chore(.editorconfig): ignore formatting for release notes

* chore(deps): bump bubbletea to v2.0.10, drop the uncloud fork

v2.0.10 carries the upstream fix for terminal capability replies leaking into
the shell (charmbracelet/bubbletea#1801). It skips every query that expects a
reply when input is disabled: the startup probe for synchronized output and
Unicode core, clipboard reads, background, foreground and cursor colour
requests, cursor position reports, and terminal version and termcap queries.

That supersedes the unlabs-dev fork, whose patch covered only the startup
probe, so the replace directive goes away and uncloud tracks upstream again.

The bump on its own does not fix the leak. Bubble Tea skips the queries only
when a program declares that it has no input, and nothing in uncloud declares
that yet. Measured: this tree still leaks "^[[?2026;2$y^[[?2027;0$y" under a
PTY harness. The next commit is what makes the spinners declare it.

Refs: #286, charmbracelet/bubbletea#1801

.dockerignore

@@ -2,8 +2,10 @@
 *
 
 # Allow files and directories.
+!api/
 !cmd/
 !internal/
+!pkg/
 !scripts/docker/
 !go.*
 

.editorconfig

@@ -0,0 +1,23 @@
+# EditorConfig is awesome: https://editorconfig.org
+
+root = true
+
+# Default settings for all files
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+# Settings for Go files
+[*.go]
+indent_style = tab
+indent_size = 4
+
+# Settings for Bash scripts
+[*.sh]
+indent_style = space
+indent_size = 4
+
+[release-notes-*.md]
+max_line_length = off

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: [psviderski]

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,36 @@
+---
+name: Bug Report
+about: Create a report to help us improve
+title: "[BUG] "
+labels: bug
+assignees: ""
+---
+
+**Describe the bug**
+
+<!-- A clear and concise description of what the bug is. -->
+
+**How to reproduce**
+
+<!-- Steps to reproduce the behavior:
+
+1. Run ...
+2. Do ...
+-->
+
+**Expected behavior**
+
+<!-- A clear and concise description of what you expected to happen. -->
+
+**Environment:**
+
+- Uncloud versions:
+  - Control (client) node (`uc --version`):
+  - Uncloud daemon (from the server) (`uncloudd --version`):
+- OS version (`uname -a`):
+  - Client (control node):
+  - Server:
+
+**Additional context**
+
+<!-- Add any other context about the problem here. -->

.github/copilot-instructions.md

@@ -0,0 +1 @@
+../AI.md

.github/workflows/go-tests.yml

@@ -0,0 +1,82 @@
+name: Go Tests
+on:
+  push:
+    branches:
+      - "main"
+      - "test/**"
+      - "release/**"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - ".github/**"
+      - "**.go"
+      - "**.proto"
+      - "go.*"
+      - "Makefile"
+      - "scripts/**"
+      - "test/**"
+permissions:
+  contents: read
+env:
+  MISE_VERSION: "2026.3.7"
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install Mise
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        with:
+          version: ${{ env.MISE_VERSION }}
+      - name: Reset changes in mise.lock after fresh mise install
+        run: git checkout mise.lock
+
+      - name: Install dependencies
+        run: |
+          go mod tidy
+          git diff --exit-code ||
+            (echo "go.mod or go.sum has changed. Please run 'go mod tidy' and commit the changes." && exit 1)
+
+      - name: Generate docs
+        run: |
+          make cli-docs
+          git diff --exit-code ||
+            (echo "Documentation is out of date. Please run 'make cli-docs' and commit the changes." && exit 1)
+
+      - name: Run tests
+        run: |
+          mise ucind:image
+          make test
+    timeout-minutes: 15
+
+  check-protobuf:
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    strategy:
+      matrix:
+        # Run on more platforms so that mise lockfile checksums are checked/generated for all platforms.
+        # See https://github.com/jdx/mise/issues/4276 for details.
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install Mise
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        with:
+          version: ${{ env.MISE_VERSION }}
+
+      # TODO: figure out how to properly lock all platforms in the lockfile and remove this hack.
+      # `mise lock` (mise run mise:lock) doesn't generate checksums for some of the tools, e.g. protoc*
+      - name: Reset changes in mise.lock after fresh mise install
+        run: git checkout mise.lock
+
+      - name: Generate Protobuf files
+        run: |
+          mise run proto
+          # Check if the generated files are up to date.
+          git diff --exit-code ||
+            (echo "Generated protobuf files are not up to date. Please run 'mise run proto' and commit the changes." && exit 1)

.github/workflows/lint.yml

@@ -0,0 +1,35 @@
+name: Lint
+on:
+  push:
+    branches:
+      - "main"
+      - "test/**"
+      - "release/**"
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "**.go"
+      - "go.*"
+permissions:
+  contents: read
+env:
+  MISE_VERSION: "2026.3.7"
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install Mise
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        with:
+          version: ${{ env.MISE_VERSION }}
+      - name: Reset changes in mise.lock after fresh mise install
+        run: git checkout mise.lock
+
+      - name: Lint
+        run: make lint
+
+    timeout-minutes: 10

.github/workflows/nightly-build.yml

@@ -0,0 +1,99 @@
+name: Nightly Build
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+
+env:
+  MISE_VERSION: "2026.3.7"
+
+jobs:
+  nightly:
+    # Run on macOS to be able to build the fsevent dependency required by compose on macOS.
+    runs-on: macos-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: Install Mise
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        with:
+          version: ${{ env.MISE_VERSION }}
+      - name: Reset changes in mise.lock after fresh mise install
+        run: git checkout mise.lock
+
+      - name: Cache Go build and module cache
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: |
+            ~/Library/Caches/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-${{ hashFiles('**/*.go') }}
+          restore-keys: |
+            ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-
+            ${{ runner.os }}-go-
+
+      - name: Run GoReleaser snapshot
+        run: goreleaser release --snapshot --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Delete existing nightly release
+        run: gh release delete nightly --yes --cleanup-tag || true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create nightly release
+        run: |
+          COMMIT=$(git rev-parse --short HEAD)
+          DATE=$(date -u '+%Y-%m-%d %H:%M UTC')
+          RELEASE_NOTES=$(cat <<EOF
+          Built from \`main\` at ${COMMIT} on ${DATE}.
+
+          The commands below show how to install the nightly version of uncloud.
+
+          > [!WARNING]
+          > These are nightly development builds and may be unstable.
+
+          **Install uncloud CLI:**
+
+          \`\`\`
+          curl -fsS https://get.uncloud.run/install.sh | VERSION=nightly sh
+          \`\`\`
+
+          **Initialize a cluster or add a machine:**
+
+          \`\`\`
+          uc machine init --version nightly user@host
+          uc machine add  --version nightly user@host
+          \`\`\`
+
+          **Upgrade machine daemon:**
+
+          \`\`\`
+          ARCH=\$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
+          curl -fsSL -o uncloudd.tar.gz https://github.com/psviderski/uncloud/releases/download/nightly/uncloudd_linux_\${ARCH}.tar.gz
+          tar -xf uncloudd.tar.gz
+          sudo install uncloudd /usr/local/bin/uncloudd
+          rm uncloudd uncloudd.tar.gz
+          sudo systemctl restart uncloud
+          \`\`\`
+
+          EOF
+          )
+
+          gh release create nightly \
+            --title "Nightly Build" \
+            --notes "${RELEASE_NOTES}" \
+            --prerelease \
+            --target ${{ github.sha }} \
+            dist/*.tar.gz dist/checksums.txt
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    timeout-minutes: 30

.gitignore

@@ -7,6 +7,10 @@
 *.dll
 *.so
 *.dylib
+/uncloud
+/uncloud-*
+/uncloudd
+/uncloudd-*
 
 # OS X
 .DS_Store
@@ -27,11 +31,17 @@ go.work.sum
 .env
 .idea/
 
-data
-dist/
+/data/
+/dist/
+/uc
+/tmp
 
 # Web
 node_modules/
 
 # VS Code
 .vscode
+.devcontainer/
+
+.zed/
+research/

.golangci.yaml

@@ -0,0 +1,42 @@
+version: "2"
+
+run:
+  concurrency: 4
+  tests: true
+  timeout: 5m
+
+linters:
+  default: none
+  enable:
+    - bodyclose
+    # - dogsled
+    - dupl
+    # - errcheck
+    - gochecknoinits
+    - goconst
+    # - gocritic
+    # - gocyclo
+    # - godot
+    # - gosec
+    # - govet
+    - ineffassign
+    - misspell
+    - nakedret
+    # - prealloc
+    # - revive
+    # - staticcheck
+    - unconvert
+    # - unparam
+    # - unused
+    - whitespace
+  exclusions:
+    rules:
+      - path: ^test/e2e
+        linters:
+          - goconst  # constants here add no value, so we skip goconst only for test/e2e.
+
+formatters:
+  enable:
+    - gofumpt
+    - goimports
+

.goreleaser.yaml

@@ -11,12 +11,21 @@ before:
 
 report_sizes: true
 
+git:
+  # Skip the stale 'nightly' tag so {{.Version}} resolves to the latest semver tag for --snapshot builds.
+  ignore_tags:
+    - nightly
+snapshot:
+  # Semver-compliant nightly version, e.g. "0.19.0-nightly-abc1234" when the latest tag is v0.18.0.
+  version_template: "{{ incminor .Version }}-nightly-{{.ShortCommit}}"
+
 builds:
-  - id: uncloud
-    main: ./cmd/uncloud
-    binary: uncloud
+  - id: uc
+    main: ./cmd/uc
+    binary: uc
     env:
-      - CGO_ENABLED=0
+      # Use CGO to be able to build fsevent required by compose on macOS.
+      - CGO_ENABLED={{ if eq .Os "darwin" }}1{{ else }}0{{ end }}
     goos:
       - darwin
       - linux
@@ -24,6 +33,13 @@ builds:
     goarch:
       - amd64
       - arm64
+    ldflags:
+      - -s -w
+        -X github.com/psviderski/uncloud/internal/version.version={{.Version}}
+        -X github.com/psviderski/uncloud/internal/version.commit={{.Commit}}
+        -X github.com/psviderski/uncloud/internal/version.dirty={{.IsGitDirty}}
+        -X github.com/psviderski/uncloud/internal/version.date={{.CommitDate}}
+        -X github.com/psviderski/uncloud/internal/version.builtBy=goreleaser
 
   - id: uncloudd
     main: ./cmd/uncloudd
@@ -35,11 +51,18 @@ builds:
     goarch:
       - amd64
       - arm64
+    ldflags:
+      - -s -w
+        -X github.com/psviderski/uncloud/internal/version.version={{.Version}}
+        -X github.com/psviderski/uncloud/internal/version.commit={{.Commit}}
+        -X github.com/psviderski/uncloud/internal/version.dirty={{.IsGitDirty}}
+        -X github.com/psviderski/uncloud/internal/version.date={{.CommitDate}}
+        -X github.com/psviderski/uncloud/internal/version.builtBy=goreleaser
 
 archives:
-  - id: uncloud
+  - id: uc
     builds:
-      - uncloud
+      - uc
     formats:
       # gz is not compatible with homebrew releases, so we use tar.gz
       - tar.gz
@@ -80,10 +103,9 @@ brews:
     description: "Uncloud CLI"
     homepage: "https://uncloud.run"
     ids:
-      - uncloud
+      - uc
     install: |
-      bin.install "uncloud"
-      bin.install_symlink "uncloud" => "uc"
+      bin.install "uc"
     skip_upload: false
     repository:
       owner: psviderski

.mise.toml

@@ -1,5 +0,0 @@
-[tools]
-go = "1.23"
-
-[env]
-_.file = ".env"

.mise/tasks/dev/install

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+#MISE description="Build and install uncloud binaries on dev machines, restart daemon if running"
+#MISE depends=["build:uncloudd-amd64", "build:uncloudd-arm64"]
+#MISE raw=true
+#USAGE arg "<hosts>" var=#true var_min=1 help="Hosts in [user@]host[/arch] format, arch defaults to amd64"
+
+for arg in ${usage_hosts}; do
+  if [[ "$arg" == */* ]]; then
+    host="${arg%/*}"
+    arch="${arg##*/}"
+  else
+    host="$arg"
+    arch="amd64"
+  fi
+
+  binary="uncloudd-linux-${arch}"
+  echo "==> Installing uncloudd on ${host} (${arch})..."
+  scp "$binary" "${host}:/tmp/"
+  ssh "$host" "sudo install /tmp/${binary} /usr/local/bin/uncloudd && rm /tmp/${binary} && sudo systemctl try-restart uncloud"
+done
+
+rm -f uncloudd-linux-amd64 uncloudd-linux-arm64

.mise/tasks/dev/reset

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+#MISE description="Stop uncloud daemon and wipe state on dev machines"
+#USAGE arg "<hosts>" var=#true var_min=1 help="Hosts in [user@]host format"
+
+for host in ${usage_hosts}; do
+  # Strip optional /arch suffix since reset doesn't need it.
+  host="${host%/*}"
+  echo "==> Resetting ${host}..."
+  ssh "$host" "sudo systemctl stop uncloud && sudo rm -rf /var/lib/uncloud"
+done
+
+echo "==> Done"

.mockery.yml

@@ -0,0 +1,4 @@
+packages:
+  github.com/psviderski/uncloud/internal/machine/caddyconfig:
+    interfaces:
+      CaddyfileValidator:

AGENTS.md

@@ -0,0 +1,265 @@
+# AGENTS.md - Uncloud Project Guide
+
+This document provides comprehensive information about the Uncloud project for AI assistants to understand the codebase,
+architecture, and development practices.
+
+## Project Overview
+
+**Uncloud** is a lightweight clustering and container orchestration tool that enables deployment and management of web
+applications across cloud VMs and bare metal servers. It creates a secure WireGuard mesh network between Docker hosts
+and provides automatic service discovery, load balancing, HTTPS ingress, and simple CLI commands for application
+management.
+
+### Key Characteristics
+
+- **Language**: Go
+- **Architecture**: Decentralized, no control plane
+- **Target**: Self-hosted infrastructure without Kubernetes complexity
+- **License**: View LICENSE file for details
+- **Status**: Active development, not yet ready for production
+
+## Core Features
+
+### 🏗️ Infrastructure
+
+- **Multi-machine deployment**: Combine cloud VMs, dedicated servers, and bare metal
+- **Zero-config networking**: Automatic WireGuard mesh with NAT traversal
+- **Decentralized design**: No central control plane, all machines are equal
+- **Service discovery**: Built-in DNS server resolves service names to container IPs
+
+### 🚀 Application Management
+
+- **Docker Compose compatibility**: Uses familiar Docker Compose format
+- **Zero-downtime deployments**: Rolling updates without service interruption
+- **Automatic HTTPS**: Caddy reverse proxy with Let's Encrypt integration
+- **Managed DNS**: Free `*.xxxxxx.uncld.dev` subdomains via Uncloud DNS service
+- **Cross-machine scaling**: Run containers across multiple machines
+
+### 🔧 Developer Experience
+
+- **Docker-like CLI**: Familiar commands (`uc` binary)
+- **Imperative operations**: Direct commands vs. declarative state reconciliation
+- **Remote management**: Control entire infrastructure via SSH to any machine
+- **Minimal overhead**: ~150MB RAM footprint per machine
+
+## Architecture
+
+### Core Components
+
+1. **CLI (`uc`)** - Main user interface for cluster management
+2. **Daemon (`uncloudd`)** - Machine daemon running on each node
+3. **Corrosion** - Distributed SQLite database for cluster state (Fly.io project)
+4. **Caddy** - Reverse proxy for HTTPS termination and routing
+5. **WireGuard** - Secure mesh networking between machines
+
+### Network Architecture
+
+- Each machine gets unique subnet (e.g., `10.210.0.0/24`, `10.210.1.0/24`)
+- Containers get cluster-unique IPs for direct communication
+- Automatic peer discovery and key management
+- NAT traversal for machines behind firewalls
+
+### State Management
+
+- **CRDT-based distributed storage** using Corrosion
+- **Eventually consistent** state across all machines
+- **Gossip protocol** (Serf) for state propagation
+- **No quorum requirements** - partial network splits remain functional
+
+## Project Structure
+
+### Key Directories
+
+- **`cmd/`**: Contains main applications
+
+    - `uc/`: CLI tool with subcommands for machine, service, volume management
+    - `uncloudd/`: Daemon that runs on each machine
+    - `ucind/`: Development cluster management for testing
+
+- **`internal/`**: Internal implementation packages
+
+    - `cli/`: Command-line interface logic
+    - `machine/`: Machine lifecycle and state management
+    - `daemon/`: Daemon implementation and gRPC services
+    - `dns/`: Internal DNS server for service discovery
+
+- **`pkg/`**: Public API packages for external use
+
+    - `api/`: Core API types and definitions
+    - `client/`: Client libraries for interacting with Uncloud
+
+- **`experiment/`**: Experimental features and prototypes
+- **`scripts/`**: Installation and utility scripts
+- **`test/`**: Test suites and test infrastructure
+- **`website/`**: Documentation website (Docusaurus)
+
+    - `landing/`: Landing page
+    - `docs/`: User documentation
+
+- **`misc/`**: Design documents and guides
+
+## Key Technologies
+
+### Core Dependencies
+
+```go
+// Networking and orchestration
+github.com/docker/docker // Docker API client
+github.com/docker/compose/v2 // Docker Compose integration
+golang.zx2c4.com/wireguard // WireGuard implementation
+github.com/hashicorp/serf // Gossip protocol
+
+// State management
+github.com/ipfs/go-ds-crdt // CRDT distributed storage
+github.com/dgraph-io/badger/v3 // Embedded database
+
+// Web proxy
+github.com/caddyserver/caddy/v2 // HTTP server and reverse proxy
+
+// CLI and UX
+github.com/spf13/cobra // CLI framework
+github.com/charmbracelet/huh // Interactive forms
+
+// gRPC and networking
+google.golang.org/grpc                     // gRPC framework
+github.com/siderolabs/grpc-proxy // gRPC proxy for forwarding
+```
+
+## Development Workflow
+
+### Build and Development
+
+```bash
+# Build binaries
+go build -o uc ./cmd/uc
+go build -o uncloudd ./cmd/uncloudd
+```
+
+### Key Make Targets
+
+- `proto`: Generate protobuf code
+- `ucind-cluster`: Create development cluster
+- `update-dev`: Deploy to development machines
+- `demo-reset`: Reset demo environment
+- `fmt`: Format code
+- `test`: Run all tests
+- `lint`: Lint the code using golangci-lint
+- `lint-and-fix`: Lint the code and fix issues whenever possible
+
+## CLI Commands Structure
+
+The `uc` CLI provides these main command groups:
+
+### Machine Management
+
+```bash
+uc machine init <user@host>     # Initialize new cluster
+uc machine add <user@host>      # Add machine to cluster
+uc machine ls                   # List machines
+uc machine rm <name>            # Remove machine
+```
+
+### Service Management
+
+```bash
+uc run <image>                  # Run container from image
+uc deploy                       # Deploy from compose.yaml
+uc scale <service> <count>      # Scale service replicas
+uc ls                           # List services
+uc rm <service>                 # Remove service
+```
+
+### Context and Connectivity
+
+```bash
+uc context ls                   # List available contexts
+uc context use <name>           # Switch context
+```
+
+### Global Flags
+
+- `--connect`: Connect to remote machine directly, without a config file
+- `--uncloud-config`: Override config file path
+
+## Development Guidelines
+
+### Code Organization
+
+- **Package naming**: Use clear, descriptive names
+- **Error handling**: Wrap errors with context using `fmt.Errorf`
+- **Logging**: Use structured logging with levels
+- **gRPC**: Services defined in `api/pb/`
+
+### Testing
+
+- Test files and locations
+    - Unit tests alongside source files (`*_test.go`)
+    - Integration tests in `test/e2e/`
+    - Test fixtures in `test/fixtures/`
+- Use the `testify` library for assertions (e.g., `require.Equal`, `assert.Nil`)
+
+### Dependencies
+
+- Prefer standard library when possible
+- Pin versions in `go.mod`
+- Document rationale for external dependencies
+
+### Configuration
+
+- Support environment variables for key settings
+- Validate configuration early
+- Provide sensible defaults
+
+## Troubleshooting and Debugging
+
+### Common Issues
+
+- **Networking**: Check WireGuard status, iptables rules
+- **DNS**: Verify service discovery resolution
+- **Containers**: Use standard Docker debugging tools
+- **State sync**: Check Corrosion logs for replication issues
+
+### Debugging Tools
+
+- Standard Linux networking tools (`ping`, `traceroute`, `wireshark`)
+- Docker commands (`docker ps`, `docker logs`)
+- SSH access to machines for direct inspection
+- gRPC debugging tools
+
+### Logs and Monitoring
+
+- Systemd services (getting logs via `journalctl -u SERVICE_NAME`)
+    - `uncloud` -- Uncloud daemon
+    - `uncloud-corrosion` -- Corrosion process
+- Machine daemon logs
+- Container logs via Docker
+
+## File Patterns and Conventions
+
+### Important Files to Understand
+
+- `cmd/uc/main.go`: CLI entry point and command structure
+- `internal/cli/cli.go`: CLI implementation and configuration
+- `internal/machine/machine.go`: Core machine management
+- `pkg/api/`: Public API definitions
+- `misc/design.md`: Architecture and design philosophy
+- `README.md`: Repository README
+
+### Configuration Files
+
+- `go.mod/go.sum`: Go dependency management
+- `Makefile`: Build and development tasks
+- `Dockerfile`: Container build instructions forUncloud-in-Docker (used for testing)
+
+This document should help AI assistants understand the project structure, make informed suggestions, and contribute
+effectively to the Uncloud codebase.
+
+## Documentation
+
+Instructions when generating documentation:
+
+- Use conversational language – write as if you were speaking to a friend.
+- Keep sentences simple, optimize for clarity and understanding.
+- Do not use em dashes (—) or semicolons (;) in sentences. Instead, break complex sentences into simpler ones.
+- Place the subject before the action whenever possible. Example: prefer "The function loads data" over "Data is loaded
+  by the function."

CLAUDE.md

@@ -0,0 +1 @@
+./AGENTS.md

Dockerfile

@@ -1,6 +1,6 @@
-ARG ALPINE_VERSION=3.20.3
+ARG ALPINE_VERSION=3.23.3
 
-FROM golang:1.23.2-alpine AS uncloudd
+FROM golang:1.26.1-alpine AS uncloudd
 
 ARG TARGETOS
 ARG TARGETARCH
@@ -13,30 +13,44 @@ COPY go.mod go.sum ./
 RUN go mod download && go mod verify
 
 COPY . .
-RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd cmd/uncloudd/main.go
+RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o uncloudd ./cmd/uncloudd
 
 
 FROM alpine:${ALPINE_VERSION} AS corrosion-download
-RUN wget -q -O /tmp/corrosion.tar.gz \
-      https://github.com/psviderski/corrosion/releases/latest/download/corrosion-aarch64-unknown-linux-gnu.tar.gz \
+ARG TARGETARCH
+ARG CORROSION_VERSION
+
+RUN CORROSION_ARCH=$(case "${TARGETARCH}" in \
+      "amd64") echo "x86_64" ;; \
+      "arm64") echo "aarch64" ;; \
+      *) echo "Architecture '${TARGETARCH}' not supported" >&2 && exit 1 ;; \
+    esac) \
+    && wget -q -O /tmp/corrosion.tar.gz \
+      "https://github.com/psviderski/corrosion/releases/download/v${CORROSION_VERSION}/corrosion-${CORROSION_ARCH}-unknown-linux-gnu.tar.gz" \
     && tar -xzf /tmp/corrosion.tar.gz -C /tmp \
-    && install /tmp/corrosion /usr/local/bin/corrosion \
+    && install /tmp/corrosion /usr/bin/corrosion \
     && rm /tmp/corrosion.tar.gz /tmp/corrosion
 
-FROM chainguard/wolfi-base:latest AS corrosion
-COPY --from=corrosion-download /usr/local/bin/corrosion /usr/local/bin/corrosion
+# Beware that more modern images like chainguard/wolfi-base build glibc with flags that require newer CPU features,
+# e.g. x86-64-v2. So such image may fail with "Fatal glibc error: CPU does not support x86-64-v2" on older CPUs.
+FROM gcr.io/distroless/cc-debian13:latest AS corrosion
+COPY --from=corrosion-download /usr/bin/corrosion /usr/bin/corrosion
 CMD ["corrosion", "agent"]
 
 
 FROM alpine:${ALPINE_VERSION} AS corrosion-image-tarball
-ARG CORROSION_IMAGE="ghcr.io/psviderski/corrosion:latest"
+ARG CORROSION_VERSION
+ARG CORROSION_IMAGE="ghcr.io/unlabs-dev/corrosion:${CORROSION_VERSION}"
+ARG TARGETOS
+ARG TARGETARCH
 
 RUN apk --no-cache add crane
-RUN crane pull "${CORROSION_IMAGE}" /corrosion.tar
-
+RUN crane pull --platform ${TARGETOS}/${TARGETARCH} "${CORROSION_IMAGE}" /corrosion.tar
 
 # Uncloud-in-Docker (ucind) image for running Uncloud test clusters using Docker.
-FROM docker:27.3.1-dind AS ucind
+FROM docker:29.4.0-dind AS ucind
+ARG CORROSION_VERSION
+
 # Create system group and user 'uncloud'.
 RUN addgroup -S uncloud && adduser -SHD -h /nonexistent -G uncloud -g "" uncloud
 RUN apk --no-cache add \
@@ -44,7 +58,7 @@ RUN apk --no-cache add \
     wireguard-tools
 
 COPY --from=corrosion-image-tarball /corrosion.tar /images/corrosion.tar
-COPY scripts/docker/dind scripts/docker/entrypoint.sh /usr/local/bin/
+COPY scripts/docker/entrypoint.sh /usr/local/bin/
 COPY --from=uncloudd /build/uncloudd /usr/local/bin/
 
 ENTRYPOINT ["entrypoint.sh"]

HACKING.md

@@ -0,0 +1,155 @@
+# Developing Uncloud
+
+A short guide on setting up your local development environment.
+
+## Prerequisites
+
+- [mise](https://mise.jdx.dev/) (development environment setup tool)
+- [Docker](https://docs.docker.com/get-docker/) with BuildKit (for running end-to-end tests). Make sure the
+  [`docker buildx`](https://docs.docker.com/build/concepts/overview/) plugin is installed.
+
+## Setup
+
+Uncloud uses `mise` to install and manage development tools and dependencies. It makes it easy to create reproducible
+development environments on developer machines and CI.
+
+Follow the [Installing Mise](https://mise.jdx.dev/installing-mise.html) guide to get it set up on your machine.
+
+Mark the project as trusted and install all required tools (Go, `protoc`, `golangci-lint`, etc.) by running from the
+project root:
+
+```shell
+mise trust
+mise install
+```
+
+This reads [`mise.toml`](mise.toml) and installs the exact versions of tools specified there. They will be available in
+your `PATH` when you are in the project directory, so you can run `go` or `golangci-lint` directly. The tools won't be
+available outside the project, so they don't interfere with system packages.
+
+## Building
+
+Build the CLI:
+
+```shell
+go build -o uc ./cmd/uc
+```
+
+Or build and run the CLI with a single command:
+
+```shell
+go run ./cmd/uc --help
+```
+
+The Uncloud daemon (`uncloudd`) only supports Linux, so you need to cross-compile it if you're developing on macOS or
+Windows:
+
+```shell
+GOOS=linux GOARCH=amd64 go build -o uncloudd ./cmd/uncloudd
+```
+
+## Testing
+
+Run all tests (unit and e2e):
+
+```shell
+make test
+```
+
+### End-to-end tests
+
+E2e tests run inside Docker using the [Uncloud-in-Docker](#uncloud-in-docker-ucind) image. Build it first:
+
+```shell
+mise ucind:image
+```
+
+⚠️ NOTE: You need to rebuild the `ucind` image every time you make changes to the daemon code if you want to test them
+in e2e tests.
+
+Then run the tests:
+
+```shell
+make test-e2e
+```
+
+If tests leave leftover containers, clean them up with:
+
+```shell
+make test-clean
+```
+
+### Manual testing on dev machines
+
+After making changes to the daemon code, you may want to test them in your dev cluster. Build and install `uncloudd` on
+one or multiple dev machines over SSH with:
+
+```shell
+mise run dev:install user@host1 user@host2/arm64
+```
+
+It will also restart the `uncloud.service` daemon on those machines to pick up the new version. The host format is
+`[user@]host[/arch]`. The architecture of a machine defaults to `amd64` if not specified.
+
+To stop the daemon and wipe all Uncloud data on the dev machines, run:
+
+```shell
+mise run dev:reset user@host1 user@host2
+```
+
+## Linting and formatting
+
+Lint and format the code:
+
+```shell
+make lint-and-fix
+```
+
+## Code generation
+
+Update the generated Go code for the gRPC API after modifying files in [`api/pb`](./api/pb):
+
+```shell
+mise run proto
+```
+
+Regenerate mocks:
+
+```shell
+make mocks
+```
+
+## Uncloud in Docker (UCinD)
+
+The [`ucind`](./cmd/ucind) CLI lets you run Uncloud clusters locally using Docker containers instead of real machines.
+Each cluster machine runs as a Docker container connected to a shared Docker network.
+
+Cluster machines use the `ghcr.io/psviderski/ucind:latest` Docker image by default. It may not always have the latest
+changes to the `uncloudd` daemon code as it's not automatically rebuilt on CI yet.
+
+You can rebuild it locally to pick up the latest changes, including your work in progress, and test them in a UCinD
+cluster:
+
+```shell
+mise ucind:image
+```
+
+Create a cluster with 3 machines:
+
+```shell
+mise ucind cluster create -m 3
+```
+
+This also sets the new cluster as the active context, so you can interact with it using the `uc` CLI right away.
+
+Remove the cluster when you're done:
+
+```shell
+mise ucind cluster rm
+```
+
+Sometimes crashed tests or interrupted runs can leave orphaned containers and networks behind. Clean them all up with:
+
+```shell
+mise ucind:cleanup
+```

Makefile

@@ -1,52 +1,75 @@
-CORROSION_IMAGE ?= ghcr.io/psviderski/corrosion:latest
+# TODO: Makefile is deprecated, add new targets as mise tasks in mise.toml instead.
+
+CORROSION_VERSION ?= 2026.6.15
+CORROSION_IMAGE = ghcr.io/unlabs-dev/corrosion:$(CORROSION_VERSION)
 UCIND_IMAGE ?= ghcr.io/psviderski/ucind:latest
 
-update-dev:
-	GOOS=linux GOARCH=amd64 go build -o uncloudd-linux-amd64 ./cmd/uncloudd && \
-		scp uncloudd-linux-amd64 spy@192.168.40.243:~/ && \
-		ssh spy@192.168.40.243 sudo install ./uncloudd-linux-amd64 /usr/local/bin/uncloudd
-		scp uncloudd-linux-amd64 spy@192.168.40.176:~/ && \
-		ssh spy@192.168.40.176 sudo install ./uncloudd-linux-amd64 /usr/local/bin/uncloudd && \
-		rm uncloudd-linux-amd64
-#	GOOS=linux GOARCH=arm64 go build -o uncloudd-linux-arm64 ./cmd/uncloudd && \
-#		scp uncloudd-linux-arm64 ubuntu@152.67.101.197:~/ && \
-#		ssh ubuntu@152.67.101.197 sudo install ./uncloudd-linux-arm64 /usr/local/bin/uncloudd && \
-#		rm uncloudd-linux-arm64
-
-update-restart-dev:
-	GOOS=linux GOARCH=amd64 go build -o uncloudd-linux-amd64 ./cmd/uncloudd && \
-		scp uncloudd-linux-amd64 spy@192.168.40.243:~/ && \
-		ssh spy@192.168.40.243 "sudo install ./uncloudd-linux-amd64 /usr/local/bin/uncloudd && sudo systemctl restart uncloud" && \
-		scp uncloudd-linux-amd64 spy@192.168.40.176:~/ && \
-		ssh spy@192.168.40.176 "sudo install ./uncloudd-linux-amd64 /usr/local/bin/uncloudd && sudo systemctl restart uncloud" && \
-		rm uncloudd-linux-amd64
-#	GOOS=linux GOARCH=arm64 go build -o uncloudd-linux-arm64 ./cmd/uncloudd && \
-#		scp uncloudd-linux-arm64 ubuntu@152.67.101.197:~/ && \
-#		ssh ubuntu@152.67.101.197 "sudo install ./uncloudd-linux-arm64 /usr/local/bin/uncloudd && sudo systemctl restart uncloud" && \
-#		rm uncloudd-linux-arm64
-
-reset-dev:
-	ssh spy@192.168.40.243 "sudo systemctl stop uncloud && sudo rm -rf /var/lib/uncloud"
-	ssh spy@192.168.40.176 "sudo systemctl stop uncloud && sudo rm -rf /var/lib/uncloud"
-	ssh ubuntu@152.67.101.197 "sudo systemctl stop uncloud && sudo rm -rf /var/lib/uncloud"
-
-.PHONY: proto
-proto:
-	protoc --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative \
-		--proto_path=. --proto_path=internal/machine/api/vendor internal/machine/api/pb/*.proto
+.PHONY: ucind-cluster
+ucind-cluster:
+	go run ./cmd/ucind cluster rm && go run ./cmd/ucind cluster create -m $(if $(MACHINES_COUNT),$(MACHINES_COUNT),3)
 
 .PHONY: corrosion-image
 corrosion-image:
-	docker build -t "$(CORROSION_IMAGE)" --target corrosion .
+	docker build --build-arg CORROSION_VERSION=$(CORROSION_VERSION) -t "$(CORROSION_IMAGE)" --target corrosion .
 
-.PHONY: corrosion-image-push
-corrosion-image-push: corrosion-image
-	docker push "$(CORROSION_IMAGE)"
+.PHONY: corrosion-multiarch-image-push
+corrosion-multiarch-image-push:
+	docker buildx build --build-arg CORROSION_VERSION=$(CORROSION_VERSION) --push --platform linux/amd64,linux/arm64 \
+		-t "$(CORROSION_IMAGE)" --target corrosion .
 
-.PHONY: ucind-image
-ucind-image:
-	docker build -t "$(UCIND_IMAGE)" --target ucind .
+.PHONY: ucind-multiarch-image-push
+ucind-multiarch-image-push:
+	docker buildx build --push --platform linux/amd64,linux/arm64 -t "$(UCIND_IMAGE)" --target ucind .
 
-.PHONY: ucind-image-push
-ucind-image-push: ucind-image
-	docker push "$(UCIND_IMAGE)"
+.PHONY: mocks
+mocks:
+	@mockery
+
+.PHONY: test
+test:
+ifeq ($(TEST_NAME),)
+	go test -shuffle=on -count=1 -v ./...
+else
+	go test -shuffle=on -race -count=1 -v -run ^$(TEST_NAME)$$ ./...
+endif
+
+.PHONY: test-e2e
+test-e2e:
+	go test -shuffle=on -race -count=1 -v ./test/e2e
+
+.PHONY: test-clean
+test-clean:
+	@CONTAINERS=$$(docker ps --filter "label=ucind.managed" -q); \
+	if [ -n "$$CONTAINERS" ]; then \
+		echo "Killing containers..."; \
+		docker kill $$CONTAINERS; \
+	fi; \
+	CONTAINERS_STOPPED=$$(docker ps -a --filter "label=ucind.managed" -q); \
+	if [ -n "$$CONTAINERS_STOPPED" ]; then \
+		echo "Removing stopped containers..."; \
+		docker rm $$CONTAINERS_STOPPED; \
+	else \
+		echo "Nothing to clean."; \
+	fi
+
+.PHONY: vet
+vet:
+	go vet ./...
+
+.PHONY: format fmt
+format fmt:
+	GOOS=linux golangci-lint fmt
+
+LINT_TARGETS := lint lint-and-fix
+.PHONY: $(LINT_TARGETS) _lint
+$(LINT_TARGETS): _lint
+lint: ARGS=
+lint-and-fix: ARGS=--fix
+_lint:
+# Explicitly set OS to Linux to not skip *_linux.go files when running on macOS.
+# Uncloud daemon won't likely support OS other than Linux anytime soon, so for now we can rely on that.
+	GOOS=linux golangci-lint run $(ARGS)
+
+.PHONY: cli-docs
+cli-docs:
+	go run ./cmd/uc docs

README.md

@@ -1,48 +1,76 @@
 <div align="center">
-  <img src="./website/images/logo.svg" height="100" alt="Uncloud logo"/>
-  <h1>Uncloud</h1>
-  <p><strong>Docker simplicity. Multi-machine power.</strong></p>
+  <img src="./website/landing/images/logo-title.svg#gh-light-mode-only" alt="Uncloud logo"/>
+  <img src="./website/landing/images/logo-title-dark.svg#gh-dark-mode-only" alt="Uncloud logo"/>
+  <p><strong>▸ Deploy and scale containerised apps across servers without Swarm or Kubernetes overhead ◂</strong></p>
+
+  <p>
+    <a href="https://uncloud.run/docs"><img src="https://img.shields.io/badge/Docs-blue.svg?style=for-the-badge&logo=gitbook&logoColor=white" alt="Documentation"></a>
+    <a href="https://discord.gg/eR35KQJhPu"><img src="https://img.shields.io/badge/discord-5865F2.svg?style=for-the-badge&logo=discord&logoColor=white" alt="Join Discord"></a>
+    <a href="https://x.com/psviderski"><img src="https://img.shields.io/badge/follow-black?style=for-the-badge&logo=X&logoColor=while" alt="Follow on X"></a>
+    <a href="https://github.com/sponsors/psviderski"><img src="https://img.shields.io/badge/Donate-EA4AAA.svg?style=for-the-badge&logo=githubsponsors&logoColor=white" alt="Donate"></a>
+  </p>
 </div>
 
 Uncloud is a lightweight clustering and container orchestration tool that lets you deploy and manage web apps across
-cloud VMs and bare metal with minimized cluster management overhead. It creates a secure WireGuard mesh network between
+cloud VMs and bare metal with minimised cluster management overhead. It creates a secure WireGuard mesh network between
 your Docker hosts and provides automatic service discovery, load balancing, ingress with HTTPS, and simple CLI commands
 to manage your apps.
 
 Unlike traditional orchestrators, there's no central control plane and quorum to maintain. Each machine maintains a
-synchronized copy of the cluster state through peer-to-peer communication, keeping cluster operations functional even if
+synchronised copy of the cluster state through peer-to-peer communication, keeping cluster operations functional even if
 some machines go offline.
 
-Uncloud aims to be the solution for developers who want the flexibility of self-hosted infrastructure without the
-operational complexity of Kubernetes.
+Uncloud is the solution for developers who want the flexibility of self-hosted infrastructure without the operational
+complexity of Kubernetes.
 
 ## ✨ Features
 
-* **Deploy anywhere**: Combine cloud VMs, dedicated servers, and bare metal into a unified computing environment —
+* **Deploy anywhere**: Combine cloud VMs, dedicated servers, and bare metal into a unified computing environment,
   regardless of location or provider.
+* **Docker Compose**: Familiar [Docker Compose](https://compose-spec.io/) format for defining services and volumes. No
+  need to learn a new bespoke DSL.
+* **Zero-downtime deployments**: Rolling updates without service interruption. Automatic rollback on failure is coming
+  soon.
+* **[Unregistry](https://github.com/psviderski/unregistry) integration**: Build and push your Docker images directly to
+  your machines without an external registry. It will transfer only the missing layers, making it fast and efficient.
+* **Service discovery**: Built-in DNS server resolves service names to container IPs.
+* **Persistent storage**: Run stateful services with Docker volumes managed across machines.
 * **Zero-config private network**: Automatic WireGuard mesh with peer discovery and NAT traversal. Containers get unique
   IPs for direct cross-machine communication.
-* **No control plane**: Fully decentralized design eliminates single points of failure and reduces operational overhead.
+* **No control plane**: Fully decentralised design eliminates single points of failure and reduces operational overhead.
 * **Imperative over declarative**: Favoring imperative operations over state reconciliation simplifies both the mental
   model and troubleshooting.
-* **Service discovery**: Built-in DNS server resolves service names to container IPs.
+* **Managed DNS**: Automatic DNS records `*.xxxxxx.uncld.dev` for services with public access via managed
+  [Uncloud DNS](https://github.com/psviderski/uncloud-dns) service.
 * **Automatic HTTPS**: Built-in Caddy reverse proxy handles TLS certificate provisioning and renewal using Let's
   Encrypt.
+* **Cluster storage for TLS certificates**: Native cluster storage for Caddy shares certificates and ACME challenge
+  tokens across machines and coordinates issuance.
 * **Docker-like CLI**: Familiar commands for managing both infrastructure and applications.
 * **Remote management**: Control your entire infrastructure through SSH access to any single machine in the cluster.
 
-Coming soon:
+## 🎬 Quick demo
 
-* Project isolation through environments/namespaces
-* Infrastructure as Code using Docker Compose format
-* Persistent volumes and secrets management
-* Monitoring and log aggregation
-* Database deployment and management
-* Curated application catalog
+The screenshot below demonstrates how we use Uncloud to deploy https://uncloud.run website to 2 remote machines from
+the [`compose.yaml`](website/compose.yaml) file on the local machine.
 
-Here is a diagram of an Uncloud multi-provider cluster of 3 machines:
+It exposes the container port `8000/tcp` as HTTPS on `uncloud.run` domain, served by the Caddy reverse proxy on the
+remote machines. All managed by Uncloud.
 
-![Diagram: multi-provider cluster of 3 machines](website/images/diagram.webp)
+![Uncloud compose deployment demo](.github/images/website-deploy.jpg)
+
+Here is a more advanced use case. Deploy a highly available web app with automatic HTTPS across multiple regions and
+on-premises in just a couple minutes.
+
+<a href="https://uncloud.wistia.com/medias/k47uwt9uau?wvideo=k47uwt9uau">
+<img src="https://embed-ssl.wistia.com/deliveries/4fb71ea442905b81b1ad4e25fc02132e.jpg?image_crop_resized=900x526&image_play_button_rounded=true&image_play_button_size=2x&image_play_button_color=18181Be0" alt="Uncloud demo" width="450" height="263" />
+</a>
+
+<br>
+<br>
+
+> **📚 Want more examples?** Check out the [**uncloud-recipes**](https://github.com/psviderski/uncloud-recipes)
+> repository for community recipes and templates for deploying popular services on Uncloud.
 
 ## 💫 Why Uncloud?
 
@@ -52,76 +80,163 @@ believe there's a sweet spot in between — a pragmatic solution for the majorit
 scale. You should be able to:
 
 * **Own your infrastructure and data**: Whether driven by costs, compliance, or flexibility, run applications on any
-  combination of cloud VMs and personal hardware while maintaining the cloud-like experience you love.
-* **Stay simple**: Don't worry about control planes, highly-available clusters, or complex YAML configurations for
-  common use cases.
+  combination of cloud VMs and personal hardware while controlling your data and maintaining the cloud-like experience
+  you love.
+* **Stay simple as you grow**: Start with a single machine and add more whenever you need without changing your
+  workflow. No worrying about highly-available control planes or complex YAML configurations.
 * **Build with proven primitives**: Get production-grade networking, deployment primitives, service discovery, load
   balancing, and ingress with HTTPS out of the box without becoming a distributed systems expert.
-* **Support sustainable computing** 🌿: Minimize system overhead to maximize resources available for your applications.
+* **Support sustainable computing** 🌿: Minimise system overhead to maximise resources available for your applications.
 
-Uncloud's goal is to make deployment and management of containerized applications feel as seamless as using a cloud
+Uncloud's goal is to make deployment and management of containerised applications feel as seamless as using a cloud
 platform, whether you're running on a $5 VPS, a spare Mac mini, or a rack of bare metal servers.
 
 ## 🚀 Quick start
 
 1. Install Uncloud CLI:
 
-```bash
-brew install psviderski/tap/uncloud
+   ```bash
+   brew install psviderski/tap/uncloud
 
-# or using curl (macOS/Linux)
-curl -fsS https://get.uncloud.run/install.sh | sh
-```
+   # or using curl (macOS/Linux)
+   curl -fsS https://get.uncloud.run/install.sh | sh
+   ```
 
-2. Initialize your first machine:
+   See [Installation](https://uncloud.run/docs/getting-started/install-cli) for more options.
 
-```bash
-uc machine init root@your-server-ip
-```
+   There's also a [nightly rolling release](https://github.com/psviderski/uncloud/releases/tag/nightly) available if you
+   want to try the latest features and fixes before they're included in an official release.
 
-3. Create a DNS A record in your DNS provider (Cloudflare, Namecheap, etc.) that points `app.example.com` to your
+2. Initialise your first machine:
+
+   ```bash
+   uc machine init root@your-server-ip
+   ```
+
+3. Deploy your app from a Docker image and publish its container port 8000 as HTTPS using `app.example.com` domain:
+
+   ```bash
+   uc run -p app.example.com:8000/https image/my-app
+   ```
+
+4. Create a DNS A record in your DNS provider (Cloudflare, Namecheap, etc.) that points `app.example.com` to your
    server's IP address. Allow a few minutes for DNS propagation.
-4. Deploy your app from a Docker image:
 
-```bash
-uc run -p app.example.com:8000/https my-app-image
-```
-
-That's it! Your app is now running and accessible at https://app.example.com ✨
+   That's it! Your app is now running and accessible at https://app.example.com ✨
 
 5. Clean up when you're done:
 
-```bash
-uc ls
-# Copy the service ID from the output and remove it:
-uc rm my-app-id
-```
+   ```bash
+   uc ls
+   # Copy the service name from the output and run the rm command:
+   uc rm my-app-name
+   ```
+
+   If you want to fully uninstall Uncloud on a machine, run:
+
+   ```bash
+   uncloud-uninstall
+   ```
+
+View the [Documentation](https://uncloud.run/docs) for more information.
 
 ## ⚙️ How it works
 
-Check out the [design document](docs/design.md) to understand Uncloud's design philosophy and goals. Here, let's peek
-under the hood to see what happens when you run certain commands.
+Check out the [design document](misc/design.md) to understand Uncloud's design philosophy and goals.
 
