+	})
+	return file_internal_machine_api_pb_caddy_proto_rawDescData
+}
+
+var file_internal_machine_api_pb_caddy_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_internal_machine_api_pb_caddy_proto_goTypes = []any{
+	(*GetCaddyConfigResponse)(nil), // 0: api.GetCaddyConfigResponse
+	(*timestamppb.Timestamp)(nil),  // 1: google.protobuf.Timestamp
+	(*emptypb.Empty)(nil),          // 2: google.protobuf.Empty
+}
+var file_internal_machine_api_pb_caddy_proto_depIdxs = []int32{
+	1, // 0: api.GetCaddyConfigResponse.modified_at:type_name -> google.protobuf.Timestamp
+	2, // 1: api.Caddy.GetConfig:input_type -> google.protobuf.Empty
+	0, // 2: api.Caddy.GetConfig:output_type -> api.GetCaddyConfigResponse
+	2, // [2:3] is the sub-list for method output_type
+	1, // [1:2] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_internal_machine_api_pb_caddy_proto_init() }
+func file_internal_machine_api_pb_caddy_proto_init() {
+	if File_internal_machine_api_pb_caddy_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_internal_machine_api_pb_caddy_proto_msgTypes[0].Exporter = func(v any, i int) any {
+			switch v := v.(*GetCaddyConfigResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_internal_machine_api_pb_caddy_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_internal_machine_api_pb_caddy_proto_goTypes,
+		DependencyIndexes: file_internal_machine_api_pb_caddy_proto_depIdxs,
+		MessageInfos:      file_internal_machine_api_pb_caddy_proto_msgTypes,
+	}.Build()
+	File_internal_machine_api_pb_caddy_proto = out.File
+	file_internal_machine_api_pb_caddy_proto_rawDesc = nil
+	file_internal_machine_api_pb_caddy_proto_goTypes = nil
+	file_internal_machine_api_pb_caddy_proto_depIdxs = nil
+}

internal/machine/api/pb/caddy.proto

@@ -0,0 +1,20 @@
+syntax = "proto3";
+
+package api;
+
+option go_package = "github.com/psviderski/uncloud/internal/machine/api/pb";
+
+import "google/protobuf/empty.proto";
+import "google/protobuf/timestamp.proto";
+
+service Caddy {
+  // GetConfig retrieves the current Caddy configuration from the machine.
+  rpc GetConfig(google.protobuf.Empty) returns (GetCaddyConfigResponse);
+}
+
+message GetCaddyConfigResponse {
+  // The generated Caddyfile content.
+  string caddyfile = 1;
+  // Timestamp when the config was last modified.
+  google.protobuf.Timestamp modified_at = 2;
+}

internal/machine/api/pb/caddy_grpc.pb.go

@@ -0,0 +1,124 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v5.27.3
+// source: internal/machine/api/pb/caddy.proto
+
+package pb
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	Caddy_GetConfig_FullMethodName = "/api.Caddy/GetConfig"
+)
+
+// CaddyClient is the client API for Caddy service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type CaddyClient interface {
+	// GetConfig retrieves the current Caddy configuration from the machine.
+	GetConfig(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*GetCaddyConfigResponse, error)
+}
+
+type caddyClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewCaddyClient(cc grpc.ClientConnInterface) CaddyClient {
+	return &caddyClient{cc}
+}
+
+func (c *caddyClient) GetConfig(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*GetCaddyConfigResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetCaddyConfigResponse)
+	err := c.cc.Invoke(ctx, Caddy_GetConfig_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// CaddyServer is the server API for Caddy service.
+// All implementations must embed UnimplementedCaddyServer
+// for forward compatibility.
+type CaddyServer interface {
+	// GetConfig retrieves the current Caddy configuration from the machine.
+	GetConfig(context.Context, *emptypb.Empty) (*GetCaddyConfigResponse, error)
+	mustEmbedUnimplementedCaddyServer()
+}
+
+// UnimplementedCaddyServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedCaddyServer struct{}
+
+func (UnimplementedCaddyServer) GetConfig(context.Context, *emptypb.Empty) (*GetCaddyConfigResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetConfig not implemented")
+}
+func (UnimplementedCaddyServer) mustEmbedUnimplementedCaddyServer() {}
+func (UnimplementedCaddyServer) testEmbeddedByValue()               {}
+
+// UnsafeCaddyServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to CaddyServer will
+// result in compilation errors.
+type UnsafeCaddyServer interface {
+	mustEmbedUnimplementedCaddyServer()
+}
+
+func RegisterCaddyServer(s grpc.ServiceRegistrar, srv CaddyServer) {
+	// If the following call pancis, it indicates UnimplementedCaddyServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&Caddy_ServiceDesc, srv)
+}
+
+func _Caddy_GetConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CaddyServer).GetConfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Caddy_GetConfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CaddyServer).GetConfig(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// Caddy_ServiceDesc is the grpc.ServiceDesc for Caddy service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Caddy_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "api.Caddy",
+	HandlerType: (*CaddyServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetConfig",
+			Handler:    _Caddy_GetConfig_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "internal/machine/api/pb/caddy.proto",
+}

internal/machine/api/pb/cluster.pb.go

@@ -124,7 +124,7 @@ func (x DNSRecord_RecordType) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use DNSRecord_RecordType.Descriptor instead.
 func (DNSRecord_RecordType) EnumDescriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{8, 0}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{11, 0}
 }
 
 type AddMachineRequest struct {
@@ -339,6 +339,173 @@ func (x *ListMachinesResponse) GetMachines() []*MachineMember {
 	return nil
 }
 
+type UpdateMachineRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Machine to update
+	MachineId string `protobuf:"bytes,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	// Updated machine information
+	Name      *string   `protobuf:"bytes,2,opt,name=name,proto3,oneof" json:"name,omitempty"`
+	PublicIp  *IP       `protobuf:"bytes,3,opt,name=public_ip,json=publicIp,proto3,oneof" json:"public_ip,omitempty"`
+	Endpoints []*IPPort `protobuf:"bytes,4,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
+}
+
+func (x *UpdateMachineRequest) Reset() {
+	*x = UpdateMachineRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateMachineRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateMachineRequest) ProtoMessage() {}
+
+func (x *UpdateMachineRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateMachineRequest.ProtoReflect.Descriptor instead.
+func (*UpdateMachineRequest) Descriptor() ([]byte, []int) {
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *UpdateMachineRequest) GetMachineId() string {
+	if x != nil {
+		return x.MachineId
+	}
+	return ""
+}
+
+func (x *UpdateMachineRequest) GetName() string {
+	if x != nil && x.Name != nil {
+		return *x.Name
+	}
+	return ""
+}
+
+func (x *UpdateMachineRequest) GetPublicIp() *IP {
+	if x != nil {
+		return x.PublicIp
+	}
+	return nil
+}
+
+func (x *UpdateMachineRequest) GetEndpoints() []*IPPort {
+	if x != nil {
+		return x.Endpoints
+	}
+	return nil
+}
+
+type UpdateMachineResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Machine *MachineInfo `protobuf:"bytes,1,opt,name=machine,proto3" json:"machine,omitempty"`
+}
+
+func (x *UpdateMachineResponse) Reset() {
+	*x = UpdateMachineResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateMachineResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateMachineResponse) ProtoMessage() {}
+
+func (x *UpdateMachineResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateMachineResponse.ProtoReflect.Descriptor instead.
+func (*UpdateMachineResponse) Descriptor() ([]byte, []int) {
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *UpdateMachineResponse) GetMachine() *MachineInfo {
+	if x != nil {
+		return x.Machine
+	}
+	return nil
+}
+
+type RemoveMachineRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *RemoveMachineRequest) Reset() {
+	*x = RemoveMachineRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RemoveMachineRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RemoveMachineRequest) ProtoMessage() {}
+
+func (x *RemoveMachineRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RemoveMachineRequest.ProtoReflect.Descriptor instead.
+func (*RemoveMachineRequest) Descriptor() ([]byte, []int) {
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *RemoveMachineRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
 type Domain struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -350,7 +517,7 @@ type Domain struct {
 func (x *Domain) Reset() {
 	*x = Domain{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[4]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -363,7 +530,7 @@ func (x *Domain) String() string {
 func (*Domain) ProtoMessage() {}
 
 func (x *Domain) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[4]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -376,7 +543,7 @@ func (x *Domain) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Domain.ProtoReflect.Descriptor instead.
 func (*Domain) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{4}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *Domain) GetName() string {
@@ -397,7 +564,7 @@ type ReserveDomainRequest struct {
 func (x *ReserveDomainRequest) Reset() {
 	*x = ReserveDomainRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[5]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -410,7 +577,7 @@ func (x *ReserveDomainRequest) String() string {
 func (*ReserveDomainRequest) ProtoMessage() {}
 
 func (x *ReserveDomainRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[5]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -423,7 +590,7 @@ func (x *ReserveDomainRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReserveDomainRequest.ProtoReflect.Descriptor instead.
 func (*ReserveDomainRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{5}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *ReserveDomainRequest) GetEndpoint() string {
@@ -444,7 +611,7 @@ type CreateDomainRecordsRequest struct {
 func (x *CreateDomainRecordsRequest) Reset() {
 	*x = CreateDomainRecordsRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[6]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -457,7 +624,7 @@ func (x *CreateDomainRecordsRequest) String() string {
 func (*CreateDomainRecordsRequest) ProtoMessage() {}
 
 func (x *CreateDomainRecordsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[6]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -470,7 +637,7 @@ func (x *CreateDomainRecordsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateDomainRecordsRequest.ProtoReflect.Descriptor instead.
 func (*CreateDomainRecordsRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{6}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *CreateDomainRecordsRequest) GetRecords() []*DNSRecord {
@@ -491,7 +658,7 @@ type CreateDomainRecordsResponse struct {
 func (x *CreateDomainRecordsResponse) Reset() {
 	*x = CreateDomainRecordsResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[7]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -504,7 +671,7 @@ func (x *CreateDomainRecordsResponse) String() string {
 func (*CreateDomainRecordsResponse) ProtoMessage() {}
 
 func (x *CreateDomainRecordsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[7]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -517,7 +684,7 @@ func (x *CreateDomainRecordsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CreateDomainRecordsResponse.ProtoReflect.Descriptor instead.
 func (*CreateDomainRecordsResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{7}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *CreateDomainRecordsResponse) GetRecords() []*DNSRecord {
@@ -540,7 +707,7 @@ type DNSRecord struct {
 func (x *DNSRecord) Reset() {
 	*x = DNSRecord{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[8]
+		mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -553,7 +720,7 @@ func (x *DNSRecord) String() string {
 func (*DNSRecord) ProtoMessage() {}
 
 func (x *DNSRecord) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[8]
+	mi := &file_internal_machine_api_pb_cluster_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -566,7 +733,7 @@ func (x *DNSRecord) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DNSRecord.ProtoReflect.Descriptor instead.
 func (*DNSRecord) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{8}
+	return file_internal_machine_api_pb_cluster_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *DNSRecord) GetName() string {
@@ -630,59 +797,87 @@ var file_internal_machine_api_pb_cluster_proto_rawDesc = []byte{
 	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2e, 0x0a, 0x08, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73,
 	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d, 0x61, 0x63,
 	0x68, 0x69, 0x6e, 0x65, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x52, 0x08, 0x6d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x73, 0x22, 0x1c, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x12,
-	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x22, 0x32, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e,
-	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e,
-	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x22, 0x46, 0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52,
-	0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x47,
-	0x0a, 0x1b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65,
-	0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x28, 0x0a,
-	0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07,
-	0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x96, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x52,
-	0x65, 0x63, 0x6f, 0x72, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2d, 0x0a, 0x04, 0x74, 0x79, 0x70,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e,
-	0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79,
-	0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73,
-	0x22, 0x2e, 0x0a, 0x0a, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0f,
-	0x0a, 0x0b, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12,
-	0x05, 0x0a, 0x01, 0x41, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x41, 0x41, 0x41, 0x10, 0x02,
-	0x32, 0x86, 0x03, 0x0a, 0x07, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x3d, 0x0a, 0x0a,
-	0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x17, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68,
-	0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x0c, 0x4c,
-	0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d,
-	0x70, 0x74, 0x79, 0x1a, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61,
-	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x37,
-	0x0a, 0x0d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12,
-	0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d,
-	0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69,
-	0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x30, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x44, 0x6f,
-	0x6d, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61,
-	0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x34, 0x0a, 0x0d, 0x52, 0x65, 0x6c,
-	0x65, 0x61, 0x73, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70,
-	0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12,
-	0x58, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52,
-	0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x1f, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65,
+	0x69, 0x6e, 0x65, 0x73, 0x22, 0xbb, 0x01, 0x0a, 0x14, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a,
+	0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x88, 0x01, 0x01, 0x12, 0x29, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f,
+	0x69, 0x70, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49,
+	0x50, 0x48, 0x01, 0x52, 0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x88, 0x01, 0x01,
+	0x12, 0x29, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x04, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x6f, 0x72, 0x74,
+	0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x42, 0x07, 0x0a, 0x05, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f,
+	0x69, 0x70, 0x22, 0x43, 0x0a, 0x15, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2a, 0x0a, 0x07, 0x6d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x07,
+	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x22, 0x26, 0x0a, 0x14, 0x52, 0x65, 0x6d, 0x6f, 0x76,
+	0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22,
+	0x1c, 0x0a, 0x06, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x32, 0x0a,
+	0x14, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x22, 0x46, 0x0a, 0x1a, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x28, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x52, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x22, 0x47, 0x0a, 0x1b, 0x43, 0x72, 0x65,
 	0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
-	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74,
-	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73,
-	0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72,
-	0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f,
-	0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x28, 0x0a, 0x07, 0x72, 0x65, 0x63, 0x6f,
+	0x72, 0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x52, 0x07, 0x72, 0x65, 0x63, 0x6f, 0x72,
+	0x64, 0x73, 0x22, 0x96, 0x01, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2d, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x4e, 0x53, 0x52, 0x65, 0x63, 0x6f,
+	0x72, 0x64, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74,
+	0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x06, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x22, 0x2e, 0x0a, 0x0a, 0x52,
+	0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0f, 0x0a, 0x0b, 0x55, 0x4e, 0x53,
+	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x05, 0x0a, 0x01, 0x41, 0x10,
+	0x01, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x41, 0x41, 0x41, 0x10, 0x02, 0x32, 0x92, 0x04, 0x0a, 0x07,
+	0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x3d, 0x0a, 0x0a, 0x41, 0x64, 0x64, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x16, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x41, 0x64, 0x64, 0x4d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x17, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x19,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x46, 0x0a, 0x0d, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x55, 0x70, 0x64, 0x61,
+	0x74, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x42, 0x0a, 0x0d, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x4d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x37, 0x0a, 0x0d, 0x52, 0x65, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x19, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x73,
+	0x65, 0x72, 0x76, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x30,
+	0x0a, 0x09, 0x47, 0x65, 0x74, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x12, 0x34, 0x0a, 0x0d, 0x52, 0x65, 0x6c, 0x65, 0x61, 0x73, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x58, 0x0a, 0x13, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x12, 0x1f, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20,
+	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x44, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70,
+	0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
+	0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }
 
 var (
@@ -698,7 +893,7 @@ func file_internal_machine_api_pb_cluster_proto_rawDescGZIP() []byte {
 }
 
 var file_internal_machine_api_pb_cluster_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_internal_machine_api_pb_cluster_proto_msgTypes = make([]protoimpl.MessageInfo, 9)
+var file_internal_machine_api_pb_cluster_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
 var file_internal_machine_api_pb_cluster_proto_goTypes = []any{
 	(MachineMember_MembershipState)(0),  // 0: api.MachineMember.MembershipState
 	(DNSRecord_RecordType)(0),           // 1: api.DNSRecord.RecordType
@@ -706,43 +901,54 @@ var file_internal_machine_api_pb_cluster_proto_goTypes = []any{
 	(*AddMachineResponse)(nil),          // 3: api.AddMachineResponse
 	(*MachineMember)(nil),               // 4: api.MachineMember
 	(*ListMachinesResponse)(nil),        // 5: api.ListMachinesResponse
-	(*Domain)(nil),                      // 6: api.Domain
-	(*ReserveDomainRequest)(nil),        // 7: api.ReserveDomainRequest
-	(*CreateDomainRecordsRequest)(nil),  // 8: api.CreateDomainRecordsRequest
-	(*CreateDomainRecordsResponse)(nil), // 9: api.CreateDomainRecordsResponse
-	(*DNSRecord)(nil),                   // 10: api.DNSRecord
-	(*NetworkConfig)(nil),               // 11: api.NetworkConfig
-	(*IP)(nil),                          // 12: api.IP
-	(*MachineInfo)(nil),                 // 13: api.MachineInfo
-	(*emptypb.Empty)(nil),               // 14: google.protobuf.Empty
+	(*UpdateMachineRequest)(nil),        // 6: api.UpdateMachineRequest
+	(*UpdateMachineResponse)(nil),       // 7: api.UpdateMachineResponse
+	(*RemoveMachineRequest)(nil),        // 8: api.RemoveMachineRequest
+	(*Domain)(nil),                      // 9: api.Domain
+	(*ReserveDomainRequest)(nil),        // 10: api.ReserveDomainRequest
+	(*CreateDomainRecordsRequest)(nil),  // 11: api.CreateDomainRecordsRequest
+	(*CreateDomainRecordsResponse)(nil), // 12: api.CreateDomainRecordsResponse
+	(*DNSRecord)(nil),                   // 13: api.DNSRecord
+	(*NetworkConfig)(nil),               // 14: api.NetworkConfig
+	(*IP)(nil),                          // 15: api.IP
+	(*MachineInfo)(nil),                 // 16: api.MachineInfo
+	(*IPPort)(nil),                      // 17: api.IPPort
+	(*emptypb.Empty)(nil),               // 18: google.protobuf.Empty
 }
 var file_internal_machine_api_pb_cluster_proto_depIdxs = []int32{
-	11, // 0: api.AddMachineRequest.network:type_name -> api.NetworkConfig
-	12, // 1: api.AddMachineRequest.public_ip:type_name -> api.IP
-	13, // 2: api.AddMachineResponse.machine:type_name -> api.MachineInfo
-	13, // 3: api.MachineMember.machine:type_name -> api.MachineInfo
+	14, // 0: api.AddMachineRequest.network:type_name -> api.NetworkConfig
+	15, // 1: api.AddMachineRequest.public_ip:type_name -> api.IP
+	16, // 2: api.AddMachineResponse.machine:type_name -> api.MachineInfo
+	16, // 3: api.MachineMember.machine:type_name -> api.MachineInfo
 	0,  // 4: api.MachineMember.state:type_name -> api.MachineMember.MembershipState
 	4,  // 5: api.ListMachinesResponse.machines:type_name -> api.MachineMember
-	10, // 6: api.CreateDomainRecordsRequest.records:type_name -> api.DNSRecord
-	10, // 7: api.CreateDomainRecordsResponse.records:type_name -> api.DNSRecord
-	1,  // 8: api.DNSRecord.type:type_name -> api.DNSRecord.RecordType
-	2,  // 9: api.Cluster.AddMachine:input_type -> api.AddMachineRequest
-	14, // 10: api.Cluster.ListMachines:input_type -> google.protobuf.Empty
-	7,  // 11: api.Cluster.ReserveDomain:input_type -> api.ReserveDomainRequest
-	14, // 12: api.Cluster.GetDomain:input_type -> google.protobuf.Empty
-	14, // 13: api.Cluster.ReleaseDomain:input_type -> google.protobuf.Empty
-	8,  // 14: api.Cluster.CreateDomainRecords:input_type -> api.CreateDomainRecordsRequest
-	3,  // 15: api.Cluster.AddMachine:output_type -> api.AddMachineResponse
-	5,  // 16: api.Cluster.ListMachines:output_type -> api.ListMachinesResponse
-	6,  // 17: api.Cluster.ReserveDomain:output_type -> api.Domain
-	6,  // 18: api.Cluster.GetDomain:output_type -> api.Domain
-	6,  // 19: api.Cluster.ReleaseDomain:output_type -> api.Domain
-	9,  // 20: api.Cluster.CreateDomainRecords:output_type -> api.CreateDomainRecordsResponse
-	15, // [15:21] is the sub-list for method output_type
-	9,  // [9:15] is the sub-list for method input_type
-	9,  // [9:9] is the sub-list for extension type_name
-	9,  // [9:9] is the sub-list for extension extendee
-	0,  // [0:9] is the sub-list for field type_name
+	15, // 6: api.UpdateMachineRequest.public_ip:type_name -> api.IP
+	17, // 7: api.UpdateMachineRequest.endpoints:type_name -> api.IPPort
+	16, // 8: api.UpdateMachineResponse.machine:type_name -> api.MachineInfo
+	13, // 9: api.CreateDomainRecordsRequest.records:type_name -> api.DNSRecord
+	13, // 10: api.CreateDomainRecordsResponse.records:type_name -> api.DNSRecord
+	1,  // 11: api.DNSRecord.type:type_name -> api.DNSRecord.RecordType
+	2,  // 12: api.Cluster.AddMachine:input_type -> api.AddMachineRequest
+	18, // 13: api.Cluster.ListMachines:input_type -> google.protobuf.Empty
+	6,  // 14: api.Cluster.UpdateMachine:input_type -> api.UpdateMachineRequest
+	8,  // 15: api.Cluster.RemoveMachine:input_type -> api.RemoveMachineRequest
+	10, // 16: api.Cluster.ReserveDomain:input_type -> api.ReserveDomainRequest
+	18, // 17: api.Cluster.GetDomain:input_type -> google.protobuf.Empty
+	18, // 18: api.Cluster.ReleaseDomain:input_type -> google.protobuf.Empty
+	11, // 19: api.Cluster.CreateDomainRecords:input_type -> api.CreateDomainRecordsRequest
+	3,  // 20: api.Cluster.AddMachine:output_type -> api.AddMachineResponse
+	5,  // 21: api.Cluster.ListMachines:output_type -> api.ListMachinesResponse
+	7,  // 22: api.Cluster.UpdateMachine:output_type -> api.UpdateMachineResponse
+	18, // 23: api.Cluster.RemoveMachine:output_type -> google.protobuf.Empty
+	9,  // 24: api.Cluster.ReserveDomain:output_type -> api.Domain
+	9,  // 25: api.Cluster.GetDomain:output_type -> api.Domain
+	9,  // 26: api.Cluster.ReleaseDomain:output_type -> api.Domain
+	12, // 27: api.Cluster.CreateDomainRecords:output_type -> api.CreateDomainRecordsResponse
+	20, // [20:28] is the sub-list for method output_type
+	12, // [12:20] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
 }
 
 func init() { file_internal_machine_api_pb_cluster_proto_init() }
@@ -802,7 +1008,7 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_cluster_proto_msgTypes[4].Exporter = func(v any, i int) any {
-			switch v := v.(*Domain); i {
+			switch v := v.(*UpdateMachineRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -814,7 +1020,7 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_cluster_proto_msgTypes[5].Exporter = func(v any, i int) any {
-			switch v := v.(*ReserveDomainRequest); i {
+			switch v := v.(*UpdateMachineResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -826,7 +1032,7 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_cluster_proto_msgTypes[6].Exporter = func(v any, i int) any {
-			switch v := v.(*CreateDomainRecordsRequest); i {
+			switch v := v.(*RemoveMachineRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -838,7 +1044,7 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_cluster_proto_msgTypes[7].Exporter = func(v any, i int) any {
-			switch v := v.(*CreateDomainRecordsResponse); i {
+			switch v := v.(*Domain); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -850,6 +1056,42 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_cluster_proto_msgTypes[8].Exporter = func(v any, i int) any {
+			switch v := v.(*ReserveDomainRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_internal_machine_api_pb_cluster_proto_msgTypes[9].Exporter = func(v any, i int) any {
+			switch v := v.(*CreateDomainRecordsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_internal_machine_api_pb_cluster_proto_msgTypes[10].Exporter = func(v any, i int) any {
+			switch v := v.(*CreateDomainRecordsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_internal_machine_api_pb_cluster_proto_msgTypes[11].Exporter = func(v any, i int) any {
 			switch v := v.(*DNSRecord); i {
 			case 0:
 				return &v.state
@@ -862,13 +1104,14 @@ func file_internal_machine_api_pb_cluster_proto_init() {
 			}
 		}
 	}
+	file_internal_machine_api_pb_cluster_proto_msgTypes[4].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_internal_machine_api_pb_cluster_proto_rawDesc,
 			NumEnums:      2,
-			NumMessages:   9,
+			NumMessages:   12,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

internal/machine/api/pb/cluster.proto

@@ -11,6 +11,8 @@ import "internal/machine/api/pb/machine.proto";
 service Cluster {
   rpc AddMachine(AddMachineRequest) returns (AddMachineResponse);
   rpc ListMachines(google.protobuf.Empty) returns (ListMachinesResponse);
+  rpc UpdateMachine(UpdateMachineRequest) returns (UpdateMachineResponse);
+  rpc RemoveMachine(RemoveMachineRequest) returns (google.protobuf.Empty);
 
   rpc ReserveDomain(ReserveDomainRequest) returns (Domain);
   rpc GetDomain(google.protobuf.Empty) returns (Domain);
@@ -49,6 +51,24 @@ message ListMachinesResponse {
   repeated MachineMember machines = 1;
 }
 