-**When you initialize a new cluster on a machine:**
+Here is a diagram of an Uncloud multi-provider cluster of 3 machines:
+
+![Diagram: multi-provider cluster of 3 machines](website/landing/images/diagram.webp)
+
+<details>
+<summary>Peek under the hood to see what happens when you run certain commands.</summary>
+
+**When you initialise a new cluster on a machine:**
 
 ```bash
-uc machine init root@your-server-ip
+$ uc machine init --name oracle-vm ubuntu@152.67.101.197
+
+⏳ Running Uncloud install script...
+✓ Docker is already installed.
+⏳ Installing Docker...
+...
+✓ Docker installed successfully.
+✓ Linux user and group 'uncloud' created.
+✓ Linux user 'ubuntu' added to group 'uncloud'.
+⏳ Installing Uncloud binaries...
+⏳ Downloading uncloudd binary: https://github.com/psviderski/uncloud/releases/latest/download/uncloudd_linux_arm64.tar.gz
+✓ uncloudd binary installed: /usr/local/bin/uncloudd
+⏳ Downloading uninstall script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/uninstall.sh
+✓ uncloud-uninstall script installed: /usr/local/bin/uncloud-uninstall
+✓ Systemd unit file created: /etc/systemd/system/uncloud.socket
+✓ Systemd unit file created: /etc/systemd/system/uncloud.service
+Created symlink /etc/systemd/system/sockets.target.wants/uncloud.socket → /etc/systemd/system/uncloud.socket.
+Created symlink /etc/systemd/system/multi-user.target.wants/uncloud.service → /etc/systemd/system/uncloud.service.
+⏳ Starting Uncloud machine daemon (uncloud.service)...
+✓ Uncloud machine daemon started.
+✓ Uncloud installed on the machine successfully! 🎉
+Cluster "default" initialised with machine "oracle-vm"
+Waiting for the machine to be ready...
+
+Reserved cluster domain: xuw3xd.cluster.uncloud.run
+[+] Deploying service caddy 1/1
+ ✔ Container caddy-c47x on oracle-vm  Started                                                                                                                                          0.9s
+
+Updating cluster domain records in Uncloud DNS to point to machines running caddy service...
+[+] Verifying internet access to caddy service 1/1
+ ✔ Machine oracle-vm (152.67.101.197)  Reachable                                                                                                                                       0.1s
+
+DNS records updated to use only the internet-reachable machines running caddy service:
+  *.xuw3xd.cluster.uncloud.run  A → 152.67.101.197
 ```
 
-1. The CLI SSHs into the machine and installs Docker, the `uncloudd` machine daemon and
-   [corrosion](https://github.com/superfly/corrosion) service, managed by systemd.
+1. The CLI SSHs into the machine and installs Docker and the `uncloudd` machine daemon, managed by systemd.
 2. Generates a unique WireGuard key pair, allocates a dedicated subnet `10.210.0.0/24` for the machine and its
    containers, and configures `uncloudd` accordingly. All subsequent communication happens with `uncloudd`
    through its gRPC API over SSH.
-3. Configures and starts `corrosion`, a CRDT-based distributed SQLite database to share cluster state between machines.
+3. Configures and starts [corrosion](https://github.com/superfly/corrosion), a CRDT-based distributed SQLite database to
+   share cluster state between machines, as a Docker container managed by `uncloudd`.
 4. Creates a Docker bridge network connected to the WireGuard interface.
-5. This machine becomes an entry point for the newly created cluster which is stored in the cluster config under
-   `~/.config/uncloud` on your local machine.
+5. This machine becomes an entry point for the newly created cluster. Its address is stored as a connection info in the
+   cluster config at `~/.config/uncloud/config.yaml` on your local machine.
 
 **When you add another machine:**
 
 ```bash
-uc machine add ubuntu@second-server-ip
+$ uc machine add --name hetzner-server root@5.223.45.199
+⏳ Running Uncloud install script...
+✓ Docker is already installed.
+✓ Linux user and group 'uncloud' created.
+⏳ Installing Uncloud binaries...
+⏳ Downloading uncloudd binary: https://github.com/psviderski/uncloud/releases/latest/download/uncloudd_linux_amd64.tar.gz
+✓ uncloudd binary installed: /usr/local/bin/uncloudd
+⏳ Downloading uninstall script: https://raw.githubusercontent.com/psviderski/uncloud/refs/heads/main/scripts/uninstall.sh
+✓ uncloud-uninstall script installed: /usr/local/bin/uncloud-uninstall
+✓ Systemd unit file created: /etc/systemd/system/uncloud.socket
+✓ Systemd unit file created: /etc/systemd/system/uncloud.service
+Created symlink /etc/systemd/system/sockets.target.wants/uncloud.socket → /etc/systemd/system/uncloud.socket.
+Created symlink /etc/systemd/system/multi-user.target.wants/uncloud.service → /etc/systemd/system/uncloud.service.
+⏳ Starting Uncloud machine daemon (uncloud.service)...
+✓ Uncloud machine daemon started.
+✓ Uncloud installed on the machine successfully! 🎉
+Machine "hetzner-server" added to cluster
+Waiting for the machine to be ready...
+
+[+] Deploying service caddy 1/1
+ ✔ Container caddy-d36c on hetzner-server  Started                                                                                                                                     1.0s
+
+Updating cluster domain records in Uncloud DNS to point to machines running caddy service...
+[+] Verifying internet access to caddy service 2/2
+ ✔ Machine hetzner-server (5.223.45.199)  Reachable                                                                                                                                    0.2s
+ ✔ Machine oracle-vm (152.67.101.197)     Reachable                                                                                                                                    0.1s
+
+DNS records updated to use only the internet-reachable machines running caddy service:
+  *.xuw3xd.cluster.uncloud.run  A → 152.67.101.197, 5.223.45.199
+
+$ uc machine ls
+NAME             STATE   ADDRESS         PUBLIC IP        WIREGUARD ENDPOINTS
+oracle-vm        Up      10.210.0.1/24   152.67.101.197   10.0.0.95:51820, 152.67.101.197:51820
+hetzner-server   Up      10.210.1.1/24   5.223.45.199     5.223.45.199:51820, [2a01:4ff:2f0:128b::1]:51820
 ```
 
 1. The second machine gets provisioned just like the first. A non-root SSH user will need `sudo` access.
@@ -129,9 +244,10 @@ uc machine add ubuntu@second-server-ip
 3. Registers the second machine in the cluster state and exchanges WireGuard keys with the first machine.
 4. Both machines establish a WireGuard tunnel between each other, allowing Docker containers connected to the bridge
    network to communicate directly across machines.
-5. Configures and starts `corrosion` on the second machine to sync the cluster state.
+5. Configures and starts the `uncloud-corrosion` container on the second machine to sync the cluster state.
 6. The second machine is added as an alternative entry point in the cluster config.
-7. If one of the machines goes offline, the other machine can still serve cluster operations.
+7. If one of the machines goes offline, the other machine can still be used by `uc` to connect and run cluster
+   operations.
 
 If one more machine is added, the process repeats with a new subnet. The new machine needs to establish a WireGuard
 connection with only one of the existing machines. Other machines will learn about it through the shared cluster state
@@ -140,7 +256,14 @@ and automatically establish a WireGuard tunnel with it.
 **When you run a service:**
 
 ```bash
-uc run -p app.example.com:8000/https my-app-image
+$ uc run -p app.example.com:8000/https image/my-app
+
+[+] Running service my-app-1b3b (replicated mode) 1/1
+ ✔ Container my-app-1b3b-tcex on oracle-vm  Started
+
+my-app-1b3b endpoints:
+ • https://app.example.com → :8000
+ • https://my-app-1b3b.xuw3xd.cluster.uncloud.run → :8000
 ```
 
 1. CLI picks a machine to run your container.
@@ -158,27 +281,83 @@ Look ma, no control plane or master nodes to maintain! Just a simple overlay net
 sync that lets machines work together. Want to check on things or make changes? Connect to any machine either implicitly
 using the CLI or directly over SSH. They all have the complete cluster state and can control everything. It's like each
 machine is a full backup of your control plane.
+</details>
+
+## 🧪 Interactive tutorials
+
+To give you a chance to play with Uncloud without even leaving your browser, we're providing interactive tutorials and
+playgrounds on the [iximiuz Labs](https://labs.iximiuz.com/) platform.
+
+Available tutorials:
+
+1. [Setting up a new Uncloud cluster](https://labs.iximiuz.com/tutorials/uncloud-create-cluster-ebebf72b) - the tutorial
+   walks you through creating a new cluster with two machines and then deploying a simple web service to it.
+2. [Deploying a Django web application](https://labs.iximiuz.com/tutorials/uncloud-deploy-django-app-7a378bc3) - deploy
+   a Django web app from source code to a remote Linux server using Uncloud.
+
+You can also launch the [Uncloud playground](https://labs.iximiuz.com/playgrounds/uncloud-cluster-64523f7c) where you
+can play with an already initialized Uncloud cluster.
 
 ## 🏗 Project status
 
-Uncloud is currently in active development and is **not ready for production use**. Features may change significantly
-and there may be breaking changes between releases.
+Uncloud is under active development and pre-1.0, so expect occasional breaking changes between releases. The core build,
+push, and deploy workflows are stable, and much of the runtime relies on battle-tested projects: Docker, Caddy,
+WireGuard, and Corrosion.
 
-I'd love your input! Here's how you can contribute:
+We'd love your input! Here's how you can contribute:
 
 * 🐛 Found a bug? [Open an issue](https://github.com/psviderski/uncloud/issues)
-* 💡 Have ideas? [Join the discussion](https://github.com/psviderski/uncloud/discussions)
+* 💡 Have questions, ideas, or need help?
+    * Start a discussion or join an existing one in
+      the [Discussions](https://github.com/psviderski/uncloud/discussions).
+    * Join our [Discord community](https://discord.gg/eR35KQJhPu) where we discuss features, roadmap, implementation
+      details, and help each other out.
+
+## 🙏 Inspiration & Acknowledgements
+
+I'm grateful to the following projects that inspired Uncloud's design and implementation:
+
+* [Kamal](https://kamal-deploy.org/) — for proving that even in the declarative era of Kubernetes there is a place for
+  simple deployment tools that use imperative commands without complex orchestration. Kamal powers the multi-billion
+  dollar company [37signals](https://37signals.com/) where it was created, and that's truly inspiring!
+* [Fly.io](https://fly.io/) — for inspiring my vision for what self-hosted infrastructure should feel like, proving that
+  developer experience and powerful infrastructure can coexist beautifully.
+* [Tailscale](https://tailscale.com/) — for pioneering the vision of decentralised flat mesh networking with an amazing
+  user experience that feels like magic.
+* [Talos Linux](https://github.com/siderolabs/talos)
+  and [KubeSpan](https://www.talos.dev/v1.10/talos-guides/network/kubespan/) — for inspiring Uncloud's API routing
+  design with [grpc-proxy](https://github.com/siderolabs/grpc-proxy) and for their elegant approach to secure
+  WireGuard-based overlay networking with zero configuration.
+* [Docker Swarm Classic](https://github.com/docker-archive/classicswarm) and
+  [Rancher 1.x](http://rancher-com-website-main-elb-elb-1798790864.us-west-2.elb.amazonaws.com/docs/rancher/v1.6/en/)
+  — for showing the power of simplicity and pragmatism in container orchestration and that not every problem needs the
+  complexity of Kubernetes.
+
+Special thanks to the [Corrosion](https://github.com/superfly/corrosion) project by Fly.io for providing the distributed
+SQLite database used to share Uncloud's cluster state.
 
 ## 📫 Stay updated
 
-* [Subscribe](https://uncloud.run/#subscribe) to my newsletter to follow the progress, get early insights into new
-  features, and be the first to know when it's ready for production use.
+* Join our [Discord server](https://discord.gg/eR35KQJhPu) for real-time discussions, support, and updates.
+* Follow [@psviderski](https://x.com/psviderski) on X/Twitter.
+* Subscribe to [our newsletter](https://uncloud.run/#subscribe) to follow the journey of building Uncloud: progress
+  updates, user stories, and the occasional deep dive.
 * Watch this repository for releases.
-* Follow [@psviderski](https://github.com/psviderski) on GitHub.
+
+## 💖 Sponsors
+
+These companies and projects are helping Uncloud with their generous sponsorship and/or services:
+
+<!-- Sentry -->
+<a href="https://sentry.io/welcome/">
+  <img height="100" alt="Sentry" src="https://github.com/user-attachments/assets/6c1439c0-d20d-40dc-a669-c9aa94651dfa" />
+</a>
 
 ## ❤️ Contributors
 
-Thank you [@cedws](https://github.com/cedws) for being the first contributor to Uncloud! 🎉
+<a href="https://trendshift.io/repositories/14069">
+    <img alt="Trendshift" src="https://trendshift.io/api/badge/repositories/14069" />
+</a>
 
 <a href="https://github.com/psviderski/uncloud/graphs/contributors">
   <img src="https://contrib.rocks/image?repo=psviderski/uncloud" />

api/pb/caddy.pb.go

@@ -0,0 +1,187 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.34.2
+// 	protoc        v5.27.3
+// source: api/pb/caddy.proto
+
+package pb
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type GetCaddyConfigResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The saved Caddyfile content.
+	Caddyfile string `protobuf:"bytes,1,opt,name=caddyfile,proto3" json:"caddyfile,omitempty"`
+	// Timestamp when the config was last modified.
+	ModifiedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=modified_at,json=modifiedAt,proto3" json:"modified_at,omitempty"`
+	// Error from the latest unsuccessful reconciliation attempt.
+	LastReconciliationError string `protobuf:"bytes,3,opt,name=last_reconciliation_error,json=lastReconciliationError,proto3" json:"last_reconciliation_error,omitempty"`
+}
+
+func (x *GetCaddyConfigResponse) Reset() {
+	*x = GetCaddyConfigResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetCaddyConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetCaddyConfigResponse) ProtoMessage() {}
+
+func (x *GetCaddyConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetCaddyConfigResponse.ProtoReflect.Descriptor instead.
+func (*GetCaddyConfigResponse) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GetCaddyConfigResponse) GetCaddyfile() string {
+	if x != nil {
+		return x.Caddyfile
+	}
+	return ""
+}
+
+func (x *GetCaddyConfigResponse) GetModifiedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ModifiedAt
+	}
+	return nil
+}
+
+func (x *GetCaddyConfigResponse) GetLastReconciliationError() string {
+	if x != nil {
+		return x.LastReconciliationError
+	}
+	return ""
+}
+
+var File_api_pb_caddy_proto protoreflect.FileDescriptor
+
+var file_api_pb_caddy_proto_rawDesc = []byte{
+	0x0a, 0x12, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x61, 0x64, 0x64, 0x79, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x61, 0x70, 0x69, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xaf, 0x01, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x43,
+	0x61, 0x64, 0x64, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x61, 0x64, 0x64, 0x79, 0x66, 0x69, 0x6c, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x61, 0x64, 0x64, 0x79, 0x66, 0x69, 0x6c, 0x65,
+	0x12, 0x3b, 0x0a, 0x0b, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x52, 0x0a, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x41, 0x74, 0x12, 0x3a, 0x0a,
+	0x19, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x72, 0x65, 0x63, 0x6f, 0x6e, 0x63, 0x69, 0x6c, 0x69, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x17, 0x6c, 0x61, 0x73, 0x74, 0x52, 0x65, 0x63, 0x6f, 0x6e, 0x63, 0x69, 0x6c, 0x69, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x32, 0x49, 0x0a, 0x05, 0x43, 0x61, 0x64,
+	0x64, 0x79, 0x12, 0x40, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
+	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1b, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x65,
+	0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x42, 0x26, 0x5a, 0x24, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e,
+	0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_api_pb_caddy_proto_rawDescOnce sync.Once
+	file_api_pb_caddy_proto_rawDescData = file_api_pb_caddy_proto_rawDesc
+)
+
+func file_api_pb_caddy_proto_rawDescGZIP() []byte {
+	file_api_pb_caddy_proto_rawDescOnce.Do(func() {
+		file_api_pb_caddy_proto_rawDescData = protoimpl.X.CompressGZIP(file_api_pb_caddy_proto_rawDescData)
+	})
+	return file_api_pb_caddy_proto_rawDescData
+}
+
+var file_api_pb_caddy_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_api_pb_caddy_proto_goTypes = []any{
+	(*GetCaddyConfigResponse)(nil), // 0: api.GetCaddyConfigResponse
+	(*timestamppb.Timestamp)(nil),  // 1: google.protobuf.Timestamp
+	(*emptypb.Empty)(nil),          // 2: google.protobuf.Empty
+}
+var file_api_pb_caddy_proto_depIdxs = []int32{
+	1, // 0: api.GetCaddyConfigResponse.modified_at:type_name -> google.protobuf.Timestamp
+	2, // 1: api.Caddy.GetConfig:input_type -> google.protobuf.Empty
+	0, // 2: api.Caddy.GetConfig:output_type -> api.GetCaddyConfigResponse
+	2, // [2:3] is the sub-list for method output_type
+	1, // [1:2] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_api_pb_caddy_proto_init() }
+func file_api_pb_caddy_proto_init() {
+	if File_api_pb_caddy_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_api_pb_caddy_proto_msgTypes[0].Exporter = func(v any, i int) any {
+			switch v := v.(*GetCaddyConfigResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_api_pb_caddy_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_api_pb_caddy_proto_goTypes,
+		DependencyIndexes: file_api_pb_caddy_proto_depIdxs,
+		MessageInfos:      file_api_pb_caddy_proto_msgTypes,
+	}.Build()
+	File_api_pb_caddy_proto = out.File
+	file_api_pb_caddy_proto_rawDesc = nil
+	file_api_pb_caddy_proto_goTypes = nil
+	file_api_pb_caddy_proto_depIdxs = nil
+}

api/pb/caddy.proto

@@ -0,0 +1,22 @@
+syntax = "proto3";
+
+package api;
+
+option go_package = "github.com/psviderski/uncloud/api/pb";
+
+import "google/protobuf/empty.proto";
+import "google/protobuf/timestamp.proto";
+
+service Caddy {
+  // GetConfig retrieves the current Caddy configuration from the machine.
+  rpc GetConfig(google.protobuf.Empty) returns (GetCaddyConfigResponse);
+}
+
+message GetCaddyConfigResponse {
+  // The saved Caddyfile content.
+  string caddyfile = 1;
+  // Timestamp when the config was last modified.
+  google.protobuf.Timestamp modified_at = 2;
+  // Error from the latest unsuccessful reconciliation attempt.
+  string last_reconciliation_error = 3;
+}

api/pb/caddy_grpc.pb.go

@@ -0,0 +1,124 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v5.27.3
+// source: api/pb/caddy.proto
+
+package pb
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	Caddy_GetConfig_FullMethodName = "/api.Caddy/GetConfig"
+)
+
+// CaddyClient is the client API for Caddy service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type CaddyClient interface {
+	// GetConfig retrieves the current Caddy configuration from the machine.
+	GetConfig(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*GetCaddyConfigResponse, error)
+}
+
+type caddyClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewCaddyClient(cc grpc.ClientConnInterface) CaddyClient {
+	return &caddyClient{cc}
+}
+
+func (c *caddyClient) GetConfig(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*GetCaddyConfigResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetCaddyConfigResponse)
+	err := c.cc.Invoke(ctx, Caddy_GetConfig_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// CaddyServer is the server API for Caddy service.
+// All implementations must embed UnimplementedCaddyServer
+// for forward compatibility.
+type CaddyServer interface {
+	// GetConfig retrieves the current Caddy configuration from the machine.
+	GetConfig(context.Context, *emptypb.Empty) (*GetCaddyConfigResponse, error)
+	mustEmbedUnimplementedCaddyServer()
+}
+
+// UnimplementedCaddyServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedCaddyServer struct{}
+
+func (UnimplementedCaddyServer) GetConfig(context.Context, *emptypb.Empty) (*GetCaddyConfigResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetConfig not implemented")
+}
+func (UnimplementedCaddyServer) mustEmbedUnimplementedCaddyServer() {}
+func (UnimplementedCaddyServer) testEmbeddedByValue()               {}
+
+// UnsafeCaddyServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to CaddyServer will
+// result in compilation errors.
+type UnsafeCaddyServer interface {
+	mustEmbedUnimplementedCaddyServer()
+}
+
+func RegisterCaddyServer(s grpc.ServiceRegistrar, srv CaddyServer) {
+	// If the following call pancis, it indicates UnimplementedCaddyServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&Caddy_ServiceDesc, srv)
+}
+
+func _Caddy_GetConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CaddyServer).GetConfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Caddy_GetConfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CaddyServer).GetConfig(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// Caddy_ServiceDesc is the grpc.ServiceDesc for Caddy service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Caddy_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "api.Caddy",
+	HandlerType: (*CaddyServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetConfig",
+			Handler:    _Caddy_GetConfig_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "api/pb/caddy.proto",
+}

api/pb/caddy_storage.pb.go

@@ -0,0 +1,848 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.34.2
+// 	protoc        v5.27.3
+// source: api/pb/caddy_storage.proto
+
+package pb
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type StoreCaddyStorageRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key   string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	Value []byte `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *StoreCaddyStorageRequest) Reset() {
+	*x = StoreCaddyStorageRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_storage_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StoreCaddyStorageRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StoreCaddyStorageRequest) ProtoMessage() {}
+
+func (x *StoreCaddyStorageRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_storage_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StoreCaddyStorageRequest.ProtoReflect.Descriptor instead.
+func (*StoreCaddyStorageRequest) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *StoreCaddyStorageRequest) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *StoreCaddyStorageRequest) GetValue() []byte {
+	if x != nil {
+		return x.Value
+	}
+	return nil
+}
+
+type LoadCaddyStorageRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+}
+
+func (x *LoadCaddyStorageRequest) Reset() {
+	*x = LoadCaddyStorageRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_storage_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LoadCaddyStorageRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LoadCaddyStorageRequest) ProtoMessage() {}
+
+func (x *LoadCaddyStorageRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_storage_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LoadCaddyStorageRequest.ProtoReflect.Descriptor instead.
+func (*LoadCaddyStorageRequest) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *LoadCaddyStorageRequest) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+type LoadCaddyStorageResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Value     []byte                 `protobuf:"bytes,1,opt,name=value,proto3" json:"value,omitempty"`
+	UpdatedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+}
+
+func (x *LoadCaddyStorageResponse) Reset() {
+	*x = LoadCaddyStorageResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_storage_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LoadCaddyStorageResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LoadCaddyStorageResponse) ProtoMessage() {}
+
+func (x *LoadCaddyStorageResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_storage_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LoadCaddyStorageResponse.ProtoReflect.Descriptor instead.
+func (*LoadCaddyStorageResponse) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *LoadCaddyStorageResponse) GetValue() []byte {
+	if x != nil {
+		return x.Value
+	}
+	return nil
+}
+
+func (x *LoadCaddyStorageResponse) GetUpdatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.UpdatedAt
+	}
+	return nil
+}
+
+type DeleteCaddyStorageRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+}
+
+func (x *DeleteCaddyStorageRequest) Reset() {
+	*x = DeleteCaddyStorageRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_storage_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DeleteCaddyStorageRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteCaddyStorageRequest) ProtoMessage() {}
+
+func (x *DeleteCaddyStorageRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_storage_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteCaddyStorageRequest.ProtoReflect.Descriptor instead.
+func (*DeleteCaddyStorageRequest) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *DeleteCaddyStorageRequest) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+type ListCaddyStorageRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Prefix    string `protobuf:"bytes,1,opt,name=prefix,proto3" json:"prefix,omitempty"`
+	Recursive bool   `protobuf:"varint,2,opt,name=recursive,proto3" json:"recursive,omitempty"`
+}
+
+func (x *ListCaddyStorageRequest) Reset() {
+	*x = ListCaddyStorageRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_storage_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListCaddyStorageRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListCaddyStorageRequest) ProtoMessage() {}
+
+func (x *ListCaddyStorageRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_storage_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListCaddyStorageRequest.ProtoReflect.Descriptor instead.
+func (*ListCaddyStorageRequest) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ListCaddyStorageRequest) GetPrefix() string {
+	if x != nil {
+		return x.Prefix
+	}
+	return ""
+}
+
+func (x *ListCaddyStorageRequest) GetRecursive() bool {
+	if x != nil {
+		return x.Recursive
+	}
+	return false
+}
+
+type ListCaddyStorageResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Keys []string `protobuf:"bytes,1,rep,name=keys,proto3" json:"keys,omitempty"`
+}
+
+func (x *ListCaddyStorageResponse) Reset() {
+	*x = ListCaddyStorageResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_storage_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListCaddyStorageResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListCaddyStorageResponse) ProtoMessage() {}
+
+func (x *ListCaddyStorageResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_storage_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListCaddyStorageResponse.ProtoReflect.Descriptor instead.
+func (*ListCaddyStorageResponse) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *ListCaddyStorageResponse) GetKeys() []string {
+	if x != nil {
+		return x.Keys
+	}
+	return nil
+}
+
+type StatCaddyStorageRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+}
+
+func (x *StatCaddyStorageRequest) Reset() {
+	*x = StatCaddyStorageRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_storage_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StatCaddyStorageRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StatCaddyStorageRequest) ProtoMessage() {}
+
+func (x *StatCaddyStorageRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_storage_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StatCaddyStorageRequest.ProtoReflect.Descriptor instead.
+func (*StatCaddyStorageRequest) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *StatCaddyStorageRequest) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+type StatCaddyStorageResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key        string                 `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	UpdatedAt  *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+	Size       int64                  `protobuf:"varint,3,opt,name=size,proto3" json:"size,omitempty"`
+	IsTerminal bool                   `protobuf:"varint,4,opt,name=is_terminal,json=isTerminal,proto3" json:"is_terminal,omitempty"`
+}
+
+func (x *StatCaddyStorageResponse) Reset() {
+	*x = StatCaddyStorageResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_storage_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StatCaddyStorageResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StatCaddyStorageResponse) ProtoMessage() {}
+
+func (x *StatCaddyStorageResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_storage_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StatCaddyStorageResponse.ProtoReflect.Descriptor instead.
+func (*StatCaddyStorageResponse) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *StatCaddyStorageResponse) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *StatCaddyStorageResponse) GetUpdatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.UpdatedAt
+	}
+	return nil
+}
+
+func (x *StatCaddyStorageResponse) GetSize() int64 {
+	if x != nil {
+		return x.Size
+	}
+	return 0
+}
+
+func (x *StatCaddyStorageResponse) GetIsTerminal() bool {
+	if x != nil {
+		return x.IsTerminal
+	}
+	return false
+}
+
+type ListCertificatesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Certificates []*IssuedCertificate `protobuf:"bytes,1,rep,name=certificates,proto3" json:"certificates,omitempty"`
+}
+
+func (x *ListCertificatesResponse) Reset() {
+	*x = ListCertificatesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_storage_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListCertificatesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListCertificatesResponse) ProtoMessage() {}
+
+func (x *ListCertificatesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_storage_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListCertificatesResponse.ProtoReflect.Descriptor instead.
+func (*ListCertificatesResponse) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *ListCertificatesResponse) GetCertificates() []*IssuedCertificate {
+	if x != nil {
+		return x.Certificates
+	}
+	return nil
+}
+
+type IssuedCertificate struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Subject Alternative Name (SAN) of the certificate. Caddy doesn't issue certificates with multiple SANs.
+	San string `protobuf:"bytes,1,opt,name=san,proto3" json:"san,omitempty"`
+	// The PEM-encoding of DER-encoded ASN.1 data for the cert or chain, leaf first.
+	Chain []byte `protobuf:"bytes,2,opt,name=chain,proto3" json:"chain,omitempty"`
+	// Any extra information associated with the certificate, usually provided by the issuer implementation.
+	// JSON-encoded, may be absent or null.
+	IssuerData []byte `protobuf:"bytes,3,opt,name=issuer_data,json=issuerData,proto3" json:"issuer_data,omitempty"`
+}
+
+func (x *IssuedCertificate) Reset() {
+	*x = IssuedCertificate{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_caddy_storage_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IssuedCertificate) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IssuedCertificate) ProtoMessage() {}
+
+func (x *IssuedCertificate) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_caddy_storage_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IssuedCertificate.ProtoReflect.Descriptor instead.
+func (*IssuedCertificate) Descriptor() ([]byte, []int) {
+	return file_api_pb_caddy_storage_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *IssuedCertificate) GetSan() string {
+	if x != nil {
+		return x.San
+	}
+	return ""
+}
+
+func (x *IssuedCertificate) GetChain() []byte {
+	if x != nil {
+		return x.Chain
+	}
+	return nil
+}
+
+func (x *IssuedCertificate) GetIssuerData() []byte {
+	if x != nil {
+		return x.IssuerData
+	}
+	return nil
+}
+
+var File_api_pb_caddy_storage_proto protoreflect.FileDescriptor
+
+var file_api_pb_caddy_storage_proto_rawDesc = []byte{
+	0x0a, 0x1a, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x61, 0x64, 0x64, 0x79, 0x5f, 0x73,
+	0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x61, 0x70,
+	0x69, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f,
+	0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
+	0x42, 0x0a, 0x18, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f,
+	0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b,
+	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x22, 0x2b, 0x0a, 0x17, 0x4c, 0x6f, 0x61, 0x64, 0x43, 0x61, 0x64, 0x64, 0x79,
+	0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
+	0x22, 0x6b, 0x0a, 0x18, 0x4c, 0x6f, 0x61, 0x64, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f,
+	0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x12, 0x39, 0x0a, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x52, 0x09, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x22, 0x2d, 0x0a,
+	0x19, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72,
+	0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x22, 0x4f, 0x0a, 0x17,
+	0x4c, 0x69, 0x73, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69,
+	0x78, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12,
+	0x1c, 0x0a, 0x09, 0x72, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x09, 0x72, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x22, 0x2e, 0x0a,
+	0x18, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6b, 0x65, 0x79,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x22, 0x2b, 0x0a,
+	0x17, 0x53, 0x74, 0x61, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x22, 0x9c, 0x01, 0x0a, 0x18, 0x53,
+	0x74, 0x61, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x39, 0x0a, 0x0a, 0x75, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x75, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x64, 0x41, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x03, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x73, 0x5f, 0x74,
+	0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x69,
+	0x73, 0x54, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x22, 0x56, 0x0a, 0x18, 0x4c, 0x69, 0x73,
+	0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3a, 0x0a, 0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
+	0x63, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x52, 0x0c, 0x63, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x65,
+	0x73, 0x22, 0x5c, 0x0a, 0x11, 0x49, 0x73, 0x73, 0x75, 0x65, 0x64, 0x43, 0x65, 0x72, 0x74, 0x69,
+	0x66, 0x69, 0x63, 0x61, 0x74, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x73, 0x61, 0x6e, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x73, 0x61, 0x6e, 0x12, 0x14, 0x0a, 0x05, 0x63, 0x68, 0x61, 0x69,
+	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x63, 0x68, 0x61, 0x69, 0x6e, 0x12, 0x1f,
+	0x0a, 0x0b, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x0a, 0x69, 0x73, 0x73, 0x75, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x32,
+	0xaa, 0x03, 0x0a, 0x0c, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65,
+	0x12, 0x3e, 0x0a, 0x05, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x12, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e,
+	0x53, 0x74, 0x6f, 0x72, 0x65, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79,
+	0x12, 0x43, 0x0a, 0x04, 0x4c, 0x6f, 0x61, 0x64, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c,
+	0x6f, 0x61, 0x64, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x6f, 0x61,
+	0x64, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12,
+	0x1e, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x43, 0x61, 0x64, 0x64,
+	0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x43, 0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74, 0x12,
+	0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53,
+	0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f,
+	0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x43, 0x0a, 0x04,
+	0x53, 0x74, 0x61, 0x74, 0x12, 0x1c, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x43,
+	0x61, 0x64, 0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x43, 0x61, 0x64,
+	0x64, 0x79, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x49, 0x0a, 0x10, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69,
+	0x63, 0x61, 0x74, 0x65, 0x73, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1d, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x43, 0x65, 0x72, 0x74, 0x69, 0x66, 0x69, 0x63,
+	0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x26, 0x5a, 0x24,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64,
+	0x65, 0x72, 0x73, 0x6b, 0x69, 0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70,
+	0x69, 0x2f, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_api_pb_caddy_storage_proto_rawDescOnce sync.Once
+	file_api_pb_caddy_storage_proto_rawDescData = file_api_pb_caddy_storage_proto_rawDesc
+)
+
+func file_api_pb_caddy_storage_proto_rawDescGZIP() []byte {
+	file_api_pb_caddy_storage_proto_rawDescOnce.Do(func() {
+		file_api_pb_caddy_storage_proto_rawDescData = protoimpl.X.CompressGZIP(file_api_pb_caddy_storage_proto_rawDescData)
+	})
+	return file_api_pb_caddy_storage_proto_rawDescData
+}
+
+var file_api_pb_caddy_storage_proto_msgTypes = make([]protoimpl.MessageInfo, 10)
+var file_api_pb_caddy_storage_proto_goTypes = []any{
+	(*StoreCaddyStorageRequest)(nil),  // 0: api.StoreCaddyStorageRequest
+	(*LoadCaddyStorageRequest)(nil),   // 1: api.LoadCaddyStorageRequest
+	(*LoadCaddyStorageResponse)(nil),  // 2: api.LoadCaddyStorageResponse
+	(*DeleteCaddyStorageRequest)(nil), // 3: api.DeleteCaddyStorageRequest
+	(*ListCaddyStorageRequest)(nil),   // 4: api.ListCaddyStorageRequest
+	(*ListCaddyStorageResponse)(nil),  // 5: api.ListCaddyStorageResponse
+	(*StatCaddyStorageRequest)(nil),   // 6: api.StatCaddyStorageRequest
+	(*StatCaddyStorageResponse)(nil),  // 7: api.StatCaddyStorageResponse
+	(*ListCertificatesResponse)(nil),  // 8: api.ListCertificatesResponse
+	(*IssuedCertificate)(nil),         // 9: api.IssuedCertificate
+	(*timestamppb.Timestamp)(nil),     // 10: google.protobuf.Timestamp
+	(*emptypb.Empty)(nil),             // 11: google.protobuf.Empty
+}
+var file_api_pb_caddy_storage_proto_depIdxs = []int32{
+	10, // 0: api.LoadCaddyStorageResponse.updated_at:type_name -> google.protobuf.Timestamp
+	10, // 1: api.StatCaddyStorageResponse.updated_at:type_name -> google.protobuf.Timestamp
+	9,  // 2: api.ListCertificatesResponse.certificates:type_name -> api.IssuedCertificate
+	0,  // 3: api.CaddyStorage.Store:input_type -> api.StoreCaddyStorageRequest
+	1,  // 4: api.CaddyStorage.Load:input_type -> api.LoadCaddyStorageRequest
+	3,  // 5: api.CaddyStorage.Delete:input_type -> api.DeleteCaddyStorageRequest
+	4,  // 6: api.CaddyStorage.List:input_type -> api.ListCaddyStorageRequest
+	6,  // 7: api.CaddyStorage.Stat:input_type -> api.StatCaddyStorageRequest
+	11, // 8: api.CaddyStorage.ListCertificates:input_type -> google.protobuf.Empty
+	11, // 9: api.CaddyStorage.Store:output_type -> google.protobuf.Empty
+	2,  // 10: api.CaddyStorage.Load:output_type -> api.LoadCaddyStorageResponse
+	11, // 11: api.CaddyStorage.Delete:output_type -> google.protobuf.Empty
+	5,  // 12: api.CaddyStorage.List:output_type -> api.ListCaddyStorageResponse
+	7,  // 13: api.CaddyStorage.Stat:output_type -> api.StatCaddyStorageResponse
+	8,  // 14: api.CaddyStorage.ListCertificates:output_type -> api.ListCertificatesResponse
+	9,  // [9:15] is the sub-list for method output_type
+	3,  // [3:9] is the sub-list for method input_type
+	3,  // [3:3] is the sub-list for extension type_name
+	3,  // [3:3] is the sub-list for extension extendee
+	0,  // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_api_pb_caddy_storage_proto_init() }
+func file_api_pb_caddy_storage_proto_init() {
+	if File_api_pb_caddy_storage_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_api_pb_caddy_storage_proto_msgTypes[0].Exporter = func(v any, i int) any {
+			switch v := v.(*StoreCaddyStorageRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_caddy_storage_proto_msgTypes[1].Exporter = func(v any, i int) any {
+			switch v := v.(*LoadCaddyStorageRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_caddy_storage_proto_msgTypes[2].Exporter = func(v any, i int) any {
+			switch v := v.(*LoadCaddyStorageResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_caddy_storage_proto_msgTypes[3].Exporter = func(v any, i int) any {
+			switch v := v.(*DeleteCaddyStorageRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_caddy_storage_proto_msgTypes[4].Exporter = func(v any, i int) any {
+			switch v := v.(*ListCaddyStorageRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_caddy_storage_proto_msgTypes[5].Exporter = func(v any, i int) any {
+			switch v := v.(*ListCaddyStorageResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_caddy_storage_proto_msgTypes[6].Exporter = func(v any, i int) any {
+			switch v := v.(*StatCaddyStorageRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_caddy_storage_proto_msgTypes[7].Exporter = func(v any, i int) any {
+			switch v := v.(*StatCaddyStorageResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_caddy_storage_proto_msgTypes[8].Exporter = func(v any, i int) any {
+			switch v := v.(*ListCertificatesResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_caddy_storage_proto_msgTypes[9].Exporter = func(v any, i int) any {
+			switch v := v.(*IssuedCertificate); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_api_pb_caddy_storage_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   10,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_api_pb_caddy_storage_proto_goTypes,
+		DependencyIndexes: file_api_pb_caddy_storage_proto_depIdxs,
+		MessageInfos:      file_api_pb_caddy_storage_proto_msgTypes,
+	}.Build()
+	File_api_pb_caddy_storage_proto = out.File
+	file_api_pb_caddy_storage_proto_rawDesc = nil
+	file_api_pb_caddy_storage_proto_goTypes = nil
+	file_api_pb_caddy_storage_proto_depIdxs = nil
+}

api/pb/caddy_storage.proto

@@ -0,0 +1,77 @@
+syntax = "proto3";
+
+package api;
+
+option go_package = "github.com/psviderski/uncloud/api/pb";
+
+import "google/protobuf/empty.proto";
+import "google/protobuf/timestamp.proto";
+
+// CaddyStorage exposes the CertMagic storage operations backed by the distributed cluster store.
+// Each request operates on the receiving machine's store replica. Callers that need replication to catch up before
+// reading should capture store versions with Machine.InspectMachine and call Machine.WaitForStoreVersion on the
+// receiving machine, subject to that RPC's data-availability limitations (see WaitForStoreVersion docs).
+// See Storage interface in https://github.com/caddyserver/certmagic/blob/master/storage.go.
+service CaddyStorage {
+  rpc Store(StoreCaddyStorageRequest) returns (google.protobuf.Empty);
+  rpc Load(LoadCaddyStorageRequest) returns (LoadCaddyStorageResponse);
+  rpc Delete(DeleteCaddyStorageRequest) returns (google.protobuf.Empty);
+  rpc List(ListCaddyStorageRequest) returns (ListCaddyStorageResponse);
+  rpc Stat(StatCaddyStorageRequest) returns (StatCaddyStorageResponse);
+
+  // ListCertificates lists certificates issued by Caddy and stored in the cluster store.
+  // Unreadable entries and invalid resource metadata are skipped. Chains and issuer data are returned as stored.
+  rpc ListCertificates(google.protobuf.Empty) returns (ListCertificatesResponse);
+}
+
+message StoreCaddyStorageRequest {
+  string key = 1;
+  bytes value = 2;
+}
+
+message LoadCaddyStorageRequest {
+  string key = 1;
+}
+
+message LoadCaddyStorageResponse {
+  bytes value = 1;
+  google.protobuf.Timestamp updated_at = 2;
+}
+
+message DeleteCaddyStorageRequest {
+  string key = 1;
+}
+
+message ListCaddyStorageRequest {
+  string prefix = 1;
+  bool recursive = 2;
+}
+
+message ListCaddyStorageResponse {
+  repeated string keys = 1;
+}
+
+message StatCaddyStorageRequest {
+  string key = 1;
+}
+
+message StatCaddyStorageResponse {
+  string key = 1;
+  google.protobuf.Timestamp updated_at = 2;
+  int64 size = 3;
+  bool is_terminal = 4;
+}
+
+message ListCertificatesResponse {
+  repeated IssuedCertificate certificates = 1;
+}
+
+message IssuedCertificate {
+  // Subject Alternative Name (SAN) of the certificate. Caddy doesn't issue certificates with multiple SANs.
+  string san = 1;
+  // The PEM-encoding of DER-encoded ASN.1 data for the cert or chain, leaf first.
+  bytes chain = 2;
+  // Any extra information associated with the certificate, usually provided by the issuer implementation.
+  // JSON-encoded, may be absent or null.
+  bytes issuer_data = 3;
+}

api/pb/caddy_storage_grpc.pb.go

@@ -0,0 +1,328 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v5.27.3
+// source: api/pb/caddy_storage.proto
+
+package pb
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	CaddyStorage_Store_FullMethodName            = "/api.CaddyStorage/Store"
+	CaddyStorage_Load_FullMethodName             = "/api.CaddyStorage/Load"
+	CaddyStorage_Delete_FullMethodName           = "/api.CaddyStorage/Delete"
+	CaddyStorage_List_FullMethodName             = "/api.CaddyStorage/List"
+	CaddyStorage_Stat_FullMethodName             = "/api.CaddyStorage/Stat"
+	CaddyStorage_ListCertificates_FullMethodName = "/api.CaddyStorage/ListCertificates"
+)
+
+// CaddyStorageClient is the client API for CaddyStorage service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// CaddyStorage exposes the CertMagic storage operations backed by the distributed cluster store.
+// Each request operates on the receiving machine's store replica. Callers that need replication to catch up before
+// reading should capture store versions with Machine.InspectMachine and call Machine.WaitForStoreVersion on the
+// receiving machine, subject to that RPC's data-availability limitations (see WaitForStoreVersion docs).
+// See Storage interface in https://github.com/caddyserver/certmagic/blob/master/storage.go.
+type CaddyStorageClient interface {
+	Store(ctx context.Context, in *StoreCaddyStorageRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	Load(ctx context.Context, in *LoadCaddyStorageRequest, opts ...grpc.CallOption) (*LoadCaddyStorageResponse, error)
+	Delete(ctx context.Context, in *DeleteCaddyStorageRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	List(ctx context.Context, in *ListCaddyStorageRequest, opts ...grpc.CallOption) (*ListCaddyStorageResponse, error)
+	Stat(ctx context.Context, in *StatCaddyStorageRequest, opts ...grpc.CallOption) (*StatCaddyStorageResponse, error)
+	// ListCertificates lists certificates issued by Caddy and stored in the cluster store.
+	// Unreadable entries and invalid resource metadata are skipped. Chains and issuer data are returned as stored.
+	ListCertificates(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListCertificatesResponse, error)
+}
+
+type caddyStorageClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewCaddyStorageClient(cc grpc.ClientConnInterface) CaddyStorageClient {
+	return &caddyStorageClient{cc}
+}
+
+func (c *caddyStorageClient) Store(ctx context.Context, in *StoreCaddyStorageRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, CaddyStorage_Store_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *caddyStorageClient) Load(ctx context.Context, in *LoadCaddyStorageRequest, opts ...grpc.CallOption) (*LoadCaddyStorageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(LoadCaddyStorageResponse)
+	err := c.cc.Invoke(ctx, CaddyStorage_Load_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *caddyStorageClient) Delete(ctx context.Context, in *DeleteCaddyStorageRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, CaddyStorage_Delete_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *caddyStorageClient) List(ctx context.Context, in *ListCaddyStorageRequest, opts ...grpc.CallOption) (*ListCaddyStorageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListCaddyStorageResponse)
+	err := c.cc.Invoke(ctx, CaddyStorage_List_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *caddyStorageClient) Stat(ctx context.Context, in *StatCaddyStorageRequest, opts ...grpc.CallOption) (*StatCaddyStorageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(StatCaddyStorageResponse)
+	err := c.cc.Invoke(ctx, CaddyStorage_Stat_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *caddyStorageClient) ListCertificates(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListCertificatesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListCertificatesResponse)
+	err := c.cc.Invoke(ctx, CaddyStorage_ListCertificates_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// CaddyStorageServer is the server API for CaddyStorage service.
+// All implementations must embed UnimplementedCaddyStorageServer
+// for forward compatibility.
+//
+// CaddyStorage exposes the CertMagic storage operations backed by the distributed cluster store.
+// Each request operates on the receiving machine's store replica. Callers that need replication to catch up before
+// reading should capture store versions with Machine.InspectMachine and call Machine.WaitForStoreVersion on the
+// receiving machine, subject to that RPC's data-availability limitations (see WaitForStoreVersion docs).
+// See Storage interface in https://github.com/caddyserver/certmagic/blob/master/storage.go.
+type CaddyStorageServer interface {
+	Store(context.Context, *StoreCaddyStorageRequest) (*emptypb.Empty, error)
+	Load(context.Context, *LoadCaddyStorageRequest) (*LoadCaddyStorageResponse, error)
+	Delete(context.Context, *DeleteCaddyStorageRequest) (*emptypb.Empty, error)
+	List(context.Context, *ListCaddyStorageRequest) (*ListCaddyStorageResponse, error)
+	Stat(context.Context, *StatCaddyStorageRequest) (*StatCaddyStorageResponse, error)
+	// ListCertificates lists certificates issued by Caddy and stored in the cluster store.
+	// Unreadable entries and invalid resource metadata are skipped. Chains and issuer data are returned as stored.
+	ListCertificates(context.Context, *emptypb.Empty) (*ListCertificatesResponse, error)
+	mustEmbedUnimplementedCaddyStorageServer()
+}
+
+// UnimplementedCaddyStorageServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedCaddyStorageServer struct{}
+
+func (UnimplementedCaddyStorageServer) Store(context.Context, *StoreCaddyStorageRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Store not implemented")
+}
+func (UnimplementedCaddyStorageServer) Load(context.Context, *LoadCaddyStorageRequest) (*LoadCaddyStorageResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Load not implemented")
+}
+func (UnimplementedCaddyStorageServer) Delete(context.Context, *DeleteCaddyStorageRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Delete not implemented")
+}
+func (UnimplementedCaddyStorageServer) List(context.Context, *ListCaddyStorageRequest) (*ListCaddyStorageResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method List not implemented")
+}
+func (UnimplementedCaddyStorageServer) Stat(context.Context, *StatCaddyStorageRequest) (*StatCaddyStorageResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Stat not implemented")
+}
+func (UnimplementedCaddyStorageServer) ListCertificates(context.Context, *emptypb.Empty) (*ListCertificatesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListCertificates not implemented")
+}
+func (UnimplementedCaddyStorageServer) mustEmbedUnimplementedCaddyStorageServer() {}
+func (UnimplementedCaddyStorageServer) testEmbeddedByValue()                      {}
+
+// UnsafeCaddyStorageServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to CaddyStorageServer will
+// result in compilation errors.
+type UnsafeCaddyStorageServer interface {
+	mustEmbedUnimplementedCaddyStorageServer()
+}
+
+func RegisterCaddyStorageServer(s grpc.ServiceRegistrar, srv CaddyStorageServer) {
+	// If the following call pancis, it indicates UnimplementedCaddyStorageServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&CaddyStorage_ServiceDesc, srv)
+}
+
+func _CaddyStorage_Store_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StoreCaddyStorageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CaddyStorageServer).Store(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: CaddyStorage_Store_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CaddyStorageServer).Store(ctx, req.(*StoreCaddyStorageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _CaddyStorage_Load_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(LoadCaddyStorageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CaddyStorageServer).Load(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: CaddyStorage_Load_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CaddyStorageServer).Load(ctx, req.(*LoadCaddyStorageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _CaddyStorage_Delete_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteCaddyStorageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CaddyStorageServer).Delete(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: CaddyStorage_Delete_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CaddyStorageServer).Delete(ctx, req.(*DeleteCaddyStorageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _CaddyStorage_List_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListCaddyStorageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CaddyStorageServer).List(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: CaddyStorage_List_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CaddyStorageServer).List(ctx, req.(*ListCaddyStorageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _CaddyStorage_Stat_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StatCaddyStorageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CaddyStorageServer).Stat(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: CaddyStorage_Stat_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CaddyStorageServer).Stat(ctx, req.(*StatCaddyStorageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _CaddyStorage_ListCertificates_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(CaddyStorageServer).ListCertificates(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: CaddyStorage_ListCertificates_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(CaddyStorageServer).ListCertificates(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// CaddyStorage_ServiceDesc is the grpc.ServiceDesc for CaddyStorage service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var CaddyStorage_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "api.CaddyStorage",
+	HandlerType: (*CaddyStorageServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Store",
+			Handler:    _CaddyStorage_Store_Handler,
+		},
+		{
+			MethodName: "Load",
+			Handler:    _CaddyStorage_Load_Handler,
+		},
+		{
+			MethodName: "Delete",
+			Handler:    _CaddyStorage_Delete_Handler,
+		},
+		{
+			MethodName: "List",
+			Handler:    _CaddyStorage_List_Handler,
+		},
+		{
+			MethodName: "Stat",
+			Handler:    _CaddyStorage_Stat_Handler,
+		},
+		{
+			MethodName: "ListCertificates",
+			Handler:    _CaddyStorage_ListCertificates_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "api/pb/caddy_storage.proto",
+}

api/pb/cluster.proto

@@ -2,17 +2,19 @@ syntax = "proto3";
 
 package api;
 