+message UpdateMachineRequest {
+  // Machine to update
+  string machine_id = 1;
+
+  // Updated machine information
+  optional string name = 2;
+  optional IP public_ip = 3;
+  repeated IPPort endpoints = 4;
+}
+
+message UpdateMachineResponse {
+  MachineInfo machine = 1;
+}
+
+message RemoveMachineRequest {
+  string id = 1;
+}
+
 message Domain {
   string name = 1;
 }

internal/machine/api/pb/cluster_grpc.pb.go

@@ -22,6 +22,8 @@ const _ = grpc.SupportPackageIsVersion9
 const (
 	Cluster_AddMachine_FullMethodName          = "/api.Cluster/AddMachine"
 	Cluster_ListMachines_FullMethodName        = "/api.Cluster/ListMachines"
+	Cluster_UpdateMachine_FullMethodName       = "/api.Cluster/UpdateMachine"
+	Cluster_RemoveMachine_FullMethodName       = "/api.Cluster/RemoveMachine"
 	Cluster_ReserveDomain_FullMethodName       = "/api.Cluster/ReserveDomain"
 	Cluster_GetDomain_FullMethodName           = "/api.Cluster/GetDomain"
 	Cluster_ReleaseDomain_FullMethodName       = "/api.Cluster/ReleaseDomain"
@@ -34,6 +36,8 @@ const (
 type ClusterClient interface {
 	AddMachine(ctx context.Context, in *AddMachineRequest, opts ...grpc.CallOption) (*AddMachineResponse, error)
 	ListMachines(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListMachinesResponse, error)
+	UpdateMachine(ctx context.Context, in *UpdateMachineRequest, opts ...grpc.CallOption) (*UpdateMachineResponse, error)
+	RemoveMachine(ctx context.Context, in *RemoveMachineRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	ReserveDomain(ctx context.Context, in *ReserveDomainRequest, opts ...grpc.CallOption) (*Domain, error)
 	GetDomain(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Domain, error)
 	ReleaseDomain(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Domain, error)
@@ -68,6 +72,26 @@ func (c *clusterClient) ListMachines(ctx context.Context, in *emptypb.Empty, opt
 	return out, nil
 }
 
+func (c *clusterClient) UpdateMachine(ctx context.Context, in *UpdateMachineRequest, opts ...grpc.CallOption) (*UpdateMachineResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdateMachineResponse)
+	err := c.cc.Invoke(ctx, Cluster_UpdateMachine_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *clusterClient) RemoveMachine(ctx context.Context, in *RemoveMachineRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Cluster_RemoveMachine_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *clusterClient) ReserveDomain(ctx context.Context, in *ReserveDomainRequest, opts ...grpc.CallOption) (*Domain, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Domain)
@@ -114,6 +138,8 @@ func (c *clusterClient) CreateDomainRecords(ctx context.Context, in *CreateDomai
 type ClusterServer interface {
 	AddMachine(context.Context, *AddMachineRequest) (*AddMachineResponse, error)
 	ListMachines(context.Context, *emptypb.Empty) (*ListMachinesResponse, error)
+	UpdateMachine(context.Context, *UpdateMachineRequest) (*UpdateMachineResponse, error)
+	RemoveMachine(context.Context, *RemoveMachineRequest) (*emptypb.Empty, error)
 	ReserveDomain(context.Context, *ReserveDomainRequest) (*Domain, error)
 	GetDomain(context.Context, *emptypb.Empty) (*Domain, error)
 	ReleaseDomain(context.Context, *emptypb.Empty) (*Domain, error)
@@ -134,6 +160,12 @@ func (UnimplementedClusterServer) AddMachine(context.Context, *AddMachineRequest
 func (UnimplementedClusterServer) ListMachines(context.Context, *emptypb.Empty) (*ListMachinesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListMachines not implemented")
 }
+func (UnimplementedClusterServer) UpdateMachine(context.Context, *UpdateMachineRequest) (*UpdateMachineResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateMachine not implemented")
+}
+func (UnimplementedClusterServer) RemoveMachine(context.Context, *RemoveMachineRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveMachine not implemented")
+}
 func (UnimplementedClusterServer) ReserveDomain(context.Context, *ReserveDomainRequest) (*Domain, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ReserveDomain not implemented")
 }
@@ -203,6 +235,42 @@ func _Cluster_ListMachines_Handler(srv interface{}, ctx context.Context, dec fun
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Cluster_UpdateMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateMachineRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ClusterServer).UpdateMachine(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Cluster_UpdateMachine_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ClusterServer).UpdateMachine(ctx, req.(*UpdateMachineRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Cluster_RemoveMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveMachineRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ClusterServer).RemoveMachine(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Cluster_RemoveMachine_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ClusterServer).RemoveMachine(ctx, req.(*RemoveMachineRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Cluster_ReserveDomain_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(ReserveDomainRequest)
 	if err := dec(in); err != nil {
@@ -290,6 +358,14 @@ var Cluster_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListMachines",
 			Handler:    _Cluster_ListMachines_Handler,
 		},
+		{
+			MethodName: "UpdateMachine",
+			Handler:    _Cluster_UpdateMachine_Handler,
+		},
+		{
+			MethodName: "RemoveMachine",
+			Handler:    _Cluster_RemoveMachine_Handler,
+		},
 		{
 			MethodName: "ReserveDomain",
 			Handler:    _Cluster_ReserveDomain_Handler,

internal/machine/api/pb/docker.proto

@@ -20,6 +20,7 @@ service Docker {
   // InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's
   // Docker auth credentials if necessary.
   rpc InspectRemoteImage(InspectRemoteImageRequest) returns (InspectRemoteImageResponse);
+  rpc ListImages(ListImagesRequest) returns (ListImagesResponse);
 
   rpc CreateVolume(CreateVolumeRequest) returns (CreateVolumeResponse);
   rpc ListVolumes(ListVolumesRequest) returns (ListVolumesResponse);
@@ -113,7 +114,7 @@ message InspectImageResponse {
 
 message Image {
   Metadata metadata = 1;
-  // JSON serialised types.ImageInspect.
+  // JSON serialised image.InspectResponse.
   bytes image = 2;
 }
 
@@ -134,6 +135,24 @@ message RemoteImage {
   bytes manifest = 3;
 }
 
+message ListImagesRequest {
+  // JSON serialised image.ListOptions.
+  bytes options = 1;
+}
+
+message ListImagesResponse {
+  // Must contain only one repeated messages field to allow broadcasting ListImages requests to multiple machines.
+  repeated MachineImages messages = 1;
+}
+
+message MachineImages {
+  Metadata metadata = 1;
+  // JSON serialised []image.Summary.
+  bytes images = 2;
+  // True if Docker uses the containerd image store, false if it uses its internal image store.
+  bool containerd_store = 3;
+}
+
 message CreateVolumeRequest {
   // JSON serialised volume.CreateOptions.
   bytes options = 1;

internal/machine/api/pb/docker_grpc.pb.go

@@ -29,6 +29,7 @@ const (
 	Docker_PullImage_FullMethodName               = "/api.Docker/PullImage"
 	Docker_InspectImage_FullMethodName            = "/api.Docker/InspectImage"
 	Docker_InspectRemoteImage_FullMethodName      = "/api.Docker/InspectRemoteImage"
+	Docker_ListImages_FullMethodName              = "/api.Docker/ListImages"
 	Docker_CreateVolume_FullMethodName            = "/api.Docker/CreateVolume"
 	Docker_ListVolumes_FullMethodName             = "/api.Docker/ListVolumes"
 	Docker_RemoveVolume_FullMethodName            = "/api.Docker/RemoveVolume"
@@ -53,6 +54,7 @@ type DockerClient interface {
 	// InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's
 	// Docker auth credentials if necessary.
 	InspectRemoteImage(ctx context.Context, in *InspectRemoteImageRequest, opts ...grpc.CallOption) (*InspectRemoteImageResponse, error)
+	ListImages(ctx context.Context, in *ListImagesRequest, opts ...grpc.CallOption) (*ListImagesResponse, error)
 	CreateVolume(ctx context.Context, in *CreateVolumeRequest, opts ...grpc.CallOption) (*CreateVolumeResponse, error)
 	ListVolumes(ctx context.Context, in *ListVolumesRequest, opts ...grpc.CallOption) (*ListVolumesResponse, error)
 	RemoveVolume(ctx context.Context, in *RemoveVolumeRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
@@ -169,6 +171,16 @@ func (c *dockerClient) InspectRemoteImage(ctx context.Context, in *InspectRemote
 	return out, nil
 }
 
+func (c *dockerClient) ListImages(ctx context.Context, in *ListImagesRequest, opts ...grpc.CallOption) (*ListImagesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListImagesResponse)
+	err := c.cc.Invoke(ctx, Docker_ListImages_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *dockerClient) CreateVolume(ctx context.Context, in *CreateVolumeRequest, opts ...grpc.CallOption) (*CreateVolumeResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(CreateVolumeResponse)
@@ -254,6 +266,7 @@ type DockerServer interface {
 	// InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's
 	// Docker auth credentials if necessary.
 	InspectRemoteImage(context.Context, *InspectRemoteImageRequest) (*InspectRemoteImageResponse, error)
+	ListImages(context.Context, *ListImagesRequest) (*ListImagesResponse, error)
 	CreateVolume(context.Context, *CreateVolumeRequest) (*CreateVolumeResponse, error)
 	ListVolumes(context.Context, *ListVolumesRequest) (*ListVolumesResponse, error)
 	RemoveVolume(context.Context, *RemoveVolumeRequest) (*emptypb.Empty, error)
@@ -298,6 +311,9 @@ func (UnimplementedDockerServer) InspectImage(context.Context, *InspectImageRequ
 func (UnimplementedDockerServer) InspectRemoteImage(context.Context, *InspectRemoteImageRequest) (*InspectRemoteImageResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method InspectRemoteImage not implemented")
 }
+func (UnimplementedDockerServer) ListImages(context.Context, *ListImagesRequest) (*ListImagesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListImages not implemented")
+}
 func (UnimplementedDockerServer) CreateVolume(context.Context, *CreateVolumeRequest) (*CreateVolumeResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method CreateVolume not implemented")
 }
@@ -495,6 +511,24 @@ func _Docker_InspectRemoteImage_Handler(srv interface{}, ctx context.Context, de
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Docker_ListImages_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListImagesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).ListImages(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_ListImages_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).ListImages(ctx, req.(*ListImagesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Docker_CreateVolume_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(CreateVolumeRequest)
 	if err := dec(in); err != nil {
@@ -660,6 +694,10 @@ var Docker_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "InspectRemoteImage",
 			Handler:    _Docker_InspectRemoteImage_Handler,
 		},
+		{
+			MethodName: "ListImages",
+			Handler:    _Docker_ListImages_Handler,
+		},
 		{
 			MethodName: "CreateVolume",
 			Handler:    _Docker_CreateVolume_Handler,

internal/machine/api/pb/machine.pb.go

@@ -21,63 +21,6 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-type CheckPrerequisitesResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Overall status of the checks.
-	Satisfied bool `protobuf:"varint,1,opt,name=satisfied,proto3" json:"satisfied,omitempty"`
-	// Error message if not satisfied (empty if all checks pass).
-	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
-}
-
-func (x *CheckPrerequisitesResponse) Reset() {
-	*x = CheckPrerequisitesResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *CheckPrerequisitesResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*CheckPrerequisitesResponse) ProtoMessage() {}
-
-func (x *CheckPrerequisitesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use CheckPrerequisitesResponse.ProtoReflect.Descriptor instead.
-func (*CheckPrerequisitesResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *CheckPrerequisitesResponse) GetSatisfied() bool {
-	if x != nil {
-		return x.Satisfied
-	}
-	return false
-}
-
-func (x *CheckPrerequisitesResponse) GetError() string {
-	if x != nil {
-		return x.Error
-	}
-	return ""
-}
-
 type MachineInfo struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -92,7 +35,7 @@ type MachineInfo struct {
 func (x *MachineInfo) Reset() {
 	*x = MachineInfo{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -105,7 +48,7 @@ func (x *MachineInfo) String() string {
 func (*MachineInfo) ProtoMessage() {}
 
 func (x *MachineInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[0]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -118,7 +61,7 @@ func (x *MachineInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MachineInfo.ProtoReflect.Descriptor instead.
 func (*MachineInfo) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{1}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *MachineInfo) GetId() string {
@@ -163,7 +106,7 @@ type NetworkConfig struct {
 func (x *NetworkConfig) Reset() {
 	*x = NetworkConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -176,7 +119,7 @@ func (x *NetworkConfig) String() string {
 func (*NetworkConfig) ProtoMessage() {}
 
 func (x *NetworkConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -189,7 +132,7 @@ func (x *NetworkConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NetworkConfig.ProtoReflect.Descriptor instead.
 func (*NetworkConfig) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{2}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *NetworkConfig) GetSubnet() *IPPrefix {
@@ -220,6 +163,63 @@ func (x *NetworkConfig) GetPublicKey() []byte {
 	return nil
 }
 
+type CheckPrerequisitesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Overall status of the checks.
+	Satisfied bool `protobuf:"varint,1,opt,name=satisfied,proto3" json:"satisfied,omitempty"`
+	// Error message if not satisfied (empty if all checks pass).
+	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
+}
+
+func (x *CheckPrerequisitesResponse) Reset() {
+	*x = CheckPrerequisitesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckPrerequisitesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckPrerequisitesResponse) ProtoMessage() {}
+
+func (x *CheckPrerequisitesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckPrerequisitesResponse.ProtoReflect.Descriptor instead.
+func (*CheckPrerequisitesResponse) Descriptor() ([]byte, []int) {
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *CheckPrerequisitesResponse) GetSatisfied() bool {
+	if x != nil {
+		return x.Satisfied
+	}
+	return false
+}
+
+func (x *CheckPrerequisitesResponse) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
 type InitClusterRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -466,6 +466,44 @@ func (x *TokenResponse) GetToken() string {
 	return ""
 }
 
+type ResetRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *ResetRequest) Reset() {
+	*x = ResetRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResetRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResetRequest) ProtoMessage() {}
+
+func (x *ResetRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResetRequest.ProtoReflect.Descriptor instead.
+func (*ResetRequest) Descriptor() ([]byte, []int) {
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{7}
+}
+
 type Service struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -480,7 +518,7 @@ type Service struct {
 func (x *Service) Reset() {
 	*x = Service{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -493,7 +531,7 @@ func (x *Service) String() string {
 func (*Service) ProtoMessage() {}
 
 func (x *Service) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[7]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -506,7 +544,7 @@ func (x *Service) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Service.ProtoReflect.Descriptor instead.
 func (*Service) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{7}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *Service) GetId() string {
@@ -548,7 +586,7 @@ type InspectServiceRequest struct {
 func (x *InspectServiceRequest) Reset() {
 	*x = InspectServiceRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -561,7 +599,7 @@ func (x *InspectServiceRequest) String() string {
 func (*InspectServiceRequest) ProtoMessage() {}
 
 func (x *InspectServiceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[8]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -574,7 +612,7 @@ func (x *InspectServiceRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InspectServiceRequest.ProtoReflect.Descriptor instead.
 func (*InspectServiceRequest) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{8}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *InspectServiceRequest) GetId() string {
@@ -595,7 +633,7 @@ type InspectServiceResponse struct {
 func (x *InspectServiceResponse) Reset() {
 	*x = InspectServiceResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -608,7 +646,7 @@ func (x *InspectServiceResponse) String() string {
 func (*InspectServiceResponse) ProtoMessage() {}
 
 func (x *InspectServiceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[9]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -621,7 +659,7 @@ func (x *InspectServiceResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InspectServiceResponse.ProtoReflect.Descriptor instead.
 func (*InspectServiceResponse) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{9}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *InspectServiceResponse) GetService() *Service {
@@ -644,7 +682,7 @@ type Service_Container struct {
 func (x *Service_Container) Reset() {
 	*x = Service_Container{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
+		mi := &file_internal_machine_api_pb_machine_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -657,7 +695,7 @@ func (x *Service_Container) String() string {
 func (*Service_Container) ProtoMessage() {}
 
 func (x *Service_Container) ProtoReflect() protoreflect.Message {
-	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[10]
+	mi := &file_internal_machine_api_pb_machine_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -670,7 +708,7 @@ func (x *Service_Container) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Service_Container.ProtoReflect.Descriptor instead.
 func (*Service_Container) Descriptor() ([]byte, []int) {
-	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{7, 0}
+	return file_internal_machine_api_pb_machine_proto_rawDescGZIP(), []int{8, 0}
 }
 
 func (x *Service_Container) GetMachineId() string {
@@ -697,31 +735,31 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x24, 0x69, 0x6e, 0x74, 0x65, 0x72,
 	0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f,
 	0x70, 0x62, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
-	0x50, 0x0a, 0x1a, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x72, 0x65, 0x72, 0x65, 0x71, 0x75, 0x69,
-	0x73, 0x69, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a,
-	0x09, 0x73, 0x61, 0x74, 0x69, 0x73, 0x66, 0x69, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x09, 0x73, 0x61, 0x74, 0x69, 0x73, 0x66, 0x69, 0x65, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65,
-	0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f,
-	0x72, 0x22, 0x85, 0x01, 0x0a, 0x0b, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66,
-	0x6f, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
-	0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4e, 0x65, 0x74,
-	0x77, 0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x12, 0x24, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x52,
-	0x08, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x22, 0xae, 0x01, 0x0a, 0x0d, 0x4e, 0x65,
-	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x25, 0x0a, 0x06, 0x73,
-	0x75, 0x62, 0x6e, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x49, 0x50, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x52, 0x06, 0x73, 0x75, 0x62, 0x6e,
-	0x65, 0x74, 0x12, 0x2c, 0x0a, 0x0d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x5f, 0x69, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x49, 0x50, 0x52, 0x0c, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x49, 0x70,
-	0x12, 0x29, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x6f, 0x72, 0x74,
-	0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x70,
-	0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52,
-	0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x22, 0xc3, 0x01, 0x0a, 0x12, 0x49,
+	0x85, 0x01, 0x0a, 0x0b, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x12, 0x24, 0x0a, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x69, 0x70, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x52, 0x08, 0x70,
+	0x75, 0x62, 0x6c, 0x69, 0x63, 0x49, 0x70, 0x22, 0xae, 0x01, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x77,
+	0x6f, 0x72, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x25, 0x0a, 0x06, 0x73, 0x75, 0x62,
+	0x6e, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x49, 0x50, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x52, 0x06, 0x73, 0x75, 0x62, 0x6e, 0x65, 0x74,
+	0x12, 0x2c, 0x0a, 0x0d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x69,
+	0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50,
+	0x52, 0x0c, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x49, 0x70, 0x12, 0x29,
+	0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x0b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x09,
+	0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x75, 0x62,
+	0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x70,
+	0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x22, 0x50, 0x0a, 0x1a, 0x43, 0x68, 0x65, 0x63,
+	0x6b, 0x50, 0x72, 0x65, 0x72, 0x65, 0x71, 0x75, 0x69, 0x73, 0x69, 0x74, 0x65, 0x73, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x61, 0x74, 0x69, 0x73, 0x66,
+	0x69, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x73, 0x61, 0x74, 0x69, 0x73,
+	0x66, 0x69, 0x65, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22, 0xc3, 0x01, 0x0a, 0x12, 0x49,
 	0x6e, 0x69, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
 	0x74, 0x12, 0x20, 0x0a, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4e, 0x61, 0x6d, 0x65,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4e,
@@ -748,7 +786,8 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x0d, 0x6f, 0x74, 0x68, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x22, 0x25,
 	0x0a, 0x0d, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
 	0x14, 0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
-	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xc3, 0x01, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0x0e, 0x0a, 0x0c, 0x52, 0x65, 0x73, 0x65, 0x74, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xc3, 0x01, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
 	0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
 	0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
 	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20,
@@ -767,7 +806,7 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26,
 	0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
 	0x0c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x07, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x32, 0x8f, 0x03, 0x0a, 0x07, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x32, 0xc3, 0x03, 0x0a, 0x07, 0x4d, 0x61, 0x63, 0x68, 0x69,
 	0x6e, 0x65, 0x12, 0x4d, 0x0a, 0x12, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x72, 0x65, 0x72, 0x65,
 	0x71, 0x75, 0x69, 0x73, 0x69, 0x74, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
 	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
@@ -787,16 +826,19 @@ var file_internal_machine_api_pb_machine_proto_rawDesc = []byte{
 	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x33, 0x0a, 0x07, 0x49, 0x6e, 0x73, 0x70,
 	0x65, 0x63, 0x74, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x10, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x49, 0x0a,
-	0x0e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12,
-	0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72,
-	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x61, 0x70,
-	0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b,
-	0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
-	0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70,
-	0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x69, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x32, 0x0a,
+	0x05, 0x52, 0x65, 0x73, 0x65, 0x74, 0x12, 0x11, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x52, 0x65, 0x73,
+	0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74,
+	0x79, 0x12, 0x49, 0x0a, 0x0e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x1a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63,
+	0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x6e, 0x73, 0x70, 0x65, 0x63, 0x74, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64,
+	0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x61,
+	0x70, 0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -811,51 +853,54 @@ func file_internal_machine_api_pb_machine_proto_rawDescGZIP() []byte {
 	return file_internal_machine_api_pb_machine_proto_rawDescData
 }
 