-option go_package = "github.com/psviderski/uncloud/internal/machine/api/pb";
+option go_package = "github.com/psviderski/uncloud/api/pb";
 
 import "google/protobuf/empty.proto";
-import "internal/machine/api/pb/common.proto";
-import "internal/machine/api/pb/machine.proto";
+import "api/pb/common.proto";
+import "api/pb/machine.proto";
 
 service Cluster {
   rpc AddMachine(AddMachineRequest) returns (AddMachineResponse);
   rpc ListMachines(google.protobuf.Empty) returns (ListMachinesResponse);
+  rpc RemoveMachine(RemoveMachineRequest) returns (google.protobuf.Empty);
 
   rpc ReserveDomain(ReserveDomainRequest) returns (Domain);
+  rpc SetDomain(SetDomainRequest) returns (google.protobuf.Empty);
   rpc GetDomain(google.protobuf.Empty) returns (Domain);
   rpc ReleaseDomain(google.protobuf.Empty) returns (Domain);
   rpc CreateDomainRecords(CreateDomainRecordsRequest) returns (CreateDomainRecordsResponse);
@@ -49,14 +51,26 @@ message ListMachinesResponse {
   repeated MachineMember machines = 1;
 }
 
+message RemoveMachineRequest {
+  string id = 1;
+}
+
 message Domain {
   string name = 1;
+  // Whether the domain is reserved in Uncloud DNS. Older daemons (<0.21) omit this field
+  // and only support reserved domains, so clients should treat absence as true.
+  optional bool reserved = 2;
 }
 
 message ReserveDomainRequest {
   string endpoint = 1;
 }
 
+message SetDomainRequest {
+  // An externally managed domain name. Empty clears a manually set domain.
+  string name = 1;
+}
+
 message CreateDomainRecordsRequest {
   repeated DNSRecord records = 1;
 }

api/pb/cluster_grpc.pb.go

@@ -2,7 +2,7 @@
 // versions:
 // - protoc-gen-go-grpc v1.5.1
 // - protoc             v5.27.3
-// source: internal/machine/api/pb/cluster.proto
+// source: api/pb/cluster.proto
 
 package pb
 
@@ -22,7 +22,9 @@ const _ = grpc.SupportPackageIsVersion9
 const (
 	Cluster_AddMachine_FullMethodName          = "/api.Cluster/AddMachine"
 	Cluster_ListMachines_FullMethodName        = "/api.Cluster/ListMachines"
+	Cluster_RemoveMachine_FullMethodName       = "/api.Cluster/RemoveMachine"
 	Cluster_ReserveDomain_FullMethodName       = "/api.Cluster/ReserveDomain"
+	Cluster_SetDomain_FullMethodName           = "/api.Cluster/SetDomain"
 	Cluster_GetDomain_FullMethodName           = "/api.Cluster/GetDomain"
 	Cluster_ReleaseDomain_FullMethodName       = "/api.Cluster/ReleaseDomain"
 	Cluster_CreateDomainRecords_FullMethodName = "/api.Cluster/CreateDomainRecords"
@@ -34,7 +36,9 @@ const (
 type ClusterClient interface {
 	AddMachine(ctx context.Context, in *AddMachineRequest, opts ...grpc.CallOption) (*AddMachineResponse, error)
 	ListMachines(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListMachinesResponse, error)
+	RemoveMachine(ctx context.Context, in *RemoveMachineRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	ReserveDomain(ctx context.Context, in *ReserveDomainRequest, opts ...grpc.CallOption) (*Domain, error)
+	SetDomain(ctx context.Context, in *SetDomainRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	GetDomain(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Domain, error)
 	ReleaseDomain(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Domain, error)
 	CreateDomainRecords(ctx context.Context, in *CreateDomainRecordsRequest, opts ...grpc.CallOption) (*CreateDomainRecordsResponse, error)
@@ -68,6 +72,16 @@ func (c *clusterClient) ListMachines(ctx context.Context, in *emptypb.Empty, opt
 	return out, nil
 }
 
+func (c *clusterClient) RemoveMachine(ctx context.Context, in *RemoveMachineRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Cluster_RemoveMachine_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *clusterClient) ReserveDomain(ctx context.Context, in *ReserveDomainRequest, opts ...grpc.CallOption) (*Domain, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Domain)
@@ -78,6 +92,16 @@ func (c *clusterClient) ReserveDomain(ctx context.Context, in *ReserveDomainRequ
 	return out, nil
 }
 
+func (c *clusterClient) SetDomain(ctx context.Context, in *SetDomainRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Cluster_SetDomain_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *clusterClient) GetDomain(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*Domain, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(Domain)
@@ -114,7 +138,9 @@ func (c *clusterClient) CreateDomainRecords(ctx context.Context, in *CreateDomai
 type ClusterServer interface {
 	AddMachine(context.Context, *AddMachineRequest) (*AddMachineResponse, error)
 	ListMachines(context.Context, *emptypb.Empty) (*ListMachinesResponse, error)
+	RemoveMachine(context.Context, *RemoveMachineRequest) (*emptypb.Empty, error)
 	ReserveDomain(context.Context, *ReserveDomainRequest) (*Domain, error)
+	SetDomain(context.Context, *SetDomainRequest) (*emptypb.Empty, error)
 	GetDomain(context.Context, *emptypb.Empty) (*Domain, error)
 	ReleaseDomain(context.Context, *emptypb.Empty) (*Domain, error)
 	CreateDomainRecords(context.Context, *CreateDomainRecordsRequest) (*CreateDomainRecordsResponse, error)
@@ -134,9 +160,15 @@ func (UnimplementedClusterServer) AddMachine(context.Context, *AddMachineRequest
 func (UnimplementedClusterServer) ListMachines(context.Context, *emptypb.Empty) (*ListMachinesResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListMachines not implemented")
 }
+func (UnimplementedClusterServer) RemoveMachine(context.Context, *RemoveMachineRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveMachine not implemented")
+}
 func (UnimplementedClusterServer) ReserveDomain(context.Context, *ReserveDomainRequest) (*Domain, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ReserveDomain not implemented")
 }
+func (UnimplementedClusterServer) SetDomain(context.Context, *SetDomainRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SetDomain not implemented")
+}
 func (UnimplementedClusterServer) GetDomain(context.Context, *emptypb.Empty) (*Domain, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetDomain not implemented")
 }
@@ -203,6 +235,24 @@ func _Cluster_ListMachines_Handler(srv interface{}, ctx context.Context, dec fun
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Cluster_RemoveMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveMachineRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ClusterServer).RemoveMachine(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Cluster_RemoveMachine_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ClusterServer).RemoveMachine(ctx, req.(*RemoveMachineRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Cluster_ReserveDomain_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(ReserveDomainRequest)
 	if err := dec(in); err != nil {
@@ -221,6 +271,24 @@ func _Cluster_ReserveDomain_Handler(srv interface{}, ctx context.Context, dec fu
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Cluster_SetDomain_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SetDomainRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ClusterServer).SetDomain(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Cluster_SetDomain_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ClusterServer).SetDomain(ctx, req.(*SetDomainRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Cluster_GetDomain_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(emptypb.Empty)
 	if err := dec(in); err != nil {
@@ -290,10 +358,18 @@ var Cluster_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ListMachines",
 			Handler:    _Cluster_ListMachines_Handler,
 		},
+		{
+			MethodName: "RemoveMachine",
+			Handler:    _Cluster_RemoveMachine_Handler,
+		},
 		{
 			MethodName: "ReserveDomain",
 			Handler:    _Cluster_ReserveDomain_Handler,
 		},
+		{
+			MethodName: "SetDomain",
+			Handler:    _Cluster_SetDomain_Handler,
+		},
 		{
 			MethodName: "GetDomain",
 			Handler:    _Cluster_GetDomain_Handler,
@@ -308,5 +384,5 @@ var Cluster_ServiceDesc = grpc.ServiceDesc{
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
-	Metadata: "internal/machine/api/pb/cluster.proto",
+	Metadata: "api/pb/cluster.proto",
 }

api/pb/common.pb.go

@@ -0,0 +1,786 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.34.2
+// 	protoc        v5.27.3
+// source: api/pb/common.proto
+
+package pb
+
+import (
+	status "google.golang.org/genproto/googleapis/rpc/status"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type LogEntry_StreamType int32
+
+const (
+	LogEntry_UNKNOWN   LogEntry_StreamType = 0
+	LogEntry_STDOUT    LogEntry_StreamType = 1
+	LogEntry_STDERR    LogEntry_StreamType = 2
+	LogEntry_HEARTBEAT LogEntry_StreamType = 3
+)
+
+// Enum value maps for LogEntry_StreamType.
+var (
+	LogEntry_StreamType_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "STDOUT",
+		2: "STDERR",
+		3: "HEARTBEAT",
+	}
+	LogEntry_StreamType_value = map[string]int32{
+		"UNKNOWN":   0,
+		"STDOUT":    1,
+		"STDERR":    2,
+		"HEARTBEAT": 3,
+	}
+)
+
+func (x LogEntry_StreamType) Enum() *LogEntry_StreamType {
+	p := new(LogEntry_StreamType)
+	*p = x
+	return p
+}
+
+func (x LogEntry_StreamType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (LogEntry_StreamType) Descriptor() protoreflect.EnumDescriptor {
+	return file_api_pb_common_proto_enumTypes[0].Descriptor()
+}
+
+func (LogEntry_StreamType) Type() protoreflect.EnumType {
+	return &file_api_pb_common_proto_enumTypes[0]
+}
+
+func (x LogEntry_StreamType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use LogEntry_StreamType.Descriptor instead.
+func (LogEntry_StreamType) EnumDescriptor() ([]byte, []int) {
+	return file_api_pb_common_proto_rawDescGZIP(), []int{7, 0}
+}
+
+// Common metadata message nested in all reply message types, injected by the gRPC proxy to provide information
+// about the machine that responded to the request.
+type Metadata struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// ID of the machine the response came from.
+	MachineId string `protobuf:"bytes,4,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	// Name of the machine the response came from.
+	MachineName string `protobuf:"bytes,5,opt,name=machine_name,json=machineName,proto3" json:"machine_name,omitempty"`
+	// Address of the machine the response came from.
+	MachineAddr string `protobuf:"bytes,1,opt,name=machine_addr,json=machineAddr,proto3" json:"machine_addr,omitempty"`
+	// error is set if the request to upstream failed. The rest of the response is undefined.
+	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
+	// error as a gRPC Status message.
+	Status *status.Status `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`
+}
+
+func (x *Metadata) Reset() {
+	*x = Metadata{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_common_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Metadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Metadata) ProtoMessage() {}
+
+func (x *Metadata) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_common_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Metadata.ProtoReflect.Descriptor instead.
+func (*Metadata) Descriptor() ([]byte, []int) {
+	return file_api_pb_common_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Metadata) GetMachineId() string {
+	if x != nil {
+		return x.MachineId
+	}
+	return ""
+}
+
+func (x *Metadata) GetMachineName() string {
+	if x != nil {
+		return x.MachineName
+	}
+	return ""
+}
+
+func (x *Metadata) GetMachineAddr() string {
+	if x != nil {
+		return x.MachineAddr
+	}
+	return ""
+}
+
+func (x *Metadata) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
+func (x *Metadata) GetStatus() *status.Status {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+// A helper message for marshalling the metadata field and injecting it into the response by the gRPC proxy.
+type Empty struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Metadata *Metadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+}
+
+func (x *Empty) Reset() {
+	*x = Empty{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_common_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Empty) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Empty) ProtoMessage() {}
+
+func (x *Empty) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_common_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Empty.ProtoReflect.Descriptor instead.
+func (*Empty) Descriptor() ([]byte, []int) {
+	return file_api_pb_common_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *Empty) GetMetadata() *Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+// EmptyResponse is a response message to be returned by the gRPC proxy when a request to the upstream failed.
+// The nested Empty.Metadata message should contain an error.
+type EmptyResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Messages []*Empty `protobuf:"bytes,1,rep,name=messages,proto3" json:"messages,omitempty"`
+}
+
+func (x *EmptyResponse) Reset() {
+	*x = EmptyResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_common_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EmptyResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EmptyResponse) ProtoMessage() {}
+
+func (x *EmptyResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_common_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EmptyResponse.ProtoReflect.Descriptor instead.
+func (*EmptyResponse) Descriptor() ([]byte, []int) {
+	return file_api_pb_common_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *EmptyResponse) GetMessages() []*Empty {
+	if x != nil {
+		return x.Messages
+	}
+	return nil
+}
+
+type IP struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Ip []byte `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
+}
+
+func (x *IP) Reset() {
+	*x = IP{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_common_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IP) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IP) ProtoMessage() {}
+
+func (x *IP) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_common_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IP.ProtoReflect.Descriptor instead.
+func (*IP) Descriptor() ([]byte, []int) {
+	return file_api_pb_common_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *IP) GetIp() []byte {
+	if x != nil {
+		return x.Ip
+	}
+	return nil
+}
+
+type IPPort struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Ip   *IP    `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
+	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
+}
+
+func (x *IPPort) Reset() {
+	*x = IPPort{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_common_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IPPort) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IPPort) ProtoMessage() {}
+
+func (x *IPPort) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_common_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IPPort.ProtoReflect.Descriptor instead.
+func (*IPPort) Descriptor() ([]byte, []int) {
+	return file_api_pb_common_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *IPPort) GetIp() *IP {
+	if x != nil {
+		return x.Ip
+	}
+	return nil
+}
+
+func (x *IPPort) GetPort() uint32 {
+	if x != nil {
+		return x.Port
+	}
+	return 0
+}
+
+type IPPrefix struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Ip   *IP    `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
+	Bits uint32 `protobuf:"varint,2,opt,name=bits,proto3" json:"bits,omitempty"`
+}
+
+func (x *IPPrefix) Reset() {
+	*x = IPPrefix{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_common_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IPPrefix) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IPPrefix) ProtoMessage() {}
+
+func (x *IPPrefix) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_common_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IPPrefix.ProtoReflect.Descriptor instead.
+func (*IPPrefix) Descriptor() ([]byte, []int) {
+	return file_api_pb_common_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *IPPrefix) GetIp() *IP {
+	if x != nil {
+		return x.Ip
+	}
+	return nil
+}
+
+func (x *IPPrefix) GetBits() uint32 {
+	if x != nil {
+		return x.Bits
+	}
+	return 0
+}
+
+type LogsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Options for logs retrieval.
+	Follow bool   `protobuf:"varint,2,opt,name=follow,proto3" json:"follow,omitempty"`
+	Tail   int32  `protobuf:"varint,3,opt,name=tail,proto3" json:"tail,omitempty"`  // -1 means all
+	Since  string `protobuf:"bytes,4,opt,name=since,proto3" json:"since,omitempty"` // https://www.rfc-editor.org/rfc/rfc3339.html timestamp or Go duration string
+	Until  string `protobuf:"bytes,5,opt,name=until,proto3" json:"until,omitempty"` // https://www.rfc-editor.org/rfc/rfc3339.html timestamp or Go duration string
+}
+
+func (x *LogsRequest) Reset() {
+	*x = LogsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_common_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LogsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LogsRequest) ProtoMessage() {}
+
+func (x *LogsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_common_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LogsRequest.ProtoReflect.Descriptor instead.
+func (*LogsRequest) Descriptor() ([]byte, []int) {
+	return file_api_pb_common_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *LogsRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *LogsRequest) GetFollow() bool {
+	if x != nil {
+		return x.Follow
+	}
+	return false
+}
+
+func (x *LogsRequest) GetTail() int32 {
+	if x != nil {
+		return x.Tail
+	}
+	return 0
+}
+
+func (x *LogsRequest) GetSince() string {
+	if x != nil {
+		return x.Since
+	}
+	return ""
+}
+
+func (x *LogsRequest) GetUntil() string {
+	if x != nil {
+		return x.Until
+	}
+	return ""
+}
+
+type LogEntry struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Stream    LogEntry_StreamType    `protobuf:"varint,1,opt,name=stream,proto3,enum=api.LogEntry_StreamType" json:"stream,omitempty"`
+	Timestamp *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// Log line content. Empty for heartbeat entries.
+	Message []byte `protobuf:"bytes,3,opt,name=message,proto3" json:"message,omitempty"`
+}
+
+func (x *LogEntry) Reset() {
+	*x = LogEntry{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_api_pb_common_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LogEntry) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LogEntry) ProtoMessage() {}
+
+func (x *LogEntry) ProtoReflect() protoreflect.Message {
+	mi := &file_api_pb_common_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LogEntry.ProtoReflect.Descriptor instead.
+func (*LogEntry) Descriptor() ([]byte, []int) {
+	return file_api_pb_common_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *LogEntry) GetStream() LogEntry_StreamType {
+	if x != nil {
+		return x.Stream
+	}
+	return LogEntry_UNKNOWN
+}
+
+func (x *LogEntry) GetTimestamp() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Timestamp
+	}
+	return nil
+}
+
+func (x *LogEntry) GetMessage() []byte {
+	if x != nil {
+		return x.Message
+	}
+	return nil
+}
+
+var File_api_pb_common_proto protoreflect.FileDescriptor
+
+var file_api_pb_common_proto_rawDesc = []byte{
+	0x0a, 0x13, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x03, 0x61, 0x70, 0x69, 0x1a, 0x17, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2f, 0x72, 0x70, 0x63, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x22, 0xb1, 0x01, 0x0a, 0x08, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64,
+	0x12, 0x21, 0x0a, 0x0c, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4e,
+	0x61, 0x6d, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x61,
+	0x64, 0x64, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x41, 0x64, 0x64, 0x72, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x2a, 0x0a, 0x06,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70, 0x63, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x32, 0x0a, 0x05, 0x45, 0x6d, 0x70, 0x74,
+	0x79, 0x12, 0x29, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61,
+	0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x37, 0x0a, 0x0d,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a,
+	0x08, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x0a, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x73,
+	0x73, 0x61, 0x67, 0x65, 0x73, 0x22, 0x14, 0x0a, 0x02, 0x49, 0x50, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x02, 0x69, 0x70, 0x22, 0x35, 0x0a, 0x06, 0x49,
+	0x50, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x17, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x49, 0x50, 0x52, 0x02, 0x69, 0x70, 0x12, 0x12,
+	0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x70, 0x6f,
+	0x72, 0x74, 0x22, 0x37, 0x0a, 0x08, 0x49, 0x50, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x17,
+	0x0a, 0x02, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x61, 0x70, 0x69,
+	0x2e, 0x49, 0x50, 0x52, 0x02, 0x69, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x62, 0x69, 0x74, 0x73, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x62, 0x69, 0x74, 0x73, 0x22, 0x75, 0x0a, 0x0b, 0x4c,
+	0x6f, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x66, 0x6f,
+	0x6c, 0x6c, 0x6f, 0x77, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x66, 0x6f, 0x6c, 0x6c,
+	0x6f, 0x77, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x69, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05,
+	0x52, 0x04, 0x74, 0x61, 0x69, 0x6c, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x69, 0x6e, 0x63, 0x65, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x73, 0x69, 0x6e, 0x63, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x75, 0x6e, 0x74, 0x69, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x75, 0x6e, 0x74,
+	0x69, 0x6c, 0x22, 0xd2, 0x01, 0x0a, 0x08, 0x4c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
+	0x30, 0x0a, 0x06, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x18, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4c, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x2e, 0x53,
+	0x74, 0x72, 0x65, 0x61, 0x6d, 0x54, 0x79, 0x70, 0x65, 0x52, 0x06, 0x73, 0x74, 0x72, 0x65, 0x61,
+	0x6d, 0x12, 0x38, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x52, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x18, 0x0a, 0x07, 0x6d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x6d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x40, 0x0a, 0x0a, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x54,
+	0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00,
+	0x12, 0x0a, 0x0a, 0x06, 0x53, 0x54, 0x44, 0x4f, 0x55, 0x54, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06,
+	0x53, 0x54, 0x44, 0x45, 0x52, 0x52, 0x10, 0x02, 0x12, 0x0d, 0x0a, 0x09, 0x48, 0x45, 0x41, 0x52,
+	0x54, 0x42, 0x45, 0x41, 0x54, 0x10, 0x03, 0x42, 0x26, 0x5a, 0x24, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x70, 0x73, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x6b, 0x69,
+	0x2f, 0x75, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x70, 0x62, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_api_pb_common_proto_rawDescOnce sync.Once
+	file_api_pb_common_proto_rawDescData = file_api_pb_common_proto_rawDesc
+)
+
+func file_api_pb_common_proto_rawDescGZIP() []byte {
+	file_api_pb_common_proto_rawDescOnce.Do(func() {
+		file_api_pb_common_proto_rawDescData = protoimpl.X.CompressGZIP(file_api_pb_common_proto_rawDescData)
+	})
+	return file_api_pb_common_proto_rawDescData
+}
+
+var file_api_pb_common_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_api_pb_common_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_api_pb_common_proto_goTypes = []any{
+	(LogEntry_StreamType)(0),      // 0: api.LogEntry.StreamType
+	(*Metadata)(nil),              // 1: api.Metadata
+	(*Empty)(nil),                 // 2: api.Empty
+	(*EmptyResponse)(nil),         // 3: api.EmptyResponse
+	(*IP)(nil),                    // 4: api.IP
+	(*IPPort)(nil),                // 5: api.IPPort
+	(*IPPrefix)(nil),              // 6: api.IPPrefix
+	(*LogsRequest)(nil),           // 7: api.LogsRequest
+	(*LogEntry)(nil),              // 8: api.LogEntry
+	(*status.Status)(nil),         // 9: google.rpc.Status
+	(*timestamppb.Timestamp)(nil), // 10: google.protobuf.Timestamp
+}
+var file_api_pb_common_proto_depIdxs = []int32{
+	9,  // 0: api.Metadata.status:type_name -> google.rpc.Status
+	1,  // 1: api.Empty.metadata:type_name -> api.Metadata
+	2,  // 2: api.EmptyResponse.messages:type_name -> api.Empty
+	4,  // 3: api.IPPort.ip:type_name -> api.IP
+	4,  // 4: api.IPPrefix.ip:type_name -> api.IP
+	0,  // 5: api.LogEntry.stream:type_name -> api.LogEntry.StreamType
+	10, // 6: api.LogEntry.timestamp:type_name -> google.protobuf.Timestamp
+	7,  // [7:7] is the sub-list for method output_type
+	7,  // [7:7] is the sub-list for method input_type
+	7,  // [7:7] is the sub-list for extension type_name
+	7,  // [7:7] is the sub-list for extension extendee
+	0,  // [0:7] is the sub-list for field type_name
+}
+
+func init() { file_api_pb_common_proto_init() }
+func file_api_pb_common_proto_init() {
+	if File_api_pb_common_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_api_pb_common_proto_msgTypes[0].Exporter = func(v any, i int) any {
+			switch v := v.(*Metadata); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_common_proto_msgTypes[1].Exporter = func(v any, i int) any {
+			switch v := v.(*Empty); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_common_proto_msgTypes[2].Exporter = func(v any, i int) any {
+			switch v := v.(*EmptyResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_common_proto_msgTypes[3].Exporter = func(v any, i int) any {
+			switch v := v.(*IP); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_common_proto_msgTypes[4].Exporter = func(v any, i int) any {
+			switch v := v.(*IPPort); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_common_proto_msgTypes[5].Exporter = func(v any, i int) any {
+			switch v := v.(*IPPrefix); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_common_proto_msgTypes[6].Exporter = func(v any, i int) any {
+			switch v := v.(*LogsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_api_pb_common_proto_msgTypes[7].Exporter = func(v any, i int) any {
+			switch v := v.(*LogEntry); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_api_pb_common_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   8,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_api_pb_common_proto_goTypes,
+		DependencyIndexes: file_api_pb_common_proto_depIdxs,
+		EnumInfos:         file_api_pb_common_proto_enumTypes,
+		MessageInfos:      file_api_pb_common_proto_msgTypes,
+	}.Build()
+	File_api_pb_common_proto = out.File
+	file_api_pb_common_proto_rawDesc = nil
+	file_api_pb_common_proto_goTypes = nil
+	file_api_pb_common_proto_depIdxs = nil
+}

api/pb/common.proto

@@ -2,16 +2,22 @@ syntax = "proto3";
 
 package api;
 
-option go_package = "github.com/psviderski/uncloud/internal/machine/api/pb";
+option go_package = "github.com/psviderski/uncloud/api/pb";
 
-// Vendored at internal/machine/api/vendor/google/rpc/status.proto.
+// Vendored at api/pb/vendor/google/rpc/status.proto.
 import "google/rpc/status.proto";
+import "google/protobuf/timestamp.proto";
 
 // Common metadata message nested in all reply message types, injected by the gRPC proxy to provide information
 // about the machine that responded to the request.
 message Metadata {
+  // ID of the machine the response came from.
+  string machine_id = 4;
+  // Name of the machine the response came from.
+  string machine_name = 5;
   // Address of the machine the response came from.
-  string machine = 1;
+  string machine_addr = 1;
+
   // error is set if the request to upstream failed. The rest of the response is undefined.
   string error = 2;
   // error as a gRPC Status message.
@@ -42,3 +48,25 @@ message IPPrefix {
   IP ip = 1;
   uint32 bits = 2;
 }
+
+message LogsRequest {
+  string id = 1;
+  // Options for logs retrieval.
+  bool follow = 2;
+  int32 tail = 3; // -1 means all
+  string since = 4; // https://www.rfc-editor.org/rfc/rfc3339.html timestamp or Go duration string
+  string until = 5; // https://www.rfc-editor.org/rfc/rfc3339.html timestamp or Go duration string
+}
+
+message LogEntry {
+  enum StreamType {
+    UNKNOWN = 0;
+    STDOUT = 1;
+    STDERR = 2;
+    HEARTBEAT = 3;
+  }
+  StreamType stream = 1;
+  google.protobuf.Timestamp timestamp = 2;
+  // Log line content. Empty for heartbeat entries.
+  bytes message = 3;
+}

api/pb/docker.proto

@@ -0,0 +1,266 @@
+syntax = "proto3";
+
+package api;
+
+option go_package = "github.com/psviderski/uncloud/api/pb";
+
+import "google/protobuf/empty.proto";
+import "api/pb/common.proto";
+
+service Docker {
+  rpc CreateContainer(CreateContainerRequest) returns (CreateContainerResponse);
+  rpc InspectContainer(InspectContainerRequest) returns (InspectContainerResponse);
+  rpc StartContainer(StartContainerRequest) returns (google.protobuf.Empty);
+  rpc StopContainer(StopContainerRequest) returns (google.protobuf.Empty);
+  rpc ListContainers(ListContainersRequest) returns (ListContainersResponse);
+  rpc RemoveContainer(RemoveContainerRequest) returns (google.protobuf.Empty);
+
+  rpc ExecContainer(stream ExecContainerRequest) returns (stream ExecContainerResponse);
+  rpc ContainerLogs(LogsRequest) returns (stream LogEntry);
+
+  rpc PullImage(PullImageRequest) returns (stream JSONMessage);
+  rpc InspectImage(InspectImageRequest) returns (InspectImageResponse);
+  // InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's
+  // Docker auth credentials if necessary.
+  rpc InspectRemoteImage(InspectRemoteImageRequest) returns (InspectRemoteImageResponse);
+  rpc ListImages(ListImagesRequest) returns (ListImagesResponse);
+
+  rpc CreateVolume(CreateVolumeRequest) returns (CreateVolumeResponse);
+  rpc ListVolumes(ListVolumesRequest) returns (ListVolumesResponse);
+  rpc RemoveVolume(RemoveVolumeRequest) returns (google.protobuf.Empty);
+
+  rpc CreateServiceContainer(CreateServiceContainerRequest) returns (CreateContainerResponse);
+  rpc InspectServiceContainer(InspectContainerRequest) returns (ServiceContainer);
+  rpc ListServiceContainers(ListServiceContainersRequest) returns (ListServiceContainersResponse);
+  rpc RemoveServiceContainer(RemoveContainerRequest) returns (google.protobuf.Empty);
+}
+
+message CreateContainerRequest {
+  // JSON serialised container.Config.
+  bytes config = 1;
+  // JSON serialised container.HostConfig.
+  bytes host_config = 2;
+  // JSON serialised network.NetworkingConfig.
+  bytes network_config = 3;
+  // JSON serialised ocispec.Platform.
+  bytes platform = 4;
+  string name = 5;
+}
+
+message CreateContainerResponse {
+  // JSON serialised container.CreateResponse.
+  bytes response = 1;
+}
+
+message InspectContainerRequest {
+  string id = 1;
+}
+
+message InspectContainerResponse {
+  // JSON serialised container.InspectResponse.
+  bytes response = 1;
+}
+
+message StartContainerRequest {
+  string id = 1;
+  // JSON serialised container.StartOptions.
+  bytes options = 2;
+}
+
+message StopContainerRequest {
+  string id = 1;
+  // JSON serialised container.StopOptions.
+  bytes options = 2;
+}
+
+message ListContainersRequest {
+  // JSON serialised container.ListOptions.
+  bytes options = 1;
+}
+
+message ListContainersResponse {
+  // Must contain only one repeated messages field to allow broadcasting ListContainers requests to multiple machines.
+  repeated MachineContainers messages = 1;
+}
+
+message MachineContainers {
+  Metadata metadata = 1;
+  // JSON serialised []container.InspectResponse.
+  bytes containers = 2;
+}
+
+message RemoveContainerRequest {
+  string id = 1;
+  // JSON serialised container.RemoveOptions.
+  bytes options = 2;
+}
+
+message ExecContainerRequest {
+  oneof payload {
+    // Initial configuration for the exec session. Must be sent as the first message.
+    ExecConfig config = 1;
+    // Raw stdin data to be written to the exec process.
+    bytes stdin = 2;
+    // TTY resize event (only used when TTY is enabled).
+    ResizeEvent resize = 3;
+  }
+}
+
+message ExecConfig {
+  // Container ID to execute the command in.
+  string container_id = 1;
+  // JSON serialised ExecOptions
+  bytes options = 2;
+}
+
+message ResizeEvent {
+  uint32 height = 1;
+  uint32 width = 2;
+}
+
+message ExecContainerResponse {
+  oneof payload {
+    // Exec instance ID returned after creating the exec.
+    string exec_id = 1;
+    // Raw stdout data from the exec process.
+    bytes stdout = 2;
+    // Raw stderr data from the exec process (only when TTY is disabled).
+    bytes stderr = 3;
+    // Exit code of the exec process. Sent as the final message.
+    int32 exit_code = 4;
+  }
+}
+
+message PullImageRequest {
+  string image = 1;
+  // JSON serialised image.PullOptions.
+  bytes options = 2;
+}
+
+message JSONMessage {
+  // JSON serialised jsonmessage.JSONMessage.
+  bytes message = 1;
+}
+
+message InspectImageRequest {
+  string id = 1;
+}
+
+message InspectImageResponse {
+  // Must contain only one repeated messages field to allow broadcasting InspectImage requests to multiple machines.
+  repeated Image messages = 1;
+}
+
+message Image {
+  Metadata metadata = 1;
+  // JSON serialised image.InspectResponse.
+  bytes image = 2;
+}
+
+message InspectRemoteImageRequest {
+  string id = 1;
+}
+
+message InspectRemoteImageResponse {
+  // Must contain only one repeated messages field to allow broadcasting InspectRemoteImage requests to multiple machines.
+  repeated RemoteImage messages = 1;
+}
+
+message RemoteImage {
+  Metadata metadata = 1;
+  // Image reference in the canonical form with the digest.
+  string reference = 2;
+  // Raw JSON manifest from the registry.
+  bytes manifest = 3;
+}
+
+message ListImagesRequest {
+  // JSON serialised image.ListOptions.
+  bytes options = 1;
+}
+
+message ListImagesResponse {
+  // Must contain only one repeated messages field to allow broadcasting ListImages requests to multiple machines.
+  repeated MachineImages messages = 1;
+}
+
+message MachineImages {
+  Metadata metadata = 1;
+  // JSON serialised []image.Summary.
+  bytes images = 2;
+  // True if Docker uses the containerd image store, false if it uses its internal image store.
+  bool containerd_store = 3;
+}
+
+message CreateVolumeRequest {
+  // JSON serialised volume.CreateOptions.
+  bytes options = 1;
+}
+
+message CreateVolumeResponse {
+  // JSON serialised volume.Volume.
+  bytes volume = 1;
+}
+
+message ListVolumesRequest {
+  // JSON serialised volume.ListOptions.
+  bytes options = 1;
+}
+
+message ListVolumesResponse {
+  // Must contain only one repeated messages field to allow broadcasting ListVolumes requests to multiple machines.
+  repeated MachineVolumes messages = 1;
+}
+
+message MachineVolumes {
+  Metadata metadata = 1;
+  // JSON serialised volume.ListResponse.
+  bytes response = 2;
+}
+
+message RemoveVolumeRequest {
+  string id = 1;
+  bool force = 2;
+}
+
+message CreateServiceContainerRequest {
+  string service_id = 1;
+  // JSON serialised api.ServiceSpec.
+  bytes service_spec = 2;
+  string container_name = 3;
+
+  // ContainerType specifies the purpose of the container being created.
+  enum ContainerType {
+    // SERVICE is the default type for long-running service containers.
+    SERVICE = 0;
+    // PRE_DEPLOY is a one-shot container for a pre-deploy hook to run before service deployment.
+    PRE_DEPLOY = 1;
+  }
+  ContainerType container_type = 4;
+}
+
+message ServiceContainer {
+  // JSON serialised container.InspectResponse.
+  bytes container = 1;
+  // JSON serialised api.ServiceSpec.
+  bytes service_spec = 2;
+}
+
+message ListServiceContainersRequest {
+  string service_id = 1;
+  // JSON serialised container.ListOptions.
+  bytes options = 2;
+}
+
+message ListServiceContainersResponse {
+  // Must contain only one repeated messages field to allow broadcasting ListServiceContainers requests
+  // to multiple machines.
+  repeated MachineServiceContainers messages = 1;
+}
+
+message MachineServiceContainers {
+  Metadata metadata = 1;
+  repeated ServiceContainer containers = 2;
+  // One-shot containers for deployment hooks (e.g. pre-deploy).
+  repeated ServiceContainer hook_containers = 3;
+}

api/pb/docker_grpc.pb.go

@@ -0,0 +1,811 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v5.27.3
+// source: api/pb/docker.proto
+
+package pb
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	Docker_CreateContainer_FullMethodName         = "/api.Docker/CreateContainer"
+	Docker_InspectContainer_FullMethodName        = "/api.Docker/InspectContainer"
+	Docker_StartContainer_FullMethodName          = "/api.Docker/StartContainer"
+	Docker_StopContainer_FullMethodName           = "/api.Docker/StopContainer"
+	Docker_ListContainers_FullMethodName          = "/api.Docker/ListContainers"
+	Docker_RemoveContainer_FullMethodName         = "/api.Docker/RemoveContainer"
+	Docker_ExecContainer_FullMethodName           = "/api.Docker/ExecContainer"
+	Docker_ContainerLogs_FullMethodName           = "/api.Docker/ContainerLogs"
+	Docker_PullImage_FullMethodName               = "/api.Docker/PullImage"
+	Docker_InspectImage_FullMethodName            = "/api.Docker/InspectImage"
+	Docker_InspectRemoteImage_FullMethodName      = "/api.Docker/InspectRemoteImage"
+	Docker_ListImages_FullMethodName              = "/api.Docker/ListImages"
+	Docker_CreateVolume_FullMethodName            = "/api.Docker/CreateVolume"
+	Docker_ListVolumes_FullMethodName             = "/api.Docker/ListVolumes"
+	Docker_RemoveVolume_FullMethodName            = "/api.Docker/RemoveVolume"
+	Docker_CreateServiceContainer_FullMethodName  = "/api.Docker/CreateServiceContainer"
+	Docker_InspectServiceContainer_FullMethodName = "/api.Docker/InspectServiceContainer"
+	Docker_ListServiceContainers_FullMethodName   = "/api.Docker/ListServiceContainers"
+	Docker_RemoveServiceContainer_FullMethodName  = "/api.Docker/RemoveServiceContainer"
+)
+
+// DockerClient is the client API for Docker service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type DockerClient interface {
+	CreateContainer(ctx context.Context, in *CreateContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error)
+	InspectContainer(ctx context.Context, in *InspectContainerRequest, opts ...grpc.CallOption) (*InspectContainerResponse, error)
+	StartContainer(ctx context.Context, in *StartContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	StopContainer(ctx context.Context, in *StopContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	ListContainers(ctx context.Context, in *ListContainersRequest, opts ...grpc.CallOption) (*ListContainersResponse, error)
+	RemoveContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	ExecContainer(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[ExecContainerRequest, ExecContainerResponse], error)
+	ContainerLogs(ctx context.Context, in *LogsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[LogEntry], error)
+	PullImage(ctx context.Context, in *PullImageRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[JSONMessage], error)
+	InspectImage(ctx context.Context, in *InspectImageRequest, opts ...grpc.CallOption) (*InspectImageResponse, error)
+	// InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's
+	// Docker auth credentials if necessary.
+	InspectRemoteImage(ctx context.Context, in *InspectRemoteImageRequest, opts ...grpc.CallOption) (*InspectRemoteImageResponse, error)
+	ListImages(ctx context.Context, in *ListImagesRequest, opts ...grpc.CallOption) (*ListImagesResponse, error)
+	CreateVolume(ctx context.Context, in *CreateVolumeRequest, opts ...grpc.CallOption) (*CreateVolumeResponse, error)
+	ListVolumes(ctx context.Context, in *ListVolumesRequest, opts ...grpc.CallOption) (*ListVolumesResponse, error)
+	RemoveVolume(ctx context.Context, in *RemoveVolumeRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	CreateServiceContainer(ctx context.Context, in *CreateServiceContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error)
+	InspectServiceContainer(ctx context.Context, in *InspectContainerRequest, opts ...grpc.CallOption) (*ServiceContainer, error)
+	ListServiceContainers(ctx context.Context, in *ListServiceContainersRequest, opts ...grpc.CallOption) (*ListServiceContainersResponse, error)
+	RemoveServiceContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+}
+
+type dockerClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewDockerClient(cc grpc.ClientConnInterface) DockerClient {
+	return &dockerClient{cc}
+}
+
+func (c *dockerClient) CreateContainer(ctx context.Context, in *CreateContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateContainerResponse)
+	err := c.cc.Invoke(ctx, Docker_CreateContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) InspectContainer(ctx context.Context, in *InspectContainerRequest, opts ...grpc.CallOption) (*InspectContainerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InspectContainerResponse)
+	err := c.cc.Invoke(ctx, Docker_InspectContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) StartContainer(ctx context.Context, in *StartContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Docker_StartContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) StopContainer(ctx context.Context, in *StopContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Docker_StopContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) ListContainers(ctx context.Context, in *ListContainersRequest, opts ...grpc.CallOption) (*ListContainersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListContainersResponse)
+	err := c.cc.Invoke(ctx, Docker_ListContainers_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) RemoveContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Docker_RemoveContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) ExecContainer(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[ExecContainerRequest, ExecContainerResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &Docker_ServiceDesc.Streams[0], Docker_ExecContainer_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[ExecContainerRequest, ExecContainerResponse]{ClientStream: stream}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Docker_ExecContainerClient = grpc.BidiStreamingClient[ExecContainerRequest, ExecContainerResponse]
+
+func (c *dockerClient) ContainerLogs(ctx context.Context, in *LogsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[LogEntry], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &Docker_ServiceDesc.Streams[1], Docker_ContainerLogs_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[LogsRequest, LogEntry]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Docker_ContainerLogsClient = grpc.ServerStreamingClient[LogEntry]
+
+func (c *dockerClient) PullImage(ctx context.Context, in *PullImageRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[JSONMessage], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &Docker_ServiceDesc.Streams[2], Docker_PullImage_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[PullImageRequest, JSONMessage]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Docker_PullImageClient = grpc.ServerStreamingClient[JSONMessage]
+
+func (c *dockerClient) InspectImage(ctx context.Context, in *InspectImageRequest, opts ...grpc.CallOption) (*InspectImageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InspectImageResponse)
+	err := c.cc.Invoke(ctx, Docker_InspectImage_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) InspectRemoteImage(ctx context.Context, in *InspectRemoteImageRequest, opts ...grpc.CallOption) (*InspectRemoteImageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InspectRemoteImageResponse)
+	err := c.cc.Invoke(ctx, Docker_InspectRemoteImage_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) ListImages(ctx context.Context, in *ListImagesRequest, opts ...grpc.CallOption) (*ListImagesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListImagesResponse)
+	err := c.cc.Invoke(ctx, Docker_ListImages_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) CreateVolume(ctx context.Context, in *CreateVolumeRequest, opts ...grpc.CallOption) (*CreateVolumeResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateVolumeResponse)
+	err := c.cc.Invoke(ctx, Docker_CreateVolume_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) ListVolumes(ctx context.Context, in *ListVolumesRequest, opts ...grpc.CallOption) (*ListVolumesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListVolumesResponse)
+	err := c.cc.Invoke(ctx, Docker_ListVolumes_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) RemoveVolume(ctx context.Context, in *RemoveVolumeRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Docker_RemoveVolume_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) CreateServiceContainer(ctx context.Context, in *CreateServiceContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateContainerResponse)
+	err := c.cc.Invoke(ctx, Docker_CreateServiceContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) InspectServiceContainer(ctx context.Context, in *InspectContainerRequest, opts ...grpc.CallOption) (*ServiceContainer, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ServiceContainer)
+	err := c.cc.Invoke(ctx, Docker_InspectServiceContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) ListServiceContainers(ctx context.Context, in *ListServiceContainersRequest, opts ...grpc.CallOption) (*ListServiceContainersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListServiceContainersResponse)
+	err := c.cc.Invoke(ctx, Docker_ListServiceContainers_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *dockerClient) RemoveServiceContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Docker_RemoveServiceContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// DockerServer is the server API for Docker service.
+// All implementations must embed UnimplementedDockerServer
+// for forward compatibility.
+type DockerServer interface {
+	CreateContainer(context.Context, *CreateContainerRequest) (*CreateContainerResponse, error)
+	InspectContainer(context.Context, *InspectContainerRequest) (*InspectContainerResponse, error)
+	StartContainer(context.Context, *StartContainerRequest) (*emptypb.Empty, error)
+	StopContainer(context.Context, *StopContainerRequest) (*emptypb.Empty, error)
+	ListContainers(context.Context, *ListContainersRequest) (*ListContainersResponse, error)
+	RemoveContainer(context.Context, *RemoveContainerRequest) (*emptypb.Empty, error)
+	ExecContainer(grpc.BidiStreamingServer[ExecContainerRequest, ExecContainerResponse]) error
+	ContainerLogs(*LogsRequest, grpc.ServerStreamingServer[LogEntry]) error
+	PullImage(*PullImageRequest, grpc.ServerStreamingServer[JSONMessage]) error
+	InspectImage(context.Context, *InspectImageRequest) (*InspectImageResponse, error)
+	// InspectRemoteImage returns the image metadata for an image in a remote registry using the machine's
+	// Docker auth credentials if necessary.
+	InspectRemoteImage(context.Context, *InspectRemoteImageRequest) (*InspectRemoteImageResponse, error)
+	ListImages(context.Context, *ListImagesRequest) (*ListImagesResponse, error)
+	CreateVolume(context.Context, *CreateVolumeRequest) (*CreateVolumeResponse, error)
+	ListVolumes(context.Context, *ListVolumesRequest) (*ListVolumesResponse, error)
+	RemoveVolume(context.Context, *RemoveVolumeRequest) (*emptypb.Empty, error)
+	CreateServiceContainer(context.Context, *CreateServiceContainerRequest) (*CreateContainerResponse, error)
+	InspectServiceContainer(context.Context, *InspectContainerRequest) (*ServiceContainer, error)
+	ListServiceContainers(context.Context, *ListServiceContainersRequest) (*ListServiceContainersResponse, error)
+	RemoveServiceContainer(context.Context, *RemoveContainerRequest) (*emptypb.Empty, error)
+	mustEmbedUnimplementedDockerServer()
+}
+
+// UnimplementedDockerServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedDockerServer struct{}
+
+func (UnimplementedDockerServer) CreateContainer(context.Context, *CreateContainerRequest) (*CreateContainerResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateContainer not implemented")
+}
+func (UnimplementedDockerServer) InspectContainer(context.Context, *InspectContainerRequest) (*InspectContainerResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InspectContainer not implemented")
+}
+func (UnimplementedDockerServer) StartContainer(context.Context, *StartContainerRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method StartContainer not implemented")
+}
+func (UnimplementedDockerServer) StopContainer(context.Context, *StopContainerRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method StopContainer not implemented")
+}
+func (UnimplementedDockerServer) ListContainers(context.Context, *ListContainersRequest) (*ListContainersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListContainers not implemented")
+}
+func (UnimplementedDockerServer) RemoveContainer(context.Context, *RemoveContainerRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveContainer not implemented")
+}
+func (UnimplementedDockerServer) ExecContainer(grpc.BidiStreamingServer[ExecContainerRequest, ExecContainerResponse]) error {
+	return status.Errorf(codes.Unimplemented, "method ExecContainer not implemented")
+}
+func (UnimplementedDockerServer) ContainerLogs(*LogsRequest, grpc.ServerStreamingServer[LogEntry]) error {
+	return status.Errorf(codes.Unimplemented, "method ContainerLogs not implemented")
+}
+func (UnimplementedDockerServer) PullImage(*PullImageRequest, grpc.ServerStreamingServer[JSONMessage]) error {
+	return status.Errorf(codes.Unimplemented, "method PullImage not implemented")
+}
+func (UnimplementedDockerServer) InspectImage(context.Context, *InspectImageRequest) (*InspectImageResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InspectImage not implemented")
+}
+func (UnimplementedDockerServer) InspectRemoteImage(context.Context, *InspectRemoteImageRequest) (*InspectRemoteImageResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InspectRemoteImage not implemented")
+}
+func (UnimplementedDockerServer) ListImages(context.Context, *ListImagesRequest) (*ListImagesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListImages not implemented")
+}
+func (UnimplementedDockerServer) CreateVolume(context.Context, *CreateVolumeRequest) (*CreateVolumeResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateVolume not implemented")
+}
+func (UnimplementedDockerServer) ListVolumes(context.Context, *ListVolumesRequest) (*ListVolumesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListVolumes not implemented")
+}
+func (UnimplementedDockerServer) RemoveVolume(context.Context, *RemoveVolumeRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveVolume not implemented")
+}
+func (UnimplementedDockerServer) CreateServiceContainer(context.Context, *CreateServiceContainerRequest) (*CreateContainerResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateServiceContainer not implemented")
+}
+func (UnimplementedDockerServer) InspectServiceContainer(context.Context, *InspectContainerRequest) (*ServiceContainer, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InspectServiceContainer not implemented")
+}
+func (UnimplementedDockerServer) ListServiceContainers(context.Context, *ListServiceContainersRequest) (*ListServiceContainersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListServiceContainers not implemented")
+}
+func (UnimplementedDockerServer) RemoveServiceContainer(context.Context, *RemoveContainerRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RemoveServiceContainer not implemented")
+}
+func (UnimplementedDockerServer) mustEmbedUnimplementedDockerServer() {}
+func (UnimplementedDockerServer) testEmbeddedByValue()                {}
+
+// UnsafeDockerServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to DockerServer will
+// result in compilation errors.
+type UnsafeDockerServer interface {
+	mustEmbedUnimplementedDockerServer()
+}
+
+func RegisterDockerServer(s grpc.ServiceRegistrar, srv DockerServer) {
+	// If the following call pancis, it indicates UnimplementedDockerServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&Docker_ServiceDesc, srv)
+}
+
+func _Docker_CreateContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).CreateContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_CreateContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).CreateContainer(ctx, req.(*CreateContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_InspectContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(InspectContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).InspectContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_InspectContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).InspectContainer(ctx, req.(*InspectContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_StartContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StartContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).StartContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_StartContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).StartContainer(ctx, req.(*StartContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_StopContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StopContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).StopContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_StopContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).StopContainer(ctx, req.(*StopContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_ListContainers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListContainersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).ListContainers(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_ListContainers_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).ListContainers(ctx, req.(*ListContainersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_RemoveContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).RemoveContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_RemoveContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).RemoveContainer(ctx, req.(*RemoveContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_ExecContainer_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(DockerServer).ExecContainer(&grpc.GenericServerStream[ExecContainerRequest, ExecContainerResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Docker_ExecContainerServer = grpc.BidiStreamingServer[ExecContainerRequest, ExecContainerResponse]
+
+func _Docker_ContainerLogs_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(LogsRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(DockerServer).ContainerLogs(m, &grpc.GenericServerStream[LogsRequest, LogEntry]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Docker_ContainerLogsServer = grpc.ServerStreamingServer[LogEntry]
+
+func _Docker_PullImage_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(PullImageRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(DockerServer).PullImage(m, &grpc.GenericServerStream[PullImageRequest, JSONMessage]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Docker_PullImageServer = grpc.ServerStreamingServer[JSONMessage]
+
+func _Docker_InspectImage_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(InspectImageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).InspectImage(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_InspectImage_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).InspectImage(ctx, req.(*InspectImageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_InspectRemoteImage_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(InspectRemoteImageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).InspectRemoteImage(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_InspectRemoteImage_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).InspectRemoteImage(ctx, req.(*InspectRemoteImageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_ListImages_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListImagesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).ListImages(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_ListImages_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).ListImages(ctx, req.(*ListImagesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_CreateVolume_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateVolumeRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).CreateVolume(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_CreateVolume_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).CreateVolume(ctx, req.(*CreateVolumeRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_ListVolumes_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListVolumesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).ListVolumes(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_ListVolumes_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).ListVolumes(ctx, req.(*ListVolumesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_RemoveVolume_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveVolumeRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).RemoveVolume(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_RemoveVolume_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).RemoveVolume(ctx, req.(*RemoveVolumeRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_CreateServiceContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateServiceContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).CreateServiceContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_CreateServiceContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).CreateServiceContainer(ctx, req.(*CreateServiceContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_InspectServiceContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(InspectContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).InspectServiceContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_InspectServiceContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).InspectServiceContainer(ctx, req.(*InspectContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_ListServiceContainers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListServiceContainersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).ListServiceContainers(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_ListServiceContainers_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).ListServiceContainers(ctx, req.(*ListServiceContainersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Docker_RemoveServiceContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DockerServer).RemoveServiceContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Docker_RemoveServiceContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DockerServer).RemoveServiceContainer(ctx, req.(*RemoveContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// Docker_ServiceDesc is the grpc.ServiceDesc for Docker service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Docker_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "api.Docker",
+	HandlerType: (*DockerServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "CreateContainer",
+			Handler:    _Docker_CreateContainer_Handler,
+		},
+		{
+			MethodName: "InspectContainer",
+			Handler:    _Docker_InspectContainer_Handler,
+		},
+		{
+			MethodName: "StartContainer",
+			Handler:    _Docker_StartContainer_Handler,
+		},
+		{
+			MethodName: "StopContainer",
+			Handler:    _Docker_StopContainer_Handler,
+		},
+		{
+			MethodName: "ListContainers",
+			Handler:    _Docker_ListContainers_Handler,
+		},
+		{
+			MethodName: "RemoveContainer",
+			Handler:    _Docker_RemoveContainer_Handler,
+		},
+		{
+			MethodName: "InspectImage",
+			Handler:    _Docker_InspectImage_Handler,
+		},
+		{
+			MethodName: "InspectRemoteImage",
+			Handler:    _Docker_InspectRemoteImage_Handler,
+		},
+		{
+			MethodName: "ListImages",
+			Handler:    _Docker_ListImages_Handler,
+		},
+		{
+			MethodName: "CreateVolume",
+			Handler:    _Docker_CreateVolume_Handler,
+		},
+		{
+			MethodName: "ListVolumes",
+			Handler:    _Docker_ListVolumes_Handler,
+		},
+		{
+			MethodName: "RemoveVolume",
+			Handler:    _Docker_RemoveVolume_Handler,
+		},
+		{
+			MethodName: "CreateServiceContainer",
+			Handler:    _Docker_CreateServiceContainer_Handler,
+		},
+		{
+			MethodName: "InspectServiceContainer",
+			Handler:    _Docker_InspectServiceContainer_Handler,
+		},
+		{
+			MethodName: "ListServiceContainers",
+			Handler:    _Docker_ListServiceContainers_Handler,
+		},
+		{
+			MethodName: "RemoveServiceContainer",
+			Handler:    _Docker_RemoveServiceContainer_Handler,
+		},
+	},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "ExecContainer",
+			Handler:       _Docker_ExecContainer_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+		{
+			StreamName:    "ContainerLogs",
+			Handler:       _Docker_ContainerLogs_Handler,
+			ServerStreams: true,
+		},
+		{
+			StreamName:    "PullImage",
+			Handler:       _Docker_PullImage_Handler,
+			ServerStreams: true,
+		},
+	},
+	Metadata: "api/pb/docker.proto",
+}