-var file_internal_machine_api_pb_machine_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
+var file_internal_machine_api_pb_machine_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
 var file_internal_machine_api_pb_machine_proto_goTypes = []any{
-	(*CheckPrerequisitesResponse)(nil), // 0: api.CheckPrerequisitesResponse
-	(*MachineInfo)(nil),                // 1: api.MachineInfo
-	(*NetworkConfig)(nil),              // 2: api.NetworkConfig
+	(*MachineInfo)(nil),                // 0: api.MachineInfo
+	(*NetworkConfig)(nil),              // 1: api.NetworkConfig
+	(*CheckPrerequisitesResponse)(nil), // 2: api.CheckPrerequisitesResponse
 	(*InitClusterRequest)(nil),         // 3: api.InitClusterRequest
 	(*InitClusterResponse)(nil),        // 4: api.InitClusterResponse
 	(*JoinClusterRequest)(nil),         // 5: api.JoinClusterRequest
 	(*TokenResponse)(nil),              // 6: api.TokenResponse
-	(*Service)(nil),                    // 7: api.Service
-	(*InspectServiceRequest)(nil),      // 8: api.InspectServiceRequest
-	(*InspectServiceResponse)(nil),     // 9: api.InspectServiceResponse
-	(*Service_Container)(nil),          // 10: api.Service.Container
-	(*IP)(nil),                         // 11: api.IP
-	(*IPPrefix)(nil),                   // 12: api.IPPrefix
-	(*IPPort)(nil),                     // 13: api.IPPort
-	(*emptypb.Empty)(nil),              // 14: google.protobuf.Empty
+	(*ResetRequest)(nil),               // 7: api.ResetRequest
+	(*Service)(nil),                    // 8: api.Service
+	(*InspectServiceRequest)(nil),      // 9: api.InspectServiceRequest
+	(*InspectServiceResponse)(nil),     // 10: api.InspectServiceResponse
+	(*Service_Container)(nil),          // 11: api.Service.Container
+	(*IP)(nil),                         // 12: api.IP
+	(*IPPrefix)(nil),                   // 13: api.IPPrefix
+	(*IPPort)(nil),                     // 14: api.IPPort
+	(*emptypb.Empty)(nil),              // 15: google.protobuf.Empty
 }
 var file_internal_machine_api_pb_machine_proto_depIdxs = []int32{
-	2,  // 0: api.MachineInfo.network:type_name -> api.NetworkConfig
-	11, // 1: api.MachineInfo.public_ip:type_name -> api.IP
-	12, // 2: api.NetworkConfig.subnet:type_name -> api.IPPrefix
-	11, // 3: api.NetworkConfig.management_ip:type_name -> api.IP
-	13, // 4: api.NetworkConfig.endpoints:type_name -> api.IPPort
-	12, // 5: api.InitClusterRequest.network:type_name -> api.IPPrefix
-	11, // 6: api.InitClusterRequest.public_ip:type_name -> api.IP
-	1,  // 7: api.InitClusterResponse.machine:type_name -> api.MachineInfo
-	1,  // 8: api.JoinClusterRequest.machine:type_name -> api.MachineInfo
-	1,  // 9: api.JoinClusterRequest.other_machines:type_name -> api.MachineInfo
-	10, // 10: api.Service.containers:type_name -> api.Service.Container
-	7,  // 11: api.InspectServiceResponse.service:type_name -> api.Service
-	14, // 12: api.Machine.CheckPrerequisites:input_type -> google.protobuf.Empty
+	1,  // 0: api.MachineInfo.network:type_name -> api.NetworkConfig
+	12, // 1: api.MachineInfo.public_ip:type_name -> api.IP
+	13, // 2: api.NetworkConfig.subnet:type_name -> api.IPPrefix
+	12, // 3: api.NetworkConfig.management_ip:type_name -> api.IP
+	14, // 4: api.NetworkConfig.endpoints:type_name -> api.IPPort
+	13, // 5: api.InitClusterRequest.network:type_name -> api.IPPrefix
+	12, // 6: api.InitClusterRequest.public_ip:type_name -> api.IP
+	0,  // 7: api.InitClusterResponse.machine:type_name -> api.MachineInfo
+	0,  // 8: api.JoinClusterRequest.machine:type_name -> api.MachineInfo
+	0,  // 9: api.JoinClusterRequest.other_machines:type_name -> api.MachineInfo
+	11, // 10: api.Service.containers:type_name -> api.Service.Container
+	8,  // 11: api.InspectServiceResponse.service:type_name -> api.Service
+	15, // 12: api.Machine.CheckPrerequisites:input_type -> google.protobuf.Empty
 	3,  // 13: api.Machine.InitCluster:input_type -> api.InitClusterRequest
 	5,  // 14: api.Machine.JoinCluster:input_type -> api.JoinClusterRequest
-	14, // 15: api.Machine.Token:input_type -> google.protobuf.Empty
-	14, // 16: api.Machine.Inspect:input_type -> google.protobuf.Empty
-	8,  // 17: api.Machine.InspectService:input_type -> api.InspectServiceRequest
-	0,  // 18: api.Machine.CheckPrerequisites:output_type -> api.CheckPrerequisitesResponse
-	4,  // 19: api.Machine.InitCluster:output_type -> api.InitClusterResponse
-	14, // 20: api.Machine.JoinCluster:output_type -> google.protobuf.Empty
-	6,  // 21: api.Machine.Token:output_type -> api.TokenResponse
-	1,  // 22: api.Machine.Inspect:output_type -> api.MachineInfo
-	9,  // 23: api.Machine.InspectService:output_type -> api.InspectServiceResponse
-	18, // [18:24] is the sub-list for method output_type
-	12, // [12:18] is the sub-list for method input_type
+	15, // 15: api.Machine.Token:input_type -> google.protobuf.Empty
+	15, // 16: api.Machine.Inspect:input_type -> google.protobuf.Empty
+	7,  // 17: api.Machine.Reset:input_type -> api.ResetRequest
+	9,  // 18: api.Machine.InspectService:input_type -> api.InspectServiceRequest
+	2,  // 19: api.Machine.CheckPrerequisites:output_type -> api.CheckPrerequisitesResponse
+	4,  // 20: api.Machine.InitCluster:output_type -> api.InitClusterResponse
+	15, // 21: api.Machine.JoinCluster:output_type -> google.protobuf.Empty
+	6,  // 22: api.Machine.Token:output_type -> api.TokenResponse
+	0,  // 23: api.Machine.Inspect:output_type -> api.MachineInfo
+	15, // 24: api.Machine.Reset:output_type -> google.protobuf.Empty
+	10, // 25: api.Machine.InspectService:output_type -> api.InspectServiceResponse
+	19, // [19:26] is the sub-list for method output_type
+	12, // [12:19] is the sub-list for method input_type
 	12, // [12:12] is the sub-list for extension type_name
 	12, // [12:12] is the sub-list for extension extendee
 	0,  // [0:12] is the sub-list for field type_name
@@ -869,18 +914,6 @@ func file_internal_machine_api_pb_machine_proto_init() {
 	file_internal_machine_api_pb_common_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_internal_machine_api_pb_machine_proto_msgTypes[0].Exporter = func(v any, i int) any {
-			switch v := v.(*CheckPrerequisitesResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_internal_machine_api_pb_machine_proto_msgTypes[1].Exporter = func(v any, i int) any {
 			switch v := v.(*MachineInfo); i {
 			case 0:
 				return &v.state
@@ -892,7 +925,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 				return nil
 			}
 		}
-		file_internal_machine_api_pb_machine_proto_msgTypes[2].Exporter = func(v any, i int) any {
+		file_internal_machine_api_pb_machine_proto_msgTypes[1].Exporter = func(v any, i int) any {
 			switch v := v.(*NetworkConfig); i {
 			case 0:
 				return &v.state
@@ -904,6 +937,18 @@ func file_internal_machine_api_pb_machine_proto_init() {
 				return nil
 			}
 		}
+		file_internal_machine_api_pb_machine_proto_msgTypes[2].Exporter = func(v any, i int) any {
+			switch v := v.(*CheckPrerequisitesResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[3].Exporter = func(v any, i int) any {
 			switch v := v.(*InitClusterRequest); i {
 			case 0:
@@ -953,7 +998,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[7].Exporter = func(v any, i int) any {
-			switch v := v.(*Service); i {
+			switch v := v.(*ResetRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -965,7 +1010,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[8].Exporter = func(v any, i int) any {
-			switch v := v.(*InspectServiceRequest); i {
+			switch v := v.(*Service); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -977,7 +1022,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[9].Exporter = func(v any, i int) any {
-			switch v := v.(*InspectServiceResponse); i {
+			switch v := v.(*InspectServiceRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -989,6 +1034,18 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			}
 		}
 		file_internal_machine_api_pb_machine_proto_msgTypes[10].Exporter = func(v any, i int) any {
+			switch v := v.(*InspectServiceResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_internal_machine_api_pb_machine_proto_msgTypes[11].Exporter = func(v any, i int) any {
 			switch v := v.(*Service_Container); i {
 			case 0:
 				return &v.state
@@ -1011,7 +1068,7 @@ func file_internal_machine_api_pb_machine_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_internal_machine_api_pb_machine_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   11,
+			NumMessages:   12,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

internal/machine/api/pb/machine.proto

@@ -14,6 +14,9 @@ service Machine {
   rpc JoinCluster(JoinClusterRequest) returns (google.protobuf.Empty);
   rpc Token(google.protobuf.Empty) returns (TokenResponse);
   rpc Inspect(google.protobuf.Empty) returns (MachineInfo);
+  // Reset restores the machine to a clean state, removing all cluster-related configuration and data.
+  rpc Reset(ResetRequest) returns (google.protobuf.Empty);
+
   rpc InspectService(InspectServiceRequest) returns (InspectServiceResponse);
 }
 
@@ -61,6 +64,9 @@ message TokenResponse {
   string token = 1;
 }
 
+message ResetRequest {
+}
+
 message Service {
   string id = 1;
   string name = 2;

internal/machine/api/pb/machine_grpc.pb.go

@@ -25,6 +25,7 @@ const (
 	Machine_JoinCluster_FullMethodName        = "/api.Machine/JoinCluster"
 	Machine_Token_FullMethodName              = "/api.Machine/Token"
 	Machine_Inspect_FullMethodName            = "/api.Machine/Inspect"
+	Machine_Reset_FullMethodName              = "/api.Machine/Reset"
 	Machine_InspectService_FullMethodName     = "/api.Machine/InspectService"
 )
 
@@ -32,11 +33,14 @@ const (
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type MachineClient interface {
+	// CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
 	CheckPrerequisites(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*CheckPrerequisitesResponse, error)
 	InitCluster(ctx context.Context, in *InitClusterRequest, opts ...grpc.CallOption) (*InitClusterResponse, error)
 	JoinCluster(ctx context.Context, in *JoinClusterRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	Token(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*TokenResponse, error)
 	Inspect(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*MachineInfo, error)
+	// Reset restores the machine to a clean state, removing all cluster-related configuration and data.
+	Reset(ctx context.Context, in *ResetRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	InspectService(ctx context.Context, in *InspectServiceRequest, opts ...grpc.CallOption) (*InspectServiceResponse, error)
 }
 
@@ -98,6 +102,16 @@ func (c *machineClient) Inspect(ctx context.Context, in *emptypb.Empty, opts ...
 	return out, nil
 }
 
+func (c *machineClient) Reset(ctx context.Context, in *ResetRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Machine_Reset_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *machineClient) InspectService(ctx context.Context, in *InspectServiceRequest, opts ...grpc.CallOption) (*InspectServiceResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(InspectServiceResponse)
@@ -112,11 +126,14 @@ func (c *machineClient) InspectService(ctx context.Context, in *InspectServiceRe
 // All implementations must embed UnimplementedMachineServer
 // for forward compatibility.
 type MachineServer interface {
+	// CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
 	CheckPrerequisites(context.Context, *emptypb.Empty) (*CheckPrerequisitesResponse, error)
 	InitCluster(context.Context, *InitClusterRequest) (*InitClusterResponse, error)
 	JoinCluster(context.Context, *JoinClusterRequest) (*emptypb.Empty, error)
 	Token(context.Context, *emptypb.Empty) (*TokenResponse, error)
 	Inspect(context.Context, *emptypb.Empty) (*MachineInfo, error)
+	// Reset restores the machine to a clean state, removing all cluster-related configuration and data.
+	Reset(context.Context, *ResetRequest) (*emptypb.Empty, error)
 	InspectService(context.Context, *InspectServiceRequest) (*InspectServiceResponse, error)
 	mustEmbedUnimplementedMachineServer()
 }
@@ -143,6 +160,9 @@ func (UnimplementedMachineServer) Token(context.Context, *emptypb.Empty) (*Token
 func (UnimplementedMachineServer) Inspect(context.Context, *emptypb.Empty) (*MachineInfo, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Inspect not implemented")
 }
+func (UnimplementedMachineServer) Reset(context.Context, *ResetRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Reset not implemented")
+}
 func (UnimplementedMachineServer) InspectService(context.Context, *InspectServiceRequest) (*InspectServiceResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method InspectService not implemented")
 }
@@ -257,6 +277,24 @@ func _Machine_Inspect_Handler(srv interface{}, ctx context.Context, dec func(int
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Machine_Reset_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResetRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).Reset(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_Reset_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).Reset(ctx, req.(*ResetRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Machine_InspectService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(InspectServiceRequest)
 	if err := dec(in); err != nil {
@@ -302,6 +340,10 @@ var Machine_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Inspect",
 			Handler:    _Machine_Inspect_Handler,
 		},
+		{
+			MethodName: "Reset",
+			Handler:    _Machine_Reset_Handler,
+		},
 		{
 			MethodName: "InspectService",
 			Handler:    _Machine_InspectService_Handler,

internal/machine/api/proxy/backend.go

@@ -2,10 +2,11 @@ package proxy
 
 import (
 	"fmt"
+
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/proto"
-	"github.com/psviderski/uncloud/internal/machine/api/pb"
 )
 
 // One2ManyResponder converts upstream responses into messages from upstreams, so that multiple

internal/machine/api/proxy/director.go

@@ -2,11 +2,12 @@ package proxy
 
 import (
 	"context"
+	"sync"
+
 	"github.com/siderolabs/grpc-proxy/proxy"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
-	"sync"
 )
 
 // Director manages routing of gRPC requests between local and remote backends.

internal/machine/api/proxy/local.go

@@ -2,11 +2,12 @@ package proxy
 
 import (
 	"context"
+	"sync"
+
 	"github.com/siderolabs/grpc-proxy/proxy"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/metadata"
-	"sync"
 )
 
 // LocalBackend is a proxy.One2ManyResponder implementation that proxies to a local gRPC server listening on a Unix socket.

internal/machine/api/proxy/remote.go

@@ -3,14 +3,15 @@ package proxy
 import (
 	"context"
 	"fmt"
+	"net/netip"
+	"sync"
+	"time"
+
 	"github.com/siderolabs/grpc-proxy/proxy"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/backoff"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/metadata"
-	"net/netip"
-	"sync"
-	"time"
 )
 