api/pb/machine.proto

@@ -0,0 +1,206 @@
+syntax = "proto3";
+
+package api;
+
+option go_package = "github.com/psviderski/uncloud/api/pb";
+
+import "google/protobuf/duration.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/timestamp.proto";
+import "api/pb/common.proto";
+
+service Machine {
+  // CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
+  rpc CheckPrerequisites(google.protobuf.Empty) returns (CheckPrerequisitesResponse);
+  rpc InitCluster(InitClusterRequest) returns (InitClusterResponse);
+  rpc JoinCluster(JoinClusterRequest) returns (google.protobuf.Empty);
+  rpc Token(google.protobuf.Empty) returns (TokenResponse);
+  // Deprecated: use InspectMachine instead.
+  rpc Inspect(google.protobuf.Empty) returns (MachineInfo);
+  // InspectMachine retrieves detailed information about the machine. Supports broadcasting to multiple machines.
+  rpc InspectMachine(google.protobuf.Empty) returns (InspectMachineResponse);
+  // WaitForStoreVersion waits until the cluster store on this machine has reached each requested actor version, with
+  // no known missing or pending transactions through those versions from active members.
+  // Corrosion may satisfy a version by applying its surviving changes or by marking it complete because its changes
+  // have been superseded.
+  //
+  // Waiting normally makes the captured data available on this machine. However, another write may replace some of that
+  // data before it arrives. Corrosion can then complete the older version without transferring the replaced data.
+  // If the replacement is outside the requested versions, this RPC can succeed while the affected data is still missing
+  // or outdated. This can happen during concurrent updates even when all machines are well connected.
+  //
+  // Success does not guarantee an exact snapshot or delivery of every historical value. Callers that require a specific
+  // record or condition should verify it after waiting.
+  //
+  // This RPC observes native replication without initiating synchronisation.
+  // Use the RPC deadline to bound the wait.
+  rpc WaitForStoreVersion(WaitForStoreVersionRequest) returns (google.protobuf.Empty);
+  // UpdateMachine updates the configuration of the machine.
+  rpc UpdateMachine(UpdateMachineRequest) returns (UpdateMachineResponse);
+  // InspectWireGuardNetwork retrieves the current WireGuard network configuration and peer status.
+  rpc InspectWireGuardNetwork(google.protobuf.Empty) returns (InspectWireGuardNetworkResponse);
+  // Reset restores the machine to a clean state, removing all cluster-related configuration and data.
+  rpc Reset(ResetRequest) returns (google.protobuf.Empty);
+
+  rpc InspectService(InspectServiceRequest) returns (InspectServiceResponse);
+
+  rpc MachineLogs(LogsRequest) returns (stream LogEntry);
+}
+
+message MachineInfo {
+  string id = 1;
+  string name = 2;
+  NetworkConfig network = 3;
+  IP public_ip = 4;
+  // Version of the machine daemon (uncloudd).
+  string daemon_version = 7;
+  // Version of the Docker engine running on the machine. Could be empty if unable to get.
+  string docker_version = 8;
+
+  // Operating system hostname.
+  string hostname = 5;
+  // CPU architecture.
+  string arch = 6;
+  // Human-readable operating system name and version, e.g. "Ubuntu 24.04.4 LTS". Empty if cannot be determined.
+  string os_pretty_name = 9;
+  // Kernel release version, e.g. "6.8.0-31-generic".
+  string kernel_version = 10;
+}
+
+message NetworkConfig {
+  IPPrefix subnet = 1;
+  IP management_ip = 2;
+  repeated IPPort endpoints = 3;
+  bytes public_key = 4;
+}
+
+message UpdateMachineRequest {
+  // Updated machine information. Only the set fields are applied.
+  optional string name = 1;
+  optional IP public_ip = 2;
+  repeated IPPort endpoints = 3;
+}
+
+message UpdateMachineResponse {
+  MachineInfo machine = 1;
+}
+
+message CheckPrerequisitesResponse {
+  // Overall status of the checks.
+  bool satisfied = 1;
+  // Error message if not satisfied (empty if all checks pass).
+  string error = 2;
+}
+
+message InitClusterRequest {
+  string machineName = 1;
+  IPPrefix network = 2;
+
+  oneof public_ip_config {
+    IP public_ip = 3;
+    bool public_ip_auto = 4;
+  }
+
+  // Optional WireGuard endpoints other machines will use to connect to this machine instead of auto-discovered ones.
+  repeated IPPort wireguard_endpoints = 5;
+  // WireGuard listen port for this machine. Uses the default port (51820) if 0 or not set.
+  int32 wireguard_port = 6;
+  // MTU of the WireGuard interface on this machine. The daemon auto-detects the optimal MTU if 0 or not set.
+  int32 wireguard_mtu = 7;
+}
+
+message InitClusterResponse {
+  MachineInfo machine = 1;
+}
+
+message JoinClusterRequest {
+  MachineInfo machine = 1;
+  repeated MachineInfo other_machines = 3;
+  // WireGuard listen port for this machine. Uses the default port (51820) if 0 or not set.
+  int32 wireguard_port = 5;
+  // MTU of the WireGuard interface on this machine. The daemon auto-detects the optimal MTU if 0 or not set.
+  int32 wireguard_mtu = 7;
+  // Cluster store version this machine must reach before participating.
+  // Per-actor vector (Corrosion actor UUID → minimum required db_version).
+  map<string, uint64> min_store_version = 6;
+}
+
+message InspectMachineResponse {
+  // Must contain only one repeated messages field to allow broadcasting InspectMachine requests to multiple machines.
+  repeated MachineDetails machines = 1;
+}
+
+message MachineDetails {
+  Metadata metadata = 1;
+  MachineInfo machine = 2;
+  // Round-trip times to other machines in the cluster, keyed by peer machine ID.
+  map<string, RTTStats> rtts = 4;
+  // Store replication progress observed on this machine.
+  // Maps each Corrosion actor UUID to its highest processed database version. Corrosion also counts versions whose
+  // changes were superseded and skipped. Versions at or below a reported version may still be missing or pending
+  // locally.
+  //
+  // Pass this vector to WaitForStoreVersion on another machine to wait for replication through these versions.
+  // See that RPC's data-availability limitations. To combine observations from several machines, take the maximum
+  // for each actor.
+  // Capturing this vector does not wait for replication or prevent further writes.
+  map<string, uint64> store_version = 5;
+}
+
+message WaitForStoreVersionRequest {
+  // Minimum database version to reach for each Corrosion actor UUID.
+  // Obtain a vector from InspectMachine. To combine several responses, take the maximum version for each actor.
+  // Actors omitted from this vector and versions above its targets are not awaited. An empty vector requires
+  // no replication. Unknown actors with positive targets remain pending until replication reaches them or the RPC ends.
+  map<string, uint64> min_version = 1;
+}
+
+message TokenResponse {
+  string token = 1;
+}
+
+message ResetRequest {
+}
+
+message Service {
+  string id = 1;
+  string name = 2;
+  string mode = 3;
+
+  message Container {
+    string machine_id = 1;
+    // JSON encoded Docker types.Container.
+    bytes container = 2;
+  }
+
+  repeated Container containers = 4;
+}
+
+message InspectServiceRequest {
+  string id = 1;
+}
+
+message InspectServiceResponse {
+  Service service = 1;
+}
+
+message InspectWireGuardNetworkResponse {
+  string interface_name = 1;
+  bytes public_key = 2;
+  int32 listen_port = 3;
+  repeated WireGuardPeer peers = 4;
+}
+
+message WireGuardPeer {
+  bytes public_key = 1;
+  string endpoint = 2;
+  google.protobuf.Timestamp last_handshake_time = 3;
+  int64 receive_bytes = 4;
+  int64 transmit_bytes = 5;
+  repeated string allowed_ips = 6;
+}
+
+message RTTStats {
+  google.protobuf.Duration median = 1;
+  google.protobuf.Duration std_dev = 2;
+}

api/pb/machine_grpc.pb.go

@@ -0,0 +1,586 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             v5.27.3
+// source: api/pb/machine.proto
+
+package pb
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	Machine_CheckPrerequisites_FullMethodName      = "/api.Machine/CheckPrerequisites"
+	Machine_InitCluster_FullMethodName             = "/api.Machine/InitCluster"
+	Machine_JoinCluster_FullMethodName             = "/api.Machine/JoinCluster"
+	Machine_Token_FullMethodName                   = "/api.Machine/Token"
+	Machine_Inspect_FullMethodName                 = "/api.Machine/Inspect"
+	Machine_InspectMachine_FullMethodName          = "/api.Machine/InspectMachine"
+	Machine_WaitForStoreVersion_FullMethodName     = "/api.Machine/WaitForStoreVersion"
+	Machine_UpdateMachine_FullMethodName           = "/api.Machine/UpdateMachine"
+	Machine_InspectWireGuardNetwork_FullMethodName = "/api.Machine/InspectWireGuardNetwork"
+	Machine_Reset_FullMethodName                   = "/api.Machine/Reset"
+	Machine_InspectService_FullMethodName          = "/api.Machine/InspectService"
+	Machine_MachineLogs_FullMethodName             = "/api.Machine/MachineLogs"
+)
+
+// MachineClient is the client API for Machine service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type MachineClient interface {
+	// CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
+	CheckPrerequisites(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*CheckPrerequisitesResponse, error)
+	InitCluster(ctx context.Context, in *InitClusterRequest, opts ...grpc.CallOption) (*InitClusterResponse, error)
+	JoinCluster(ctx context.Context, in *JoinClusterRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	Token(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*TokenResponse, error)
+	// Deprecated: use InspectMachine instead.
+	Inspect(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*MachineInfo, error)
+	// InspectMachine retrieves detailed information about the machine. Supports broadcasting to multiple machines.
+	InspectMachine(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*InspectMachineResponse, error)
+	// WaitForStoreVersion waits until the cluster store on this machine has reached each requested actor version, with
+	// no known missing or pending transactions through those versions from active members.
+	// Corrosion may satisfy a version by applying its surviving changes or by marking it complete because its changes
+	// have been superseded.
+	//
+	// Waiting normally makes the captured data available on this machine. However, another write may replace some of that
+	// data before it arrives. Corrosion can then complete the older version without transferring the replaced data.
+	// If the replacement is outside the requested versions, this RPC can succeed while the affected data is still missing
+	// or outdated. This can happen during concurrent updates even when all machines are well connected.
+	//
+	// Success does not guarantee an exact snapshot or delivery of every historical value. Callers that require a specific
+	// record or condition should verify it after waiting.
+	//
+	// This RPC observes native replication without initiating synchronisation.
+	// Use the RPC deadline to bound the wait.
+	WaitForStoreVersion(ctx context.Context, in *WaitForStoreVersionRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// UpdateMachine updates the configuration of the machine.
+	UpdateMachine(ctx context.Context, in *UpdateMachineRequest, opts ...grpc.CallOption) (*UpdateMachineResponse, error)
+	// InspectWireGuardNetwork retrieves the current WireGuard network configuration and peer status.
+	InspectWireGuardNetwork(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*InspectWireGuardNetworkResponse, error)
+	// Reset restores the machine to a clean state, removing all cluster-related configuration and data.
+	Reset(ctx context.Context, in *ResetRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	InspectService(ctx context.Context, in *InspectServiceRequest, opts ...grpc.CallOption) (*InspectServiceResponse, error)
+	MachineLogs(ctx context.Context, in *LogsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[LogEntry], error)
+}
+
+type machineClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewMachineClient(cc grpc.ClientConnInterface) MachineClient {
+	return &machineClient{cc}
+}
+
+func (c *machineClient) CheckPrerequisites(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*CheckPrerequisitesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CheckPrerequisitesResponse)
+	err := c.cc.Invoke(ctx, Machine_CheckPrerequisites_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *machineClient) InitCluster(ctx context.Context, in *InitClusterRequest, opts ...grpc.CallOption) (*InitClusterResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InitClusterResponse)
+	err := c.cc.Invoke(ctx, Machine_InitCluster_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *machineClient) JoinCluster(ctx context.Context, in *JoinClusterRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Machine_JoinCluster_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *machineClient) Token(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*TokenResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(TokenResponse)
+	err := c.cc.Invoke(ctx, Machine_Token_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *machineClient) Inspect(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*MachineInfo, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(MachineInfo)
+	err := c.cc.Invoke(ctx, Machine_Inspect_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *machineClient) InspectMachine(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*InspectMachineResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InspectMachineResponse)
+	err := c.cc.Invoke(ctx, Machine_InspectMachine_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *machineClient) WaitForStoreVersion(ctx context.Context, in *WaitForStoreVersionRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Machine_WaitForStoreVersion_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *machineClient) UpdateMachine(ctx context.Context, in *UpdateMachineRequest, opts ...grpc.CallOption) (*UpdateMachineResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdateMachineResponse)
+	err := c.cc.Invoke(ctx, Machine_UpdateMachine_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *machineClient) InspectWireGuardNetwork(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*InspectWireGuardNetworkResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InspectWireGuardNetworkResponse)
+	err := c.cc.Invoke(ctx, Machine_InspectWireGuardNetwork_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *machineClient) Reset(ctx context.Context, in *ResetRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Machine_Reset_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *machineClient) InspectService(ctx context.Context, in *InspectServiceRequest, opts ...grpc.CallOption) (*InspectServiceResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(InspectServiceResponse)
+	err := c.cc.Invoke(ctx, Machine_InspectService_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *machineClient) MachineLogs(ctx context.Context, in *LogsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[LogEntry], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &Machine_ServiceDesc.Streams[0], Machine_MachineLogs_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[LogsRequest, LogEntry]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Machine_MachineLogsClient = grpc.ServerStreamingClient[LogEntry]
+
+// MachineServer is the server API for Machine service.
+// All implementations must embed UnimplementedMachineServer
+// for forward compatibility.
+type MachineServer interface {
+	// CheckPrerequisites verifies if the machine meets all necessary system requirements to participate in the cluster.
+	CheckPrerequisites(context.Context, *emptypb.Empty) (*CheckPrerequisitesResponse, error)
+	InitCluster(context.Context, *InitClusterRequest) (*InitClusterResponse, error)
+	JoinCluster(context.Context, *JoinClusterRequest) (*emptypb.Empty, error)
+	Token(context.Context, *emptypb.Empty) (*TokenResponse, error)
+	// Deprecated: use InspectMachine instead.
+	Inspect(context.Context, *emptypb.Empty) (*MachineInfo, error)
+	// InspectMachine retrieves detailed information about the machine. Supports broadcasting to multiple machines.
+	InspectMachine(context.Context, *emptypb.Empty) (*InspectMachineResponse, error)
+	// WaitForStoreVersion waits until the cluster store on this machine has reached each requested actor version, with
+	// no known missing or pending transactions through those versions from active members.
+	// Corrosion may satisfy a version by applying its surviving changes or by marking it complete because its changes
+	// have been superseded.
+	//
+	// Waiting normally makes the captured data available on this machine. However, another write may replace some of that
+	// data before it arrives. Corrosion can then complete the older version without transferring the replaced data.
+	// If the replacement is outside the requested versions, this RPC can succeed while the affected data is still missing
+	// or outdated. This can happen during concurrent updates even when all machines are well connected.
+	//
+	// Success does not guarantee an exact snapshot or delivery of every historical value. Callers that require a specific
+	// record or condition should verify it after waiting.
+	//
+	// This RPC observes native replication without initiating synchronisation.
+	// Use the RPC deadline to bound the wait.
+	WaitForStoreVersion(context.Context, *WaitForStoreVersionRequest) (*emptypb.Empty, error)
+	// UpdateMachine updates the configuration of the machine.
+	UpdateMachine(context.Context, *UpdateMachineRequest) (*UpdateMachineResponse, error)
+	// InspectWireGuardNetwork retrieves the current WireGuard network configuration and peer status.
+	InspectWireGuardNetwork(context.Context, *emptypb.Empty) (*InspectWireGuardNetworkResponse, error)
+	// Reset restores the machine to a clean state, removing all cluster-related configuration and data.
+	Reset(context.Context, *ResetRequest) (*emptypb.Empty, error)
+	InspectService(context.Context, *InspectServiceRequest) (*InspectServiceResponse, error)
+	MachineLogs(*LogsRequest, grpc.ServerStreamingServer[LogEntry]) error
+	mustEmbedUnimplementedMachineServer()
+}
+
+// UnimplementedMachineServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedMachineServer struct{}
+
+func (UnimplementedMachineServer) CheckPrerequisites(context.Context, *emptypb.Empty) (*CheckPrerequisitesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CheckPrerequisites not implemented")
+}
+func (UnimplementedMachineServer) InitCluster(context.Context, *InitClusterRequest) (*InitClusterResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InitCluster not implemented")
+}
+func (UnimplementedMachineServer) JoinCluster(context.Context, *JoinClusterRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method JoinCluster not implemented")
+}
+func (UnimplementedMachineServer) Token(context.Context, *emptypb.Empty) (*TokenResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Token not implemented")
+}
+func (UnimplementedMachineServer) Inspect(context.Context, *emptypb.Empty) (*MachineInfo, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Inspect not implemented")
+}
+func (UnimplementedMachineServer) InspectMachine(context.Context, *emptypb.Empty) (*InspectMachineResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InspectMachine not implemented")
+}
+func (UnimplementedMachineServer) WaitForStoreVersion(context.Context, *WaitForStoreVersionRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method WaitForStoreVersion not implemented")
+}
+func (UnimplementedMachineServer) UpdateMachine(context.Context, *UpdateMachineRequest) (*UpdateMachineResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UpdateMachine not implemented")
+}
+func (UnimplementedMachineServer) InspectWireGuardNetwork(context.Context, *emptypb.Empty) (*InspectWireGuardNetworkResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InspectWireGuardNetwork not implemented")
+}
+func (UnimplementedMachineServer) Reset(context.Context, *ResetRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Reset not implemented")
+}
+func (UnimplementedMachineServer) InspectService(context.Context, *InspectServiceRequest) (*InspectServiceResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InspectService not implemented")
+}
+func (UnimplementedMachineServer) MachineLogs(*LogsRequest, grpc.ServerStreamingServer[LogEntry]) error {
+	return status.Errorf(codes.Unimplemented, "method MachineLogs not implemented")
+}
+func (UnimplementedMachineServer) mustEmbedUnimplementedMachineServer() {}
+func (UnimplementedMachineServer) testEmbeddedByValue()                 {}
+
+// UnsafeMachineServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to MachineServer will
+// result in compilation errors.
+type UnsafeMachineServer interface {
+	mustEmbedUnimplementedMachineServer()
+}
+
+func RegisterMachineServer(s grpc.ServiceRegistrar, srv MachineServer) {
+	// If the following call pancis, it indicates UnimplementedMachineServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&Machine_ServiceDesc, srv)
+}
+
+func _Machine_CheckPrerequisites_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).CheckPrerequisites(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_CheckPrerequisites_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).CheckPrerequisites(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Machine_InitCluster_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(InitClusterRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).InitCluster(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_InitCluster_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).InitCluster(ctx, req.(*InitClusterRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Machine_JoinCluster_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(JoinClusterRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).JoinCluster(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_JoinCluster_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).JoinCluster(ctx, req.(*JoinClusterRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Machine_Token_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).Token(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_Token_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).Token(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Machine_Inspect_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).Inspect(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_Inspect_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).Inspect(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Machine_InspectMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).InspectMachine(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_InspectMachine_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).InspectMachine(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Machine_WaitForStoreVersion_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(WaitForStoreVersionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).WaitForStoreVersion(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_WaitForStoreVersion_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).WaitForStoreVersion(ctx, req.(*WaitForStoreVersionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Machine_UpdateMachine_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateMachineRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).UpdateMachine(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_UpdateMachine_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).UpdateMachine(ctx, req.(*UpdateMachineRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Machine_InspectWireGuardNetwork_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).InspectWireGuardNetwork(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_InspectWireGuardNetwork_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).InspectWireGuardNetwork(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Machine_Reset_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResetRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).Reset(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_Reset_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).Reset(ctx, req.(*ResetRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Machine_InspectService_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(InspectServiceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(MachineServer).InspectService(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Machine_InspectService_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(MachineServer).InspectService(ctx, req.(*InspectServiceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Machine_MachineLogs_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(LogsRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(MachineServer).MachineLogs(m, &grpc.GenericServerStream[LogsRequest, LogEntry]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Machine_MachineLogsServer = grpc.ServerStreamingServer[LogEntry]
+
+// Machine_ServiceDesc is the grpc.ServiceDesc for Machine service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Machine_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "api.Machine",
+	HandlerType: (*MachineServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "CheckPrerequisites",
+			Handler:    _Machine_CheckPrerequisites_Handler,
+		},
+		{
+			MethodName: "InitCluster",
+			Handler:    _Machine_InitCluster_Handler,
+		},
+		{
+			MethodName: "JoinCluster",
+			Handler:    _Machine_JoinCluster_Handler,
+		},
+		{
+			MethodName: "Token",
+			Handler:    _Machine_Token_Handler,
+		},
+		{
+			MethodName: "Inspect",
+			Handler:    _Machine_Inspect_Handler,
+		},
+		{
+			MethodName: "InspectMachine",
+			Handler:    _Machine_InspectMachine_Handler,
+		},
+		{
+			MethodName: "WaitForStoreVersion",
+			Handler:    _Machine_WaitForStoreVersion_Handler,
+		},
+		{
+			MethodName: "UpdateMachine",
+			Handler:    _Machine_UpdateMachine_Handler,
+		},
+		{
+			MethodName: "InspectWireGuardNetwork",
+			Handler:    _Machine_InspectWireGuardNetwork_Handler,
+		},
+		{
+			MethodName: "Reset",
+			Handler:    _Machine_Reset_Handler,
+		},
+		{
+			MethodName: "InspectService",
+			Handler:    _Machine_InspectService_Handler,
+		},
+	},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "MachineLogs",
+			Handler:       _Machine_MachineLogs_Handler,
+			ServerStreams: true,
+		},
+	},
+	Metadata: "api/pb/machine.proto",
+}

cmd/uc/art.txt

@@ -0,0 +1,4 @@
+ _   _  ___
+| | | |/ __|
+| |_| | (__
+ \__,_|\___|

cmd/uc/build.go

@@ -0,0 +1,119 @@
+package main
+
+import (
+	"context"
+	"fmt"
+
+	composecli "github.com/compose-spec/compose-go/v2/cli"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/pkg/client/compose"
+	"github.com/spf13/cobra"
+)
+
+type buildOptions struct {
+	cli.BuildServicesOptions
+	files    []string
+	profiles []string
+}
+
+// NewBuildCommand creates a new command to build images for services from a Compose file.
+func NewBuildCommand() *cobra.Command {
+	opts := buildOptions{}
+	cmd := &cobra.Command{
+		Use:   "build [FLAGS] [SERVICE...]",
+		Short: "Build services from a Compose file.",
+		Long: `Build images for services from a Compose file using local Docker.
+
+By default, built images remain on the local Docker host. Use --push to upload them
+to cluster machines or --push-registry to upload them to external registries.`,
+		Example: `  # Build all services that have a build section in compose.yaml.
+  uc build
+
+  # Build specific services that have a build section.
+  uc build web api
+
+  # Build services and push images to all cluster machines or service x-machines if specified.
+  uc build --push
+
+  # Build services and push images to specific machines.
+  uc build --push -m machine1,machine2
+
+  # Build services and push images to external registries (e.g., Docker Hub).
+  uc build --push-registry
+
+  # Build services with build arguments, pull newer base images before building, and don't use cache.
+  uc build --build-arg NODE_VERSION=24 --build-arg ENV=production --no-cache --pull`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			opts.Services = args
+
+			return runBuild(cmd.Context(), uncli, opts)
+		},
+		GroupID: "service",
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			return completion.ComposeServices(cmd.Context(), args, toComplete, opts.files, opts.profiles)
+		},
+	}
+
+	cmd.Flags().StringArrayVar(&opts.BuildArgs, "build-arg", nil,
+		"Set a build-time variable for services. Used in Dockerfiles that declare the variable with ARG.\n"+
+			"Can be specified multiple times. Format: --build-arg VAR=VALUE")
+	cmd.Flags().BoolVar(&opts.Check, "check", false,
+		"Check the build configuration for services without building them.")
+	cmd.Flags().BoolVar(&opts.Deps, "deps", false,
+		"Also build services declared as dependencies of the selected services.")
+	cmd.Flags().StringSliceVarP(&opts.files, "file", "f", nil,
+		"One or more Compose files to build. (default compose.yaml)")
+	cmd.Flags().StringSliceVarP(&opts.Machines, "machine", "m", nil,
+		"Machine names or IDs to push the built images to (requires --push).\n"+
+			"Can be specified multiple times or as a comma-separated list. (default is all machines or x-machines)")
+	cmd.Flags().BoolVar(&opts.NoCache, "no-cache", false,
+		"Do not use cache when building images.")
+	cmd.Flags().StringSliceVarP(&opts.profiles, "profile", "p", nil,
+		"One or more Compose profiles to enable.")
+	cmd.Flags().BoolVar(&opts.Pull, "pull", false,
+		"Always attempt to pull newer versions of base images before building.")
+	cmd.Flags().BoolVar(&opts.PushCluster, "push", false,
+		"Upload the built images to cluster machines after building.\n"+
+			"Use --machine to specify which machines. (default is all machines)")
+	cmd.Flags().BoolVar(&opts.PushRegistry, "push-registry", false,
+		"Upload the built images to external registries (e.g., Docker Hub) after building.")
+
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+// runBuild parses the Compose file(s) and builds the images for selected services.
+func runBuild(ctx context.Context, uncli *cli.CLI, opts buildOptions) error {
+	// Validate push flags.
+	if opts.PushCluster && opts.PushRegistry {
+		return fmt.Errorf("cannot specify both --push and --push-registry: choose one push target")
+	}
+
+	machines := cli.ExpandCommaSeparatedValues(opts.Machines)
+	// Special handling for an explicit "all" keyword to push to all machines.
+	if len(machines) == 1 && machines[0] == "all" {
+		machines = nil
+	}
+	opts.Machines = machines
+
+	project, err := compose.LoadProject(ctx, opts.files, composecli.WithDefaultProfiles(opts.profiles...))
+	if err != nil {
+		return fmt.Errorf("load compose file(s): %w", err)
+	}
+
+	uncli.SetClusterContextIfUnset(compose.ClusterContext(project))
+
+	servicesToBuild, err := cli.ServicesThatNeedBuild(project, opts.Services, opts.Deps)
+	if err != nil {
+		return fmt.Errorf("determine services to build: %w", err)
+	}
+	if len(servicesToBuild) == 0 {
+		fmt.Println("No services to build.")
+		return nil
+	}
+
+	return uncli.BuildServices(ctx, project, opts.BuildServicesOptions)
+}

cmd/uc/caddy/cert/ls.go

@@ -0,0 +1,167 @@
+package cert
+
+import (
+	"context"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"strings"
+	"time"
+
+	"charm.land/lipgloss/v2"
+	"github.com/caddyserver/certmagic"
+	"github.com/docker/go-units"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
+)
+
+type listOptions struct {
+	machine string
+	output  string
+}
+
+func NewListCommand() *cobra.Command {
+	opts := listOptions{}
+	cmd := &cobra.Command{
+		Use:     "ls",
+		Aliases: []string{"list"},
+		Short:   "List certificates in cluster storage for Caddy.",
+		Long: `List certificates stored in the Uncloud cluster storage for Caddy.
+
+Caddy must use the Uncloud storage module (https://github.com/unlabs-dev/caddy-uncloud)
+configured with 'storage uncloud' in the global options for its certificates to appear here.
+
+This inventory does not check whether Caddy currently serves or trusts a certificate.`,
+		Args: cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return list(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
+		"Name or ID of the machine to read certificate storage from. (default is connected machine)")
+	cmd.Flags().StringVarP(&opts.output, "output", "o", "",
+		"Output format: 'json' or empty for a human-readable table.")
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
+	if opts.output != "" && opts.output != "json" {
+		return fmt.Errorf("unsupported output format '%s' (supported: json)", opts.output)
+	}
+
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	certs, listErr := clusterClient.Caddy.ListCertificates(ctx,
+		client.CaddyListCertificatesOptions{Machine: opts.machine})
+	if len(certs) > 0 || listErr == nil {
+		if err = printCertificates(os.Stdout, certs, opts.output); err != nil {
+			return fmt.Errorf("print Caddy certificates: %w", err)
+		}
+	}
+	if listErr != nil {
+		if len(certs) > 0 {
+			return fmt.Errorf("certificate list is partial: %w", listErr)
+		}
+		return fmt.Errorf("list Caddy certificates: %w", listErr)
+	}
+
+	return nil
+}
+
+func printCertificates(out io.Writer, certs []api.IssuedCertificate, output string) error {
+	type certificate struct {
+		api.IssuedCertificate
+		Fingerprint string
+	}
+
+	items := make([]certificate, 0, len(certs))
+	for _, cert := range certs {
+		fingerprint := cert.Fingerprint()
+		items = append(items, certificate{
+			IssuedCertificate: cert,
+			Fingerprint:       hex.EncodeToString(fingerprint[:]),
+		})
+	}
+	slices.SortFunc(items, func(a, b certificate) int {
+		if cmp := strings.Compare(a.SAN, b.SAN); cmp != 0 {
+			return cmp
+		}
+		if cmp := a.Chain[0].NotAfter.Compare(b.Chain[0].NotAfter); cmp != 0 {
+			return cmp
+		}
+		return strings.Compare(a.Fingerprint, b.Fingerprint)
+	})
+
+	if output == "json" {
+		encoder := json.NewEncoder(out)
+		encoder.SetIndent("", "  ")
+		if err := encoder.Encode(items); err != nil {
+			return fmt.Errorf("marshal certificates: %w", err)
+		}
+		return nil
+	}
+
+	if len(items) == 0 {
+		_, err := fmt.Fprintln(out, "No Caddy certificates found in cluster storage.")
+		return err
+	}
+
+	t := tui.NewTable()
+	t.Headers("ID", "NAME", "ISSUER", "EXPIRES")
+	for _, item := range items {
+		t.Row(
+			item.Fingerprint[:12],
+			item.SAN,
+			formatIssuer(item.IssuerData),
+			formatExpiry(item.Chain[0].NotAfter),
+		)
+	}
+	_, err := lipgloss.Fprintln(out, t)
+	return err
+}
+
+func formatIssuer(data api.CertificateIssuerData) string {
+	if data.ACME == nil {
+		return "unknown"
+	}
+
+	switch data.ACME.CA {
+	case certmagic.LetsEncryptProductionCA:
+		return "Let's Encrypt"
+	case certmagic.LetsEncryptStagingCA:
+		return "Let's Encrypt (staging)"
+	case certmagic.ZeroSSLProductionCA:
+		return "ZeroSSL"
+	case certmagic.GoogleTrustProductionCA:
+		return "Google Trust Services"
+	case certmagic.GoogleTrustStagingCA:
+		return "Google Trust Services (staging)"
+	default:
+		return data.ACME.CA
+	}
+}
+
+func formatExpiry(expires time.Time) string {
+	delta := expires.Sub(time.Now())
+	if delta <= 0 {
+		return fmt.Sprintf("%s (expired %s ago)", expires.UTC().Format(time.DateOnly),
+			strings.ToLower(units.HumanDuration(-delta)))
+	}
+	return fmt.Sprintf("%s (%s)", expires.UTC().Format(time.DateOnly),
+		strings.ToLower(units.HumanDuration(delta)))
+}

cmd/uc/caddy/cert/ls_test.go

@@ -0,0 +1,128 @@
+package cert
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/hex"
+	"encoding/json"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/caddyserver/certmagic"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPrintCertificates(t *testing.T) {
+	now := time.Now().UTC().Truncate(time.Hour)
+	certs := []api.IssuedCertificate{
+		testIssuedCertificate("z.example.com", "z", now.Add(48*time.Hour), certmagic.LetsEncryptProductionCA),
+		testIssuedCertificate("a.example.com", "old", now.Add(-48*time.Hour), certmagic.LetsEncryptStagingCA),
+		testIssuedCertificate("a.example.com", "new", now.Add(72*time.Hour), "https://ca.example/directory"),
+		testIssuedCertificate("unknown.example.com", "unknown", now.Add(96*time.Hour), ""),
+	}
+
+	var table bytes.Buffer
+	require.NoError(t, printCertificates(&table, certs, ""))
+	output := table.String()
+	assert.Contains(t, output, "ID")
+	assert.Contains(t, output, "NAME")
+	assert.Contains(t, output, "ISSUER")
+	assert.Contains(t, output, "EXPIRES")
+	assert.Contains(t, output, now.Add(-48*time.Hour).Format(time.DateOnly)+" (expired ")
+	assert.Contains(t, output, now.Add(48*time.Hour).Format(time.DateOnly)+" (")
+	assert.Contains(t, output, "Let's Encrypt (staging)")
+	assert.Contains(t, output, "https://ca.example/directory")
+	assert.Less(t, strings.Index(output, now.Add(-48*time.Hour).Format(time.DateOnly)),
+		strings.Index(output, now.Add(72*time.Hour).Format(time.DateOnly)))
+	assert.Less(t, strings.Index(output, "a.example.com"), strings.Index(output, "z.example.com"))
+	assert.Contains(t, output, testFingerprint("old")[:12])
+
+	var encoded bytes.Buffer
+	require.NoError(t, printCertificates(&encoded, certs, "json"))
+	var items []struct {
+		api.IssuedCertificate
+		Fingerprint string
+	}
+	require.NoError(t, json.Unmarshal(encoded.Bytes(), &items))
+	require.Len(t, items, 4)
+	assert.Equal(t, testFingerprint("old"), items[0].Fingerprint)
+	assert.Equal(t, "a.example.com", items[0].SAN)
+	require.Len(t, items[0].Chain, 1)
+	assert.Equal(t, []byte("old"), items[0].Chain[0].Raw)
+	assert.Equal(t, now.Add(-48*time.Hour), items[0].Chain[0].NotAfter)
+	require.NotNil(t, items[0].IssuerData.ACME)
+	assert.Equal(t, certmagic.LetsEncryptStagingCA, items[0].IssuerData.ACME.CA)
+	assert.Equal(t, testFingerprint("new"), items[1].Fingerprint)
+	require.NotNil(t, items[1].IssuerData.ACME)
+	assert.Equal(t, "https://ca.example/directory", items[1].IssuerData.ACME.CA)
+	assert.Nil(t, items[2].IssuerData.ACME)
+	assert.Equal(t, "z.example.com", items[3].SAN)
+}
+
+func TestPrintCertificates_Empty(t *testing.T) {
+	for _, tt := range []struct {
+		output string
+		want   string
+	}{
+		{output: "", want: "No Caddy certificates found in cluster storage.\n"},
+		{output: "json", want: "[]\n"},
+	} {
+		var out bytes.Buffer
+		require.NoError(t, printCertificates(&out, nil, tt.output))
+		assert.Equal(t, tt.want, out.String())
+	}
+}
+
+func TestFormatIssuer(t *testing.T) {
+	for _, tt := range []struct {
+		name string
+		ca   string
+		want string
+	}{
+		{name: "production", ca: certmagic.LetsEncryptProductionCA, want: "Let's Encrypt"},
+		{name: "staging", ca: certmagic.LetsEncryptStagingCA, want: "Let's Encrypt (staging)"},
+		{name: "ZeroSSL", ca: certmagic.ZeroSSLProductionCA, want: "ZeroSSL"},
+		{name: "Google Trust Services", ca: certmagic.GoogleTrustProductionCA, want: "Google Trust Services"},
+		{name: "Google Trust Services staging", ca: certmagic.GoogleTrustStagingCA, want: "Google Trust Services (staging)"},
+		{name: "other", ca: "https://ca.example/directory", want: "https://ca.example/directory"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, formatIssuer(api.CertificateIssuerData{
+				ACME: &api.ACMEIssuerData{CA: tt.ca},
+			}))
+		})
+	}
+
+	assert.Equal(t, "unknown", formatIssuer(api.CertificateIssuerData{}))
+}
+
+func TestFormatExpiry_UTC(t *testing.T) {
+	now := time.Now().UTC()
+	brisbane := time.FixedZone("AEST", 10*60*60)
+	expires := time.Date(now.Year(), now.Month(), now.Day()+3, 3, 0, 0, 0, brisbane)
+	assert.True(t, strings.HasPrefix(formatExpiry(expires), expires.UTC().Format(time.DateOnly)+" ("))
+	assert.NotEqual(t, expires.Format(time.DateOnly), expires.UTC().Format(time.DateOnly))
+	expired := now.Add(-2 * time.Hour)
+	assert.True(t, strings.HasPrefix(formatExpiry(expired), expired.UTC().Format(time.DateOnly)+" (expired "))
+	assert.Contains(t, formatExpiry(expired), " ago)")
+}
+
+func testIssuedCertificate(name, raw string, expires time.Time, ca string) api.IssuedCertificate {
+	cert := api.IssuedCertificate{
+		SAN:   name,
+		Chain: []*x509.Certificate{{Raw: []byte(raw), NotAfter: expires}},
+	}
+	if ca != "" {
+		cert.IssuerData.ACME = &api.ACMEIssuerData{CA: ca}
+	}
+	return cert
+}
+
+func testFingerprint(raw string) string {
+	sum := sha256.Sum256([]byte(raw))
+	return hex.EncodeToString(sum[:])
+}

cmd/uc/caddy/cert/root.go

@@ -0,0 +1,12 @@
+package cert
+
+import "github.com/spf13/cobra"
+
+func NewRootCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "cert",
+		Short: "Inspect certificates in cluster storage for Caddy.",
+	}
+	cmd.AddCommand(NewListCommand())
+	return cmd
+}

cmd/uc/caddy/config.go

@@ -0,0 +1,72 @@
+package caddy
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/alecthomas/chroma/v2/quick"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
+)
+
+type configOptions struct {
+	machine string
+	noColor bool
+}
+
+func NewConfigCommand() *cobra.Command {
+	opts := configOptions{}
+
+	cmd := &cobra.Command{
+		Use:   "config",
+		Short: "Show the current Caddy configuration (Caddyfile).",
+		Long:  "Display the current Caddy configuration (Caddyfile) from the connected machine or a specified one.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return runConfig(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
+		"Name or ID of the machine to get the configuration from. (default is connected machine)")
+	cmd.Flags().BoolVar(&opts.noColor, "no-color", false,
+		"Disable syntax highlighting for the output.")
+
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+func runConfig(ctx context.Context, uncli *cli.CLI, opts configOptions) error {
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	config, err := clusterClient.Caddy.Config(ctx, client.CaddyConfigOptions{Machine: opts.machine})
+	if err != nil {
+		return fmt.Errorf("get Caddy config: %w", err)
+	}
+
+	// Print the Caddyfile with syntax highlighting.
+	if opts.noColor {
+		fmt.Print(config.Caddyfile)
+	} else {
+		if err = quick.Highlight(os.Stdout, config.Caddyfile, "caddy", "terminal256", "monokai"); err != nil {
+			// If highlighting fails, fall back to plain output.
+			fmt.Print(config.Caddyfile)
+		}
+	}
+
+	if config.LastReconciliationError != "" {
+		tui.PrintWarning(fmt.Sprintf("last Caddy config load failed: %s\nShowing the last saved Caddyfile.",
+			config.LastReconciliationError))
+	}
+
+	return nil
+}