 // RemoteBackend is a proxy.One2ManyResponder implementation that proxies to a remote gRPC server, injecting machine metadata

internal/machine/caddyconfig/caddyfile.go

@@ -0,0 +1,342 @@
+package caddyconfig
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"fmt"
+	"log/slog"
+	"maps"
+	"net"
+	"slices"
+	"strconv"
+	"strings"
+	"text/template"
+
+	"github.com/psviderski/uncloud/internal/machine/store"
+	"github.com/psviderski/uncloud/pkg/api"
+)
+
+const (
+	caddyfileHeader = `# This file is autogenerated by Uncloud based on the configuration of running services.
+# Do not edit manually. Any manual changes will be overwritten on the next update.
+`
+	caddyfileTemplate = `# Health check endpoint to verify Caddy reachability on this machine.
+http:// {
+	handle {{.VerifyPath}} {
+		respond "{{.VerifyResponse}}" 200
+	}
+	log
+}
+
+(common_proxy) {
+	# Retry failed requests up to lb_retries times against other available upstreams.
+	lb_retries 3
+	# Upstreams are marked unhealthy for fail_duration after a failed request (passive health checking).
+	fail_duration 30s
+}
+{{- if or .HTTPHostUpstreams .HTTPSHostUpstreams }}
+
+# Sites generated from service ports.{{end}}
+{{- range $hostname, $upstreams := .HTTPHostUpstreams}}
+
+http://{{$hostname}} {
+	reverse_proxy {{join $upstreams " "}} {
+		import common_proxy
+	}
+	log
+}{{end}}
+{{- range $hostname, $upstreams := .HTTPSHostUpstreams}}
+
+https://{{$hostname}} {
+	reverse_proxy {{join $upstreams " "}} {
+		import common_proxy
+	}
+	log
+}{{end}}
+`
+	caddyfileUnavailabeFooter = `# NOTE: User-defined configs for services were skipped because Caddy is not running on this machine
+#       or the latest generated config is invalid. Please check the Caddy logs if it's running.
+`
+)
+
+// CaddyfileGenerator generates a Caddyfile configuration for the Caddy reverse proxy.
+type CaddyfileGenerator struct {
+	// machineID is the unique identifier of the machine where the controller is running.
+	machineID string
+	validator CaddyfileValidator
+	log       *slog.Logger
+}
+
+// CaddyfileValidator is an interface for validating Caddyfile configurations.
+type CaddyfileValidator interface {
+	Validate(ctx context.Context, caddyfile string) error
+}
+
+func NewCaddyfileGenerator(machineID string, validator CaddyfileValidator, log *slog.Logger) *CaddyfileGenerator {
+	if log == nil {
+		log = slog.Default()
+	}
+	return &CaddyfileGenerator{
+		machineID: machineID,
+		validator: validator,
+		log:       log,
+	}
+}
+
+// Generate creates a Caddyfile configuration based on the provided service containers.
+// The Caddyfile is generated from the service ports of the healthy containers.
+// If a 'caddy' service container is running on this machine and defines a custom Caddy config (x-caddy) in its service
+// spec, it will be validated and prepended to the generated Caddyfile. Custom Caddy configs (x-caddy) defined in other
+// service specs are validated and appended to the generated Caddyfile. Invalid configs are logged and skipped to ensure
+// the generated Caddyfile remains valid.
+//
+// The final Caddyfile structure includes:
+//
+//	[caddy x-caddy (global config)]
+//	[generated Caddyfile from all service ports]
+//	[service-a x-caddy]
+//	...
+//	[service-z x-caddy]
+//
+// If includeCustom is false, custom Caddy configs (x-caddy) are not included in the generated Caddyfile.
+func (g *CaddyfileGenerator) Generate(
+	ctx context.Context, records []store.ContainerRecord, includeCustom bool,
+) (string, error) {
+	containers := make([]api.ServiceContainer, len(records))
+	for i, cr := range records {
+		containers[i] = cr.Container
+	}
+	// Sort containers by service name and creation time to generate a stable Caddyfile.
+	slices.SortStableFunc(containers, func(a, b api.ServiceContainer) int {
+		return cmp.Or(
+			strings.Compare(a.ServiceName(), b.ServiceName()),
+			a.CreatedTime().Compare(b.CreatedTime()),
+		)
+	})
+
+	caddyfile, err := g.generateBaseFromPorts(containers)
+	if err != nil {
+		return "", fmt.Errorf("generate base Caddyfile from service ports: %w", err)
+	}
+
+	if !includeCustom {
+		return fmt.Sprintf("%s\n%s\n%s", caddyfileHeader, caddyfile, caddyfileUnavailabeFooter), nil
+	}
+
+	upstreams := serviceUpstreams(containers)
+	// Track validation errors for reporting.
+	var configErrors []string
+
+	// Find the 'caddy' service container on this machine. Use the most recent one if multiple exist.
+	var caddyCtr *api.ServiceContainer
+	for _, cr := range records {
+		if cr.MachineID == g.machineID && cr.Container.ServiceName() == CaddyServiceName &&
+			(caddyCtr == nil || cr.Container.CreatedTime().Compare(caddyCtr.CreatedTime()) > 0) {
+			caddyCtr = &cr.Container
+		}
+	}
+
+	// If the caddy container is running on this machine and has a custom Caddy config (global),
+	// prepend it to the generated Caddyfile and validate it.
+	if caddyCtr != nil && caddyCtr.ServiceSpec.CaddyConfig() != "" {
+		// Render the custom global Caddy config as a Go template with the upstreams.
+		tmplCtx := templateContext{
+			Name:      caddyCtr.ServiceName(),
+			Upstreams: upstreams,
+		}
+		renderedConfig, err := renderCaddyfile(tmplCtx, caddyCtr.ServiceSpec.CaddyConfig())
+		if err != nil {
+			g.log.Error("Failed to render template directives in user-defined global Caddy config, skipping it.",
+				"service", caddyCtr.ServiceName(), "container", caddyCtr.ID, "err", err)
+			configErrors = append(configErrors,
+				fmt.Sprintf("service '%s': failed to render template: %v", caddyCtr.ServiceName(), err))
+		} else {
+			caddyfileCandidate := fmt.Sprintf("# User-defined global config from service '%s'.\n%s\n\n%s",
+				caddyCtr.ServiceName(), renderedConfig, caddyfile)
+
+			if err = g.validator.Validate(ctx, caddyfileCandidate); err != nil {
+				g.log.Error("User-defined global Caddy config is invalid, skipping it.",
+					"service", caddyCtr.ServiceName(), "container", caddyCtr.ID, "err", err)
+				configErrors = append(configErrors,
+					fmt.Sprintf("service '%s': validation failed: %v", caddyCtr.ServiceName(), err))
+			} else {
+				caddyfile = caddyfileCandidate
+			}
+		}
+	}
+
+	// There could be multiple service containers for the same service with different custom Caddy configs, for example,
+	// if the service has been partially updated. The most recent container for each service defines the current custom
+	// Caddy config for that service.
+	latestServiceContainers := make(map[string]api.ServiceContainer, len(containers))
+	for _, ctr := range containers {
+		if latest, ok := latestServiceContainers[ctr.ServiceName()]; ok {
+			if ctr.CreatedTime().Compare(latest.CreatedTime()) > 0 {
+				latestServiceContainers[ctr.ServiceName()] = ctr
+			}
+		} else {
+			latestServiceContainers[ctr.ServiceName()] = ctr
+		}
+	}
+	sortedServiceNames := slices.Sorted(maps.Keys(latestServiceContainers))
+
+	// Append a custom Caddy config for each service to the Caddyfile and validate it. If the config for a service
+	// is invalid, skip it but continue processing other services to ensure the Caddyfile remains valid.
+	for _, serviceName := range sortedServiceNames {
+		// Skip the caddy container as we already processed it.
+		if serviceName == CaddyServiceName {
+			continue
+		}
+
+		ctr := latestServiceContainers[serviceName]
+		if ctr.ServiceSpec.CaddyConfig() == "" {
+			continue
+		}
+
+		// Render the template actions in the service's Caddy config.
+		tmplCtx := templateContext{
+			Name:      serviceName,
+			Upstreams: upstreams,
+		}
+		renderedConfig, err := renderCaddyfile(tmplCtx, ctr.ServiceSpec.CaddyConfig())
+		if err != nil {
+			g.log.Error("Failed to render template directives in user-defined Caddy config for service, skipping it.",
+				"service", serviceName, "err", err)
+			configErrors = append(configErrors,
+				fmt.Sprintf("service '%s': failed to render template: %v", serviceName, err))
+			continue
+		}
+
+		caddyfileCandidate := fmt.Sprintf("%s\n# User-defined config for service '%s'.\n%s\n",
+			caddyfile, serviceName, renderedConfig)
+		if err = g.validator.Validate(ctx, caddyfileCandidate); err != nil {
+			g.log.Error("User-defined Caddy config for service is invalid, skipping it.",
+				"service", serviceName, "err", err)
+			configErrors = append(configErrors, fmt.Sprintf("service '%s': validation failed: %v", serviceName, err))
+		} else {
+			caddyfile = caddyfileCandidate
+		}
+	}
+
+	// Append error summary as comment if there were any invalid configs.
+	if len(configErrors) > 0 {
+		errorsComment := "# Skipped invalid user-defined configs:\n"
+		for _, e := range configErrors {
+			errorsComment += fmt.Sprintf("# - %s\n", e)
+		}
+
+		caddyfile += "\n" + errorsComment
+	}
+
+	return caddyfileHeader + "\n" + caddyfile, nil
+}
+
+func (g *CaddyfileGenerator) generateBaseFromPorts(containers []api.ServiceContainer) (string, error) {
+	httpHostUpstreams, httpsHostUpstreams := httpUpstreamsFromPorts(containers)
+
+	funcs := template.FuncMap{"join": strings.Join}
+	tmpl, err := template.New("Caddyfile").Funcs(funcs).Parse(caddyfileTemplate)
+	if err != nil {
+		return "", fmt.Errorf("parse Caddyfile template: %w", err)
+	}
+
+	data := struct {
+		VerifyPath         string
+		VerifyResponse     string
+		HTTPHostUpstreams  map[string][]string
+		HTTPSHostUpstreams map[string][]string
+	}{
+		VerifyPath:         VerifyPath,
+		VerifyResponse:     g.machineID,
+		HTTPHostUpstreams:  httpHostUpstreams,
+		HTTPSHostUpstreams: httpsHostUpstreams,
+	}
+
+	var buf bytes.Buffer
+	if err = tmpl.Execute(&buf, data); err != nil {
+		return "", fmt.Errorf("execute Caddyfile template: %w", err)
+	}
+
+	return buf.String(), nil
+}
+
+// httpUpstreamsFromPorts extracts upstreams for HTTP and HTTPS protocols from the published ports of the provided
+// service containers. It's expected that all containers are healthy.
+func httpUpstreamsFromPorts(containers []api.ServiceContainer) (map[string][]string, map[string][]string) {
+	// Maps hostnames to lists of upstreams (container IP:port pairs).
+	httpHostUpstreams := make(map[string][]string)
+	httpsHostUpstreams := make(map[string][]string)
+	for _, ctr := range containers {
+		ip := ctr.UncloudNetworkIP()
+		if !ip.IsValid() {
+			// Container is not connected to the uncloud Docker network (could be host network).
+			continue
+		}
+		log := slog.With("container", ctr.ID)
+
+		ports, err := ctr.ServicePorts()
+		if err != nil {
+			log.Error("Failed to parse service ports for container.", "err", err)
+			continue
+		}
+
+		for _, port := range ports {
+			if port.Mode != api.PortModeIngress {
+				continue
+			}
+
+			switch port.Protocol {
+			case api.ProtocolHTTP:
+				upstream := net.JoinHostPort(ip.String(), strconv.Itoa(int(port.ContainerPort)))
+				httpHostUpstreams[port.Hostname] = append(httpHostUpstreams[port.Hostname], upstream)
+			case api.ProtocolHTTPS:
+				upstream := net.JoinHostPort(ip.String(), strconv.Itoa(int(port.ContainerPort)))
+				httpsHostUpstreams[port.Hostname] = append(httpsHostUpstreams[port.Hostname], upstream)
+			default:
+				// TODO: implement L4 ingress routing for TCP and UDP.
+				log.Error("Unsupported protocol for ingress port.", "port", port)
+				continue
+			}
+		}
+	}
+
+	return httpHostUpstreams, httpsHostUpstreams
+}
+
+// serviceUpstreams creates a map of service names to their container IPs.
+// Only includes containers connected to the uncloud Docker network.
+func serviceUpstreams(containers []api.ServiceContainer) map[string][]string {
+	upstreams := make(map[string][]string)
+	for _, ctr := range containers {
+		ip := ctr.UncloudNetworkIP()
+		if !ip.IsValid() {
+			// Container is not connected to the uncloud Docker network (could be host network).
+			continue
+		}
+
+		serviceName := ctr.ServiceName()
+		upstreams[serviceName] = append(upstreams[serviceName], ip.String())
+	}
+
+	return upstreams
+}
+
+// renderCaddyfile renders a Caddyfile template with the upstreams function and data.
+func renderCaddyfile(tmplCtx templateContext, caddyfile string) (string, error) {
+	funcs := template.FuncMap{
+		"upstreams": upstreamsTemplateFn(tmplCtx),
+	}
+
+	tmpl, err := template.New("Caddyfile").Funcs(funcs).Parse(caddyfile)
+	if err != nil {
+		return "", fmt.Errorf("parse config as Go template: %w", err)
+	}
+
+	var buf bytes.Buffer
+	if err = tmpl.Execute(&buf, tmplCtx); err != nil {
+		return "", fmt.Errorf("execute template: %w", err)
+	}
+
+	return buf.String(), nil
+}