cmd/uc/caddy/deploy.go

@@ -0,0 +1,248 @@
+package caddy
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"os"
+	"slices"
+	"strings"
+
+	"charm.land/lipgloss/v2"
+	"github.com/docker/cli/cli/streams"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/api/pb"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
+)
+
+type deployOptions struct {
+	caddyfile string
+	image     string
+	machines  []string
+}
+
+func NewDeployCommand() *cobra.Command {
+	opts := deployOptions{}
+
+	cmd := &cobra.Command{
+		Use:   "deploy",
+		Short: "Deploy or upgrade Caddy reverse proxy across all machines in the cluster.",
+		Long: "Deploy or upgrade Caddy reverse proxy across all machines in the cluster.\n" +
+			"A rolling update is performed when updating existing containers to minimise disruption.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return runDeploy(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringVar(&opts.caddyfile, "caddyfile", "",
+		"Path to a custom global Caddy config (Caddyfile) that will be prepended to the auto-generated Caddy config.")
+	cmd.Flags().StringVar(&opts.image, "image", "",
+		"Caddy Docker image to deploy. (default caddy:LATEST_VERSION)")
+	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
+		"Machine names or IDs to deploy to. Can be specified multiple times or as a comma-separated "+
+			"list. (default is all machines)")
+
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
+	caddyfile := ""
+	if opts.caddyfile != "" {
+		data, err := os.ReadFile(opts.caddyfile)
+		if err != nil {
+			return fmt.Errorf("read Caddyfile: %w", err)
+		}
+		caddyfile = strings.TrimSpace(string(data))
+	}
+
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	svc, err := clusterClient.InspectService(ctx, client.CaddyServiceName)
+	if err != nil {
+		if !errors.Is(err, api.ErrNotFound) {
+			return fmt.Errorf("inspect caddy service: %w", err)
+		}
+		fmt.Println(tui.Faint.Render("service: ") + tui.NameStyle.Render(client.CaddyServiceName) +
+			tui.Faint.Render(" (not running)"))
+	} else {
+		fmt.Println(tui.Faint.Render("service: ") + tui.NameStyle.Render(svc.Name) +
+			tui.Faint.Render(" ("+svc.Mode+" mode)"))
+
+		// Collect unique images of all containers in the running caddy service.
+		images := make(map[string]struct{}, len(svc.Containers))
+		for _, c := range svc.Containers {
+			images[c.Container.Config.Image] = struct{}{}
+		}
+		currentImages := slices.Collect(maps.Keys(images))
+
+		if len(currentImages) > 1 {
+			formattedImages := make([]string, len(currentImages))
+			for i, img := range currentImages {
+				formattedImages[i] = tui.FormatImage(img, tui.NoStyle)
+			}
+			fmt.Println(tui.Faint.Render("current images (multiple versions detected): ") +
+				strings.Join(formattedImages, tui.Faint.Render(", ")))
+		} else {
+			fmt.Println(tui.Faint.Render("current image: ") + tui.FormatImage(currentImages[0], tui.NoStyle))
+		}
+	}
+
+	if opts.image != "" {
+		fmt.Println(tui.Faint.Render("target image: ") + tui.FormatImage(opts.image, tui.Green))
+	}
+
+	fmt.Println()
+	fmt.Println("Preparing a deployment plan...")
+
+	placement := api.Placement{
+		Machines: cli.ExpandCommaSeparatedValues(opts.machines),
+	}
+	d, err := clusterClient.Caddy.NewDeployment(ctx, client.CaddyDeploymentOptions{
+		Image: opts.image, Config: caddyfile, Placement: placement,
+	})
+	if err != nil {
+		return fmt.Errorf("create caddy deployment: %w", err)
+	}
+
+	if opts.image == "" {
+		fmt.Println(tui.Faint.Render("target image: ") + tui.FormatImage(d.Spec.Container.Image,
+			tui.Green) + tui.Faint.Render(" (latest stable)"))
+	}
+
+	plan, err := d.Plan(ctx)
+	if err != nil {
+		return fmt.Errorf("plan caddy deployment: %w", err)
+	}
+
+	if len(plan.Operations) == 0 {
+		fmt.Printf("%s service is up to date.\n", client.CaddyServiceName)
+	} else {
+		if svc.ID == "" {
+			if len(opts.machines) > 0 {
+				fmt.Println("This will run a Caddy container on each selected machine.")
+			} else {
+				fmt.Println("This will run a Caddy container on each machine.")
+			}
+		}
+
+		fmt.Println()
+		fmt.Println(tui.Bold.Underline(true).Render("Deployment plan"))
+		fmt.Println()
+
+		directConn := uncli.DirectConnection()
+		contextName := uncli.ContextOverrideOrCurrent()
+		deployTarget := ""
+		if directConn != "" {
+			deployTarget = directConn
+			fmt.Println(tui.Faint.Render("connection: ") + tui.NameStyle.Render(directConn))
+			fmt.Println()
+		} else if contextName != "" && len(uncli.Config.Contexts) > 1 {
+			// Only show context if there's more than one to avoid unnecessary clutter.
+			deployTarget = contextName
+			fmt.Println(tui.Faint.Render("context: ") + tui.NameStyle.Render(contextName))
+			fmt.Println()
+		}
+
+		fmt.Println(plan.Format())
+
+		summary := plan.FormatSummary()
+		fmt.Println(tui.Faint.Render(strings.Repeat("─", lipgloss.Width(summary))))
+		fmt.Println(summary)
+		fmt.Println()
+
+		title := "Proceed with deployment?"
+		// Include the direct connection or context name in the confirmation prompt to avoid accidentally
+		// deploying to the wrong cluster.
+		if deployTarget != "" {
+			isDark := lipgloss.HasDarkBackground(os.Stdin, os.Stdout)
+			confirmStyle := tui.ThemeConfirm().Theme(isDark).Focused.Title
+			title = "Proceed with deployment to " + tui.NameStyle.Render(deployTarget) + confirmStyle.Render("?")
+		}
+
+		confirmed, err := tui.Confirm(title)
+		if err != nil {
+			return fmt.Errorf("confirm deployment: %w", err)
+		}
+		if !confirmed {
+			return cli.Cancelled("Caddy deploy cancelled. No changes were made.")
+		}
+
+		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+			if _, err = d.Run(ctx); err != nil {
+				return fmt.Errorf("deploy caddy: %w", err)
+			}
+			return nil
+		}, uncli.ProgressOut(), fmt.Sprintf("Deploying service %s (%s mode)", d.Spec.Name, d.Spec.Mode))
+		if err != nil {
+			return err
+		}
+	}
+
+	fmt.Println()
+	return UpdateDomainRecords(ctx, clusterClient, uncli.ProgressOut())
+}
+
+func UpdateDomainRecords(ctx context.Context, clusterClient *client.Client, progressOut *streams.Out) error {
+	domain, err := clusterClient.GetDomain(ctx)
+	if err != nil {
+		if errors.Is(err, api.ErrNotFound) {
+			fmt.Println("Skipping DNS records update as no cluster domain is reserved (see 'uc dns').")
+			return nil
+		}
+		return fmt.Errorf("get cluster domain: %w", err)
+	}
+	if !domain.Reserved {
+		fmt.Printf("Skipping DNS records update as cluster domain '%s' is managed externally.\n", domain.Name)
+		return nil
+	}
+
+	fmt.Println("Updating cluster domain records in Uncloud DNS to point to machines running caddy service...")
+	// TODO: split the method into two: one to get the records and one to update them to ask for update confirmation.
+
+	var records []*pb.DNSRecord
+	err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+		var err error
+		records, err = clusterClient.CreateIngressRecords(ctx, client.CaddyServiceName)
+		return err
+	}, progressOut, "Verifying internet access to caddy service")
+	if err != nil {
+		if errors.Is(err, client.ErrNoReachableMachines) {
+			fmt.Println()
+			fmt.Printf("DNS records for domain '%s' could not be updated as there are no internet-reachable "+
+				"machines running caddy containers.\n", domain.Name)
+			fmt.Println()
+			fmt.Println("Possible solutions:")
+			fmt.Println("- Ensure your machines have public IP addresses")
+			fmt.Println("- Use --public-ip flag when adding machines to override the automatically detected IPs")
+			fmt.Println("- Check firewall settings on your machines")
+			fmt.Println("- Configure port forwarding if behind NAT")
+			fmt.Println("- Retry Caddy deployment with 'uc caddy deploy' after resolving connectivity issues")
+			fmt.Println()
+			fmt.Println("Your services won't be accessible from the internet until at least one machine " +
+				"becomes reachable. If you aren't planning to expose any services publicly, you can release " +
+				"the domain by running 'uc dns release'.")
+		}
+		return fmt.Errorf("failed to update DNS records pointing to caddy service: %w", err)
+	}
+
+	fmt.Println()
+	fmt.Println("DNS records updated to use only the internet-reachable machines running caddy service:")
+	for _, r := range records {
+		fmt.Printf("  %s  %s → %s\n", r.Name, r.Type, strings.Join(r.Values, ", "))
+	}
+
+	return nil
+}

cmd/uc/caddy/logs.go

@@ -0,0 +1,29 @@
+package caddy
+
+import (
+	"github.com/psviderski/uncloud/cmd/uc/service"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/logs"
+	"github.com/spf13/cobra"
+)
+
+func NewLogsCommand() *cobra.Command {
+	var options logs.Options
+
+	cmd := &cobra.Command{
+		Use:     "logs",
+		Aliases: []string{"log"},
+		Short:   "View caddy logs.",
+		Long: `View caddy logs.
+
+This calls "uc logs caddy", see "uc logs" for the documention.
+`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			args = append([]string{"caddy"}, args...)
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return service.RunLogs(cmd.Context(), uncli, args, options)
+		},
+	}
+	cmd.Flags().AddFlagSet(logs.Flags(&options))
+	return cmd
+}

cmd/uc/caddy/root.go

@@ -1,6 +1,7 @@
 package caddy
 
 import (
+	"github.com/psviderski/uncloud/cmd/uc/caddy/cert"
 	"github.com/spf13/cobra"
 )
 
@@ -10,7 +11,10 @@ func NewRootCommand() *cobra.Command {
 		Short: "Manage Caddy reverse proxy service.",
 	}
 	cmd.AddCommand(
+		cert.NewRootCommand(),
+		NewConfigCommand(),
 		NewDeployCommand(),
+		NewLogsCommand(),
 	)
 	return cmd
 }

cmd/uc/context/args_test.go

@@ -0,0 +1,103 @@
+package context
+
+import (
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCommandArgsValidation(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		newCmd  func() *cobra.Command
+		args    []string
+		wantErr bool
+	}{
+		{
+			name:    "root accepts no args",
+			newCmd:  NewRootCommand,
+			args:    nil,
+			wantErr: false,
+		},
+		{
+			name:    "root rejects extra args",
+			newCmd:  NewRootCommand,
+			args:    []string{"extra"},
+			wantErr: true,
+		},
+		{
+			name:    "list accepts no args",
+			newCmd:  NewListCommand,
+			args:    nil,
+			wantErr: false,
+		},
+		{
+			name:    "list rejects extra args",
+			newCmd:  NewListCommand,
+			args:    []string{"extra"},
+			wantErr: true,
+		},
+		{
+			name:    "show accepts no args",
+			newCmd:  NewShowCommand,
+			args:    nil,
+			wantErr: false,
+		},
+		{
+			name:    "show rejects extra args",
+			newCmd:  NewShowCommand,
+			args:    []string{"extra"},
+			wantErr: true,
+		},
+		{
+			name:    "connection accepts no args",
+			newCmd:  NewConnectionCommand,
+			args:    nil,
+			wantErr: false,
+		},
+		{
+			name:    "connection rejects extra args",
+			newCmd:  NewConnectionCommand,
+			args:    []string{"extra"},
+			wantErr: true,
+		},
+		{
+			name:    "use accepts no args",
+			newCmd:  NewUseCommand,
+			args:    nil,
+			wantErr: false,
+		},
+		{
+			name:    "use accepts one arg",
+			newCmd:  NewUseCommand,
+			args:    []string{"prod"},
+			wantErr: false,
+		},
+		{
+			name:    "use rejects extra args",
+			newCmd:  NewUseCommand,
+			args:    []string{"prod", "extra"},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			cmd := tt.newCmd()
+			require.NotNil(t, cmd.Args)
+
+			err := cmd.Args(cmd, tt.args)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+		})
+	}
+}

cmd/uc/context/connection.go

@@ -0,0 +1,80 @@
+package context
+
+import (
+	"fmt"
+
+	"charm.land/huh/v2"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/spf13/cobra"
+)
+
+func NewConnectionCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "connection",
+		Aliases: []string{"conn"},
+		Short:   "Choose a new default connection for the current context.",
+		Args:    cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return selectConnection(uncli)
+		},
+	}
+	return cmd
+}
+
+func selectConnection(uncli *cli.CLI) error {
+	if uncli.Config == nil {
+		return fmt.Errorf("connection management is not available: Uncloud configuration file is not being used")
+	}
+	if len(uncli.Config.Contexts) == 0 {
+		return fmt.Errorf("no contexts found in Uncloud config (%s)", uncli.Config.Path())
+	}
+
+	currentCtxName := uncli.Config.CurrentContext
+	currentCtx, ok := uncli.Config.Contexts[currentCtxName]
+	if !ok {
+		return fmt.Errorf("current context '%s' not found", currentCtxName)
+	}
+
+	if len(currentCtx.Connections) == 0 {
+		return fmt.Errorf("no connections found in context '%s'", currentCtxName)
+	}
+
+	var selectedConnection int
+	form := huh.NewForm(
+		huh.NewGroup(
+			huh.NewSelect[int]().
+				Title("Select a default connection").
+				Options(buildConnectionOptions(currentCtx.Connections)...).
+				Value(&selectedConnection),
+		),
+	)
+	if err := form.Run(); err != nil {
+		return fmt.Errorf("select connection: %w", err)
+	}
+
+	currentCtx.SetDefaultConnection(selectedConnection)
+	selected := currentCtx.Connections[0]
+
+	if err := uncli.Config.Save(); err != nil {
+		return fmt.Errorf("save config: %w", err)
+	}
+
+	fmt.Printf("Default connection for context '%s' is now '%s'.\n", currentCtxName, selected.String())
+	return nil
+}
+
+func buildConnectionOptions(connections []config.MachineConnection) []huh.Option[int] {
+	options := make([]huh.Option[int], len(connections))
+	for i, conn := range connections {
+		key := conn.String()
+		opt := huh.NewOption(key, i)
+		if i == 0 {
+			opt.Key += " (default)"
+			opt = opt.Selected(true)
+		}
+		options[i] = opt
+	}
+	return options
+}

cmd/uc/context/ls.go

@@ -0,0 +1,56 @@
+package context
+
+import (
+	"fmt"
+	"maps"
+	"slices"
+
+	"charm.land/lipgloss/v2"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/spf13/cobra"
+)
+
+func NewListCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "ls",
+		Aliases: []string{"list"},
+		Short:   "List available cluster contexts.",
+		Args:    cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return list(uncli)
+		},
+	}
+
+	return cmd
+}
+
+func list(uncli *cli.CLI) error {
+	if uncli.Config == nil {
+		return fmt.Errorf("context management is not available: Uncloud configuration file is not being used")
+	}
+
+	if len(uncli.Config.Contexts) == 0 {
+		fmt.Println("No contexts found")
+		return nil
+	}
+
+	contextNames := slices.Sorted(maps.Keys(uncli.Config.Contexts))
+	currentContext := uncli.Config.CurrentContext
+
+	t := tui.NewTable()
+	t.Headers("NAME", "CURRENT", "CONNECTIONS")
+
+	for _, name := range contextNames {
+		current := ""
+		if name == currentContext {
+			current = "✓"
+		}
+		connCount := len(uncli.Config.Contexts[name].Connections)
+		t.Row(name, current, fmt.Sprintf("%d", connCount))
+	}
+
+	lipgloss.Println(t)
+	return nil
+}

cmd/uc/context/root.go

@@ -0,0 +1,28 @@
+package context
+
+import (
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/spf13/cobra"
+)
+
+func NewRootCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "ctx",
+		Aliases: []string{"context"},
+		Short:   "Switch between different cluster contexts. Contains subcommands to manage contexts.",
+		Args:    cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return selectContext(uncli)
+		},
+	}
+
+	cmd.AddCommand(
+		NewListCommand(),
+		NewUseCommand(),
+		NewConnectionCommand(),
+		NewShowCommand(),
+	)
+
+	return cmd
+}

cmd/uc/context/show.go

@@ -0,0 +1,36 @@
+package context
+
+import (
+	"fmt"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/spf13/cobra"
+)
+
+func NewShowCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "show",
+		Short: "Show current cluster context.",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return show(uncli)
+		},
+	}
+
+	return cmd
+}
+
+func show(uncli *cli.CLI) error {
+	// discard errors, only show the current context, otherwise nothing
+	if uncli.Config == nil {
+		return nil
+	}
+
+	if len(uncli.Config.Contexts) == 0 {
+		return nil
+	}
+	fmt.Println(uncli.Config.CurrentContext)
+
+	return nil
+}

cmd/uc/context/use.go

@@ -0,0 +1,96 @@
+package context
+
+import (
+	"fmt"
+	"maps"
+	"slices"
+
+	"charm.land/huh/v2"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/spf13/cobra"
+)
+
+func NewUseCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "use [CONTEXT]",
+		Short: "Switch to a different cluster context.",
+		Long: "Switch to a different cluster context. If no context is provided, " +
+			"a list of available contexts will be displayed for selection.",
+		Args: cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			if len(args) == 1 {
+				if err := uncli.SetCurrentContext(args[0]); err != nil {
+					return fmt.Errorf("failed to set the current cluster context to '%s': %w", args[0], err)
+				}
+				fmt.Printf("Current cluster context is now '%s'.\n", args[0])
+				return nil
+			}
+
+			return selectContext(uncli)
+		},
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			if len(args) > 0 {
+				return nil, cobra.ShellCompDirectiveNoFileComp
+			}
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Contexts(cmd.Context(), uncli, args, toComplete)
+		},
+	}
+
+	return cmd
+}
+
+func selectContext(uncli *cli.CLI) error {
+	if uncli.Config == nil {
+		return fmt.Errorf("context management is not available: Uncloud configuration file is not being used")
+	}
+	if len(uncli.Config.Contexts) == 0 {
+		return fmt.Errorf("no contexts found in Uncloud config (%s)", uncli.Config.Path())
+	}
+	if !tui.IsTerminalAvailable() {
+		return fmt.Errorf("cannot select a context interactively without a terminal. " +
+			"Pass the context name explicitly: uc ctx use CONTEXT")
+	}
+
+	contextNames := slices.Sorted(maps.Keys(uncli.Config.Contexts))
+
+	var selected string
+	form := huh.NewForm(
+		huh.NewGroup(
+			huh.NewSelect[string]().
+				Title("Select a cluster context").
+				Options(buildContextOptions(contextNames, uncli.Config.CurrentContext)...).
+				Value(&selected),
+		),
+	)
+	if err := form.Run(); err != nil {
+		return fmt.Errorf("select cluster context: %w", err)
+	}
+
+	if err := uncli.SetCurrentContext(selected); err != nil {
+		return fmt.Errorf("set current cluster context: %w", err)
+	}
+
+	fmt.Printf("Current cluster context is now '%s'.\n", selected)
+	return nil
+}
+
+func buildContextOptions(contexts []string, current string) []huh.Option[string] {
+	options := make([]huh.Option[string], len(contexts))
+
+	for i, ctx := range contexts {
+		opt := huh.NewOption(ctx, ctx)
+		if ctx == current {
+			opt.Key += " (current)"
+			opt = opt.Selected(true)
+		}
+
+		options[i] = opt
+	}
+
+	return options
+}

cmd/uc/deploy.go

@@ -0,0 +1,313 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+
+	"charm.land/lipgloss/v2"
+	composecli "github.com/compose-spec/compose-go/v2/cli"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/docker/docker/pkg/stringid"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/logs"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/psviderski/uncloud/pkg/client/compose"
+	"github.com/psviderski/uncloud/pkg/client/deploy"
+	"github.com/psviderski/uncloud/pkg/client/deploy/operation"
+	"github.com/spf13/cobra"
+)
+
+type deployOptions struct {
+	cli.BuildServicesOptions
+
+	files      []string
+	profiles   []string
+	services   []string
+	noBuild    bool
+	recreate   bool
+	skipHealth bool
+	yes        bool
+}
+
+// NewDeployCommand creates a new command to deploy services from a Compose file.
+func NewDeployCommand() *cobra.Command {
+	opts := deployOptions{}
+	cmd := &cobra.Command{
+		Use:   "deploy [FLAGS] [SERVICE...]",
+		Short: "Deploy services from a Compose file.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
+
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			opts.services = args
+
+			return runDeploy(cmd.Context(), uncli, opts)
+		},
+		GroupID: "service",
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			return completion.ComposeServices(cmd.Context(), args, toComplete, opts.files, opts.profiles)
+		},
+	}
+
+	cmd.Flags().StringArrayVar(&opts.BuildServicesOptions.BuildArgs, "build-arg", nil,
+		"Set a build-time variable for services. Used in Dockerfiles that declare the variable with ARG.\n"+
+			"Can be specified multiple times. Format: --build-arg VAR=VALUE")
+	cmd.Flags().BoolVar(&opts.BuildServicesOptions.Pull, "build-pull", false,
+		"Always attempt to pull newer versions of base images before building service images.")
+	cmd.Flags().StringSliceVarP(&opts.files, "file", "f", nil,
+		"One or more Compose files to deploy services from. (default compose.yaml)")
+	cmd.Flags().BoolVar(&opts.noBuild, "no-build", false,
+		"Do not build new images before deploying services.")
+	cmd.Flags().BoolVar(&opts.BuildServicesOptions.NoCache, "no-cache", false,
+		"Do not use cache when building images.")
+	cmd.Flags().StringSliceVarP(&opts.profiles, "profile", "p", nil,
+		"One or more Compose profiles to enable.")
+	cmd.Flags().BoolVar(&opts.recreate, "recreate", false,
+		"Recreate containers even if their configuration and image haven't changed.")
+	cmd.Flags().BoolVar(&opts.skipHealth, "skip-health", false,
+		"Skip the monitoring period and health checks after starting new containers. Useful for faster emergency "+
+			"deployments.\n"+
+			"Warning: This may cause downtime if new containers fail to start properly.")
+	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
+		"Auto-confirm deployment plan. Should be explicitly set when running non-interactively,\n"+
+			"e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")
+
+	// TODO: Consider adding a filter flag to specify which machines to deploy to but keep the rest running.
+	//  Could be useful to test a new version on a subset of machines before rolling out to all.
+
+	return cmd
+}
+
+// runDeploy parses the Compose file(s) and deploys the services.
+func runDeploy(ctx context.Context, uncli *cli.CLI, opts deployOptions) error {
+	project, err := compose.LoadProject(ctx, opts.files, composecli.WithDefaultProfiles(opts.profiles...))
+	if err != nil {
+		return fmt.Errorf("load compose file(s): %w", err)
+	}
+
+	uncli.SetClusterContextIfUnset(compose.ClusterContext(project))
+
+	if len(opts.services) > 0 {
+		// Includes service dependencies by default. This is the default docker compose behavior.
+		project, err = project.WithSelectedServices(opts.services)
+		if err != nil {
+			return fmt.Errorf("select services: %w", err)
+		}
+	}
+
+	servicesToBuild, err := cli.ServicesThatNeedBuild(project, opts.services, false)
+	if err != nil {
+		return fmt.Errorf("determine services to build: %w", err)
+	}
+
+	if len(servicesToBuild) > 0 {
+		if opts.noBuild {
+			fmt.Println("Not building services as requested.")
+		} else {
+			// Build service images without pushing them to cluster yet to not connect to the cluster twice.
+			opts.BuildServicesOptions.Deps = true // build dependencies as deploy includes them by default
+			opts.BuildServicesOptions.Services = opts.services
+
+			if err = uncli.BuildServices(ctx, project, opts.BuildServicesOptions); err != nil {
+				return fmt.Errorf("build services: %w", err)
+			}
+		}
+		fmt.Println()
+	}
+
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	if len(servicesToBuild) > 0 && !opts.noBuild {
+		// Push built service images to cluster machines one at a time.
+		var errs []error
+		for _, s := range servicesToBuild {
+			if s.Image == "" {
+				// Skip services without an image name (shouldn't happen for services with build config).
+				continue
+			}
+
+			// Push to the specified x-machines or to *all* cluster machines if not specified.
+			var pushOpts client.PushImageOptions
+			if machines, ok := s.Extensions[compose.MachinesExtensionKey].(compose.MachinesSource); ok {
+				pushOpts.Machines = machines
+			}
+			if len(pushOpts.Machines) == 0 {
+				pushOpts.AllMachines = true
+			}
+
+			boldStyle := lipgloss.NewStyle().Bold(true)
+			err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+				if err = clusterClient.PushImage(ctx, s.Image, pushOpts); err != nil {
+					return fmt.Errorf("push image '%s' for service '%s': %w", s.Image, s.Name, err)
+				}
+				return nil
+			}, uncli.ProgressOut(), fmt.Sprintf("Pushing image %s to cluster", boldStyle.Render(s.Image)))
+			// Collect errors to try pushing all images.
+			if err != nil {
+				errs = append(errs, err)
+			}
+		}
+
+		if err = errors.Join(errs...); err != nil {
+			return err
+		}
+		fmt.Println()
+	}
+
+	// Resolve 'secret://name' references to actual secret values before creating a deployment.
+	if compose.HasCommandSecretRefs(project) {
+		fmt.Fprintln(os.Stderr, "Resolving secrets...")
+	}
+	if err = compose.ResolveSecrets(ctx, project); err != nil {
+		return fmt.Errorf("resolve secrets: %w", err)
+	}
+
+	strategy := &deploy.RollingStrategy{
+		ForceRecreate:     opts.recreate,
+		SkipHealthMonitor: opts.skipHealth,
+	}
+	composeDeploy, err := compose.NewDeploymentWithStrategy(ctx, clusterClient, project, strategy)
+	if err != nil {
+		return fmt.Errorf("create compose deployment: %w", err)
+	}
+
+	plan, err := composeDeploy.Plan(ctx)
+	if err != nil {
+		return fmt.Errorf("plan deployment: %w", err)
+	}
+
+	if plan.IsEmpty() {
+		fmt.Println("Services are up to date.")
+		return nil
+	}
+
+	fmt.Println(tui.Bold.Underline(true).Render("Deployment plan"))
+	fmt.Println()
+
+	directConn := uncli.DirectConnection()
+	contextName := uncli.ContextOverrideOrCurrent()
+	deployTarget := ""
+	if directConn != "" {
+		deployTarget = directConn
+		fmt.Println(tui.Faint.Render("connection: ") + tui.NameStyle.Render(directConn))
+		fmt.Println()
+	} else if contextName != "" && len(uncli.Config.Contexts) > 1 {
+		// Only show context if there's more than one to avoid unnecessary clutter.
+		deployTarget = contextName
+		fmt.Println(tui.Faint.Render("context: ") + tui.NameStyle.Render(contextName))
+		fmt.Println()
+	}
+
+	fmt.Println(plan.Format())
+
+	// Ask for plan confirmation before proceeding with the deployment unless auto-confirmed with --yes.
+	if !opts.yes {
+		if !tui.IsTerminalAvailable() {
+			return errors.New("cannot ask to confirm deployment plan in non-interactive mode, " +
+				"use --yes flag or set UNCLOUD_AUTO_CONFIRM=true to auto-confirm")
+		}
+
+		title := "Proceed with deployment?"
+		// Include the direct connection or context name in the confirmation prompt to avoid accidentally
+		// deploying to the wrong cluster.
+		if deployTarget != "" {
+			isDark := lipgloss.HasDarkBackground(os.Stdin, os.Stdout)
+			confirmStyle := tui.ThemeConfirm().Theme(isDark).Focused.Title
+			title = "Proceed with deployment to " + tui.NameStyle.Render(deployTarget) + confirmStyle.Render("?")
+		}
+
+		confirmed, err := tui.Confirm(title)
+		if err != nil {
+			return fmt.Errorf("confirm deployment: %w", err)
+		}
+		if !confirmed {
+			return cli.Cancelled("Deploy cancelled. No changes were made.")
+		}
+	}
+
+	title := "Deploying"
+	if deployTarget != "" {
+		title += " to " + tui.NameStyle.Render(deployTarget)
+	}
+	err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+		if err := plan.Execute(ctx, clusterClient); err != nil {
+			return fmt.Errorf("deploy services: %w", err)
+		}
+		return nil
+	}, uncli.ProgressOut(), title)
+	if err != nil {
+		fmt.Println()
+
+		tail := failedContainerLogsTail()
+		if hookErr, ok := errors.AsType[*operation.PreDeployHookError](err); ok {
+			printFailedContainerLogs(ctx, clusterClient,
+				hookErr.ServiceName, hookErr.ContainerID, hookErr.MachineName, tail,
+				fmt.Sprintf("Last %d log lines from failed pre-deploy hook:", tail))
+			fmt.Println()
+		} else if startErr, ok := errors.AsType[*operation.ContainerHealthError](err); ok {
+			printFailedContainerLogs(ctx, clusterClient,
+				startErr.ServiceName, startErr.ContainerID, startErr.MachineName, tail,
+				fmt.Sprintf("Last %d log lines from failed container:", tail))
+			fmt.Println()
+		}
+
+		return err
+	}
+	return nil
+}
+
+// printFailedContainerLogs fetches the last tail log lines from a container that failed during deployment and prints
+// them using the standard log formatter under the provided header.
+func printFailedContainerLogs(
+	ctx context.Context, cli *client.Client, serviceName, containerID, machineName string, tail int, header string,
+) {
+	_, ch, err := cli.ServiceLogs(ctx, serviceName, api.ServiceLogsOptions{
+		Containers: []string{containerID},
+		Machines:   []string{machineName},
+		Tail:       tail,
+	})
+	if err != nil {
+		shortCtrID := stringid.TruncateID(containerID)
+		fmt.Fprintf(os.Stderr, "Failed to fetch container logs '%s/%s': %v\n", serviceName, shortCtrID, err)
+		fmt.Fprintf(os.Stderr, "You can try manually with: uc logs %s/%s\n", serviceName, shortCtrID)
+		return
+	}
+
+	fmt.Println(tui.BoldRed.Render(header))
+
+	logsEmpty := true
+	formatter := logs.NewFormatter([]string{machineName}, []string{serviceName}, false)
+	for entry := range ch {
+		logsEmpty = false
+		formatter.PrintEntry(entry)
+	}
+
+	if logsEmpty {
+		fmt.Println("<no logs available>")
+	}
+}
+
+// defaultFailedContainerLogsTail is the default number of recent log lines to print from a failed container to give
+// the user immediate context without requiring a follow-up 'uc logs' invocation.
+// Overridable via UNCLOUD_FAILED_CONTAINER_LOGS_TAIL.
+const defaultFailedContainerLogsTail = 10
+
+// failedContainerLogsTail returns the number of log lines to fetch from a failed container, honouring the
+// UNCLOUD_FAILED_CONTAINER_LOGS_TAIL environment variable override when set and valid.
+func failedContainerLogsTail() int {
+	if v := os.Getenv("UNCLOUD_FAILED_CONTAINER_LOGS_TAIL"); v != "" {
+		if tail, err := logs.Tail(v); err == nil && (tail == -1 || tail > 0) {
+			return tail
+		}
+	}
+	return defaultFailedContainerLogsTail
+}

cmd/uc/dns/release.go

@@ -4,39 +4,29 @@ import (
 	"context"
 	"errors"
 	"fmt"
+
+	"github.com/psviderski/uncloud/internal/cli"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
-	"uncloud/internal/cli"
 )
 
-type releaseOptions struct {
-	cluster string
-}
-
 func NewReleaseCommand() *cobra.Command {
-	opts := releaseOptions{}
-
 	cmd := &cobra.Command{
 		Use:   "release",
 		Short: "Release the reserved cluster domain.",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
-			return release(cmd.Context(), uncli, opts)
+			return release(cmd.Context(), uncli)
 		},
 	}
 
-	cmd.Flags().StringVarP(
-		&opts.cluster, "cluster", "c", "",
-		"Name of the cluster. (default is the current cluster)",
-	)
-
 	return cmd
 }
 
-func release(ctx context.Context, uncli *cli.CLI, opts releaseOptions) error {
-	client, err := uncli.ConnectCluster(ctx, opts.cluster)
+func release(ctx context.Context, uncli *cli.CLI) error {
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -47,6 +37,7 @@ func release(ctx context.Context, uncli *cli.CLI, opts releaseOptions) error {
 		if status.Convert(err).Code() == codes.NotFound {
 			return errors.New("no domain reserved")
 		}
+		return fmt.Errorf("release cluster domain: %w", err)
 	}
 
 	fmt.Printf("Released cluster domain: %s\n", domain.Name)

cmd/uc/dns/reserve.go

@@ -0,0 +1,71 @@
+package dns
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/psviderski/uncloud/api/pb"
+	"github.com/psviderski/uncloud/cmd/uc/caddy"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+const DefaultUncloudDNSAPIEndpoint = "https://dns.uncloud.run/v1"
+
+type reserveOptions struct {
+	endpoint string
+}
+
+func NewReserveCommand() *cobra.Command {
+	opts := reserveOptions{}
+
+	cmd := &cobra.Command{
+		Use:   "reserve",
+		Short: "Reserve a cluster domain in Uncloud DNS.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return reserve(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringVar(&opts.endpoint, "endpoint", DefaultUncloudDNSAPIEndpoint,
+		"API endpoint for the Uncloud DNS service.")
+
+	return cmd
+}
+
+func reserve(ctx context.Context, uncli *cli.CLI, opts reserveOptions) error {
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	domain, err := clusterClient.ReserveDomain(ctx, &pb.ReserveDomainRequest{Endpoint: opts.endpoint})
+	if err != nil {
+		if status.Convert(err).Code() == codes.AlreadyExists {
+			return errors.New("cluster domain already configured, unset it with 'uc dns set \"\"' " +
+				"or release a reservation with 'uc dns release' first")
+		}
+		return err
+	}
+
+	fmt.Printf("Reserved cluster domain: %s\n", domain.Name)
+
+	// Update cluster domain records in Uncloud DNS to point to machines running caddy service if it has been deployed.
+	if _, err = clusterClient.InspectService(ctx, client.CaddyServiceName); err != nil {
+		if errors.Is(err, api.ErrNotFound) {
+			fmt.Println("Deploy the Caddy reverse proxy service ('uc caddy deploy') to enable internet access " +
+				"to your services via the reserved or your custom domain.")
+			return nil
+		}
+		return fmt.Errorf("inspect caddy service: %w", err)
+	}
+
+	return caddy.UpdateDomainRecords(ctx, clusterClient, uncli.ProgressOut())
+}

cmd/uc/dns/root.go

@@ -0,0 +1,25 @@
+package dns
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func NewRootCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "dns",
+		Short: "Manage the cluster domain.",
+		Long: "Manage the cluster domain.\n" +
+			"DNS commands allow you to reserve or release a unique 'xxxxxx.uncld.dev' domain for your " +
+			"cluster. When reserved, Caddy service deployments will automatically update DNS records to route " +
+			"traffic to the services in the cluster.\n\n" +
+			"EXPERIMENTAL: Use 'uc dns set' to configure an externally managed domain instead. " +
+			"Uncloud does not manage DNS records for manually set domains.",
+	}
+	cmd.AddCommand(
+		NewReleaseCommand(),
+		NewReserveCommand(),
+		NewShowCommand(),
+		NewSetCommand(),
+	)
+	return cmd
+}

cmd/uc/dns/set.go

@@ -0,0 +1,72 @@
+package dns
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/miekg/dns"
+	"github.com/psviderski/uncloud/api/pb"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/internal/grpcversion"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+)
+
+func NewSetCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "set DOMAIN_NAME",
+		Args:  cobra.ExactArgs(1),
+		Short: "Set or unset an externally managed cluster domain (EXPERIMENTAL).",
+		Long: "EXPERIMENTAL: Set the cluster domain used to generate ingress hostnames for services.\n" +
+			"Configure wildcard DNS records for this domain with your DNS provider. " +
+			"Uncloud will not create, verify, update, or delete external DNS records.\n" +
+			"Pass an empty string to unset a manually set domain. " +
+			"Use 'uc dns release' to release a domain reserved in Uncloud DNS. " +
+			"Setting or unsetting the domain does not change existing service hostnames.",
+		Example: "  uc dns set apps.example.com\n  uc dns set \"\"",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return set(cmd.Context(), uncli, args[0])
+		},
+	}
+
+	return cmd
+}
+
+func set(ctx context.Context, uncli *cli.CLI, name string) error {
+	if name != "" {
+		if labels, ok := dns.IsDomainName(name); !ok || labels < 2 {
+			return fmt.Errorf("invalid cluster domain %q: must be a valid domain name with at least two labels", name)
+		}
+	}
+	tui.PrintWarning("Setting an externally managed cluster domain is experimental.")
+
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	ctx = metadata.AppendToOutgoingContext(ctx, grpcversion.MetadataKeyMinServerVersion, "0.21.0")
+	_, err = clusterClient.SetDomain(ctx, &pb.SetDomainRequest{Name: name})
+	if err != nil {
+		if status.Convert(err).Code() == codes.AlreadyExists {
+			return errors.New("cluster domain already configured, unset it with 'uc dns set \"\"' or " +
+				"release a reservation with 'uc dns release' first")
+		}
+		return fmt.Errorf("set cluster domain: %w", err)
+	}
+
+	if name == "" {
+		fmt.Println("Unset cluster domain. External DNS records have not been changed.")
+		return nil
+	}
+	fmt.Printf("Set cluster domain: %s\n", name)
+	fmt.Println("DNS is managed externally. " +
+		"Configure wildcard DNS records pointing to machines running the Caddy service.")
+	return nil
+}

cmd/uc/dns/show.go

@@ -0,0 +1,43 @@
+package dns
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+func NewShowCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "show",
+		Short: "Print the cluster domain name.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return show(cmd.Context(), uncli)
+		},
+	}
+
+	return cmd
+}
+
+func show(ctx context.Context, uncli *cli.CLI) error {
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	domain, err := clusterClient.GetDomain(ctx)
+	if err != nil {
+		if errors.Is(err, api.ErrNotFound) {
+			return errors.New("no cluster domain configured")
+		}
+		return err
+	}
+
+	fmt.Println(domain.Name)
+	return nil
+}

cmd/uc/docs.go

@@ -0,0 +1,151 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/cobra/doc"
+)
+
+const docsDir = "website/docs/9-cli-reference"
+
+type docOptions struct {
+	manual bool
+}
+
+type cmdWrapper struct {
+	cmd *cobra.Command
+}
+
+// NewDocsCommand creates a new hidden command to generate CLI reference docs.
+func NewDocsCommand() *cobra.Command {
+	wrapper := &cmdWrapper{}
+	opts := docOptions{}
+	cmd := &cobra.Command{
+		Use:                   "docs",
+		Short:                 "Generate Uncloud CLI reference docs",
+		SilenceUsage:          true,
+		DisableFlagsInUseLine: true,
+		Hidden:                true,
+		Args:                  cobra.NoArgs,
+		ValidArgsFunction:     cobra.NoFileCompletions,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			if opts.manual {
+				header := &doc.GenManHeader{
+					Title:   "Uncloud",
+					Section: "1",
+					Source:  "Uncloud https://uncloud.run",
+				}
+				if err := doc.GenManTree(cmd.Root(), header, "."); err != nil {
+					return fmt.Errorf("generate CLI manual pages: %w", err)
+				}
+				completionFiles, err := filepath.Glob("uc-completion*.1")
+				if err != nil {
+					return fmt.Errorf("list generated manual pages: %w", err)
+				}
+				for _, f := range completionFiles {
+					if err = os.Remove(f); err != nil {
+						return fmt.Errorf("remove '%s': %w", f, err)
+					}
+				}
+
+				return nil
+			}
+
+			// Remove existing markdown files.
+			mdFiles, err := filepath.Glob(filepath.Join(docsDir, "*.md"))
+			if err != nil {
+				return fmt.Errorf("list existing CLI docs: %w", err)
+			}
+			for _, f := range mdFiles {
+				if err = os.Remove(f); err != nil {
+					return fmt.Errorf("remove '%s': %w", f, err)
+				}
+			}
+
+			// Generate new CLI reference docs.
+			wrapper.cmd.Root().DisableAutoGenTag = true
+			if err := doc.GenMarkdownTree(cmd.Root(), docsDir); err != nil {
+				return fmt.Errorf("generate CLI docs: %w", err)
+			}
+
+			// Remove *completion*.md files that contain malformatted code blocks that break Docusaurus.
+			mdFiles, err = filepath.Glob(filepath.Join(docsDir, "*completion*.md"))
+			if err != nil {
+				return fmt.Errorf("list generated CLI docs: %w", err)
+			}
+			for _, f := range mdFiles {
+				if err = os.Remove(f); err != nil {
+					return fmt.Errorf("remove '%s': %w", f, err)
+				}
+			}
+
+			// Post-process generated markdown files.
+			mdFiles, err = filepath.Glob(filepath.Join(docsDir, "*.md"))
+			if err != nil {
+				return fmt.Errorf("list generated CLI docs: %w", err)
+			}
+
+			for _, f := range mdFiles {
+				if err = postProcessMarkdown(f); err != nil {
+					return fmt.Errorf("post-process '%s': %w", f, err)
+				}
+			}
+
+			return nil
+		},
+	}
+	cmd.Flags().BoolVar(&opts.manual, "manual", false,
+		"Generate Uncloud manual pages in the current directory.")
+
+	wrapper.cmd = cmd
+	return cmd
+}
+
+// postProcessMarkdown applies transformations to generated markdown files.
+func postProcessMarkdown(filename string) error {
+	data, err := os.ReadFile(filename)
+	if err != nil {
+		return err
+	}
+
+	content := string(data)
+
+	// Replace "SEE ALSO" with "See also".
+	content = strings.ReplaceAll(content, "SEE ALSO", "See also")
+	// Escape <id> to avoid Docusaurus treating it as an HTML tag.
+	content = strings.ReplaceAll(content, "<id>", "\\<id>")
+
+	// Remove broken links to completion docs.
+	if strings.Contains(content, "[uc completion") {
+		lines := strings.Split(content, "\n")
+		var filteredLines []string
+		for _, line := range lines {
+			if !strings.Contains(line, "[uc completion") {
+				filteredLines = append(filteredLines, line)
+			}
+		}
+		content = strings.Join(filteredLines, "\n")
+	}
+
+	// Adjust heading levels. Process from shortest to longest to avoid double replacements.
+	replacements := []struct {
+		old, new string
+	}{
+		{`(?m)^## `, `# `},
+		{`(?m)^### `, `## `},
+		{`(?m)^#### `, `### `},
+		{`(?m)^##### `, `#### `},
+	}
+
+	for _, r := range replacements {
+		re := regexp.MustCompile(r.old)
+		content = re.ReplaceAllString(content, r.new)
+	}
+
+	return os.WriteFile(filename, []byte(content), 0o644)
+}

cmd/uc/image/ls.go

@@ -0,0 +1,295 @@
+package image
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"slices"
+	"sort"
+	"strings"
+	"time"
+
+	"charm.land/lipgloss/v2"
+	"github.com/charmbracelet/colorprofile"
+	"github.com/containerd/platforms"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/go-units"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type listOptions struct {
+	machines   []string
+	nameFilter string
+}
+
+func NewListCommand() *cobra.Command {
+	opts := listOptions{}
+
+	cmd := &cobra.Command{
+		Use:     "ls [REPO:[TAG]]",
+		Aliases: []string{"list"},
+		Short:   "List images on machines in the cluster.",
+		Long:    "List images on machines in the cluster. By default, on all machines. Optionally filter by image name.",
+		Example: `  # List all images on all machines.
+  uc image ls
+
+  # List images on specific machine.
+  uc image ls -m machine1
+
+  # List images on multiple machines.
+  uc image ls -m machine1,machine2
+
+  # List images filtered by name (with any tag) on all machines.
+  uc image ls myapp
+
+  # List images filtered by name pattern on specific machine.
+  uc image ls "myapp:1.*" -m machine1`,
+		Args: cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if len(args) > 0 {
+				opts.nameFilter = args[0]
+			}
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return list(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
+		"Filter images by machine name or ID. Can be specified multiple times or as a comma-separated list. "+
+			"(default is include all machines)")
+
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+// imageRow represents a single image with its metadata for display.
+type imageRow struct {
+	id           string
+	name         string
+	platforms    string
+	createdHuman string
+	createdUnix  int64
+	size         string
+	inUse        string
+	store        string
+	machine      string
+}
+
+func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	machines := cli.ExpandCommaSeparatedValues(opts.machines)
+
+	clusterImages, err := clusterClient.ListImages(ctx, api.ImageFilter{
+		Machines: machines,
+		Name:     opts.nameFilter,
+	})
+	if err != nil {
+		return fmt.Errorf("list images: %w", err)
+	}
+
+	// Collect all images from all machines.
+	var rows []imageRow
+
+	for _, machineImages := range clusterImages {
+		if err := machineImages.Error(); err != nil {
+			tui.PrintWarning(fmt.Sprintf("failed to list images on machine '%s': %s",
+				machineImages.Metadata.MachineName, err))
+			continue
+		}
+
+		// Get machine name for better readability.
+		machineName := machineImages.Metadata.MachineName
+
+		store := "docker"
+		if machineImages.ContainerdStore {
+			store = "containerd"
+		}
+
+		// Process each image for this machine.
+		for _, img := range machineImages.Images {
+			// Show the first 12 chars without 'sha256:' as the image ID like Docker does.
+			id := strings.TrimPrefix(img.ID, "sha256:")[:12]
+
+			name := "<none>"
+			if len(img.RepoTags) > 0 && img.RepoTags[0] != "<none>:<none>" {
+				name = img.RepoTags[0]
+			}
+
+			imgPlatforms, _ := imagePlatforms(img)
+			formattedPlatforms := formatPlatforms(imgPlatforms)
+
+			created := ""
+			createdAt := time.Unix(img.Created, 0)
+			if !createdAt.IsZero() {
+				created = units.HumanDuration(time.Now().UTC().Sub(createdAt)) + " ago"
+			}
+
+			size := units.HumanSizeWithPrecision(float64(img.Size), 3)
+
+			// Check if the image is in use by any containers. Only supported by Docker API >=1.51
+			inUse := "-"
+			if img.Containers != -1 { // -1 means the info is not available.
+				if img.Containers > 0 {
+					inUse = lipgloss.NewStyle().Foreground(lipgloss.Color("10")).Render("●")
+				} else {
+					inUse = lipgloss.NewStyle().Foreground(lipgloss.Color("8")).Render("○")
+				}
+			}
+
+			rows = append(rows, imageRow{
+				id:           id,
+				name:         name,
+				platforms:    formattedPlatforms,
+				createdHuman: created,
+				createdUnix:  img.Created,
+				size:         size,
+				inUse:        inUse,
+				store:        store,
+				machine:      machineName,
+			})
+		}
+	}
+
+	if len(rows) == 0 {
+		if opts.nameFilter != "" {
+			fmt.Printf("No images matching '%s' found.\n", opts.nameFilter)
+		} else {
+			fmt.Println("No images found.")
+		}
+		return nil
+	}
+
+	// Sort images by name, then by machine name.
+	sort.Slice(rows, func(i, j int) bool {
+		if rows[i].name != rows[j].name {
+			return rows[i].name < rows[j].name
+		}
+		return rows[i].machine < rows[j].machine
+	})
+
+	// Print the images in a table format.
+	lipgloss.Println(formatImageTable(rows))
+
+	return nil
+}
+
+// imagePlatforms returns a list of platforms supported by the image and a boolean indicating if it's multi-platform.
+func imagePlatforms(img image.Summary) ([]string, bool) {
+	var formattedPlatforms []string
+	multiPlatform := false
+
+	for _, m := range img.Manifests {
+		if m.Kind != image.ManifestKindImage || !m.Available {
+			continue
+		}
+
+		if m.ID != img.ID {
+			// There is an image manifest that has digest different from the main image digest.
+			// This means the image manifest is an index or a manifest list (multi-platform image).
+			multiPlatform = true
+		}
+		formattedPlatforms = append(formattedPlatforms, platforms.Format(m.ImageData.Platform))
+	}
+
+	slices.Sort(formattedPlatforms)
+
+	return formattedPlatforms, multiPlatform
+}
+
+func formatPlatforms(platforms []string) string {
+	if len(platforms) == 0 {
+		return "-"
+	}
+
+	platformStyle := lipgloss.NewStyle().
+		BorderForeground(lipgloss.Color("152")).
+		Foreground(lipgloss.Color("0")).
+		Background(lipgloss.Color("152"))
+	// Use fancy pill borders only if the output is a terminal with color support.
+	if colorprofile.Detect(os.Stdout, os.Environ()) > colorprofile.ASCII {
+		platformStyle = platformStyle.Border(lipgloss.Border{Left: "", Right: ""}, false, true, false, true)
+	}
+
+	styledPlatforms := make([]string, len(platforms))
+	for i, p := range platforms {
+		styledPlatforms[i] = platformStyle.Render(p)
+	}
+
+	return strings.Join(styledPlatforms, " ")
+}
+
+func formatImageTable(rows []imageRow) string {
+	columns := []struct {
+		name string
+		hide bool
+	}{
+		{name: "IMAGE ID"},
+		{name: "NAME"},
+		{name: "PLATFORMS"},
+		{name: "CREATED"},
+		{name: "SIZE"},
+		{name: "IN USE"},
+		{name: "STORE"},
+		{name: "MACHINE"},
+	}
+
+	// Hide the "IN USE" column if none of the images have that info available.
+	inUseInfoAvailable := slices.ContainsFunc(rows, func(r imageRow) bool {
+		return r.inUse != "-"
+	})
+	if !inUseInfoAvailable {
+		// Hide "IN USE" column.
+		columns[5].hide = true
+	}
+
+	// Hide the "STORE" column if all machines use the containerd store.
+	hasNonContainerd := slices.ContainsFunc(rows, func(r imageRow) bool {
+		return r.store != "containerd"
+	})
+	if !hasNonContainerd {
+		columns[6].hide = true
+	}
+
+	t := tui.NewTable()
+
+	var headers []string
+	for _, col := range columns {
+		if !col.hide {
+			headers = append(headers, col.name)
+		}
+	}
+	t.Headers(headers...)
+
+	for _, row := range rows {
+		values := []string{
+			row.id,
+			tui.FormatImage(row.name, tui.NoStyle),
+			row.platforms,
+			row.createdHuman,
+			row.size,
+			row.inUse,
+			row.store,
+			row.machine,
+		}
+		var filteredValues []string
+		for i, v := range values {
+			if !columns[i].hide {
+				filteredValues = append(filteredValues, v)
+			}
+		}
+		t.Row(filteredValues...)
+	}
+
+	return t.String()
+}

cmd/uc/image/push.go

@@ -0,0 +1,97 @@
+package image
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/containerd/platforms"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
+)
+
+type pushOptions struct {
+	image    string
+	machines []string
+	platform string
+}
+
+func NewPushCommand() *cobra.Command {
+	opts := pushOptions{}
+
+	cmd := &cobra.Command{
+		Use:   "push IMAGE",
+		Short: "Upload a local Docker image to the cluster.",
+		Long: `Upload a local Docker image to the cluster transferring only the missing layers.
+The image is uploaded to all cluster machines (default) or the specified machine(s).`,
+		Example: `  # Push image to all machines in the cluster.
+  uc image push myapp:latest
+
+  # Push image to specific machine.
+  uc image push myapp:latest -m machine1
+
+  # Push image to multiple machines.
+  uc image push myapp:latest -m machine1,machine2,machine3
+
+  # Push a specific platform of a multi-platform image.
+  uc image push myapp:latest --platform linux/amd64`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			opts.image = args[0]
+			return push(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
+		"Machine names or IDs to push the image to. Can be specified multiple times or as a comma-separated list. "+
+			"(default is all machines)")
+	cmd.Flags().StringVar(
+		&opts.platform, "platform", "",
+		"Push a specific platform of a multi-platform image (e.g., linux/amd64, linux/arm64).\n"+
+			"Local Docker must be configured to use containerd image store to support multi-platform images.",
+	)
+
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+func push(ctx context.Context, uncli *cli.CLI, opts pushOptions) error {
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	machines := cli.ExpandCommaSeparatedValues(opts.machines)
+	pushOpts := client.PushImageOptions{}
+
+	// Special handling for an explicit "all" keyword to push to all machines.
+	if len(machines) == 1 && machines[0] == "all" {
+		pushOpts.AllMachines = true
+	} else if len(machines) > 0 {
+		pushOpts.Machines = machines
+	} else {
+		// Default is to push to all machines in the cluster.
+		pushOpts.AllMachines = true
+	}
+
+	if opts.platform != "" {
+		p, err := platforms.Parse(opts.platform)
+		if err != nil {
+			return fmt.Errorf("invalid platform '%s': %w", opts.platform, err)
+		}
+		pushOpts.Platform = &p
+	}
+
+	return progress.RunWithTitle(ctx, func(ctx context.Context) error {
+		if err = clusterClient.PushImage(ctx, opts.image, pushOpts); err != nil {
+			return fmt.Errorf("push image to cluster: %w", err)
+		}
+		return nil
+	}, uncli.ProgressOut(), fmt.Sprintf("Pushing image %s to cluster", opts.image))
+}

cmd/uc/image/root.go

@@ -0,0 +1,19 @@
+package image
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func NewRootCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "image",
+		Short: "Manage images on machines in the cluster.",
+	}
+
+	cmd.AddCommand(
+		NewListCommand(),
+		NewPushCommand(),
+	)
+
+	return cmd
+}

cmd/uc/images.go

@@ -0,0 +1,19 @@
+package main
+
+import (
+	"strings"
+
+	"github.com/psviderski/uncloud/cmd/uc/image"
+	"github.com/spf13/cobra"
+)
+
+// NewImagesCommand returns the 'image ls' command modified to work as 'images'.
+func NewImagesCommand() *cobra.Command {
+	listCmd := image.NewListCommand()
+	listCmd.Use = "images [IMAGE]"
+	// Remove 'list' alias since this command is already an alias.
+	listCmd.Aliases = nil
+	listCmd.Example = strings.ReplaceAll(listCmd.Example, "uc image ls", "uc images")
+
+	return listCmd
+}

cmd/uc/machine/add.go

@@ -0,0 +1,267 @@
+package machine
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/netip"
+	"strings"
+	"time"
+
+	"charm.land/lipgloss/v2"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/cmd/uc/caddy"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/internal/machine/network"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
+)
+
+type addOptions struct {
+	name        string
+	noCaddy     bool
+	noInstall   bool
+	publicIP    string
+	sshKey      string
+	version     string
+	wgEndpoints []string
+	wgPort      int
+	wgMTU       int
+	yes         bool
+}
+
+func NewAddCommand() *cobra.Command {
+	opts := addOptions{}
+	cmd := &cobra.Command{
+		Use:   "add [USER@]HOST[:PORT]",
+		Short: "Add a remote machine to a cluster.",
+		Long: `Add a new machine to an existing Uncloud cluster.
+
+By default, it installs Docker and the Uncloud daemon on the machine over SSH unless --no-install
+is specified, which assumes they are already installed and running.
+
+Connection methods:
+  [ssh://]user@host   - Use system 'ssh' command with full SSH config support (default, no prefix required)
+  ssh+go://user@host  - Use Go's built-in SSH library`,
+		Args: cobra.ExactArgs(1),
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
+			cli.BindEnvToFlag(cmd, "version", "UNCLOUD_DAEMON_VERSION")
+			return nil
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			// Determine connection mode and strip scheme.
+			destination := args[0]
+			useSSHGo := strings.HasPrefix(destination, "ssh+go://")
+			destination = strings.TrimPrefix(destination, "ssh+go://")
+			destination = strings.TrimPrefix(destination, "ssh+cli://")
+			destination = strings.TrimPrefix(destination, "ssh://")
+
+			user, host, port, err := config.SSHDestination(destination).Parse()
+			if err != nil {
+				return fmt.Errorf("parse remote machine: %w", err)
+			}
+			remoteMachine := &cli.RemoteMachine{
+				User:     user,
+				Host:     host,
+				Port:     port,
+				KeyPath:  opts.sshKey,
+				UseSSHGo: useSSHGo,
+			}
+
+			return add(cmd.Context(), uncli, remoteMachine, opts)
+		},
+	}
+	cmd.Flags().StringVarP(&opts.name, "name", "n", "",
+		"Assign a name to the machine. (default is the machine's hostname)")
+	cmd.Flags().BoolVar(
+		&opts.noCaddy, "no-caddy", false,
+		"Don't deploy Caddy reverse proxy service to the machine.",
+	)
+	cmd.Flags().BoolVar(
+		&opts.noInstall, "no-install", false,
+		"Skip installation of Docker and the Uncloud daemon on the machine. "+
+			"Assumes they're already installed and running.",
+	)
+	cmd.Flags().StringVar(
+		&opts.publicIP, "public-ip", "auto",
+		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
+			fmt.Sprintf("blank '' or '%s' to disable ingress on this machine, or specify an IP address.", PublicIPNone),
+	)
+	cmd.Flags().StringVarP(
+		&opts.sshKey, "ssh-key", "i", "",
+		fmt.Sprintf("Path to SSH private key for remote login (if not already added to SSH agent). (default %q)",
+			cli.DefaultSSHKeyPath),
+	)
+	cmd.Flags().StringVar(
+		&opts.version, "version", "latest",
+		"Version of the Uncloud daemon to install on the machine. [$UNCLOUD_DAEMON_VERSION]",
+	)
+	cmd.Flags().StringSliceVar(
+		&opts.wgEndpoints, "wg-endpoint", nil,
+		"WireGuard endpoint address that other machines in the cluster should use to establish "+
+			"WireGuard connections\n"+
+			"to this machine. This doesn't change the address/port WireGuard listens on the machine.\n"+
+			"Format: IP, IP:PORT, IPv6, or [IPv6]:PORT. Default port is the value of --wg-port if omitted.\n"+
+			"Multiple endpoints can be specified by repeating the flag or using a comma-separated list.\n"+
+			"Defaults to the auto-detected public and routable machine IPs.",
+	)
+	cmd.Flags().IntVar(
+		&opts.wgMTU, "wg-mtu", 0,
+		"MTU of the WireGuard network interface on the machine. (default auto-detects the optimal value)",
+	)
+	cmd.Flags().IntVar(
+		&opts.wgPort, "wg-port", network.DefaultWireGuardPort,
+		"UDP port WireGuard listens on for incoming connections from other machines.",
+	)
+	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
+		"Auto-confirm prompts (e.g., resetting an already initialised machine).\n"+
+			"Should be explicitly set when running non-interactively, e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")
+
+	return cmd
+}
+
+func add(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine, opts addOptions) error {
+	var publicIP *netip.Addr
+	switch opts.publicIP {
+	case "auto":
+		publicIP = &netip.Addr{}
+	case "", PublicIPNone:
+		publicIP = nil
+	default:
+		ip, err := netip.ParseAddr(opts.publicIP)
+		if err != nil {
+			return fmt.Errorf("parse public IP: %w", err)
+		}
+		publicIP = &ip
+	}
+
+	if opts.wgPort < 1 || opts.wgPort > 65535 {
+		return fmt.Errorf("invalid WireGuard port %d: must be between 1 and 65535", opts.wgPort)
+	}
+	if opts.wgMTU != 0 && (opts.wgMTU < network.MinWireGuardMTU || opts.wgMTU > 65535) {
+		return fmt.Errorf("invalid WireGuard MTU %d: must be 0 (auto-detect) or between %d and 65535",
+			opts.wgMTU, network.MinWireGuardMTU)
+	}
+	addOpts := cli.AddMachineOptions{
+		MachineName:   opts.name,
+		PublicIP:      publicIP,
+		RemoteMachine: remoteMachine,
+		SkipInstall:   opts.noInstall,
+		Version:       opts.version,
+		WireguardMTU:  opts.wgMTU,
+		WireguardPort: opts.wgPort,
+		AutoConfirm:   opts.yes,
+	}
+	if len(opts.wgEndpoints) > 0 {
+		expanded := cli.ExpandCommaSeparatedValues(opts.wgEndpoints)
+		endpoints, err := cli.ParseWireGuardEndpoints(expanded, uint16(opts.wgPort))
+		if err != nil {
+			return fmt.Errorf("parse WireGuard endpoint (--wg-endpoint): %w", err)
+		}
+		addOpts.WireguardEndpoints = endpoints
+	}
+
+	clusterClient, machineClient, err := uncli.AddMachine(ctx, addOpts)
+	if err != nil {
+		return err
+	}
+	defer clusterClient.Close()
+	defer machineClient.Close()
+
+	if opts.noCaddy {
+		return nil
+	}
+
+	// Wait for the cluster to be initialised on the machine to be able to deploy the Caddy service.
+	err = tui.RunSpinner(ctx, "Waiting for the machine to join the cluster...", func(ctx context.Context) error {
+		return machineClient.WaitClusterReady(ctx, 5*time.Minute)
+	})
+	if err != nil {
+		return fmt.Errorf("wait for machine to join the cluster: %w", err)
+	}
+	fmt.Println("Machine joined the cluster.")
+
+	// TODO: scale the existing Caddy service to the new machine instead of running a new deployment
+	//  that may cause a small downtime.
+	// Deploy a Caddy service container to the added machine. If caddy service is already deployed on other machines,
+	// use the deployed image version.
+	// NOTE: We use the cluster client to inspect and scale the Caddy service because the newly added machine may have
+	// issues accessing the API of existing machines in the cluster.
+	// See the issue for more details: https://github.com/psviderski/uncloud/issues/65.
+	caddyImage := ""
+	caddySvc, err := clusterClient.InspectService(ctx, client.CaddyServiceName)
+	if err != nil {
+		if errors.Is(err, api.ErrNotFound) {
+			// Caddy service is not deployed.
+			return nil
+		}
+		return fmt.Errorf("inspect caddy service: %w", err)
+	}
+	caddyImage = caddySvc.Containers[0].Container.Config.Image
+	// Find the latest created container and use its image.
+	var latestCreated time.Time
+	for _, c := range caddySvc.Containers[1:] {
+		created, err := time.Parse(time.RFC3339Nano, c.Container.Created)
+		if err != nil {
+			continue
+		}
+		if created.After(latestCreated) {
+			latestCreated = created
+			caddyImage = c.Container.Config.Image
+		}
+	}
+
+	fmt.Println()
+	fmt.Println("Preparing Caddy deployment...")
+	d, err := clusterClient.Caddy.NewDeployment(ctx, client.CaddyDeploymentOptions{Image: caddyImage})
+	if err != nil {
+		return fmt.Errorf("create caddy deployment: %w", err)
+	}
+
+	plan, err := d.Plan(ctx)
+	if err != nil {
+		return fmt.Errorf("plan caddy deployment: %w", err)
+	}
+
+	if len(plan.Operations) == 0 {
+		fmt.Printf("%s service is up to date.\n", client.CaddyServiceName)
+	} else {
+		fmt.Println(tui.Bold.Underline(true).Render("Deployment plan"))
+		fmt.Println()
+		fmt.Print(plan.Format())
+
+		summary := plan.FormatSummary()
+		fmt.Println(tui.Faint.Render(strings.Repeat("─", lipgloss.Width(summary))))
+		fmt.Println(summary)
+		fmt.Println()
+
+		if !opts.yes {
+			confirmed, err := tui.Confirm("Proceed with deployment?")
+			if err != nil {
+				return fmt.Errorf("confirm deployment: %w", err)
+			}
+			if !confirmed {
+				return cli.Cancelled("Caddy deploy cancelled. The machine has been added to the cluster.")
+			}
+		}
+
+		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+			if _, err = d.Run(ctx); err != nil {
+				return fmt.Errorf("deploy caddy: %w", err)
+			}
+			return nil
+		}, uncli.ProgressOut(), fmt.Sprintf("Deploying service %s (%s mode)", d.Spec.Name, d.Spec.Mode))
+		if err != nil {
+			return err
+		}
+	}
+
+	fmt.Println()
+	return caddy.UpdateDomainRecords(ctx, machineClient, uncli.ProgressOut())
+}

cmd/uc/machine/constants.go

@@ -0,0 +1,6 @@
+package machine
+
+const (
+	// PublicIPNone is the value used to indicate removal of public IP
+	PublicIPNone = "none"
+)

cmd/uc/machine/flags_test.go

@@ -0,0 +1,72 @@
+package machine
+
+import (
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// runVersionFlagEnvTest builds the given command for each case, stubs out RunE so only flag
+// parsing and PreRunE run (no SSH calls), and asserts the resolved --version flag value.
+// Note: cannot use t.Parallel() because subtests use t.Setenv().
+func runVersionFlagEnvTest(t *testing.T, newCommand func() *cobra.Command) {
+	t.Helper()
+
+	tests := []struct {
+		name string
+		args []string
+		env  string
+		want string
+	}{
+		{
+			name: "env var sets version when flag not passed",
+			args: []string{"root@localhost"},
+			env:  "v1.2.3",
+			want: "v1.2.3",
+		},
+		{
+			name: "explicit flag wins over env var",
+			args: []string{"root@localhost", "--version", "v9.9.9"},
+			env:  "v1.2.3",
+			want: "v9.9.9",
+		},
+		{
+			name: "defaults to latest when neither flag nor env var set",
+			args: []string{"root@localhost"},
+			want: "latest",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.env != "" {
+				t.Setenv("UNCLOUD_DAEMON_VERSION", tt.env)
+			}
+
+			cmd := newCommand()
+			cmd.RunE = func(*cobra.Command, []string) error {
+				return nil
+			}
+			cmd.SetArgs(tt.args)
+			require.NoError(t, cmd.Execute())
+
+			version, err := cmd.Flags().GetString("version")
+			require.NoError(t, err)
+			assert.Equal(t, tt.want, version)
+		})
+	}
+}
+
+// TestInitCommandVersionFlagEnvVar verifies that the UNCLOUD_DAEMON_VERSION environment variable
+// is bound to the --version flag of 'machine init', and that an explicit flag wins.
+func TestInitCommandVersionFlagEnvVar(t *testing.T) {
+	runVersionFlagEnvTest(t, NewInitCommand)
+}
+
+// TestAddCommandVersionFlagEnvVar verifies that the UNCLOUD_DAEMON_VERSION environment variable
+// is bound to the --version flag of 'machine add', and that an explicit flag wins.
+func TestAddCommandVersionFlagEnvVar(t *testing.T) {
+	runVersionFlagEnvTest(t, NewAddCommand)
+}

cmd/uc/machine/init.go

@@ -0,0 +1,276 @@
+package machine
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+	"strings"
+	"time"
+
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/api/pb"
+	"github.com/psviderski/uncloud/cmd/uc/caddy"
+	"github.com/psviderski/uncloud/cmd/uc/dns"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/internal/machine/cluster"
+	"github.com/psviderski/uncloud/internal/machine/network"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
+)
+
+type initOptions struct {
+	context     string
+	dnsEndpoint string
+	name        string
+	network     string
+	noCaddy     bool
+	noDNS       bool
+	noInstall   bool
+	publicIP    string
+	sshKey      string
+	version     string
+	wgEndpoints []string
+	wgPort      int
+	wgMTU       int
+	yes         bool
+}
+
+func NewInitCommand() *cobra.Command {
+	opts := initOptions{}
+	cmd := &cobra.Command{
+		Use:   "init [schema://]USER@HOST[:PORT]",
+		Short: "Initialise a new cluster with a remote machine as the first member.",
+		Long: `Initialise a new cluster by setting up a remote machine as the first member.
+This command creates a new context in your Uncloud config to manage the cluster.
+
+By default, it installs Docker and the Uncloud daemon on the machine over SSH unless --no-install
+is specified, which assumes they are already installed and running.
+
+Connection methods:
+  [ssh://]user@host   - Use system 'ssh' command with full SSH config support (default, no prefix required)
+  ssh+go://user@host  - Use Go's built-in SSH library`,
+		Example: `  # Initialise a new cluster with default settings.
+  uc machine init root@<your-server-ip>
+
+  # Initialise with a context name 'prod' in the Uncloud config (~/.config/uncloud/config.yaml) and machine name 'vps1'.
+  uc machine init root@<your-server-ip> -c prod -n vps1
+
+  # Initialise with a non-root user and custom SSH port and key.
+  uc machine init ubuntu@<your-server-ip>:2222 -i ~/.ssh/mykey
+
+  # Initialise without Caddy (no reverse proxy) and without an automatically managed domain name (xxxxxx.uncld.dev).
+  # You can deploy Caddy with 'uc caddy deploy' and reserve a domain with 'uc dns reserve' later.
+  uc machine init root@<your-server-ip> --no-caddy --no-dns`,
+		// TODO: support initialising a cluster on the local machine.
+		Args: cobra.MaximumNArgs(1),
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
+			cli.BindEnvToFlag(cmd, "version", "UNCLOUD_DAEMON_VERSION")
+			return nil
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			var remoteMachine *cli.RemoteMachine
+			if len(args) > 0 {
+				// Determine connection mode and strip scheme.
+				destination := args[0]
+				useSSHGo := strings.HasPrefix(destination, "ssh+go://")
+				destination = strings.TrimPrefix(destination, "ssh+go://")
+				destination = strings.TrimPrefix(destination, "ssh+cli://")
+				destination = strings.TrimPrefix(destination, "ssh://")
+
+				user, host, port, err := config.SSHDestination(destination).Parse()
+				if err != nil {
+					return fmt.Errorf("parse remote machine: %w", err)
+				}
+				remoteMachine = &cli.RemoteMachine{
+					User:     user,
+					Host:     host,
+					Port:     port,
+					KeyPath:  opts.sshKey,
+					UseSSHGo: useSSHGo,
+				}
+			}
+
+			return initCluster(cmd.Context(), uncli, remoteMachine, opts)
+		},
+	}
+
+	cmd.Flags().StringVarP(
+		&opts.context, "context", "c", cli.DefaultContextName,
+		"Name of the new context to be created in the Uncloud config to manage the cluster.",
+	)
+	cmd.Flags().StringVar(&opts.dnsEndpoint, "dns-endpoint", dns.DefaultUncloudDNSAPIEndpoint,
+		"API endpoint for the Uncloud DNS service.")
+	cmd.Flags().StringVarP(
+		&opts.name, "name", "n", "",
+		"Assign a name to the machine. (default is the machine's hostname)",
+	)
+	cmd.Flags().StringVar(
+		&opts.network, "network", cluster.DefaultNetwork.String(),
+		"IPv4 network CIDR to use for machines and services.",
+	)
+	cmd.Flags().BoolVar(
+		&opts.noCaddy, "no-caddy", false,
+		"Don't deploy Caddy reverse proxy service to the machine. You can deploy it later with 'uc caddy deploy'.",
+	)
+	cmd.Flags().BoolVar(
+		&opts.noDNS, "no-dns", false,
+		"Don't reserve a cluster domain in Uncloud DNS. You can reserve it later with 'uc dns reserve'.",
+	)
+	cmd.Flags().BoolVar(
+		&opts.noInstall, "no-install", false,
+		"Skip installation of Docker and the Uncloud daemon on the machine. "+
+			"Assumes they're already installed and running.",
+	)
+	cmd.Flags().StringVar(
+		&opts.publicIP, "public-ip", "auto",
+		"Public IP address of the machine for ingress configuration. Use 'auto' for automatic detection, "+
+			fmt.Sprintf("blank '' or '%s' to disable ingress on this machine, or specify an IP address.", PublicIPNone),
+	)
+	cmd.Flags().StringVarP(
+		&opts.sshKey, "ssh-key", "i", "",
+		fmt.Sprintf("Path to SSH private key for remote login (if not already added to SSH agent). (default %q)",
+			cli.DefaultSSHKeyPath),
+	)
+	cmd.Flags().StringVar(
+		&opts.version, "version", "latest",
+		"Version of the Uncloud daemon to install on the machine. [$UNCLOUD_DAEMON_VERSION]",
+	)
+	cmd.Flags().StringSliceVar(
+		&opts.wgEndpoints, "wg-endpoint", nil,
+		"WireGuard endpoint address that other machines in the cluster should use to establish "+
+			"WireGuard connections\n"+
+			"to this machine. This doesn't change the address/port WireGuard listens on the machine.\n"+
+			"Format: IP, IP:PORT, IPv6, or [IPv6]:PORT. Default port is the value of --wg-port if omitted.\n"+
+			"Multiple endpoints can be specified by repeating the flag or using a comma-separated list.\n"+
+			"Defaults to the auto-detected public and routable machine IPs.",
+	)
+	cmd.Flags().IntVar(
+		&opts.wgMTU, "wg-mtu", 0,
+		"MTU of the WireGuard network interface on the machine. (default auto-detects the optimal value)",
+	)
+	cmd.Flags().IntVar(
+		&opts.wgPort, "wg-port", network.DefaultWireGuardPort,
+		"UDP port WireGuard listens on for incoming connections from other machines.",
+	)
+	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
+		"Auto-confirm prompts (e.g., resetting an already initialised machine).\n"+
+			"Should be explicitly set when running non-interactively, e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")
+
+	return cmd
+}
+
+func initCluster(ctx context.Context, uncli *cli.CLI, remoteMachine *cli.RemoteMachine, opts initOptions) error {
+	if uncli.Config == nil {
+		// Config is nil when connecting directly to a remote machine (--connect) without using Uncloud config
+		// or when being logged in on a machine and using the uncloud socket directly.
+		return fmt.Errorf(
+			"do not use --connect when initialising a new cluster: --connect is for overriding the connection " +
+				"to an existing cluster, but 'machine init' creates a new one and writes the new cluster context " +
+				"to the Uncloud config file (--uncloud-config), when logged in on a cluster machine, 'machine init' " +
+				"is not supported")
+	}
+
+	netPrefix, err := netip.ParsePrefix(opts.network)
+	if err != nil {
+		return fmt.Errorf("parse network CIDR: %w", err)
+	}
+
+	var publicIP *netip.Addr
+	switch opts.publicIP {
+	case "auto":
+		publicIP = &netip.Addr{}
+	case "", PublicIPNone:
+		publicIP = nil
+	default:
+		ip, err := netip.ParseAddr(opts.publicIP)
+		if err != nil {
+			return fmt.Errorf("parse public IP: %w", err)
+		}
+		publicIP = &ip
+	}
+	if opts.wgPort < 1 || opts.wgPort > 65535 {
+		return fmt.Errorf("invalid WireGuard port %d: must be between 1 and 65535", opts.wgPort)
+	}
+	if opts.wgMTU != 0 && (opts.wgMTU < network.MinWireGuardMTU || opts.wgMTU > 65535) {
+		return fmt.Errorf("invalid WireGuard MTU %d: must be 0 (auto-detect) or between %d and 65535",
+			opts.wgMTU, network.MinWireGuardMTU)
+	}
+	initOpts := cli.InitClusterOptions{
+		Context:       opts.context,
+		MachineName:   opts.name,
+		Network:       netPrefix,
+		PublicIP:      publicIP,
+		RemoteMachine: remoteMachine,
+		SkipInstall:   opts.noInstall,
+		Version:       opts.version,
+		WireguardMTU:  opts.wgMTU,
+		WireguardPort: opts.wgPort,
+		AutoConfirm:   opts.yes,
+	}
+	if len(opts.wgEndpoints) > 0 {
+		expanded := cli.ExpandCommaSeparatedValues(opts.wgEndpoints)
+		endpoints, err := cli.ParseWireGuardEndpoints(expanded, uint16(opts.wgPort))
+		if err != nil {
+			return fmt.Errorf("parse WireGuard endpoint (--wg-endpoint): %w", err)
+		}
+		initOpts.WireguardEndpoints = endpoints
+	}
+
+	clusterClient, err := uncli.InitCluster(ctx, initOpts)
+	if err != nil {
+		return err
+	}
+	defer clusterClient.Close()
+
+	// Since the cluster API needs a few moments to become ready after cluster initialisation,
+	// we keep the user informed during this wait. We wait here even if no Caddy or DNS is requested
+	// as the cluster needs to be ready so that commands such as 'uc machine ls' work immediately after init.
+	err = tui.RunSpinner(ctx, "Waiting for the cluster to be ready...", func(ctx context.Context) error {
+		return clusterClient.WaitClusterReady(ctx, 1*time.Minute)
+	})
+	if err != nil {
+		return fmt.Errorf("wait for cluster to be ready: %w", err)
+	}
+	fmt.Println("Cluster is ready.")
+
+	if opts.noCaddy && opts.noDNS {
+		return nil
+	}
+
+	fmt.Println()
+
+	if !opts.noDNS {
+		domain, err := clusterClient.ReserveDomain(ctx, &pb.ReserveDomainRequest{Endpoint: opts.dnsEndpoint})
+		if err != nil {
+			return fmt.Errorf("reserve cluster domain in Uncloud DNS: %w", err)
+		}
+		fmt.Printf("Reserved cluster domain: %s\n", domain.Name)
+	}
+
+	if !opts.noCaddy {
+		d, err := clusterClient.Caddy.NewDeployment(ctx, client.CaddyDeploymentOptions{})
+		if err != nil {
+			return fmt.Errorf("create caddy deployment: %w", err)
+		}
+
+		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+			if _, err = d.Run(ctx); err != nil {
+				return fmt.Errorf("deploy caddy: %w", err)
+			}
+			return nil
+		}, uncli.ProgressOut(), fmt.Sprintf("Deploying service %s", d.Spec.Name))
+		if err != nil {
+			return err
+		}
+
+		fmt.Println()
+		return caddy.UpdateDomainRecords(ctx, clusterClient, uncli.ProgressOut())
+	}
+
+	return nil
+}

cmd/uc/machine/logs.go

@@ -0,0 +1,136 @@
+package machine
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/logs"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
+)
+
+func NewLogsCommand() *cobra.Command {
+	var options logs.Options
+
+	cmd := &cobra.Command{
+		Use:     "logs [SERVICE...]",
+		Aliases: []string{"log"},
+		Short:   "View system service logs.",
+		Long: `View logs from the specified system service(s) across all machines in the cluster.
+Use -m to restrict to specific machines.
+
+Supported services:
+  corrosion  the Corrosion distributed state store
+  docker     the Docker daemon
+  uncloud    the Uncloud daemon
+
+If no services are specified, streams logs from the uncloud service.`,
+		Example: `  # View recent logs for the uncloud service.
+  uc machine logs
+  uc machine logs uncloud
+
+  # Stream logs in real-time (follow mode).
+  uc machine logs -f uncloud
+
+  # View logs from multiple services.
+  uc machine logs uncloud docker corrosion
+
+  # Show last 20 lines per machine (default is 100).
+  uc machine logs -n 20 docker
+
+  # Show all logs without line limit.
+  uc machine logs -n all docker
+
+  # View logs from a specific time range.
+  uc machine logs --since 3h --until 1h30m docker
+
+  # View logs only from specific machines.
+  uc machine logs -m machine1,machine2 uncloud corrosion`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return runLogs(cmd.Context(), uncli, args, options)
+		},
+	}
+
+	cmd.Flags().AddFlagSet(logs.Flags(&options))
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+func runLogs(ctx context.Context, uncli *cli.CLI, services []string, opts logs.Options) error {
+	if len(services) == 0 {
+		services = []string{api.SystemServiceUncloud}
+	}
+	for _, service := range services {
+		if !slices.Contains(api.SystemServices, service) {
+			return fmt.Errorf("invalid system service '%s'; valid services: %s",
+				service, strings.Join(api.SystemServices, ", "))
+		}
+	}
+
+	tail, err := logs.Tail(opts.Tail)
+	if err != nil {
+		return err
+	}
+
+	c, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer c.Close()
+
+	logsOpts := api.ServiceLogsOptions{
+		Follow:   opts.Follow,
+		Tail:     tail,
+		Since:    opts.Since,
+		Until:    opts.Until,
+		Machines: cli.ExpandCommaSeparatedValues(opts.Machines),
+	}
+
+	// Resolve machine records for the formatter's column width computation.
+	machines, err := c.ListMachines(ctx, &api.MachineFilter{
+		NamesOrIDs: logsOpts.Machines,
+	})
+	if err != nil {
+		return fmt.Errorf("list machines: %w", err)
+	}
+	machineNames := make([]string, 0, len(machines))
+	for _, m := range machines {
+		machineNames = append(machineNames, m.Machine.Name)
+	}
+
+	// Collect one log stream per service. MachineLogs merges across machines internally.
+	serviceStreams := make([]<-chan api.ServiceLogEntry, 0, len(services))
+	for _, service := range services {
+		ch, err := c.MachineLogs(ctx, service, logsOpts)
+		if err != nil {
+			return fmt.Errorf("stream logs for system service '%s': %w", service, err)
+		}
+		serviceStreams = append(serviceStreams, ch)
+	}
+
+	var stream <-chan api.ServiceLogEntry
+	if len(serviceStreams) == 1 {
+		stream = serviceStreams[0]
+	} else {
+		// Each MachineLogs stream already runs its own inner merger with stall detection,
+		// so the outer merger across services skips it to avoid duplicate warnings.
+		merger := client.NewLogMerger(serviceStreams, client.LogMergerOptions{})
+		stream = merger.Stream()
+	}
+
+	formatter := logs.NewFormatter(machineNames, services, opts.UTC)
+
+	// Print merged logs.
+	for entry := range stream {
+		formatter.PrintEntry(entry)
+	}
+
+	return nil
+}

cmd/uc/machine/ls.go

@@ -0,0 +1,132 @@
+package machine
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/netip"
+	"strings"
+
+	"charm.land/lipgloss/v2"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/internal/machine/network"
+	"github.com/spf13/cobra"
+)
+
+func NewListCommand() *cobra.Command {
+	var output string
+
+	cmd := &cobra.Command{
+		Use:     "ls",
+		Aliases: []string{"list"},
+		Short:   "List machines in a cluster.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return list(cmd.Context(), uncli, output)
+		},
+	}
+
+	cmd.Flags().StringVarP(&output, "output", "o", "",
+		"Output format: 'json' or empty for a human-readable table.")
+
+	return cmd
+}
+
+func list(ctx context.Context, uncli *cli.CLI, output string) error {
+	if output != "" && output != "json" {
+		return fmt.Errorf("unsupported output format '%s' (supported: json)", output)
+	}
+
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	machines, err := client.ListMachines(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("list machines: %w", err)
+	}
+
+	if output == "json" {
+		data, err := json.MarshalIndent(machines.ToNative(), "", "  ")
+		if err != nil {
+			return fmt.Errorf("marshal machines: %w", err)
+		}
+		fmt.Println(string(data))
+		return nil
+	}
+
+	// Print the list of machines in a table format.
+	t := tui.NewTable()
+	t.Headers("NAME", "STATE", "ADDRESS", "PUBLIC IP", "WIREGUARD ENDPOINTS",
+		"OS", "KERNEL", "ARCH", "DOCKER", "VERSION")
+
+	for _, member := range machines {
+		m := member.Machine
+		subnet, _ := m.Network.Subnet.ToPrefix()
+		subnet = netip.PrefixFrom(network.MachineIP(subnet), subnet.Bits())
+
+		publicIP := "-"
+		if m.PublicIp != nil {
+			ip, _ := m.PublicIp.ToAddr()
+			publicIP = ip.String()
+		}
+
+		endpoints := make([]string, len(m.Network.Endpoints))
+		for i, ep := range m.Network.Endpoints {
+			addrPort, _ := ep.ToAddrPort()
+			endpoints[i] = addrPort.String()
+		}
+
+		arch := "-"
+		if m.Arch != "" {
+			arch = m.Arch
+		}
+
+		osName := "-"
+		if m.OsPrettyName != "" {
+			osName = m.OsPrettyName
+		}
+
+		kernel := "-"
+		if m.KernelVersion != "" {
+			kernel = m.KernelVersion
+		}
+
+		daemonVersion := "-"
+		if m.DaemonVersion != "" {
+			daemonVersion = m.DaemonVersion
+		}
+
+		dockerVersion := "-"
+		if m.DockerVersion != "" {
+			dockerVersion = m.DockerVersion
+		}
+
+		t.Row(
+			m.Name,
+			capitalise(member.State.String()),
+			subnet.String(),
+			publicIP,
+			strings.Join(endpoints, tui.Faint.Render(", ")),
+			osName,
+			kernel,
+			arch,
+			dockerVersion,
+			daemonVersion,
+		)
+	}
+
+	lipgloss.Println(t)
+	return nil
+}
+
+// capitalise returns a string where the first character is upper case, and the rest is lower case.
+func capitalise(s string) string {
+	if s == "" {
+		return ""
+	}
+	return strings.ToUpper(s[:1]) + strings.ToLower(s[1:])
+}

cmd/uc/machine/rename.go

@@ -0,0 +1,42 @@
+package machine
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/spf13/cobra"
+)
+
+func NewRenameCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "rename OLD_NAME NEW_NAME",
+		Short: "Rename a machine in the cluster.",
+		Long: `Rename a machine in the cluster.
+
+This command changes the name of an existing machine while preserving all other
+configuration including network settings, public IP, and cluster membership.`,
+		Args: cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return rename(cmd.Context(), uncli, args[0], args[1])
+		},
+	}
+	return cmd
+}
+
+func rename(ctx context.Context, uncli *cli.CLI, oldName, newName string) error {
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return err
+	}
+	defer client.Close()
+
+	machine, err := client.RenameMachine(ctx, oldName, newName)
+	if err != nil {
+		return fmt.Errorf("rename machine: %w", err)
+	}
+
+	fmt.Printf("Machine %q renamed to %q (ID: %s)\n", oldName, machine.Name, machine.Id)
+	return nil
+}

cmd/uc/machine/rm.go

@@ -0,0 +1,273 @@
+package machine
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+
+	"charm.land/lipgloss/v2"
+	"charm.land/lipgloss/v2/tree"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/docker/docker/api/types/container"
+	"github.com/psviderski/uncloud/api/pb"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type removeOptions struct {
+	noReset bool
+	yes     bool
+}
+
+func NewRmCommand() *cobra.Command {
+	opts := removeOptions{}
+
+	cmd := &cobra.Command{
+		Use:     "rm MACHINE",
+		Aliases: []string{"remove", "delete"},
+		Short:   "Remove a machine from a cluster and reset it.",
+		Args:    cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return remove(cmd.Context(), uncli, args[0], opts)
+		},
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			if len(args) > 0 {
+				return nil, cobra.ShellCompDirectiveNoFileComp
+			}
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Machines(cmd.Context(), uncli, args, toComplete)
+		},
+	}
+
+	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
+		"Do not prompt for confirmation before removing the machine.")
+	cmd.Flags().BoolVar(&opts.noReset, "no-reset", false,
+		"Do not reset the machine after removing it from the cluster. This will leave all containers and data intact.")
+
+	return cmd
+}
+
+func remove(ctx context.Context, uncli *cli.CLI, nameOrID string, opts removeOptions) error {
+	// TODO: automatically choose a connection to the machine that is not being removed.
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	// Verify the machine exists in the cluster.
+	member, err := client.InspectMachine(ctx, nameOrID)
+	if err != nil {
+		return fmt.Errorf("inspect machine '%s': %w", nameOrID, err)
+	}
+	m := member.Machine
+
+	// Create a proxy context for the machine being removed.
+	// This is used for calls that need to run directly on that machine.
+	rmCtx := client.ProxySingleMachineContext(ctx, m.Id)
+
+	// Verify if the machine being removed is the proxy machine we're connected to.
+	proxyMachine, err := client.MachineClient.Inspect(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("inspect proxy machine: %w", err)
+	}
+	if proxyMachine.Id == m.Id {
+		allMachines, err := client.ListMachines(ctx, nil)
+		if err != nil {
+			return fmt.Errorf("list machines: %w", err)
+		}
+		if len(allMachines) > 1 {
+			return fmt.Errorf("cannot remove the machine you are currently connected to. "+
+				"Please connect to another machine in the cluster and try again. "+
+				"Change the default connection for the current cluster using 'uc ctx conn' or "+
+				"manually update 'connections' in your Uncloud config (%s). "+
+				"For more information on connecting to a cluster, see "+
+				"https://uncloud.run/docs/concepts/clusters/connecting/", uncli.Config.Path())
+			// It's ok to remove the proxy machine if it's the last one in the cluster.
+		}
+	}
+
+	// TODO: mark the machine as being removed and unschedulable when this is possible to prevent new containers
+	//  from being scheduled on it while the removal is in progress.
+
+	reset := !opts.noReset
+	var containers []api.ServiceContainer
+	reachable := false
+	if reset {
+		// Check if the machine is up and has service containers.
+		listOpts := container.ListOptions{All: true}
+		machineContainers, err := client.Docker.ListServiceContainers(rmCtx, "", listOpts)
+		if err == nil {
+			reachable = true
+			containers = machineContainers[0].Containers
+			if len(containers) > 0 {
+				plural := ""
+				if len(containers) > 1 {
+					plural = "s"
+				}
+				fmt.Printf("Found %d service container%s on machine '%s':\n", len(containers), plural, m.Name)
+				lipgloss.Println(formatContainerTree(containers))
+				fmt.Println()
+				fmt.Println("This will remove all service containers from the machine, remove it from the cluster, " +
+					"and reset it to the uninitialised state.")
+			} else {
+				fmt.Printf("No service containers found on machine '%s'.\n", m.Name)
+				fmt.Println("This will remove the machine from the cluster and reset it to the uninitialised state.")
+			}
+		} else {
+			fmt.Printf("This will remove machine '%s' from the cluster without resetting it as it's unreachable.\n",
+				m.Name)
+		}
+	} else {
+		fmt.Printf("This will remove machine '%s' from the cluster without resetting it.\n", m.Name)
+	}
+
+	if !opts.yes {
+		confirmed, err := tui.Confirm("")
+		if err != nil {
+			return fmt.Errorf("confirm removal: %w", err)
+		}
+		if !confirmed {
+			return cli.Cancelled("Cancelled. Machine was not removed.")
+		}
+	}
+
+	if reset && len(containers) > 0 {
+		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+			return removeContainers(ctx, client, containers)
+		}, uncli.ProgressOut(), "Removing containers")
+		if err != nil {
+			return fmt.Errorf("remove containers: %w", err)
+		}
+		fmt.Println()
+	}
+
+	// Initiate reset before removing the machine from the cluster to stop it from updating the cluster store.
+	// This is still optimistic as Reset only triggers the reset process that runs asynchronously.
+	if reset && reachable {
+		_, err = client.MachineClient.Reset(rmCtx, &pb.ResetRequest{})
+		if err != nil {
+			tui.PrintWarning(fmt.Sprintf("Failed to reset machine: %v\n", err))
+		} else {
+			fmt.Println("Machine reset initiated and will complete in the background.")
+		}
+	}
+
+	if _, err = client.RemoveMachine(ctx, &pb.RemoveMachineRequest{Id: m.Id}); err != nil {
+		return fmt.Errorf("remove machine from cluster: %w", err)
+	}
+	fmt.Printf("Machine '%s' removed from the cluster.\n", m.Name)
+
+	// Remove the connection to the machine from the uncloud config if it exists.
+	if uncli.Config != nil {
+		contextName := uncli.ContextOverrideOrCurrent()
+		if context, ok := uncli.Config.Contexts[contextName]; ok {
+			for i, c := range context.Connections {
+				if c.MachineID == m.Id {
+					context.Connections = slices.Delete(context.Connections, i, i+1)
+					break
+				}
+			}
+			if err := uncli.Config.Save(); err != nil {
+				return fmt.Errorf("save config: %w", err)
+			}
+		}
+	}
+
+	// TODO: If Caddy was running on this machine and a cluster domain is reserved,
+	//  let the user know that the DNS records should be updated.
+
+	return nil
+}
+
+// formatContainerTree formats a list of containers grouped by service as a tree structure.
+func formatContainerTree(containers []api.ServiceContainer) string {
+	if len(containers) == 0 {
+		return ""
+	}
+
+	// Group containers by service.
+	serviceContainers := make(map[string][]api.ServiceContainer)
+	for _, ctr := range containers {
+		serviceName := ctr.ServiceName()
+		serviceContainers[serviceName] = append(serviceContainers[serviceName], ctr)
+	}
+
+	// Build tree output.
+	var output []string
+	serviceNames := slices.Sorted(maps.Keys(serviceContainers))
+	for _, serviceName := range serviceNames {
+		ctrs := serviceContainers[serviceName]
+		mode := ctrs[0].ServiceMode()
+
+		// Format a tree for the service with its containers.
+		plural := ""
+		if len(ctrs) > 1 {
+			plural = "s"
+		}
+		t := tree.Root(fmt.Sprintf("• %s (%s, %d container%s)", serviceName, mode, len(ctrs), plural)).
+			EnumeratorStyle(lipgloss.NewStyle().MarginLeft(2).MarginRight(1))
+
+		// Add containers as children.
+		for _, ctr := range ctrs {
+			state, _ := ctr.HumanState()
+			info := fmt.Sprintf("%s • %s • %s", ctr.Name, tui.FormatImage(ctr.Config.Image, tui.NoStyle), state)
+			t.Child(info)
+		}
+
+		output = append(output, t.String())
+	}
+
+	return strings.Join(output, "\n")
+}
+
+// removeContainers removes the given service containers from the machine.
+func removeContainers(ctx context.Context, client api.Client, containers []api.ServiceContainer) error {
+	if len(containers) == 0 {
+		return nil
+	}
+
+	wg := sync.WaitGroup{}
+	errCh := make(chan error)
+
+	for _, ctr := range containers {
+		wg.Add(1)
+		go func(c api.ServiceContainer) {
+			defer wg.Done()
+
+			// Gracefully stop the container before removing it.
+			err := client.StopContainer(ctx, c.ServiceID(), c.ID, container.StopOptions{})
+			if err != nil && !errors.Is(err, api.ErrNotFound) {
+				errCh <- fmt.Errorf("stop container '%s': %w", c.ID, err)
+			}
+
+			err = client.RemoveContainer(ctx, c.ServiceID(), c.ID, container.RemoveOptions{
+				// Remove anonymous volumes created by the container.
+				RemoveVolumes: true,
+			})
+			if err != nil && !errors.Is(err, api.ErrNotFound) {
+				errCh <- fmt.Errorf("remove container '%s': %w", c.ID, err)
+			}
+		}(ctr)
+	}
+
+	go func() {
+		wg.Wait()
+		close(errCh)
+	}()
+
+	var err error
+	for e := range errCh {
+		err = errors.Join(err, e)
+	}
+
+	return err
+}

cmd/uc/machine/root.go

@@ -6,14 +6,19 @@ import (
 
 func NewRootCommand() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "machine",
-		Short: "Manage machines in an Uncloud cluster.",
+		Use:     "machine",
+		Aliases: []string{"m"},
+		Short:   "Manage machines in the cluster.",
 	}
 	cmd.AddCommand(
 		NewAddCommand(),
 		NewInitCommand(),
 		NewListCommand(),
-		NewTokenCommand(),
+		NewLogsCommand(),
+		NewRenameCommand(),
+		NewRmCommand(),
+		NewRTTCommand(),
+		NewUpdateCommand(),
 	)
 	return cmd
 }

cmd/uc/machine/rtt.go

@@ -0,0 +1,118 @@
+package machine
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"time"
+
+	"charm.land/lipgloss/v2"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/spf13/cobra"
+	"google.golang.org/protobuf/types/known/emptypb"
+)
+
+func NewRTTCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "rtt",
+		Short: "Show round-trip times between machines.",
+		Long: `Show round-trip times between machines.
+
+Round-trip time statistics are collected from the Corrosion gossip protocol
+and represent the median of recent RTT samples between each pair of machines
+in the cluster. The values shown include the median RTT and standard deviation
+for each machine-to-machine connection.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return rtt(cmd.Context(), uncli)
+		},
+	}
+	return cmd
+}
+
+func rtt(ctx context.Context, uncli *cli.CLI) error {
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	// Setup context to proxy request to all machines.
+	ctx = client.ProxyMachinesContext(ctx, nil)
+
+	resp, err := client.MachineClient.InspectMachine(ctx, &emptypb.Empty{})
+	if err != nil {
+		return fmt.Errorf("inspect machines: %w", err)
+	}
+
+	// Map machine IDs to names for display from the response.
+	machineNames := make(map[string]string)
+	for _, m := range resp.Machines {
+		// NOTE: Metadata should never be nil in practice. This is legacy fallback that will be removed.
+		if m.Metadata == nil {
+			tui.PrintWarning("metadata is missing in response from unknown server")
+			continue
+		}
+		if m.Metadata.Error != "" {
+			tui.PrintWarning(fmt.Sprintf("failed to inspect machine '%s': %s", m.Metadata.MachineName, m.Metadata.Error))
+			continue
+		}
+		if m.Machine == nil {
+			continue
+		}
+		machineNames[m.Machine.Id] = m.Machine.Name
+	}
+
+	type row struct {
+		machine string
+		peer    string
+		median  time.Duration
+		stdDev  time.Duration
+	}
+	var rows []row
+
+	for _, m := range resp.Machines {
+		// Unlikely to occur, but might be a possible edge case when
+		// a machine is still initializing. So just to be safe.
+		if m.Machine == nil || m.Rtts == nil {
+			continue
+		}
+		for peerID, stats := range m.Rtts {
+			peerName := peerID
+			if name, ok := machineNames[peerID]; ok {
+				peerName = name
+			}
+			rows = append(rows, row{
+				machine: m.Machine.Name,
+				peer:    peerName,
+				median:  stats.Median.AsDuration(),
+				stdDev:  stats.StdDev.AsDuration(),
+			})
+		}
+	}
+
+	// Sort by machine name then peer name.
+	sort.Slice(rows, func(i, j int) bool {
+		if rows[i].machine == rows[j].machine {
+			return rows[i].peer < rows[j].peer
+		}
+		return rows[i].machine < rows[j].machine
+	})
+
+	// Print table.
+	t := tui.NewTable()
+	t.Headers("MACHINE", "PEER", "MEDIAN", "STDDEV")
+
+	for _, r := range rows {
+		t.Row(r.machine, r.peer, tui.FormatRTT(r.median), formatRTTStdDev(r.stdDev))
+	}
+
+	lipgloss.Println(t)
+	return nil
+}
+
+// formatRTTStdDev formats a round-trip time standard deviation with one decimal place, e.g. "±19.4ms".
+func formatRTTStdDev(d time.Duration) string {
+	return fmt.Sprintf("±%.1fms", float64(d)/float64(time.Millisecond))
+}