internal/machine/caddyconfig/client.go

@@ -0,0 +1,142 @@
+package caddyconfig
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/caddyserver/caddy/v2"
+)
+
+// CaddyAdminClient is a client for interacting with the Caddy admin API over a Unix socket.
+type CaddyAdminClient struct {
+	socketPath string
+	client     *http.Client
+}
+
+func NewCaddyAdminClient(socketPath string) *CaddyAdminClient {
+	return &CaddyAdminClient{
+		socketPath: socketPath,
+		client: &http.Client{
+			Timeout: 5 * time.Second,
+			Transport: &http.Transport{
+				DialContext: func(_ context.Context, _, _ string) (net.Conn, error) {
+					return net.Dial("unix", socketPath)
+				},
+			},
+		},
+	}
+}
+
+// IsAvailable checks if the local Caddy instance is running and responding to admin API requests.
+func (c *CaddyAdminClient) IsAvailable(ctx context.Context) bool {
+	// Caddy doesn't serve a /ping endpoint. It's a random endpoint we can use to check if Caddy is running.
+	req, err := http.NewRequestWithContext(ctx, "GET", "http://localhost/ping", nil)
+	if err != nil {
+		return false
+	}
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return false
+	}
+	defer resp.Body.Close()
+
+	// Any HTTP response means Caddy is running and accessible.
+	return true
+}
+
+// Adapt converts a Caddyfile to JSON configuration without loading or running it.
+func (c *CaddyAdminClient) Adapt(ctx context.Context, caddyfile string) (string, error) {
+	req, err := http.NewRequestWithContext(ctx, "POST", "http://localhost/adapt", strings.NewReader(caddyfile))
+	if err != nil {
+		return "", fmt.Errorf("create adapt request: %w", err)
+	}
+	req.Header.Set("Content-Type", "text/caddyfile")
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("send adapt request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return "", fmt.Errorf("read response body: %w", err)
+	}
+
+	if resp.StatusCode == http.StatusOK {
+		// Parse the response body to extract the result field.
+		var msg struct {
+			Result json.RawMessage `json:"result"`
+		}
+		if err = json.Unmarshal(body, &msg); err != nil {
+			return "", fmt.Errorf("parse adapt response: %w", err)
+		}
+		return string(msg.Result), nil
+	}
+
+	// If the response is a 400 Bad Request, try to parse the error message from it.
+	if resp.StatusCode == http.StatusBadRequest {
+		var apiError caddy.APIError
+		if err = json.Unmarshal(body, &apiError); err == nil {
+			return "", errors.New(apiError.Message)
+		}
+	}
+
+	return "", errors.New(string(body))
+}
+
+// Load loads a Caddyfile configuration into the Caddy instance running on the machine.
+// Due to a Caddy bug (https://github.com/caddyserver/caddy/issues/7246), we first adapt the Caddyfile to JSON
+// and then load the JSON config to get proper error handling.
+func (c *CaddyAdminClient) Load(ctx context.Context, caddyfile string) error {
+	jsonConfig, err := c.Adapt(ctx, caddyfile)
+	if err != nil {
+		return fmt.Errorf("adapt Caddyfile to JSON config: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, "POST", "http://localhost/load", strings.NewReader(jsonConfig))
+	if err != nil {
+		return fmt.Errorf("create load request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return fmt.Errorf("send load request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusOK {
+		return nil
+	}
+
+	body, _ := io.ReadAll(resp.Body)
+	// If the response is a 400 Bad Request, try to parse the error message from it.
+	if resp.StatusCode == http.StatusBadRequest {
+		var apiError caddy.APIError
+		if err = json.Unmarshal(body, &apiError); err == nil {
+			return fmt.Errorf("caddy responded with error: %s", apiError.Message)
+		}
+	}
+
+	return fmt.Errorf("caddy responded with error: HTTP %d: %s", resp.StatusCode, string(body))
+}
+
+// Validate checks if the provided Caddyfile can be adapted to Caddy JSON config using the running Caddy instance via
+// its admin API. It doesn't guarantee that the Caddyfile is actually valid and can be loaded. For example, a tls
+// directive with a missing certificate will pass the adaptation but will fail when Caddy tries to load it.
+// But this is the best we can do over the admin API.
+// TODO: run 'docker exec caddy-container caddy validate' to do proper validation or implement a Caddy module that
+// exposes a validation endpoint.
+func (c *CaddyAdminClient) Validate(ctx context.Context, caddyfile string) error {
+	_, err := c.Adapt(ctx, caddyfile)
+	return err
+}

internal/machine/caddyconfig/controller.go

@@ -0,0 +1,186 @@
+package caddyconfig
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+
+	"github.com/psviderski/uncloud/internal/fs"
+	"github.com/psviderski/uncloud/internal/machine/store"
+	"github.com/psviderski/uncloud/pkg/api"
+)
+
+const (
+	CaddyServiceName = "caddy"
+	CaddyGroup       = "uncloud"
+	VerifyPath       = "/.uncloud-verify"
+)
+
+// Controller monitors container changes in the cluster store and generates a configuration file for Caddy reverse
+// proxy. The generated configuration allows Caddy to route external traffic to service containers across the internal
+// network.
+type Controller struct {
+	machineID     string
+	caddyfilePath string
+	generator     *CaddyfileGenerator
+	client        *CaddyAdminClient
+	store         *store.Store
+	log           *slog.Logger
+}
+
+func NewController(machineID, configDir, adminSock string, store *store.Store) (*Controller, error) {
+	if err := os.MkdirAll(configDir, 0o750); err != nil {
+		return nil, fmt.Errorf("create directory for Caddy configuration '%s': %w", configDir, err)
+	}
+	if err := fs.Chown(configDir, "", CaddyGroup); err != nil {
+		return nil, fmt.Errorf("change owner of directory for Caddy configuration '%s': %w", configDir, err)
+	}
+
+	log := slog.With("component", "caddy-controller")
+	client := NewCaddyAdminClient(adminSock)
+	generator := NewCaddyfileGenerator(machineID, client, log)
+
+	return &Controller{
+		machineID:     machineID,
+		caddyfilePath: filepath.Join(configDir, "Caddyfile"),
+		generator:     generator,
+		client:        client,
+		store:         store,
+		log:           log,
+	}, nil
+}
+
+func (c *Controller) Run(ctx context.Context) error {
+	containers, changes, err := c.store.SubscribeContainers(ctx)
+	if err != nil {
+		return fmt.Errorf("subscribe to container changes: %w", err)
+	}
+	c.log.Info("Subscribed to container changes in the cluster to generate Caddy configuration.")
+
+	containers = filterHealthyContainers(containers)
+	c.generateAndLoadCaddyfile(ctx, containers)
+
+	// TODO: left for backward compatibility, remove later.
+	if err = c.generateJSONConfig(containers); err != nil {
+		c.log.Error("Failed to generate Caddy JSON configuration to disk.", "err", err)
+	}
+
+	for {
+		select {
+		case _, ok := <-changes:
+			if !ok {
+				return fmt.Errorf("containers subscription failed")
+			}
+			c.log.Info("Cluster containers changed, updating Caddy configuration.")
+
+			containers, err = c.store.ListContainers(ctx, store.ListOptions{})
+			if err != nil {
+				c.log.Error("Failed to list containers.", "err", err)
+				continue
+			}
+			containers = filterHealthyContainers(containers)
+			c.generateAndLoadCaddyfile(ctx, containers)
+
+			// TODO: left for backward compatibility, remove later.
+			if err = c.generateJSONConfig(containers); err != nil {
+				c.log.Error("Failed to generate Caddy JSON configuration to disk.", "err", err)
+			}
+		case <-ctx.Done():
+			return nil
+		}
+	}
+}
+
+// filterHealthyContainers filters out containers that are not healthy.
+// TODO: Filters out containers from this machine that are likely unavailable. The availability can be determined
+// by the cluster membership state of the machine that the container is running on. Implement machine membership
+// check using Corrossion Admin client.
+func filterHealthyContainers(containers []store.ContainerRecord) []store.ContainerRecord {
+	healthy := make([]store.ContainerRecord, 0, len(containers))
+	for _, cr := range containers {
+		if cr.Container.Healthy() {
+			healthy = append(healthy, cr)
+		}
+	}
+	return healthy
+}
+
+func (c *Controller) generateAndLoadCaddyfile(ctx context.Context, containers []store.ContainerRecord) {
+	// Check if Caddy is available before attempting to generate and load config.
+	caddyAvailable := c.client.IsAvailable(ctx)
+	caddyfile, err := c.generator.Generate(ctx, containers, caddyAvailable)
+	if err != nil {
+		c.log.Error("Failed to generate Caddyfile configuration.", "err", err)
+		return
+	}
+
+	if !caddyAvailable {
+		// Caddy is not running so the generated Caddyfile should not include user-defined configs thus must be valid.
+		// It's safe to write the config to disk so that when Caddy is deployed on this machine, it can pick it up.
+		if err = c.writeCaddyfile(caddyfile); err != nil {
+			c.log.Error("Failed to write Caddyfile to disk.", "err", err)
+			return
+		}
+		c.log.Debug("Caddy is not running on this machine, skipping configuration load.", "path", c.caddyfilePath)
+		return
+	}
+
+	// Caddy is available, try to load the config which may fail if the config is invalid. Generally, a config can
+	// pass the adaptation/validation step but still fail to load, for example, if it references resources that are
+	// not available.
+	if err = c.client.Load(ctx, caddyfile); err != nil {
+		c.log.Error("Failed to load new Caddy configuration into local Caddy instance.",
+			"err", err, "path", c.caddyfilePath)
+		// Don't write invalid config to disk.
+		return
+	}
+
+	// Config loaded successfully, now write it to disk.
+	if err = c.writeCaddyfile(caddyfile); err != nil {
+		c.log.Error("Failed to write Caddyfile to disk after successful load.", "err", err)
+		// Config is already loaded in Caddy, so this is not critical.
+	}
+
+	c.log.Info("New Caddy configuration loaded into local Caddy instance.", "path", c.caddyfilePath)
+}
+
+// writeCaddyfile writes the Caddyfile content to disk with proper permissions.
+func (c *Controller) writeCaddyfile(caddyfile string) error {
+	if err := os.WriteFile(c.caddyfilePath, []byte(caddyfile), 0o640); err != nil {
+		return fmt.Errorf("write Caddyfile to file '%s': %w", c.caddyfilePath, err)
+	}
+	if err := fs.Chown(c.caddyfilePath, "", CaddyGroup); err != nil {
+		return fmt.Errorf("change owner of Caddyfile '%s': %w", c.caddyfilePath, err)
+	}
+	return nil
+}
+
+func (c *Controller) generateJSONConfig(containers []store.ContainerRecord) error {
+	serviceContainers := make([]api.ServiceContainer, len(containers))
+	for i, cr := range containers {
+		serviceContainers[i] = cr.Container
+	}
+
+	config, err := GenerateJSONConfig(serviceContainers, c.machineID)
+	if err != nil {
+		return err
+	}
+
+	configBytes, err := json.MarshalIndent(config, "", "    ")
+	if err != nil {
+		return fmt.Errorf("marshal Caddy configuration: %w", err)
+	}
+	configPath := filepath.Join(filepath.Dir(c.caddyfilePath), "caddy.json")
+
+	if err = os.WriteFile(configPath, configBytes, 0o640); err != nil {
+		return fmt.Errorf("write Caddy configuration to file '%s': %w", configPath, err)
+	}
+	if err = fs.Chown(configPath, "", CaddyGroup); err != nil {
+		return fmt.Errorf("change owner of Caddy configuration file '%s': %w", configPath, err)
+	}
+
+	return nil
+}

internal/machine/caddyconfig/jsonconfig.go

@@ -1,15 +1,14 @@
-package caddyfile
+package caddyconfig
 
 import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"log/slog"
 	"maps"
-	"net"
 	"net/http"
 	"slices"
 	"strconv"
+	"time"
 
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig"
@@ -18,52 +17,15 @@ import (
 	"github.com/psviderski/uncloud/pkg/api"
 )
 