cmd/uc/machine/update.go

@@ -0,0 +1,180 @@
+package machine
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+	"strings"
+
+	"github.com/psviderski/uncloud/api/pb"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/machine/network"
+	"github.com/spf13/cobra"
+)
+
+type updateOptions struct {
+	name        string
+	publicIP    string
+	wgEndpoints []string
+}
+
+func NewUpdateCommand() *cobra.Command {
+	opts := updateOptions{}
+	cmd := &cobra.Command{
+		Use:   "update MACHINE [flags]",
+		Short: "Update machine configuration in the cluster.",
+		Long: `Update machine configuration in the cluster.
+
+Change the name, public IP address, or WireGuard endpoints of an existing machine.
+At least one flag must be specified to perform an update.`,
+		Example: `  # Rename a machine.
+  uc machine update machine1 --name web-server
+
+  # Set the public IP address of a machine.
+  uc machine update machine1 --public-ip 203.0.113.10
+
+  # Remove the public IP address from a machine.
+  uc machine update machine1 --public-ip none
+
+  # Update WireGuard endpoints for a machine.
+  uc machine update machine1 --wg-endpoint 203.0.113.10 --wg-endpoint 192.168.1.5
+
+  # Update multiple properties at once.
+  uc machine update machine1 --name web-server --public-ip 203.0.113.10`,
+		Args: cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return update(cmd.Context(), uncli, cmd, opts, args[0])
+		},
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			if len(args) > 0 {
+				return nil, cobra.ShellCompDirectiveNoFileComp
+			}
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Machines(cmd.Context(), uncli, args, toComplete)
+		},
+	}
+
+	cmd.Flags().StringVar(
+		&opts.name, "name", "",
+		"New name for the machine",
+	)
+	cmd.Flags().StringVar(
+		&opts.publicIP, "public-ip", "",
+		fmt.Sprintf("Public IP address of the machine for ingress configuration. Use '%s' or '' to remove the public IP.",
+			PublicIPNone),
+	)
+	cmd.Flags().StringSliceVar(
+		&opts.wgEndpoints, "wg-endpoint", nil,
+		fmt.Sprintf("WireGuard endpoint address that other machines in the cluster should use to establish "+
+			"WireGuard connections\n"+
+			"to this machine. This doesn't change the address/port WireGuard listens on the machine.\n"+
+			"Format: IP, IP:PORT, IPv6, or [IPv6]:PORT. Default port is %d if omitted.\n",
+			network.DefaultWireGuardPort)+
+			"Multiple endpoints can be specified by repeating the flag or using a comma-separated list.",
+	)
+
+	return cmd
+}
+
+func update(ctx context.Context, uncli *cli.CLI, cmd *cobra.Command, opts updateOptions, machineNameOrID string) error {
+	// Check if at least one flag was explicitly set.
+	if !cmd.Flags().Changed("name") && !cmd.Flags().Changed("public-ip") && !cmd.Flags().Changed("wg-endpoint") {
+		return fmt.Errorf("at least one update flag must be specified (--name, --public-ip, --wg-endpoint)")
+	}
+
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return err
+	}
+	defer client.Close()
+
+	// Resolve the machine to capture its current configuration for the before/after report and to validate existence.
+	machine, err := client.InspectMachine(ctx, machineNameOrID)
+	if err != nil {
+		return fmt.Errorf("find machine: %w", err)
+	}
+
+	req := &pb.UpdateMachineRequest{}
+
+	if opts.name != "" {
+		req.Name = &opts.name
+	}
+
+	// Check if --public-ip flag was explicitly provided
+	if cmd.Flags().Changed("public-ip") {
+		if opts.publicIP == "" || opts.publicIP == PublicIPNone {
+			req.PublicIp = &pb.IP{} // Empty IP to signal removal
+		} else {
+			// Parse and validate the public IP
+			ip, err := netip.ParseAddr(opts.publicIP)
+			if err != nil {
+				return fmt.Errorf("invalid public IP address %q: %w", opts.publicIP, err)
+			}
+			req.PublicIp = pb.NewIP(ip)
+		}
+	}
+
+	// Parse and set endpoints if the flag was explicitly provided.
+	if cmd.Flags().Changed("wg-endpoint") {
+		expanded := cli.ExpandCommaSeparatedValues(opts.wgEndpoints)
+		endpoints, err := cli.ParseWireGuardEndpoints(expanded, network.DefaultWireGuardPort)
+		if err != nil {
+			return err
+		}
+		if len(endpoints) == 0 {
+			return fmt.Errorf("at least one endpoint must be specified if --wg-endpoint flag is used")
+		}
+		req.Endpoints = endpoints
+	}
+
+	updatedMachine, err := client.UpdateMachine(ctx, machine.Machine.Id, req)
+	if err != nil {
+		return fmt.Errorf("update machine: %w", err)
+	}
+
+	// Report what was changed
+	changes := make([]string, 0)
+	if opts.name != "" {
+		changes = append(changes, fmt.Sprintf("name: %q -> %q", machine.Machine.Name, updatedMachine.Name))
+	}
+	if cmd.Flags().Changed("public-ip") {
+		oldIP := PublicIPNone
+		if machine.Machine.PublicIp != nil {
+			if addr, err := machine.Machine.PublicIp.ToAddr(); err == nil {
+				oldIP = addr.String()
+			}
+		}
+		newIP := PublicIPNone
+		if updatedMachine.PublicIp != nil {
+			if addr, err := updatedMachine.PublicIp.ToAddr(); err == nil {
+				newIP = addr.String()
+			}
+		}
+		changes = append(changes, fmt.Sprintf("public IP: %s -> %s", oldIP, newIP))
+	}
+	if cmd.Flags().Changed("wg-endpoint") {
+		formatEndpoints := func(eps []*pb.IPPort) string {
+			if len(eps) == 0 {
+				return "none"
+			}
+			parts := make([]string, len(eps))
+			for i, ep := range eps {
+				ap, _ := ep.ToAddrPort()
+				parts[i] = ap.String()
+			}
+			return strings.Join(parts, ", ")
+		}
+		oldEndpoints := formatEndpoints(machine.Machine.Network.Endpoints)
+		newEndpoints := formatEndpoints(updatedMachine.Network.Endpoints)
+		changes = append(changes, fmt.Sprintf("endpoints: %s -> %s", oldEndpoints, newEndpoints))
+	}
+
+	fmt.Printf("Machine '%s' (ID: %s) configuration updated:\n", updatedMachine.Name, updatedMachine.Id)
+	for _, change := range changes {
+		fmt.Printf("  %s\n", change)
+	}
+
+	return nil
+}

cmd/uc/main.go

@@ -0,0 +1,194 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/netip"
+	"os"
+	"strings"
+
+	"github.com/psviderski/uncloud/cmd/uc/caddy"
+	cmdcontext "github.com/psviderski/uncloud/cmd/uc/context"
+	"github.com/psviderski/uncloud/cmd/uc/dns"
+	"github.com/psviderski/uncloud/cmd/uc/image"
+	cmdmachine "github.com/psviderski/uncloud/cmd/uc/machine"
+	"github.com/psviderski/uncloud/cmd/uc/service"
+	"github.com/psviderski/uncloud/cmd/uc/volume"
+	"github.com/psviderski/uncloud/cmd/uc/wg"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/config"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/internal/fs"
+	"github.com/psviderski/uncloud/internal/log"
+	"github.com/psviderski/uncloud/internal/machine"
+	"github.com/psviderski/uncloud/internal/version"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+type globalOptions struct {
+	configPath string
+	connect    string
+	context    string
+}
+
+func main() {
+	log.InitLoggerFromEnv()
+
+	opts := globalOptions{}
+	cmd := &cobra.Command{
+		Use:           "uc",
+		Short:         "A CLI tool for managing Uncloud resources such as machines, services, and volumes.",
+		SilenceUsage:  true,
+		SilenceErrors: true,
+		PersistentPreRunE: func(cmd *cobra.Command, args []string) error {
+			// Shell completion runs through the hidden __complete command which has flag parsing disabled,
+			// so the global flags from the completed command line are never parsed. Apply them manually to make
+			// completion work with --connect, --context, and --uncloud-config.
+			if cmd.Name() == cobra.ShellCompRequestCmd {
+				applyGlobalFlagsFromCompletionArgs(cmd.Root().PersistentFlags(), os.Args[1:])
+			}
+
+			cli.BindEnvToFlag(cmd, "connect", "UNCLOUD_CONNECT")
+			cli.BindEnvToFlag(cmd, "context", "UNCLOUD_CONTEXT")
+			cli.BindEnvToFlag(cmd, "uncloud-config", "UNCLOUD_CONFIG")
+
+			var conn *config.MachineConnection
+			if opts.connect != "" {
+				if after, ok := strings.CutPrefix(opts.connect, "tcp://"); ok {
+					addrPort, err := netip.ParseAddrPort(after)
+					if err != nil {
+						return fmt.Errorf("parse TCP address: %w", err)
+					}
+					conn = &config.MachineConnection{
+						TCP: &addrPort,
+					}
+				} else if after, ok := strings.CutPrefix(opts.connect, "ssh+go://"); ok {
+					conn = &config.MachineConnection{
+						SSHGo: config.SSHDestination(after),
+					}
+				} else if after, ok := strings.CutPrefix(opts.connect, "ssh+cli://"); ok {
+					// Backward-compatible alias for ssh://.
+					conn = &config.MachineConnection{
+						SSH: config.SSHDestination(after),
+					}
+				} else if strings.HasPrefix(opts.connect, "unix://") {
+					conn = &config.MachineConnection{
+						Unix: opts.connect[len("unix://"):],
+					}
+				} else {
+					// Default: system ssh CLI command (no prefix or ssh:// prefix).
+					dest := strings.TrimPrefix(opts.connect, "ssh://")
+					conn = &config.MachineConnection{
+						SSH: config.SSHDestination(dest),
+					}
+				}
+			}
+
+			configPath := fs.ExpandHomeDir(opts.configPath)
+
+			// Make uc connect via the local Unix socket when running on a cluster machine.
+			if opts.connect == "" {
+				if !fs.Exists(configPath) && fs.Exists(machine.DefaultClusterAPISockPath) {
+					conn = &config.MachineConnection{
+						Unix: machine.DefaultClusterAPISockPath,
+					}
+				}
+			}
+
+			uncli, err := cli.New(configPath, conn, opts.context)
+			if err != nil {
+				return fmt.Errorf("initialise CLI: %w", err)
+			}
+			cmd.SetContext(context.WithValue(cmd.Context(), "cli", uncli))
+			return nil
+		},
+	}
+
+	cmd.PersistentFlags().StringVar(&opts.connect, "connect", "",
+		"Connect to a remote cluster machine without using the Uncloud configuration file. [$UNCLOUD_CONNECT]\n"+
+			"Format: [ssh://]user@host[:port], ssh+go://user@host[:port], tcp://host:port, or unix:///path/to/uncloud.sock")
+	cmd.PersistentFlags().StringVar(&opts.configPath, "uncloud-config", "~/.config/uncloud/config.yaml",
+		"Path to the Uncloud configuration file. [$UNCLOUD_CONFIG]")
+	_ = cmd.MarkPersistentFlagFilename("uncloud-config", "yaml", "yml")
+	cmd.PersistentFlags().StringVarP(&opts.context, "context", "c", "",
+		"Name of the cluster context to use (default is the current context). [$UNCLOUD_CONTEXT]")
+
+	// Set custom help function to show links to docs and Discord only for the root 'uc' command.
+	defaultHelpFunc := cmd.HelpFunc()
+	cmd.SetHelpFunc(func(c *cobra.Command, args []string) {
+		defaultHelpFunc(c, args)
+		// Only show links for the root 'uc' command.
+		if c.Name() == "uc" {
+			fmt.Fprintln(c.OutOrStdout())
+			fmt.Fprintf(c.OutOrStdout(), "Learn more about Uncloud:       %s\n",
+				tui.URLStyle.Render(version.DocsURL))
+			fmt.Fprintf(c.OutOrStdout(), "Join our Discord community:     %s\n",
+				tui.URLStyle.Render(version.DiscordURL))
+		}
+	})
+
+	cmd.AddGroup(&cobra.Group{
+		ID:    "service",
+		Title: "Deploy and manage services:",
+	})
+
+	cmd.AddCommand(
+		NewBuildCommand(),
+		NewDeployCommand(),
+		NewDocsCommand(),
+		NewImagesCommand(),
+		NewPsCommand(),
+		NewProxyCommand(),
+		caddy.NewRootCommand(),
+		cmdcontext.NewRootCommand(),
+		dns.NewRootCommand(),
+		image.NewRootCommand(),
+		cmdmachine.NewRootCommand(),
+		service.NewRootCommand(),
+		service.NewExecCommand("service"),
+		service.NewInspectCommand("service"),
+		service.NewListCommand("service"),
+		service.NewLogsCommand("service"),
+		service.NewRmCommand("service"),
+		service.NewRunCommand("service"),
+		service.NewScaleCommand("service"),
+		service.NewStartCommand("service"),
+		service.NewStopCommand("service"),
+		NewVersionCommand(),
+		volume.NewRootCommand(),
+		wg.NewRootCommand(),
+	)
+	if err := cmd.Execute(); err != nil {
+		if cancelled, ok := errors.AsType[*cli.CancelledError](err); ok {
+			fmt.Fprintln(os.Stderr, cancelled.Error())
+			os.Exit(1)
+		}
+		cobra.CheckErr(err)
+	}
+}
+
+// applyGlobalFlagsFromCompletionArgs parses the global flags from the raw arguments of a __complete command and applies
+// the ones found to flags. The trailing word being completed, unknown flags, and positional arguments are ignored.
+func applyGlobalFlagsFromCompletionArgs(flags *pflag.FlagSet, args []string) {
+	// The shell always passes the word being completed as the last argument, even if it's empty.
+	// Exclude it from parsing as its value may not be complete yet.
+	if len(args) == 0 {
+		return
+	}
+	args = args[:len(args)-1]
+
+	fset := pflag.NewFlagSet("global", pflag.ContinueOnError)
+	fset.ParseErrorsAllowlist.UnknownFlags = true
+	fset.String("connect", "", "")
+	fset.StringP("context", "c", "", "")
+	fset.String("uncloud-config", "", "")
+	// Parsing an incomplete command line may fail, apply the flags parsed so far anyway.
+	_ = fset.Parse(args)
+
+	fset.Visit(func(f *pflag.Flag) {
+		// Setting the flag marks it as changed so it takes precedence over environment variables.
+		_ = flags.Set(f.Name, f.Value.String())
+	})
+}

cmd/uc/main_test.go

@@ -0,0 +1,116 @@
+package main
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/spf13/pflag"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestApplyGlobalFlagsFromCompletionArgs(t *testing.T) {
+	defaultConfigPath := "~/.config/uncloud/config.yaml"
+
+	tests := []struct {
+		name           string
+		args           []string
+		wantConnect    string
+		wantContext    string
+		wantConfigPath string
+		// Flag names expected to be marked as changed on the target flag set.
+		wantChanged []string
+	}{
+		{
+			name: "no flags",
+			args: []string{"__complete", "inspect", ""},
+		},
+		{
+			name:        "connect with space",
+			args:        []string{"__complete", "--connect", "ssh://user@host", "inspect", ""},
+			wantConnect: "ssh://user@host",
+			wantChanged: []string{"connect"},
+		},
+		{
+			name:        "connect with equals",
+			args:        []string{"__complete", "--connect=tcp://127.0.0.1:51000", "inspect", ""},
+			wantConnect: "tcp://127.0.0.1:51000",
+			wantChanged: []string{"connect"},
+		},
+		{
+			name:        "context shorthand",
+			args:        []string{"__complete", "-c", "prod", "inspect", ""},
+			wantContext: "prod",
+			wantChanged: []string{"context"},
+		},
+		{
+			name:           "all flags",
+			args:           []string{"__complete", "--connect", "user@host", "-c", "prod", "--uncloud-config", "/tmp/uncloud.yaml", "inspect", ""},
+			wantConnect:    "user@host",
+			wantContext:    "prod",
+			wantConfigPath: "/tmp/uncloud.yaml",
+			wantChanged:    []string{"connect", "context", "uncloud-config"},
+		},
+		{
+			name:        "unknown flags are ignored",
+			args:        []string{"__complete", "--quiet", "-n", "5", "--connect", "user@host", "logs", ""},
+			wantConnect: "user@host",
+			wantChanged: []string{"connect"},
+		},
+		{
+			name: "flags after double dash are ignored",
+			args: []string{"__complete", "exec", "svc", "--", "sh", "--connect", "user@host"},
+		},
+		{
+			name:        "flags before double dash are applied",
+			args:        []string{"__complete", "--connect", "user@host", "exec", "svc", "--", "sh", "-c", "env"},
+			wantConnect: "user@host",
+			wantChanged: []string{"connect"},
+		},
+		{
+			name:        "partial flag name being completed is excluded",
+			args:        []string{"__complete", "--connect", "user@host", "inspect", "--context"},
+			wantConnect: "user@host",
+			wantChanged: []string{"connect"},
+		},
+		{
+			name: "partial flag value being completed is excluded",
+			args: []string{"__complete", "--uncloud-config", "/tmp/"},
+		},
+		{
+			name: "partial connect value being completed is excluded",
+			args: []string{"__complete", "--connect", "tcp://127.0.0.1:5"},
+		},
+		{
+			name:           "completed flag value with partial command word",
+			args:           []string{"__complete", "--uncloud-config", "/tmp/uncloud.yaml", "insp"},
+			wantConfigPath: "/tmp/uncloud.yaml",
+			wantChanged:    []string{"uncloud-config"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Mirror the global persistent flags defined on the root command.
+			var opts globalOptions
+			flags := pflag.NewFlagSet("test", pflag.ContinueOnError)
+			flags.StringVar(&opts.connect, "connect", "", "")
+			flags.StringVarP(&opts.context, "context", "c", "", "")
+			flags.StringVar(&opts.configPath, "uncloud-config", defaultConfigPath, "")
+
+			applyGlobalFlagsFromCompletionArgs(flags, tt.args)
+
+			assert.Equal(t, tt.wantConnect, opts.connect)
+			assert.Equal(t, tt.wantContext, opts.context)
+			wantConfigPath := tt.wantConfigPath
+			if wantConfigPath == "" {
+				wantConfigPath = defaultConfigPath
+			}
+			assert.Equal(t, wantConfigPath, opts.configPath)
+
+			for _, name := range []string{"connect", "context", "uncloud-config"} {
+				assert.Equal(t, slices.Contains(tt.wantChanged, name), flags.Changed(name),
+					"changed status of flag '%s'", name)
+			}
+		})
+	}
+}

cmd/uc/proxy.go

@@ -0,0 +1,175 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strconv"
+	"strings"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/internal/proxy"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type proxyOptions struct {
+	localPort  int
+	remotePort int
+	service    string
+}
+
+// NewProxyCommand creates a new command to proxy a local port to a service's port in the cluster.
+func NewProxyCommand() *cobra.Command {
+	opts := proxyOptions{}
+	cmd := &cobra.Command{
+		Use:   "proxy SERVICE [LOCAL_PORT:]REMOTE_PORT",
+		Args:  cobra.ExactArgs(2),
+		Short: "Proxy a service port to a local port.",
+		Long: `Proxy a service port in the cluster to a local port on this machine.
+
+If the service runs multiple containers, the command connects to the first running and healthy one.
+If you don't provide a local port, the command picks a random one.
+
+The connection stays open for as long as the command runs.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			opts.service = args[0]
+
+			parts := strings.Split(args[1], ":")
+			switch len(parts) {
+			case 1:
+				remoteport, err := strconv.Atoi(parts[0])
+				if err != nil {
+					return fmt.Errorf("invalid remote port: '%s': %w", parts[0], err)
+				}
+				opts.remotePort = remoteport
+			case 2:
+				localport, err := strconv.Atoi(parts[0])
+				if err != nil {
+					return fmt.Errorf("invalid local port: '%s': %w", parts[0], err)
+				}
+				remoteport, err := strconv.Atoi(parts[1])
+				if err != nil {
+					return fmt.Errorf("invalid remote port: '%s': %w", parts[1], err)
+				}
+				opts.localPort = localport
+				opts.remotePort = remoteport
+			default:
+				return fmt.Errorf("invalid port")
+			}
+
+			return runProxy(cmd.Context(), uncli, opts)
+		},
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			if len(args) > 0 {
+				return nil, cobra.ShellCompDirectiveNoFileComp
+			}
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Services(cmd.Context(), uncli, args, toComplete)
+		},
+	}
+
+	return cmd
+}
+
+func runProxy(ctx context.Context, uncli *cli.CLI, opts proxyOptions) error {
+	if opts.localPort < 0 || opts.localPort > 65535 {
+		return fmt.Errorf("invalid local port %d: must be between 0 and 65535", opts.localPort)
+	}
+	if opts.remotePort < 1 || opts.remotePort > 65535 {
+		return fmt.Errorf("invalid remote port %d: must be between 1 and 65535", opts.remotePort)
+	}
+
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	svc, err := clusterClient.InspectService(ctx, opts.service)
+	if err != nil {
+		if errors.Is(err, api.ErrNotFound) {
+			return fmt.Errorf("service '%s' not found in the cluster", opts.service)
+		}
+		return fmt.Errorf("inspect service '%s': %w", opts.service, err)
+	}
+
+	// Pick the first running and healthy container to proxy to.
+	var ctr *api.MachineServiceContainer
+	for i := range svc.Containers {
+		if svc.Containers[i].Container.Healthy() {
+			ctr = &svc.Containers[i]
+			break
+		}
+	}
+	if ctr == nil {
+		return fmt.Errorf("no running healthy container found for service '%s'", opts.service)
+	}
+
+	containerID := ctr.Container.ShortID()
+	ip := ctr.Container.UncloudNetworkIP()
+	if !ip.IsValid() {
+		return fmt.Errorf("container '%s' is not connected to the uncloud Docker network (could be host network)",
+			containerID)
+	}
+
+	dialer, err := clusterClient.Dialer()
+	if err != nil {
+		return fmt.Errorf("get proxy dialer: %w", err)
+	}
+
+	listener, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(opts.localPort)))
+	if err != nil {
+		return fmt.Errorf("listen on 127.0.0.1:%d: %w", opts.localPort, err)
+	}
+
+	// There is no precheck if we can connect, as this always succeeds, only the proxy connects with the
+	// endpoint and shuffles the data, *it* will actually experience errors.
+	remoteAddr := net.JoinHostPort(ip.String(), strconv.Itoa(opts.remotePort))
+
+	p := &proxy.Proxy{
+		Listener:    listener,
+		RemoteAddr:  remoteAddr,
+		DialContext: dialer.DialContext,
+		OnError: func(err error) {
+			if proxy.IsConnectionClosedError(err) {
+				return
+			}
+			// A more actionable error instead of the cryptic [ssh -W] command error.
+			if strings.Contains(err.Error(), "Session open refused by peer") {
+				fmt.Printf("Could not connect to '%s': connection refused. "+
+					"Check that the service is running and listening on port %d inside the container.\n",
+					remoteAddr, opts.remotePort)
+				return
+			}
+
+			fmt.Printf("Failed to proxy a connection to '%s': %v\n", remoteAddr, err)
+		},
+	}
+
+	// Prefix the local address with the scheme for common HTTP ports so it becomes control-clickable in most
+	// terminals. We assume plain HTTP since TLS is typically terminated by Caddy in front of the service.
+	fmt.Printf("%s%s → %s (%s%s%s)\n", schemeForPort(opts.remotePort), p.Listener.Addr().String(),
+		remoteAddr, opts.service, tui.Faint.Render("/"), containerID)
+
+	if err = p.Run(ctx); err != nil {
+		return fmt.Errorf("run proxy to '%s': %w", remoteAddr, err)
+	}
+	return nil
+}
+
+// schemeForPort returns the "http://" URL scheme prefix for the ports most likely to serve plain HTTP,
+// or an empty string otherwise.
+func schemeForPort(port int) string {
+	switch port {
+	case 80, 3000, 8000, 8080, 8081, 8888, 9090:
+		return "http://"
+	default:
+		return ""
+	}
+}

cmd/uc/ps.go

@@ -0,0 +1,269 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"time"
+
+	"charm.land/lipgloss/v2"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/go-units"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/spf13/cobra"
+)
+
+const (
+	sortByService = "service"
+	sortByMachine = "machine"
+	sortByHealth  = "health"
+)
+
+type containerHighlight int
+
+const (
+	highlightDanger containerHighlight = iota
+	highlightWarning
+	highlightSuccess
+	highlightNormal
+)
+
+type psOptions struct {
+	sortBy string
+}
+
+func NewPsCommand() *cobra.Command {
+	opts := psOptions{}
+	cmd := &cobra.Command{
+		Use:   "ps",
+		Short: "List all service containers.",
+		Long: `List all service containers across all machines in the cluster.
+
+This command provides a comprehensive overview of all running containers that are part of a service,
+making it easy to see the distribution and status of containers across the cluster.`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			if opts.sortBy != sortByService && opts.sortBy != sortByMachine && opts.sortBy != sortByHealth {
+				return fmt.Errorf("invalid value for --sort: %q, must be one of '%s', '%s' or '%s'", opts.sortBy,
+					sortByService, sortByMachine, sortByHealth)
+			}
+
+			return runPs(cmd.Context(), uncli, opts)
+		},
+		GroupID: "service",
+	}
+	cmd.Flags().StringVarP(&opts.sortBy, "sort", "s", sortByService,
+		"Sort containers by 'service', 'machine', or 'health'.")
+	return cmd
+}
+
+type containerInfo struct {
+	serviceName string
+	machineName string
+	id          string
+	image       string
+	status      string
+	highlight   containerHighlight
+	created     time.Time
+	ip          string
+	// Hook type (e.g., "pre-deploy"), empty for regular containers.
+	hook string
+}
+
+func runPs(ctx context.Context, uncli *cli.CLI, opts psOptions) error {
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	var containers []containerInfo
+	err = tui.RunSpinner(ctx, "Collecting container info...", func(ctx context.Context) error {
+		containers, err = collectContainers(ctx, clusterClient)
+		return err
+	})
+	if err != nil {
+		return fmt.Errorf("collect containers: %w", err)
+	}
+
+	// Sort the containers based on the sorting option.
+	sort.SliceStable(containers, func(i, j int) bool {
+		a, b := containers[i], containers[j]
+		switch opts.sortBy {
+		case sortByHealth:
+			if a.highlight != b.highlight {
+				return a.highlight < b.highlight
+			}
+			if a.serviceName != b.serviceName {
+				return a.serviceName < b.serviceName
+			}
+		case sortByMachine:
+			if a.machineName != b.machineName {
+				return a.machineName < b.machineName
+			}
+			if a.serviceName != b.serviceName {
+				return a.serviceName < b.serviceName
+			}
+		default: // sortByService
+			if a.serviceName != b.serviceName {
+				return a.serviceName < b.serviceName
+			}
+		}
+		// Fallback to creation time (newest first).
+		return a.created.After(b.created)
+	})
+
+	return printContainers(containers)
+}
+
+func printContainers(containers []containerInfo) error {
+	t := tui.NewTable()
+
+	// Show HOOK column only when hook containers are present.
+	hasHooks := false
+	for _, ctr := range containers {
+		if ctr.hook != "" {
+			hasHooks = true
+			break
+		}
+	}
+
+	if hasHooks {
+		t.Headers("SERVICE", "CONTAINER ID", "IMAGE", "CREATED", "STATUS", "HOOK", "IP ADDRESS", "MACHINE")
+	} else {
+		t.Headers("SERVICE", "CONTAINER ID", "IMAGE", "CREATED", "STATUS", "IP ADDRESS", "MACHINE")
+	}
+
+	for _, ctr := range containers {
+		id := ctr.id
+		if len(id) > 12 {
+			id = id[:12]
+		}
+
+		created := units.HumanDuration(time.Now().UTC().Sub(ctr.created)) + " ago"
+
+		var statusStyle lipgloss.Style
+		switch ctr.highlight {
+		case highlightSuccess:
+			statusStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("2")) // Green
+		case highlightDanger:
+			statusStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("1")) // Red
+		case highlightWarning:
+			statusStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("3")) // Yellow
+		default:
+			statusStyle = lipgloss.NewStyle() // Default
+		}
+
+		if hasHooks {
+			t.Row(
+				ctr.serviceName,
+				id,
+				tui.FormatImage(ctr.image, tui.NoStyle),
+				created,
+				statusStyle.Render(ctr.status),
+				ctr.hook,
+				ctr.ip,
+				ctr.machineName,
+			)
+		} else {
+			t.Row(
+				ctr.serviceName,
+				id,
+				tui.FormatImage(ctr.image, tui.NoStyle),
+				created,
+				statusStyle.Render(ctr.status),
+				ctr.ip,
+				ctr.machineName,
+			)
+		}
+	}
+
+	lipgloss.Println(t)
+	return nil
+}
+
+func collectContainers(ctx context.Context, cli *client.Client) ([]containerInfo, error) {
+	listCtx := client.ProxyMachinesContext(ctx, nil)
+
+	// List all service containers across all machines in the cluster.
+	machineContainers, err := cli.Docker.ListServiceContainers(
+		listCtx, "", container.ListOptions{All: true},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("list service containers: %w", err)
+	}
+
+	var containers []containerInfo
+	for _, msc := range machineContainers {
+		// NOTE: Metadata should never be nil in practice. This is legacy fallback that will be removed.
+		if msc.Metadata == nil {
+			tui.PrintWarning("metadata is missing in response from unknown server")
+			continue
+		}
+
+		machineName := msc.Metadata.MachineName
+
+		if msc.Metadata.Error != "" {
+			tui.PrintWarning(fmt.Sprintf("failed to list service containers on machine %s: %s",
+				machineName, msc.Metadata.Error))
+			continue
+		}
+
+		for _, ctr := range append(msc.Containers, msc.HookContainers...) {
+			if ctr.Container.State == nil || ctr.Container.Config == nil {
+				continue
+			}
+
+			status, err := ctr.Container.HumanState()
+			if err != nil {
+				return nil, fmt.Errorf("get human state for container %s: %w", ctr.Container.ID, err)
+			}
+
+			var highlight containerHighlight
+			healthStatus := ""
+			if ctr.Container.State.Health != nil {
+				healthStatus = ctr.Container.State.Health.Status
+			}
+
+			if healthStatus == container.Unhealthy || ctr.Container.State.Status == "dead" || ctr.Container.State.OOMKilled || ctr.Container.State.Dead {
+				highlight = highlightDanger
+			} else if healthStatus == container.Healthy {
+				highlight = highlightSuccess
+			} else if ctr.Container.State.Status == "running" {
+				highlight = highlightNormal
+			} else if ctr.IsHook() && ctr.Container.State.Status == "exited" && ctr.Container.State.ExitCode == 0 {
+				// Hook containers (e.g., pre-deploy) are expected to exit successfully.
+				highlight = highlightNormal
+			} else { // Other non-critical but noteworthy states
+				highlight = highlightWarning
+			}
+
+			created, _ := time.Parse(time.RFC3339Nano, ctr.Container.Created)
+
+			ip := ctr.Container.UncloudNetworkIP()
+			ipStr := ""
+			// The container might not have an IP if it's not running or uses the host network.
+			if ip.IsValid() {
+				ipStr = ip.String()
+			}
+
+			info := containerInfo{
+				serviceName: ctr.ServiceName(),
+				machineName: machineName,
+				id:          ctr.Container.ID,
+				image:       ctr.Container.Config.Image,
+				status:      status,
+				highlight:   highlight,
+				created:     created,
+				ip:          ipStr,
+				hook:        ctr.Config.Labels[api.LabelHook],
+			}
+			containers = append(containers, info)
+		}
+	}
+	return containers, nil
+}

cmd/uc/ps_test.go

@@ -0,0 +1,105 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/psviderski/uncloud/api/pb"
+	"github.com/psviderski/uncloud/internal/machine/docker"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+)
+
+type mockDockerClient struct {
+	pb.DockerClient
+	listResp *pb.ListServiceContainersResponse
+	listErr  error
+}
+
+func (m *mockDockerClient) ListServiceContainers(ctx context.Context, in *pb.ListServiceContainersRequest, opts ...grpc.CallOption) (*pb.ListServiceContainersResponse, error) {
+	return m.listResp, m.listErr
+}
+
+func TestCollectContainers(t *testing.T) {
+	containerData1 := map[string]interface{}{
+		"Id":   "container1",
+		"Name": "container-1",
+		"Config": map[string]any{
+			"Image": "image-1",
+		},
+		"State": map[string]any{
+			"Status":     "running",
+			"StartedAt":  "2023-01-01T12:00:00Z",
+			"FinishedAt": "0001-01-01T00:00:00Z",
+		},
+		"NetworkSettings": map[string]any{
+			"Networks": map[string]any{},
+		},
+	}
+	containerJSON1, _ := json.Marshal(containerData1)
+
+	containerData2 := map[string]any{
+		"Id":   "container2",
+		"Name": "container-2",
+		"Config": map[string]any{
+			"Image": "image-2",
+		},
+		"State": map[string]any{
+			"Status":     "running",
+			"StartedAt":  "2023-01-01T12:00:00Z",
+			"FinishedAt": "0001-01-01T00:00:00Z",
+		},
+		"NetworkSettings": map[string]any{
+			"Networks": map[string]any{},
+		},
+	}
+	containerJSON2, _ := json.Marshal(containerData2)
+
+	serviceSpecJSON, _ := json.Marshal(map[string]any{})
+
+	mockDocker := &mockDockerClient{
+		listResp: &pb.ListServiceContainersResponse{
+			Messages: []*pb.MachineServiceContainers{
+				{
+					Metadata: &pb.Metadata{MachineAddr: "10.0.0.1", MachineName: "machine-1"},
+					Containers: []*pb.ServiceContainer{
+						{
+							Container:   containerJSON1,
+							ServiceSpec: serviceSpecJSON,
+						},
+					},
+				},
+				{
+					Metadata: &pb.Metadata{MachineAddr: "10.0.0.2", MachineName: "machine-2"},
+					Containers: []*pb.ServiceContainer{
+						{
+							Container:   containerJSON2,
+							ServiceSpec: serviceSpecJSON,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	cli := &client.Client{
+		Docker: &docker.Client{GRPCClient: mockDocker},
+	}
+
+	containers, err := collectContainers(context.Background(), cli)
+	require.NoError(t, err)
+
+	assert.Len(t, containers, 2)
+	for _, c := range containers {
+		if c.id == "container1" {
+			assert.Equal(t, "machine-1", c.machineName)
+		} else if c.id == "container2" {
+			assert.Equal(t, "machine-2", c.machineName)
+		} else {
+			t.Errorf("unexpected container id: %s", c.id)
+		}
+	}
+}

cmd/uc/service/exec.go

@@ -0,0 +1,150 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/docker/cli/cli/streams"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type execCliOptions struct {
+	detach      bool
+	interactive bool
+	noTty       bool
+	containerId string
+}
+
+var DEFAULT_COMMAND = []string{"sh", "-c", "command -v bash >/dev/null 2>&1 && exec bash || exec sh"}
+
+func NewExecCommand(groupID string) *cobra.Command {
+	opts := execCliOptions{}
+
+	execCmd := &cobra.Command{
+		Use:   "exec [OPTIONS] SERVICE [COMMAND ARGS...]",
+		Short: "Execute a command in a running service container.",
+		Long: `Execute a command (interactive shell by default) in a running container within a service.
+If the service has multiple replicas and no container ID is specified, the command will be executed in a random container.
+	`,
+		Example: `
+  # Start an interactive shell ("bash" or "sh" will be tried by default)
+  uc exec web-service
+
+  # Start an interactive shell with explicit command
+  uc exec web-service /bin/zsh
+
+  # List files in the specific container of the service; --container accepts full ID or a (unique) prefix
+  uc exec --container d792e web-service ls -la
+
+  # Pipe input to a command inside the service container
+  cat backup.sql | uc exec -T db-service psql -U postgres mydb
+
+  # Run a task in the background (detached mode)
+  uc exec -d web-service /scripts/cleanup.sh`,
+		Args: cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			serviceName, command := normalizeExecArgs(args)
+			if len(command) == 0 {
+				command = DEFAULT_COMMAND
+			}
+			return runExec(cmd.Context(), uncli, serviceName, command, opts)
+		},
+		GroupID: groupID,
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			if len(args) > 0 {
+				return nil, cobra.ShellCompDirectiveNoFileComp
+			}
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Services(cmd.Context(), uncli, args, toComplete)
+		},
+	}
+
+	execCmd.Flags().BoolVarP(&opts.detach, "detach", "d", false, "Detached mode: run command in the background")
+
+	execCmd.Flags().BoolVarP(&opts.noTty, "no-tty", "T", false,
+		"Disable pseudo-TTY allocation. By default 'uc exec' allocates a TTY when connected to a terminal.")
+
+	// Keep "-i" and "-t" flags hidden for compatibility with docker exec
+	execCmd.Flags().BoolVarP(&opts.interactive, "interactive", "i", true, "Keep STDIN open even if not attached")
+	execCmd.Flags().MarkHidden("interactive")
+
+	execCmd.Flags().BoolP("tty", "t", false, "Allocate a pseudo-TTY")
+	execCmd.Flags().MarkHidden("tty")
+
+	// Common flags
+	execCmd.Flags().StringVar(&opts.containerId, "container", "",
+		"ID of the container to exec into. Accepts full ID or a unique prefix "+
+			"(default is the random container of the service)")
+
+	// This tells Cobra that all flags must come before positional arguments, so that
+	// commands with their own flags can be handled correctly.
+	execCmd.Flags().SetInterspersed(false)
+
+	return execCmd
+}
+
+func normalizeExecArgs(args []string) (serviceName string, command []string) {
+	serviceName = args[0]
+	command = args[1:]
+	if len(command) > 0 && command[0] == "--" {
+		command = command[1:]
+	}
+	return serviceName, command
+}
+
+func runExec(ctx context.Context, uncli *cli.CLI, serviceName string, command []string, opts execCliOptions) error {
+	// Disable TTY allocation if not connected to a terminal
+	if !tui.IsStdoutTerminal() {
+		opts.noTty = true
+	}
+
+	if !opts.detach {
+		// Check if we're trying to attach to a TTY from a non-TTY client, e.g.
+		// when doing an 'cmd | uc exec ...'
+		stdin := streams.NewIn(os.Stdin)
+		// TODO: this logic/behavior mirrors docker-compose, but we can be smarter about it and detect TTY dynamically
+		if err := stdin.CheckTty(opts.interactive, !opts.noTty); err != nil {
+			return fmt.Errorf("check TTY: %w; use -T option to disable TTY allocation", err)
+		}
+	}
+
+	client, err := uncli.ConnectClusterWithOptions(ctx, cli.ConnectOptions{
+		ShowProgress: false,
+	})
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	execConfig := api.ExecOptions{
+		Command:     command,
+		AttachStdin: opts.interactive,
+		Tty:         !opts.noTty,
+		Detach:      opts.detach,
+	}
+
+	if !opts.detach {
+		execConfig.AttachStdout = true
+		execConfig.AttachStderr = true
+	}
+
+	exitCode, err := client.ExecContainer(ctx, serviceName, opts.containerId, execConfig)
+	if err != nil {
+		return fmt.Errorf("exec container: %w", err)
+	}
+
+	// For non-detached mode, exit with the same code as the executed command
+	if !opts.detach {
+		if exitCode != 0 {
+			os.Exit(exitCode)
+		}
+	}
+
+	return nil
+}

cmd/uc/service/exec_test.go

@@ -0,0 +1,61 @@
+package service
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNormalizeExecArgs(t *testing.T) {
+	tests := []struct {
+		name            string
+		args            []string
+		wantServiceName string
+		wantCommand     []string
+	}{
+		{
+			name:            "service only",
+			args:            []string{"test-service"},
+			wantServiceName: "test-service",
+			wantCommand:     []string{},
+		},
+		{
+			name:            "service with command",
+			args:            []string{"test-service", "echo", "hello"},
+			wantServiceName: "test-service",
+			wantCommand:     []string{"echo", "hello"},
+		},
+		{
+			name:            "service with separator and command",
+			args:            []string{"test-service", "--", "echo", "hello"},
+			wantServiceName: "test-service",
+			wantCommand:     []string{"echo", "hello"},
+		},
+		{
+			name:            "service with separator only",
+			args:            []string{"test-service", "--"},
+			wantServiceName: "test-service",
+			wantCommand:     []string{},
+		},
+		{
+			name:            "separator preserves command flag",
+			args:            []string{"test-service", "--", "--help"},
+			wantServiceName: "test-service",
+			wantCommand:     []string{"--help"},
+		},
+		{
+			name:            "only first separator is removed",
+			args:            []string{"test-service", "--", "cmd", "--", "arg"},
+			wantServiceName: "test-service",
+			wantCommand:     []string{"cmd", "--", "arg"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotServiceName, gotCommand := normalizeExecArgs(tt.args)
+			assert.Equal(t, tt.wantServiceName, gotServiceName)
+			assert.Equal(t, tt.wantCommand, gotCommand)
+		})
+	}
+}

cmd/uc/service/inspect.go

@@ -0,0 +1,132 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"time"
+
+	"charm.land/lipgloss/v2"
+	"github.com/docker/docker/pkg/stringid"
+	"github.com/docker/go-units"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type inspectOptions struct {
+	service string
+}
+
+func NewInspectCommand(groupID string) *cobra.Command {
+	opts := inspectOptions{}
+	cmd := &cobra.Command{
+		Use:   "inspect SERVICE",
+		Short: "Display detailed information on a service.",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			opts.service = args[0]
+			return inspect(cmd.Context(), uncli, opts)
+		},
+		GroupID: groupID,
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			if len(args) > 0 {
+				return nil, cobra.ShellCompDirectiveNoFileComp
+			}
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Services(cmd.Context(), uncli, args, toComplete)
+		},
+	}
+	return cmd
+}
+
+func inspect(ctx context.Context, uncli *cli.CLI, opts inspectOptions) error {
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	svc, err := client.InspectService(ctx, opts.service)
+	if err != nil {
+		return fmt.Errorf("inspect service: %w", err)
+	}
+
+	fmt.Printf("Service ID: %s\n", svc.ID)
+	fmt.Printf("Name:       %s\n", svc.Name)
+	fmt.Printf("Mode:       %s\n", svc.Mode)
+	fmt.Println()
+
+	// Combine regular and hook containers.
+	allContainers := append(svc.Containers, svc.HookContainers...)
+
+	// Parse created times for sorting and display.
+	createdTimes := make(map[string]time.Time, len(allContainers))
+	for _, ctr := range allContainers {
+		createdTimes[ctr.Container.ID], _ = time.Parse(time.RFC3339Nano, ctr.Container.Created)
+	}
+
+	// Sort containers by created time (newest first).
+	slices.SortFunc(allContainers, func(a, b api.MachineServiceContainer) int {
+		return createdTimes[b.Container.ID].Compare(createdTimes[a.Container.ID])
+	})
+
+	// Print the list of containers in a table format.
+	// Show HOOK column only when hook containers are present.
+	hasHooks := len(svc.HookContainers) > 0
+
+	t := tui.NewTable()
+	if hasHooks {
+		t.Headers("CONTAINER ID", "IMAGE", "CREATED", "STATUS", "HOOK", "IP ADDRESS", "MACHINE")
+	} else {
+		t.Headers("CONTAINER ID", "IMAGE", "CREATED", "STATUS", "IP ADDRESS", "MACHINE")
+	}
+
+	now := time.Now().UTC()
+	for _, ctr := range allContainers {
+		created := units.HumanDuration(now.Sub(createdTimes[ctr.Container.ID])) + " ago"
+
+		machine := ctr.MachineName
+		if machine == "" {
+			machine = ctr.MachineID
+		}
+		state, err := ctr.Container.HumanState()
+		if err != nil {
+			return fmt.Errorf("get human state: %w", err)
+		}
+
+		ip := ctr.Container.UncloudNetworkIP()
+		ipStr := ""
+		// The container might not have an IP if it's not running or uses the host network.
+		if ip.IsValid() {
+			ipStr = ip.String()
+		}
+
+		if hasHooks {
+			t.Row(
+				stringid.TruncateID(ctr.Container.ID),
+				tui.FormatImage(ctr.Container.Config.Image, tui.NoStyle),
+				created,
+				state,
+				ctr.Container.Config.Labels[api.LabelHook],
+				ipStr,
+				machine,
+			)
+		} else {
+			t.Row(
+				stringid.TruncateID(ctr.Container.ID),
+				tui.FormatImage(ctr.Container.Config.Image, tui.NoStyle),
+				created,
+				state,
+				ipStr,
+				machine,
+			)
+		}
+	}
+
+	lipgloss.Println(t)
+	return nil
+}