-func GenerateConfig(containers []api.ServiceContainer, verifyResponse string) (*caddy.Config, error) {
-	// Maps hostnames to lists of upstreams (container IP:port pairs).
-	httpHostUpstreams := make(map[string][]string)
-	httpsHostUpstreams := make(map[string][]string)
-	for _, ctr := range containers {
-		if !ctr.Healthy() {
-			continue
-		}
-
-		ip := ctr.UncloudNetworkIP()
-		if !ip.IsValid() {
-			// Container is not connected to the uncloud Docker network (could be host network).
-			continue
-		}
-		log := slog.With("container", ctr.ID)
-
-		ports, err := ctr.ServicePorts()
-		if err != nil {
-			log.Error("Failed to parse service ports for container.", "err", err)
-			continue
-		}
-
-		for _, port := range ports {
-			if port.Mode != api.PortModeIngress {
-				continue
-			}
-
-			switch port.Protocol {
-			case api.ProtocolHTTP:
-				upstream := net.JoinHostPort(ip.String(), strconv.Itoa(int(port.ContainerPort)))
-				httpHostUpstreams[port.Hostname] = append(httpHostUpstreams[port.Hostname], upstream)
-			case api.ProtocolHTTPS:
-				upstream := net.JoinHostPort(ip.String(), strconv.Itoa(int(port.ContainerPort)))
-				httpsHostUpstreams[port.Hostname] = append(httpsHostUpstreams[port.Hostname], upstream)
-			default:
-				// TODO: implement L4 ingress routing for TCP and UDP.
-				log.Error("Unsupported protocol for ingress port.", "port", port)
-				continue
-			}
-		}
-	}
+func GenerateJSONConfig(containers []api.ServiceContainer, verifyResponse string) (*caddy.Config, error) {
+	httpHostUpstreams, httpsHostUpstreams := httpUpstreamsFromPorts(containers)
 
 	var warnings []caddyconfig.Warning
 	servers := make(map[string]*caddyhttp.Server)
 	servers["http"] = &caddyhttp.Server{
 		Listen: []string{fmt.Sprintf(":%d", caddyhttp.DefaultHTTPPort)},
+		// All http requests to this server are logged to the default logger.
+		Logs: &caddyhttp.ServerLogConfig{},
 		Routes: append(
 			hostUpstreamsToRoutes(httpHostUpstreams, &warnings),
 			// Add a route to respond with a static verification response at the /.uncloud-verify path.
@@ -72,6 +34,8 @@ func GenerateConfig(containers []api.ServiceContainer, verifyResponse string) (*
 	}
 	servers["https"] = &caddyhttp.Server{
 		Listen: []string{fmt.Sprintf(":%d", caddyhttp.DefaultHTTPSPort)},
+		// All https requests to this server are logged to the default logger.
+		Logs:   &caddyhttp.ServerLogConfig{},
 		Routes: hostUpstreamsToRoutes(httpsHostUpstreams, &warnings),
 	}
 
@@ -112,6 +76,16 @@ func hostUpstreamsToRoutes(hostUpstreams map[string][]string, warnings *[]caddyc
 			}
 		}
 		handler := &reverseproxy.Handler{
+			HealthChecks: &reverseproxy.HealthChecks{
+				// Enable passive health checks to automatically detect unhealthy upstreams.
+				Passive: &reverseproxy.PassiveHealthChecks{
+					FailDuration: caddy.Duration(30 * time.Second),
+				},
+			},
+			LoadBalancing: &reverseproxy.LoadBalancing{
+				// Retry failed requests to skip over temporarily unavailable upstreams.
+				Retries: 3,
+			},
 			Upstreams: upstreamPool,
 		}
 

internal/machine/caddyconfig/jsonconfig_test.go

@@ -1,10 +1,9 @@
-package caddyfile
+package caddyconfig
 
 import (
 	"strings"
 	"testing"
 
-	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
 	"github.com/psviderski/uncloud/internal/machine/docker"
@@ -13,7 +12,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestGenerateConfig(t *testing.T) {
+func TestGenerateJSONConfig(t *testing.T) {
 	configWithoutServices := `{
 		"servers": {
 			"http": {
@@ -25,10 +24,12 @@ func TestGenerateConfig(t *testing.T) {
 						"handler": "static_response",
 						"status_code": 200
 					}]
-				}]
+				}],
+				"logs": {}
 			},
 			"https": {
-				"listen": [":443"]
+				"listen": [":443"],
+				"logs": {}
 			}
 		}
 	}`
@@ -60,6 +61,14 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [{"dial": "10.210.0.2:8080"}]
                                 }]
                             },
@@ -71,10 +80,12 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     },
                     "https": {
-                        "listen": [":443"]
+                        "listen": [":443"],
+						"logs": {}
                     }
                 }
             }`,
@@ -95,6 +106,14 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [
                                         {"dial": "10.210.0.2:8080"},
                                         {"dial": "10.210.0.3:8080"}
@@ -109,10 +128,12 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     },
                     "https": {
-                        "listen": [":443"]
+                        "listen": [":443"],
+						"logs": {}
                     }
                 }
             }`,
@@ -136,7 +157,8 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     },
                     "https": {
                         "listen": [":443"],
@@ -145,10 +167,19 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["secure.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [{"dial": "10.210.0.2:8000"}]
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     }
                 }
             }`,
@@ -180,6 +211,14 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["app.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [
 										{"dial": "10.210.0.2:8080"},
 										{"dial": "10.210.0.3:8080"},
@@ -191,6 +230,14 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["web.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [
 										{"dial": "10.210.0.2:8000"},
 										{"dial": "10.210.0.4:8000"},
@@ -206,7 +253,8 @@ func TestGenerateConfig(t *testing.T) {
                                     "status_code": 200
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     },
                     "https": {
                         "listen": [":443"],
@@ -215,6 +263,14 @@ func TestGenerateConfig(t *testing.T) {
                                 "match": [{"host": ["secure.example.com"]}],
                                 "handle": [{
                                     "handler": "reverse_proxy",
+									"health_checks": {
+                                        "passive": {
+                                            "fail_duration": 30000000000
+                                        }
+                                    },
+                                    "load_balancing": {
+                                        "retries": 3
+                                    },
                                     "upstreams": [
 										{"dial": "10.210.0.3:8888"},
 										{"dial": "10.210.0.4:8888"},
@@ -222,7 +278,8 @@ func TestGenerateConfig(t *testing.T) {
 									]
                                 }]
                             }
-                        ]
+                        ],
+						"logs": {}
                     }
                 }
             }`,
@@ -254,63 +311,11 @@ func TestGenerateConfig(t *testing.T) {
 			want:    configWithoutServices,
 			wantErr: false,
 		},
-		{
-			name: "restarting container ignored",
-			containers: []api.ServiceContainer{
-				newRestartingContainer("10.210.0.2", "app.example.com:8080/http"),
-			},
-			want:    configWithoutServices,
-			wantErr: false,
-		},
-		{
-			name: "stopped container ignored",
-			containers: []api.ServiceContainer{
-				newStoppedContainer("10.210.0.2", "app.example.com:8080/http"),
-			},
-			want:    configWithoutServices,
-			wantErr: false,
-		},
-		{
-			name: "mix of running, restarting, and stopped containers",
-			containers: []api.ServiceContainer{
-				newContainer("10.210.0.2", "app.example.com:8080/http"),
-				newRestartingContainer("10.210.0.3", "app.example.com:8080/http"),
-				newStoppedContainer("10.210.0.4", "app.example.com:8080/http"),
-			},
-			want: `{
-                "servers": {
-                    "http": {
-                        "listen": [":80"],
-                        "routes": [
-                            {
-                                "match": [{"host": ["app.example.com"]}],
-                                "handle": [{
-                                    "handler": "reverse_proxy",
-                                    "upstreams": [{"dial": "10.210.0.2:8080"}]
-                                }]
-                            },
-                            {
-                                "match": [{"path": ["/.uncloud-verify"]}],
-                                "handle": [{
-                                    "body": "verification-response-body",
-                                    "handler": "static_response",
-                                    "status_code": 200
-                                }]
-                            }
-                        ]
-                    },
-                    "https": {
-                        "listen": [":443"]
-                    }
-                }
-            }`,
-			wantErr: false,
-		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			config, err := GenerateConfig(tt.containers, "verification-response-body")
+			config, err := GenerateJSONConfig(tt.containers, "verification-response-body")
 
 			if tt.wantErr {
 				assert.Error(t, err)
@@ -328,13 +333,13 @@ func TestGenerateConfig(t *testing.T) {
 
 func newContainer(ip string, ports ...string) api.ServiceContainer {
 	portsLabel := strings.Join(ports, ",")
-	return api.ServiceContainer{Container: api.Container{ContainerJSON: types.ContainerJSON{
-		ContainerJSONBase: &types.ContainerJSONBase{
-			State: &types.ContainerState{
+	return api.ServiceContainer{Container: api.Container{InspectResponse: container.InspectResponse{
+		ContainerJSONBase: &container.ContainerJSONBase{
+			State: &container.State{
 				Running: true,
 			},
 		},
-		NetworkSettings: &types.NetworkSettings{
+		NetworkSettings: &container.NetworkSettings{
 			Networks: map[string]*network.EndpointSettings{
 				docker.NetworkName: {
 					IPAddress: ip,
@@ -351,13 +356,13 @@ func newContainer(ip string, ports ...string) api.ServiceContainer {
 
 func newContainerWithoutNetwork(ports ...string) api.ServiceContainer {
 	portsLabel := strings.Join(ports, ",")
-	return api.ServiceContainer{Container: api.Container{ContainerJSON: types.ContainerJSON{
-		ContainerJSONBase: &types.ContainerJSONBase{
-			State: &types.ContainerState{
+	return api.ServiceContainer{Container: api.Container{InspectResponse: container.InspectResponse{
+		ContainerJSONBase: &container.ContainerJSONBase{
+			State: &container.State{
 				Running: true,
 			},
 		},
-		NetworkSettings: &types.NetworkSettings{
+		NetworkSettings: &container.NetworkSettings{
 			Networks: map[string]*network.EndpointSettings{
 				"other-network": {
 					IPAddress: "172.17.0.2",
@@ -371,15 +376,3 @@ func newContainerWithoutNetwork(ports ...string) api.ServiceContainer {
 		},
 	}}}
 }
-
-func newRestartingContainer(ip string, ports ...string) api.ServiceContainer {
-	ctr := newContainer(ip, ports...)
-	ctr.Container.State.Restarting = true
-	return ctr
-}
-
-func newStoppedContainer(ip string, ports ...string) api.ServiceContainer {
-	ctr := newContainer(ip, ports...)
-	ctr.Container.State.Running = false
-	return ctr
-}

internal/machine/caddyconfig/mocks_test.go

@@ -0,0 +1,95 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package caddyconfig
+
+import (
+	"context"
+
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewMockCaddyfileValidator creates a new instance of MockCaddyfileValidator. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewMockCaddyfileValidator(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *MockCaddyfileValidator {
+	mock := &MockCaddyfileValidator{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// MockCaddyfileValidator is an autogenerated mock type for the CaddyfileValidator type
+type MockCaddyfileValidator struct {
+	mock.Mock
+}
+
+type MockCaddyfileValidator_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *MockCaddyfileValidator) EXPECT() *MockCaddyfileValidator_Expecter {
+	return &MockCaddyfileValidator_Expecter{mock: &_m.Mock}
+}
+
+// Validate provides a mock function for the type MockCaddyfileValidator
+func (_mock *MockCaddyfileValidator) Validate(ctx context.Context, caddyfile string) error {
+	ret := _mock.Called(ctx, caddyfile)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Validate")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string) error); ok {
+		r0 = returnFunc(ctx, caddyfile)
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// MockCaddyfileValidator_Validate_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Validate'
+type MockCaddyfileValidator_Validate_Call struct {
+	*mock.Call
+}
+
+// Validate is a helper method to define mock.On call
+//   - ctx context.Context
+//   - caddyfile string
+func (_e *MockCaddyfileValidator_Expecter) Validate(ctx interface{}, caddyfile interface{}) *MockCaddyfileValidator_Validate_Call {
+	return &MockCaddyfileValidator_Validate_Call{Call: _e.mock.On("Validate", ctx, caddyfile)}
+}
+
+func (_c *MockCaddyfileValidator_Validate_Call) Run(run func(ctx context.Context, caddyfile string)) *MockCaddyfileValidator_Validate_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *MockCaddyfileValidator_Validate_Call) Return(err error) *MockCaddyfileValidator_Validate_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *MockCaddyfileValidator_Validate_Call) RunAndReturn(run func(ctx context.Context, caddyfile string) error) *MockCaddyfileValidator_Validate_Call {
+	_c.Call.Return(run)
+	return _c
+}

internal/machine/caddyconfig/server.go

@@ -0,0 +1,39 @@
+package caddyconfig
+
+import (
+	"context"
+	"os"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/psviderski/uncloud/internal/machine/api/pb"
+)
+
+// Server implements the gRPC Caddy service.
+type Server struct {
+	pb.UnimplementedCaddyServer
+	service *Service
+}
+
+func NewServer(service *Service) *Server {
+	return &Server{service: service}
+}
+
+// GetConfig retrieves the current Caddy configuration from the machine.
+func (s *Server) GetConfig(ctx context.Context, _ *emptypb.Empty) (*pb.GetCaddyConfigResponse, error) {
+	caddyfile, modifiedAt, err := s.service.Caddyfile()
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, status.Error(codes.NotFound, err.Error())
+		}
+		return nil, status.Error(codes.Internal, err.Error())
+	}
+
+	return &pb.GetCaddyConfigResponse{
+		Caddyfile:  caddyfile,
+		ModifiedAt: timestamppb.New(modifiedAt),
+	}, nil
+}