cmd/uc/service/logs.go

@@ -0,0 +1,194 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+
+	mapset "github.com/deckarep/golang-set/v2"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/logs"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client"
+	"github.com/psviderski/uncloud/pkg/client/compose"
+	"github.com/spf13/cobra"
+)
+
+func NewLogsCommand(groupID string) *cobra.Command {
+	var options logs.Options
+
+	cmd := &cobra.Command{
+		Use:     "logs [SERVICE[/CONTAINER]...]",
+		Aliases: []string{"log"},
+		Short:   "View service logs.",
+		Long: `View logs from all replicas of the specified service(s) across all machines in the cluster.
+
+To view logs from specific replicas (containers) within a service, use the SERVICE/CONTAINER form,
+where CONTAINER is a container name, full ID, or unique ID prefix.
+
+If no services are specified, streams logs from all services defined in the Compose file
+(compose.yaml by default or the file(s) specified with --file).`,
+		Example: `  # View recent logs for a service.
+  uc logs web
+
+  # Stream logs in real-time (follow mode).
+  uc logs -f web
+
+  # View logs from multiple services.
+  uc logs web api db
+
+  # View logs from all services in compose.yaml.
+  uc logs
+
+  # Show last 20 lines per replica (default is 100).
+  uc logs -n 20 web
+
+  # Show all logs without line limit.
+  uc logs -n all web
+
+  # View logs from a specific time range.
+  uc logs --since 3h --until 1h30m web
+
+  # View logs only from specific replicas (containers).
+  uc logs web/61d57fd3428f api/2f60
+
+  # View logs only from replicas running on specific machines.
+  uc logs -m machine1,machine2 web api`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return RunLogs(cmd.Context(), uncli, args, options)
+		},
+		GroupID: groupID,
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Services(cmd.Context(), uncli, args, toComplete)
+		},
+	}
+
+	cmd.Flags().StringSliceVar(&options.Files, "file", nil,
+		"One or more Compose files to load service names from when no services are specified. (default compose.yaml)")
+
+	cmd.Flags().AddFlagSet(logs.Flags(&options))
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+func RunLogs(ctx context.Context, uncli *cli.CLI, args []string, opts logs.Options) error {
+	serviceArgs, err := logs.ParseServiceArgs(args)
+	if err != nil {
+		return err
+	}
+
+	// If no services specified, try to load them from the Compose file(s).
+	fromCompose := false
+	if len(serviceArgs) == 0 {
+		fromCompose = true
+		project, err := compose.LoadProject(ctx, opts.Files)
+		if err != nil {
+			return fmt.Errorf("load Compose file(s): %w", err)
+		}
+
+		uncli.SetClusterContextIfUnset(compose.ClusterContext(project))
+
+		// View logs for all services, including disabled by inactive profiles.
+		composeServices := append(project.ServiceNames(), project.DisabledServiceNames()...)
+		if len(composeServices) == 0 {
+			return errors.New("no services found in Compose file(s)")
+		}
+
+		serviceArgs = make([]logs.ServiceArg, len(composeServices))
+		for i, name := range composeServices {
+			serviceArgs[i] = logs.ServiceArg{Service: name}
+		}
+	}
+
+	// Parse tail option.
+	tail, err := logs.Tail(opts.Tail)
+	if err != nil {
+		return err
+	}
+
+	c, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer c.Close()
+
+	baseOpts := api.ServiceLogsOptions{
+		Follow:   opts.Follow,
+		Tail:     tail,
+		Since:    opts.Since,
+		Until:    opts.Until,
+		Machines: cli.ExpandCommaSeparatedValues(opts.Machines),
+	}
+
+	// Collect log streams from all services. When service names come from a Compose file,
+	// skip the ones that are not found in the cluster (they may have been removed or not deployed yet).
+	machineIDsSet := mapset.NewSet[string]()
+	svcStreams := make([]<-chan api.ServiceLogEntry, 0, len(serviceArgs))
+	var foundServices, notFoundServices []string
+
+	for _, sa := range serviceArgs {
+		svcOpts := baseOpts
+		svcOpts.Containers = sa.Containers
+
+		svc, ch, err := c.ServiceLogs(ctx, sa.Service, svcOpts)
+		if err != nil {
+			if errors.Is(err, api.ErrNotFound) && fromCompose {
+				notFoundServices = append(notFoundServices, sa.Service)
+				continue
+			}
+			return fmt.Errorf("stream logs for service '%s': %w", sa.Service, err)
+		}
+		svcStreams = append(svcStreams, ch)
+		foundServices = append(foundServices, sa.Service)
+
+		machineIDs := svc.MachineIDs()
+		machineIDsSet.Append(machineIDs...)
+	}
+
+	if fromCompose {
+		if len(foundServices) == 0 {
+			return fmt.Errorf("stream logs for services defined in %s: no services found in the cluster",
+				strings.Join(opts.Files, ", "))
+		}
+
+		for _, name := range notFoundServices {
+			tui.PrintWarning(fmt.Sprintf("service '%s' not found in the cluster, skipping", name))
+		}
+	}
+
+	var stream <-chan api.ServiceLogEntry
+	if len(svcStreams) == 1 {
+		stream = svcStreams[0]
+	} else {
+		// Merge all service streams into a single sorted stream without stall detection as its handled per-service.
+		merger := client.NewLogMerger(svcStreams, client.LogMergerOptions{})
+		stream = merger.Stream()
+	}
+
+	// Fetch machine names for all machines (machineIDsSet) service containers are running on.
+	// Note: this is the full set per service, not narrowed by --machine or per-container filters,
+	// so the formatter may pad columns wider than strictly needed when filters are active.
+	machines, err := c.ListMachines(ctx, &api.MachineFilter{NamesOrIDs: machineIDsSet.ToSlice()})
+	if err != nil {
+		return fmt.Errorf("list machines: %w", err)
+	}
+	machineNames := make([]string, 0, len(machines))
+	for _, m := range machines {
+		machineNames = append(machineNames, m.Machine.Name)
+	}
+
+	formatter := logs.NewFormatter(machineNames, foundServices, opts.UTC)
+
+	// Print merged logs.
+	for entry := range stream {
+		formatter.PrintEntry(entry)
+	}
+
+	return nil
+}

cmd/uc/service/ls.go

@@ -0,0 +1,88 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"charm.land/lipgloss/v2"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+func NewListCommand(groupID string) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "ls",
+		Aliases: []string{"list"},
+		Short:   "List services.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return list(cmd.Context(), uncli)
+		},
+		GroupID: groupID,
+	}
+	return cmd
+}
+
+func list(ctx context.Context, uncli *cli.CLI) error {
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	services, err := client.ListServices(ctx)
+	if err != nil {
+		return fmt.Errorf("list services: %w", err)
+	}
+
+	// Sort services by name.
+	haveDuplicateNames := false
+	slices.SortFunc(services, func(a, b api.Service) int {
+		if a.Name == b.Name {
+			haveDuplicateNames = true
+			return strings.Compare(a.ID, b.ID)
+		}
+		return strings.Compare(a.Name, b.Name)
+	})
+
+	// Print the list of services in a table format.
+	t := tui.NewTable()
+
+	// Include the ID column if there are duplicate service names to differentiate them.
+	headers := []string{"NAME", "MODE", "REPLICAS", "IMAGE", "ENDPOINTS"}
+	if haveDuplicateNames {
+		headers = append([]string{"ID"}, headers...)
+	}
+	t.Headers(headers...)
+
+	for _, s := range services {
+		images := s.Images()
+		for i, img := range images {
+			images[i] = tui.FormatImage(img, tui.NoStyle)
+		}
+		formattedImages := strings.Join(images, tui.Faint.Render(", "))
+		endpoints := strings.Join(s.Endpoints(), tui.Faint.Render(", "))
+
+		// If no endpoints from ports, check if the service uses custom Caddy config.
+		if endpoints == "" {
+			for _, ctr := range s.Containers {
+				if ctr.Container.ServiceSpec.CaddyConfig() != "" {
+					endpoints = "(custom Caddy config)"
+				}
+			}
+		}
+
+		row := []string{s.Name, s.Mode, fmt.Sprintf("%d", len(s.Containers)), formattedImages, endpoints}
+		if haveDuplicateNames {
+			row = append([]string{s.ID}, row...)
+		}
+		t.Row(row...)
+	}
+
+	lipgloss.Println(t)
+	return nil
+}

cmd/uc/service/rm.go

@@ -3,40 +3,45 @@ package service
 import (
 	"context"
 	"fmt"
-	"github.com/docker/cli/cli/streams"
+
 	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
 	"github.com/spf13/cobra"
-	"os"
-	"uncloud/internal/cli"
 )
 
 type rmOptions struct {
 	services []string
-	cluster  string
 }
 
-func NewRmCommand() *cobra.Command {
+func NewRmCommand(groupID string) *cobra.Command {
 	opts := rmOptions{}
 	cmd := &cobra.Command{
 		Use:     "rm SERVICE [SERVICE...]",
 		Aliases: []string{"remove", "delete"},
 		Short:   "Remove one or more services.",
-		Args:    cobra.MinimumNArgs(1),
+		Long: `Remove one or more services.
+
+The volumes used by the services are preserved and should be removed separately
+with 'uc volume rm'. Anonymous Docker volumes (automatically created from VOLUME
+directives in image Dockerfiles) are automatically removed with their containers.`,
+		Args: cobra.MinimumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			uncli := cmd.Context().Value("cli").(*cli.CLI)
 			opts.services = args
 			return rm(cmd.Context(), uncli, opts)
 		},
+		GroupID: groupID,
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Services(cmd.Context(), uncli, args, toComplete)
+		},
 	}
-	cmd.Flags().StringVarP(
-		&opts.cluster, "cluster", "c", "",
-		"Name of the cluster. (default is the current cluster)",
-	)
 	return cmd
 }
 
 func rm(ctx context.Context, uncli *cli.CLI, opts rmOptions) error {
-	client, err := uncli.ConnectCluster(ctx, opts.cluster)
+	client, err := uncli.ConnectCluster(ctx)
 	if err != nil {
 		return fmt.Errorf("connect to cluster: %w", err)
 	}
@@ -48,8 +53,8 @@ func rm(ctx context.Context, uncli *cli.CLI, opts rmOptions) error {
 				return fmt.Errorf("remove service '%s': %w", s, err)
 			}
 			return nil
-		}, streams.NewOut(os.Stdout), "Removing service "+s)
+		}, uncli.ProgressOut(), "Removing service "+s)
 	}
 
-	return nil
+	return err
 }

cmd/uc/service/root.go

@@ -0,0 +1,25 @@
+package service
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func NewRootCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:     "service",
+		Aliases: []string{"svc"},
+		Short:   "Manage services in the cluster.",
+	}
+	cmd.AddCommand(
+		NewExecCommand(""),
+		NewInspectCommand(""),
+		NewListCommand(""),
+		NewLogsCommand(""),
+		NewRmCommand(""),
+		NewRunCommand(""),
+		NewScaleCommand(""),
+		NewStartCommand(""),
+		NewStopCommand(""),
+	)
+	return cmd
+}

cmd/uc/service/run.go

@@ -0,0 +1,420 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+
+	dockeropts "github.com/docker/cli/opts"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/docker/docker/daemon/names"
+	"github.com/docker/go-units"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/secret"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/psviderski/uncloud/pkg/client/deploy"
+	"github.com/spf13/cobra"
+)
+
+type runOptions struct {
+	caddyfile         string
+	command           []string
+	cpu               dockeropts.NanoCPUs
+	entrypoint        string
+	entrypointChanged bool
+	env               []string
+	image             string
+	machines          []string
+	memory            dockeropts.MemBytes
+	mode              string
+	shmSize           dockeropts.MemBytes
+	name              string
+	privileged        bool
+	publish           []string
+	pull              string
+	replicas          uint
+	ulimits           []string
+	user              string
+	volumes           []string
+}
+
+func NewRunCommand(groupID string) *cobra.Command {
+	opts := runOptions{}
+
+	cmd := &cobra.Command{
+		Use:   "run IMAGE [COMMAND...]",
+		Short: "Run a service.",
+		Args:  cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			opts.entrypointChanged = cmd.Flag("entrypoint").Changed
+			opts.image = args[0]
+			if len(args) > 1 {
+				opts.command = args[1:]
+			}
+
+			return run(cmd.Context(), uncli, opts)
+		},
+		GroupID: groupID,
+	}
+
+	cmd.Flags().StringVar(&opts.caddyfile, "caddyfile", "",
+		"Path to a custom Caddy config (Caddyfile) for the service. "+
+			"Cannot be used together with non-@host published ports.")
+	cmd.Flags().VarP(&opts.cpu, "cpu", "",
+		"Maximum number of CPU cores a service container can use. Fractional values are allowed: "+
+			"0.5 for half a core or 2.25 for two and a quarter cores.")
+	cmd.Flags().StringVar(&opts.entrypoint, "entrypoint", "",
+		"Overwrite the default ENTRYPOINT of the image. Pass an empty string \"\" to reset it.")
+	cmd.Flags().StringSliceVarP(&opts.env, "env", "e", nil,
+		"Set an environment variable for service containers. Can be specified multiple times.\n"+
+			"Format: VAR=value or just VAR to use the value from the local environment.")
+	cmd.Flags().StringVar(&opts.mode, "mode", api.ServiceModeReplicated,
+		fmt.Sprintf("Replication mode of the service: either '%s' (a specified number of containers across "+
+			"the machines) or '%s' (one container on every machine).",
+			api.ServiceModeReplicated, api.ServiceModeGlobal))
+	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
+		"Placement constraint by machine names, limiting which machines the service can run on. Can be specified "+
+			"multiple times or as a comma-separated list of machine names. (default is any suitable machine)")
+	cmd.Flags().VarP(&opts.memory, "memory", "",
+		"Maximum amount of memory a service container can use. Value is a positive integer with optional unit suffix (b, k, m, g).\n"+
+			"Default unit is bytes if no suffix specified.\n"+
+			"Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)")
+	cmd.Flags().VarP(&opts.shmSize, "shm-size", "",
+		"Maximum amount of shared memory (mounted at /dev/shm) a service container can use. Value is a positive integer\n"+
+			"with optional unit suffix (b, k, m, g). Default unit is bytes if no suffix specified.\n"+
+			"Examples: 1073741824, 1024m, 1g (all equal 1 gibibyte)")
+	cmd.Flags().StringVarP(&opts.name, "name", "n", "",
+		"Assign a name to the service. A random name is generated if not specified.")
+	cmd.Flags().BoolVar(&opts.privileged, "privileged", false,
+		"Give extended privileges to service containers. This is a security risk and should be used with caution.")
+	cmd.Flags().StringSliceVarP(&opts.publish, "publish", "p", nil,
+		"Publish a service port to make it accessible outside the cluster. Can be specified multiple times.\n"+
+			"Format: [hostname:]container_port[/protocol] or [host_ip|host_prefix:]host_port:container_port[/protocol]@host\n"+
+			"Supported protocols: tcp, udp, http, https (default is tcp). If a hostname for http(s) port is not specified\n"+
+			"and a cluster domain is reserved, service-name.cluster-domain will be used as the hostname.\n"+
+			"Examples:\n"+
+			"  -p 8080/https                       Publish port 8080 as HTTPS via reverse proxy with default service-name.cluster-domain hostname\n"+
+			"  -p app.example.com:8080/https       Publish port 8080 as HTTPS via reverse proxy with custom hostname\n"+
+			// TODO: add support for publishing L4 tcp/udp ports.
+			//"  -p 9000:8080                   Publish port 8080 as TCP port 9000 via reverse proxy\n"+
+			"  -p 53:5353/udp@host                 Bind UDP port 5353 to host port 53\n"+
+			"  -p 192.168.76.0/24:53:5353/udp@host Bind UDP port 5353 to host port 53 on every host IP address\n"+
+			"                                      contained in the prefix 192.168.76.0/24")
+	cmd.Flags().StringVar(&opts.pull, "pull", api.PullPolicyMissing,
+		fmt.Sprintf("Pull image from the registry before running service containers ('%s', '%s', '%s').",
+			api.PullPolicyAlways, api.PullPolicyMissing, api.PullPolicyNever))
+	cmd.Flags().UintVar(&opts.replicas, "replicas", 1,
+		"Number of containers to run for the service. Only valid for a replicated service.")
+	cmd.Flags().StringVarP(&opts.user, "user", "u", "",
+		"User name or UID and optionally group name or GID used for running the command inside service containers.\n"+
+			"Format: USER[:GROUP] or UID[:GID]. If not specified, the user is set to the default user of the image.")
+	cmd.Flags().StringSliceVar(&opts.ulimits, "ulimit", nil,
+		"Set resource limits for service containers. Can be specified multiple times.\n"+
+			"Format: type=soft_limit[:hard_limit]. If hard limit is not specified, soft limit is used for both.\n"+
+			"Examples:\n"+
+			"  --ulimit nofile=1024:2048  Set soft limit to 1024 and hard limit to 2048 for number of open files\n"+
+			"  --ulimit nproc=65535       Set both soft and hard limits to 65535 for number of processes")
+	cmd.Flags().StringSliceVarP(&opts.volumes, "volume", "v", nil,
+		"Mount a data volume or host path into service containers. Service containers will be scheduled on the machine(s) where\n"+
+			"the volume is located. Can be specified multiple times.\n"+
+			"Format: volume_name:/container/path[:ro|volume-nocopy] or /host/path:/container/path[:ro]\n"+
+			"Host and container paths support runtime templates such as {{.Container.Name}}.\n"+
+			"Examples:\n"+
+			"  -v postgres-data:/var/lib/postgresql/data  Mount volume 'postgres-data' to /var/lib/postgresql/data in container\n"+
+			"  -v /data/uploads:/app/uploads         	 Bind mount /data/uploads host directory to /app/uploads in container\n"+
+			"  -v /host/path:/container/path:ro 		 Bind mount a host directory or file as read-only")
+
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+func run(ctx context.Context, uncli *cli.CLI, opts runOptions) error {
+	spec, err := prepareServiceSpec(opts)
+	if err != nil {
+		return err
+	}
+
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	var resp api.RunServiceResponse
+	err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+		resp, err = clusterClient.RunService(ctx, spec)
+		if err != nil {
+			return fmt.Errorf("run service: %w", err)
+		}
+
+		return nil
+	}, uncli.ProgressOut(), fmt.Sprintf("Running service %s (%s mode)", spec.Name, spec.Mode))
+	if err != nil {
+		return err
+	}
+
+	svc, err := clusterClient.InspectService(ctx, resp.ID)
+	if err != nil {
+		return fmt.Errorf("inspect service: %w", err)
+	}
+
+	endpoints := svc.Endpoints()
+	if len(endpoints) > 0 {
+		fmt.Println()
+		fmt.Printf("%s endpoints:\n", svc.Name)
+		for _, endpoint := range endpoints {
+			fmt.Printf(" • %s\n", endpoint)
+		}
+	}
+
+	return nil
+}
+
+func prepareServiceSpec(opts runOptions) (api.ServiceSpec, error) {
+	var spec api.ServiceSpec
+
+	caddyfile := ""
+	if opts.caddyfile != "" {
+		data, err := os.ReadFile(opts.caddyfile)
+		if err != nil {
+			return spec, fmt.Errorf("read Caddyfile: %w", err)
+		}
+		caddyfile = strings.TrimSpace(string(data))
+	}
+
+	env, err := parseEnv(opts.env)
+	if err != nil {
+		return spec, err
+	}
+
+	switch opts.mode {
+	case api.ServiceModeReplicated, api.ServiceModeGlobal:
+	default:
+		return spec, fmt.Errorf("invalid replication mode: '%s'", opts.mode)
+	}
+
+	switch opts.pull {
+	case api.PullPolicyAlways, api.PullPolicyMissing, api.PullPolicyNever:
+	default:
+		return spec, fmt.Errorf("invalid pull policy: '%s'", opts.pull)
+	}
+
+	ports := make([]api.PortSpec, len(opts.publish))
+	for i, publishPort := range opts.publish {
+		port, err := api.ParsePortSpec(publishPort)
+		if err != nil {
+			return spec, fmt.Errorf("invalid service port '%s': %w", publishPort, err)
+		}
+		ports[i] = port
+	}
+
+	placement := api.Placement{
+		Machines: cli.ExpandCommaSeparatedValues(opts.machines),
+	}
+
+	ulimits, err := parseUlimits(opts.ulimits)
+	if err != nil {
+		return spec, err
+	}
+
+	volumes, mounts, err := parseVolumeFlags(opts.volumes)
+	if err != nil {
+		return spec, err
+	}
+
+	spec = api.ServiceSpec{
+		Container: api.ContainerSpec{
+			Command:    opts.command,
+			Env:        env,
+			Image:      opts.image,
+			Privileged: opts.privileged,
+			PullPolicy: opts.pull,
+			Resources: api.ContainerResources{
+				CPU:          opts.cpu.Value(),
+				Memory:       opts.memory.Value(),
+				SharedMemory: opts.shmSize.Value(),
+				Ulimits:      ulimits,
+			},
+			User:         opts.user,
+			VolumeMounts: mounts,
+		},
+		Mode:      opts.mode,
+		Name:      opts.name,
+		Placement: placement,
+		Ports:     ports,
+		Replicas:  opts.replicas,
+		Volumes:   volumes,
+	}
+
+	if caddyfile != "" {
+		spec.Caddy = &api.CaddySpec{
+			Config: caddyfile,
+		}
+	}
+
+	// Overwrite the default ENTRYPOINT of the image or reset it if an empty string is passed.
+	if opts.entrypoint != "" {
+		spec.Container.Entrypoint = []string{opts.entrypoint}
+	} else if opts.entrypointChanged {
+		spec.Container.Entrypoint = []string{""}
+	}
+
+	if err = spec.Validate(); err != nil {
+		return spec, fmt.Errorf("invalid service configuration: %w", err)
+	}
+
+	// Generate a service name if not specified to be able to include it in the progress title.
+	if spec.Name == "" {
+		spec.Name, err = deploy.GenerateServiceName(spec.Container.Image)
+		if err != nil {
+			return spec, fmt.Errorf("generate service name: %w", err)
+		}
+	}
+
+	return spec, err
+}
+
+// parseEnv parses the environment variables from the command line arguments.
+// It supports two formats: "VAR=value" or just "VAR" to use the value from the local environment.
+func parseEnv(env []string) (api.EnvVars, error) {
+	envVars := make(api.EnvVars)
+	for _, e := range env {
+		key, value, hasValue := strings.Cut(e, "=")
+		if key == "" {
+			return nil, fmt.Errorf("invalid environment variable: '%s'", e)
+		}
+
+		if hasValue {
+			envVars[key] = value
+		} else {
+			if localEnvValue, ok := os.LookupEnv(key); ok {
+				envVars[key] = localEnvValue
+			}
+		}
+	}
+
+	return envVars, nil
+}
+
+// parseVolumeFlags parses volume flag values in Docker CLI format and returns VolumeSpecs and VolumeMounts.
+// It handles both named volumes (volume_name:/container/path[:ro|volume-nocopy])
+// and bind mounts (/host/path:/container/path[:ro]).
+func parseVolumeFlags(volumes []string) ([]api.VolumeSpec, []api.VolumeMount, error) {
+	specs := make([]api.VolumeSpec, 0, len(volumes))
+	mounts := make([]api.VolumeMount, 0, len(volumes))
+
+	// Track volume names to avoid duplicate specs.
+	seenVolumes := make(map[string]struct{})
+
+	for _, vol := range volumes {
+		spec, mount, err := parseVolumeFlagValue(vol)
+		if err != nil {
+			return nil, nil, fmt.Errorf("invalid volume mount '%s': %w", vol, err)
+		}
+
+		if _, ok := seenVolumes[spec.Name]; !ok {
+			specs = append(specs, spec)
+			seenVolumes[spec.Name] = struct{}{}
+		}
+
+		mounts = append(mounts, mount)
+	}
+
+	return specs, mounts, nil
+}
+
+// parseUlimits parses ulimit flag values in Docker CLI format (type=soft[:hard]).
+func parseUlimits(ulimits []string) (map[string]api.Ulimit, error) {
+	if len(ulimits) == 0 {
+		return nil, nil
+	}
+
+	result := make(map[string]api.Ulimit, len(ulimits))
+	for _, u := range ulimits {
+		parsed, err := units.ParseUlimit(u)
+		if err != nil {
+			return nil, fmt.Errorf("invalid ulimit '%s': %w", u, err)
+		}
+		result[parsed.Name] = api.Ulimit{Soft: parsed.Soft, Hard: parsed.Hard}
+	}
+
+	return result, nil
+}
+
+func parseVolumeFlagValue(volume string) (api.VolumeSpec, api.VolumeMount, error) {
+	var spec api.VolumeSpec
+	var mount api.VolumeMount
+
+	parts := strings.Split(volume, ":")
+	switch len(parts) {
+	case 1:
+		return spec, mount, fmt.Errorf("invalid format, must contain at least one separator ':'")
+	case 2, 3:
+		// Format: (volume_name|/host/path):/container/path[:opts]
+		if !strings.HasPrefix(parts[1], "/") {
+			return spec, mount, fmt.Errorf("invalid container mount path: '%s', must be absolute path", parts[1])
+		}
+
+		mount.ContainerPath = parts[1]
+		volumeNoCopy := false
+
+		if len(parts) == 3 {
+			opts := strings.SplitSeq(parts[2], ",")
+			for opt := range opts {
+				switch opt {
+				case "ro", "readonly":
+					mount.ReadOnly = true
+				case "volume-nocopy":
+					volumeNoCopy = true
+				default:
+					return spec, mount, fmt.Errorf("invalid option: '%s'", opt)
+				}
+			}
+		}
+
+		if strings.HasPrefix(parts[0], "/") {
+			// Host path bind mount: /host/path:/container/path
+			suffix, err := secret.RandomAlphaNumeric(4)
+			if err != nil {
+				return spec, mount, fmt.Errorf("generate random suffix: %w", err)
+			}
+
+			spec = api.VolumeSpec{
+				Name: "bind-" + suffix,
+				Type: api.VolumeTypeBind,
+				BindOptions: &api.BindOptions{
+					HostPath:       parts[0],
+					CreateHostPath: true,
+				},
+			}
+		} else {
+			// Named volume mount: volume_name:/container/path
+			volumeName := parts[0]
+			if !names.RestrictedNamePattern.MatchString(volumeName) {
+				return spec, mount, fmt.Errorf("volume name '%s' includes invalid characters, only '%s' are allowed. "+
+					"If you intended to pass a host directory or file, use absolute path",
+					volumeName, names.RestrictedNameChars)
+			}
+
+			spec = api.VolumeSpec{
+				Name: volumeName,
+				Type: api.VolumeTypeVolume,
+				VolumeOptions: &api.VolumeOptions{
+					Name:   volumeName,
+					NoCopy: volumeNoCopy,
+				},
+			}
+		}
+
+		mount.VolumeName = spec.Name
+	default:
+		return spec, mount, fmt.Errorf("invalid format, must container at most 2 separators ':'")
+	}
+
+	return spec, mount, nil
+}

cmd/uc/service/scale.go

@@ -0,0 +1,177 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
+	"charm.land/lipgloss/v2"
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type scaleOptions struct {
+	service  string
+	replicas uint
+	yes      bool
+}
+
+func NewScaleCommand(groupID string) *cobra.Command {
+	opts := scaleOptions{}
+	cmd := &cobra.Command{
+		Use:   "scale SERVICE REPLICAS",
+		Short: "Scale a replicated service by changing the number of replicas.",
+		Long:  "Scale a replicated service by changing the number of replicas.",
+		Args:  cobra.ExactArgs(2),
+		PreRunE: func(cmd *cobra.Command, args []string) error {
+			cli.BindEnvToFlag(cmd, "yes", "UNCLOUD_AUTO_CONFIRM")
+			return nil
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+
+			opts.service = args[0]
+			replicas, err := strconv.ParseUint(args[1], 10, 0)
+			if err != nil {
+				return fmt.Errorf("invalid number of replicas: %w", err)
+			}
+			opts.replicas = uint(replicas)
+
+			return scale(cmd.Context(), uncli, opts)
+		},
+		GroupID: groupID,
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			if len(args) > 0 {
+				return nil, cobra.ShellCompDirectiveNoFileComp
+			}
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Services(cmd.Context(), uncli, args, toComplete)
+		},
+	}
+
+	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
+		"Auto-confirm scaling plan. Should be explicitly set when running non-interactively,\n"+
+			"e.g., in CI/CD pipelines. [$UNCLOUD_AUTO_CONFIRM]")
+
+	return cmd
+}
+
+func scale(ctx context.Context, uncli *cli.CLI, opts scaleOptions) error {
+	if opts.replicas == 0 {
+		return fmt.Errorf(
+			"scaling to zero replicas is not supported. This would effectively remove the service without preserving "+
+				"its configuration, making it impossible to scale back up. Uncloud derives the service configuration "+
+				"from existing containers. Use 'uc rm %s' instead if you want to remove the service",
+			opts.service,
+		)
+	}
+
+	clusterClient, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer clusterClient.Close()
+
+	svc, err := clusterClient.InspectService(ctx, opts.service)
+	if err != nil {
+		return fmt.Errorf("inspect service '%s': %w", opts.service, err)
+	}
+
+	if svc.Mode != api.ServiceModeReplicated {
+		return fmt.Errorf("scaling is only supported for services in %s mode, service '%s' is in %s mode",
+			api.ServiceModeReplicated, svc.Name, svc.Mode)
+	}
+
+	currentReplicas := uint(len(svc.Containers))
+
+	if currentReplicas == opts.replicas {
+		fmt.Printf("Service %s already has %s replicas. No changes required.\n",
+			tui.NameStyle.Render(svc.Name), tui.Bold.Render(fmt.Sprintf("%d", currentReplicas)))
+		return nil
+	}
+
+	// TODO: Check if all containers have the same spec. If not, prompt user to choose which one to scale.
+	//  This can happen if a service deployment failed midway and some containers were not updated.
+	spec := svc.Containers[0].Container.ServiceSpec
+	spec.Replicas = opts.replicas
+	deployment := clusterClient.NewDeployment(spec, nil)
+	plan, err := deployment.Plan(ctx)
+	if err != nil {
+		return fmt.Errorf("plan deployment: %w", err)
+	}
+
+	if len(plan.Operations) == 0 {
+		fmt.Printf("Service %s is already scaled to %d replicas.\n", tui.NameStyle.Render(svc.Name), opts.replicas)
+		return nil
+	}
+
+	fmt.Println(tui.Bold.Underline(true).Render("Scaling plan"))
+	fmt.Println()
+
+	directConn := uncli.DirectConnection()
+	contextName := uncli.ContextOverrideOrCurrent()
+	deployTarget := ""
+	if directConn != "" {
+		deployTarget = directConn
+		fmt.Println(tui.Faint.Render("connection: ") + tui.NameStyle.Render(directConn))
+		fmt.Println()
+	} else if contextName != "" && len(uncli.Config.Contexts) > 1 {
+		// Only show context if there's more than one to avoid unnecessary clutter.
+		deployTarget = contextName
+		fmt.Println(tui.Faint.Render("context: ") + tui.NameStyle.Render(contextName))
+		fmt.Println()
+	}
+
+	fmt.Println(plan.Format())
+
+	summary := plan.FormatSummary()
+	fmt.Println(tui.Faint.Render(strings.Repeat("─", lipgloss.Width(summary))))
+	fmt.Println(summary)
+	fmt.Println()
+
+	// Ask for confirmation unless auto-confirmed with --yes.
+	if !opts.yes {
+		if !tui.IsTerminalAvailable() {
+			return errors.New("cannot ask to confirm scaling plan in non-interactive mode, " +
+				"use --yes flag or set UNCLOUD_AUTO_CONFIRM=true to auto-confirm")
+		}
+
+		title := "Proceed with scaling?"
+		// Include the direct connection or context name in the confirmation prompt to avoid accidentally
+		// scaling on the wrong cluster.
+		if deployTarget != "" {
+			isDark := lipgloss.HasDarkBackground(os.Stdin, os.Stdout)
+			confirmStyle := tui.ThemeConfirm().Theme(isDark).Focused.Title
+			title = "Proceed with scaling on " + tui.NameStyle.Render(deployTarget) + confirmStyle.Render("?")
+		}
+
+		confirmed, err := tui.Confirm(title)
+		if err != nil {
+			return fmt.Errorf("confirm scaling: %w", err)
+		}
+		if !confirmed {
+			return cli.Cancelled("Scaling cancelled. No changes were made.")
+		}
+	}
+
+	title := fmt.Sprintf("Scaling service %s (%d → %d replicas)",
+		tui.NameStyle.Render(svc.Name), currentReplicas, opts.replicas)
+	err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+		if _, err = deployment.Run(ctx); err != nil {
+			return fmt.Errorf("deploy service: %w", err)
+		}
+		return nil
+	}, uncli.ProgressOut(), title)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

cmd/uc/service/start.go

@@ -0,0 +1,59 @@
+//nolint:dupl
+package service
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/spf13/cobra"
+)
+
+type startOptions struct {
+	services []string
+}
+
+func NewStartCommand(groupID string) *cobra.Command {
+	opts := startOptions{}
+	cmd := &cobra.Command{
+		Use:   "start SERVICE [SERVICE...]",
+		Short: "Start one or more services.",
+		Long: `Start one or more previously stopped services.
+
+Starts all containers of the specified service(s) across all machines in the cluster.
+Services can be specified by name or ID.`,
+		Args: cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			opts.services = args
+			return start(cmd.Context(), uncli, opts)
+		},
+		GroupID: groupID,
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Services(cmd.Context(), uncli, args, toComplete)
+		},
+	}
+	return cmd
+}
+
+func start(ctx context.Context, uncli *cli.CLI, opts startOptions) error {
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	for _, s := range opts.services {
+		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+			if err = client.StartService(ctx, s); err != nil {
+				return fmt.Errorf("start service '%s': %w", s, err)
+			}
+			return nil
+		}, uncli.ProgressOut(), "Starting service "+s)
+	}
+
+	return err
+}

cmd/uc/service/stop.go

@@ -0,0 +1,73 @@
+//nolint:dupl
+package service
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/docker/compose/v2/pkg/progress"
+	"github.com/docker/docker/api/types/container"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/spf13/cobra"
+)
+
+type stopOptions struct {
+	services []string
+	signal   string
+	timeout  int
+}
+
+func NewStopCommand(groupID string) *cobra.Command {
+	opts := stopOptions{}
+	cmd := &cobra.Command{
+		Use:   "stop SERVICE [SERVICE...]",
+		Short: "Stop one or more services.",
+		Long: `Stop one or more running services.
+
+Gracefully stops all containers of the specified service(s) across all machines in the cluster.
+Services can be specified by name or ID. Stopped services can be restarted with 'uc start'.`,
+		Args: cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			opts.services = args
+			return stop(cmd.Context(), uncli, opts)
+		},
+		GroupID: groupID,
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Services(cmd.Context(), uncli, args, toComplete)
+		},
+	}
+	cmd.Flags().StringVarP(&opts.signal, "signal", "s", "",
+		"Signal to send to each container's main process.\n"+
+			"Can be a signal name (SIGTERM, SIGINT, SIGHUP, etc.) or a number. (default SIGTERM)")
+	cmd.Flags().IntVarP(&opts.timeout, "timeout", "t", 10,
+		"Seconds to wait for each container to stop gracefully before forcibly killing it with SIGKILL.\n"+
+			"Use -1 to wait indefinitely.")
+	return cmd
+}
+
+func stop(ctx context.Context, uncli *cli.CLI, opts stopOptions) error {
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	stopOpts := container.StopOptions{
+		Signal:  opts.signal,
+		Timeout: &opts.timeout,
+	}
+
+	for _, s := range opts.services {
+		err = progress.RunWithTitle(ctx, func(ctx context.Context) error {
+			if err = client.StopService(ctx, s, stopOpts); err != nil {
+				return fmt.Errorf("stop service '%s': %w", s, err)
+			}
+			return nil
+		}, uncli.ProgressOut(), "Stopping service "+s)
+	}
+
+	return err
+}

cmd/uc/version.go

@@ -0,0 +1,82 @@
+package main
+
+import (
+	"bytes"
+	_ "embed"
+	"fmt"
+	"strings"
+	"text/template"
+
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/internal/version"
+	"github.com/spf13/cobra"
+)
+
+//go:embed art.txt
+var asciiArt string
+
+// NewVersionCommand creates a new command to print the version and build information for the binary.
+func NewVersionCommand() *cobra.Command {
+	var output string
+
+	cmd := &cobra.Command{
+		Use:   "version",
+		Short: "Show version and build information.",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			info := version.GetInfo()
+			w := cmd.OutOrStdout()
+
+			switch output {
+			case "":
+				fmt.Fprint(w, humanVersion(info))
+			case "json":
+				s, err := info.JSONString()
+				if err != nil {
+					return err
+				}
+				fmt.Fprintln(w, s)
+			default:
+				s, err := templateVersion(output, info)
+				if err != nil {
+					return err
+				}
+				fmt.Fprint(w, s)
+			}
+
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVarP(&output, "output", "o", "",
+		"Output format: 'json' or a Go template (e.g. '{{.Version}}').\n"+
+			"Run with '-o json' to discover the field names available to the template.\n"+
+			"(default is human-readable)")
+
+	return cmd
+}
+
+func humanVersion(info version.Info) string {
+	var b strings.Builder
+	b.WriteString(asciiArt)
+	b.WriteString("\n")
+	b.WriteString(fmt.Sprintf("uc: Uncloud CLI tool for deploying apps and managing resources (%s)",
+		tui.URLStyle.Render(version.WebsiteURL)))
+	b.WriteString("\n\n")
+	b.WriteString(info.String())
+	return b.String()
+}
+
+// templateVersion renders the version info using the provided Go template.
+func templateVersion(tmpl string, info version.Info) (string, error) {
+	t, err := template.New("version").Parse(tmpl)
+	if err != nil {
+		return "", fmt.Errorf("parse template: %w", err)
+	}
+
+	var buf bytes.Buffer
+	if err = t.Execute(&buf, info); err != nil {
+		return "", fmt.Errorf("execute template: %w", err)
+	}
+	return buf.String(), nil
+}

cmd/uc/volume/create.go

@@ -0,0 +1,148 @@
+package volume
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"charm.land/huh/v2"
+	"github.com/docker/docker/api/types/volume"
+	"github.com/psviderski/uncloud/api/pb"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type createOptions struct {
+	driver     string
+	driverOpts []string
+	labels     []string
+	machine    string
+}
+
+func NewCreateCommand() *cobra.Command {
+	opts := createOptions{}
+
+	cmd := &cobra.Command{
+		Use:   "create VOLUME_NAME",
+		Short: "Create a volume on a specific machine.",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			opts.driver = strings.TrimSpace(opts.driver)
+
+			volumeName := args[0]
+			if volumeName == "" {
+				return fmt.Errorf("volume name is required")
+			}
+
+			return create(cmd.Context(), uncli, volumeName, opts)
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.driver, "driver", "d", "local",
+		"Volume driver to use.")
+	cmd.Flags().StringSliceVarP(&opts.driverOpts, "opt", "o", nil,
+		"Driver specific options in the form of 'key=value' pairs. Can be specified multiple times.")
+	cmd.Flags().StringSliceVarP(&opts.labels, "label", "l", nil,
+		"Labels to assign to the volume in the form of 'key=value' pairs. Can be specified multiple times.")
+	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
+		"Name or ID of the machine to create the volume on.")
+
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+func create(ctx context.Context, uncli *cli.CLI, name string, opts createOptions) error {
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	// Parse driver options.
+	driverOpts := make(map[string]string)
+	for _, opt := range opts.driverOpts {
+		k, v, ok := strings.Cut(opt, "=")
+		if !ok {
+			return fmt.Errorf("invalid driver option format: '%s' (expected key=value)", opt)
+		}
+		driverOpts[k] = v
+	}
+
+	// Parse labels.
+	labels := make(map[string]string)
+	for _, label := range opts.labels {
+		k, v, ok := strings.Cut(label, "=")
+		if !ok {
+			return fmt.Errorf("invalid label format: '%s' (expected key=value)", label)
+		}
+		labels[k] = v
+	}
+
+	// List machines and filter by the specified machine name or ID.
+	// If no machine is specified, prompt the user to select one.
+	machines, err := client.ListMachines(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("list machines: %w", err)
+	}
+	var selectedMachine *pb.MachineInfo
+
+	if opts.machine == "" {
+		if len(machines) == 1 {
+			selectedMachine = machines[0].Machine
+		} else {
+			if selectedMachine, err = promptSelectMachine(ctx, machines); err != nil {
+				return fmt.Errorf("select machine: %w", err)
+			}
+		}
+	} else {
+		m := machines.FindByNameOrID(opts.machine)
+		if m == nil {
+			return fmt.Errorf("machine '%s' not found", opts.machine)
+		}
+		selectedMachine = m.Machine
+	}
+
+	createOpts := volume.CreateOptions{
+		Name:       name,
+		Driver:     opts.driver,
+		DriverOpts: driverOpts,
+		Labels:     labels,
+	}
+	vol, err := client.CreateVolume(ctx, selectedMachine.Id, createOpts)
+	if err != nil {
+		return fmt.Errorf("create volume '%s' on machine '%s': %w", name, selectedMachine.Name, err)
+	}
+
+	fmt.Printf("Volume '%s' created on machine '%s'.\n", vol.Volume.Name, vol.MachineName)
+	return nil
+}
+
+func promptSelectMachine(ctx context.Context, machines api.MachineMembersList) (*pb.MachineInfo, error) {
+	options := make([]huh.Option[*pb.MachineInfo], len(machines))
+	for i, m := range machines {
+		options[i] = huh.NewOption(m.Machine.Name, m.Machine)
+	}
+	slices.SortFunc(options, func(a, b huh.Option[*pb.MachineInfo]) int {
+		return strings.Compare(a.Key, b.Key)
+	})
+
+	var selected *pb.MachineInfo
+	form := huh.NewForm(
+		huh.NewGroup(
+			huh.NewSelect[*pb.MachineInfo]().
+				Title("Select a machine to create the volume on (or specify with --machine flag)").
+				Options(options...).
+				Value(&selected),
+		),
+	)
+	if err := form.RunWithContext(ctx); err != nil {
+		return nil, err
+	}
+
+	return selected, nil
+}

cmd/uc/volume/inspect.go

@@ -0,0 +1,88 @@
+package volume
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type inspectOptions struct {
+	machine string
+}
+
+func NewInspectCommand() *cobra.Command {
+	opts := inspectOptions{}
+
+	cmd := &cobra.Command{
+		Use:   "inspect VOLUME_NAME",
+		Short: "Display detailed information on a volume.",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return inspect(cmd.Context(), uncli, args[0], opts)
+		},
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			if len(args) > 0 {
+				return nil, cobra.ShellCompDirectiveNoFileComp
+			}
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Volumes(cmd.Context(), uncli, args, toComplete)
+		},
+	}
+
+	cmd.Flags().StringVarP(&opts.machine, "machine", "m", "",
+		"Name or ID of the machine where the volume is located. "+
+			"If not specified, the volume will be searched across all machines.")
+
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+func inspect(ctx context.Context, uncli *cli.CLI, name string, opts inspectOptions) error {
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	filter := &api.VolumeFilter{
+		Names: []string{name},
+	}
+	if opts.machine != "" {
+		filter.Machines = []string{opts.machine}
+	}
+
+	volumes, err := client.ListVolumes(ctx, filter)
+	if err != nil {
+		return fmt.Errorf("list volumes: %w", err)
+	}
+
+	if len(volumes) == 0 {
+		if opts.machine != "" {
+			return fmt.Errorf("volume '%s' not found on machine '%s'", name, opts.machine)
+		}
+		return fmt.Errorf("volume '%s' not found on any machine", name)
+	}
+	if len(volumes) > 1 {
+		fmt.Printf("Volume '%s' found on multiple machines:\n", name)
+		for _, v := range volumes {
+			fmt.Printf(" • %s\n", v.MachineName)
+		}
+		return errors.New("specify --machine flag to choose which machine to use")
+	}
+
+	data, err := json.MarshalIndent(volumes[0], "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshal volume: %w", err)
+	}
+	fmt.Println(string(data))
+
+	return nil
+}

cmd/uc/volume/ls.go

@@ -0,0 +1,101 @@
+package volume
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"charm.land/lipgloss/v2"
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type listOptions struct {
+	machines []string
+	quiet    bool
+}
+
+func NewListCommand() *cobra.Command {
+	opts := listOptions{}
+
+	cmd := &cobra.Command{
+		Use:     "ls",
+		Aliases: []string{"list"},
+		Short:   "List volumes across all machines in the cluster.",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return list(cmd.Context(), uncli, opts)
+		},
+	}
+
+	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
+		"Filter volumes by machine name or ID. Can be specified multiple times or as a comma-separated list. "+
+			"(default is include all machines)")
+	cmd.Flags().BoolVarP(&opts.quiet, "quiet", "q", false,
+		"Only display volume names.")
+
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+func list(ctx context.Context, uncli *cli.CLI, opts listOptions) error {
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	// Apply machine filter if specified.
+	var filter *api.VolumeFilter
+	if len(opts.machines) > 0 {
+		machines := cli.ExpandCommaSeparatedValues(opts.machines)
+		filter = &api.VolumeFilter{
+			Machines: machines,
+		}
+	}
+
+	volumes, err := client.ListVolumes(ctx, filter)
+	if err != nil {
+		return fmt.Errorf("list volumes: %w", err)
+	}
+
+	if len(volumes) == 0 {
+		if !opts.quiet {
+			fmt.Println("No volumes found.")
+		}
+		return nil
+	}
+
+	// Sort the volumes by name first, then by machine name.
+	slices.SortFunc(volumes, func(a, b api.MachineVolume) int {
+		cmp := strings.Compare(a.Volume.Name, b.Volume.Name)
+		if cmp != 0 {
+			return cmp
+		}
+		return strings.Compare(a.MachineName, b.MachineName)
+	})
+
+	// If quiet mode, just print volume names.
+	if opts.quiet {
+		for _, v := range volumes {
+			fmt.Println(v.Volume.Name)
+		}
+		return nil
+	}
+
+	// Print the volumes in a table format.
+	t := tui.NewTable()
+	t.Headers("NAME", "DRIVER", "MACHINE")
+
+	for _, v := range volumes {
+		t.Row(v.Volume.Name, v.Volume.Driver, v.MachineName)
+	}
+
+	lipgloss.Println(t)
+	return nil
+}

cmd/uc/volume/rm.go

@@ -0,0 +1,114 @@
+package volume
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/psviderski/uncloud/internal/cli"
+	"github.com/psviderski/uncloud/internal/cli/completion"
+	"github.com/psviderski/uncloud/internal/cli/tui"
+	"github.com/psviderski/uncloud/pkg/api"
+	"github.com/spf13/cobra"
+)
+
+type removeOptions struct {
+	force    bool
+	machines []string
+	yes      bool
+}
+
+func NewRemoveCommand() *cobra.Command {
+	opts := removeOptions{}
+
+	cmd := &cobra.Command{
+		Use:     "rm VOLUME_NAME [VOLUME_NAME...]",
+		Aliases: []string{"remove", "delete"},
+		Short:   "Remove one or more volumes.",
+		Long:    "Remove one or more volumes. You cannot remove a volume that is in use by a container.",
+		Args:    cobra.MinimumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return remove(cmd.Context(), uncli, args, opts)
+		},
+		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]cobra.Completion, cobra.ShellCompDirective) {
+			uncli := cmd.Context().Value("cli").(*cli.CLI)
+			return completion.Volumes(cmd.Context(), uncli, args, toComplete)
+		},
+	}
+
+	cmd.Flags().BoolVarP(&opts.force, "force", "f", false,
+		"Force the removal of one or more volumes.")
+	cmd.Flags().StringSliceVarP(&opts.machines, "machine", "m", nil,
+		"Name or ID of the machine to remove one or more volumes from. "+
+			"Can be specified multiple times or as a comma-separated list.\n"+
+			"If not specified, the found volume(s) will be removed from all machines.")
+	cmd.Flags().BoolVarP(&opts.yes, "yes", "y", false,
+		"Do not prompt for confirmation before removing the volume(s).")
+
+	completion.MachinesFlag(cmd)
+
+	return cmd
+}
+
+func remove(ctx context.Context, uncli *cli.CLI, names []string, opts removeOptions) error {
+	client, err := uncli.ConnectCluster(ctx)
+	if err != nil {
+		return fmt.Errorf("connect to cluster: %w", err)
+	}
+	defer client.Close()
+
+	filter := &api.VolumeFilter{
+		Names: names,
+	}
+
+	if len(opts.machines) > 0 {
+		machines := cli.ExpandCommaSeparatedValues(opts.machines)
+		filter.Machines = machines
+	}
+
+	volumes, err := client.ListVolumes(ctx, filter)
+	if err != nil {
+		return fmt.Errorf("list volumes: %w", err)
+	}
+
+	if len(volumes) == 0 {
+		if len(names) == 1 {
+			return fmt.Errorf("volume '%s' not found", names[0])
+		}
+		return fmt.Errorf("no volumes found matching the specified names")
+	}
+
+	// Confirm removal if not using --yes flag.
+	if !opts.yes {
+		fmt.Println("The following volumes will be removed:")
+		for _, v := range volumes {
+			fmt.Printf(" • '%s' on machine '%s'\n", v.Volume.Name, v.MachineName)
+		}
+
+		fmt.Println()
+		confirmed, err := tui.Confirm("")
+		if err != nil {
+			return fmt.Errorf("confirm removal: %w", err)
+		}
+		if !confirmed {
+			return cli.Cancelled("Cancelled. No volumes were removed.")
+		}
+	}
+
+	// Remove the volumes one by one collecting errors.
+	var removeErr error
+	for _, v := range volumes {
+		if err = client.RemoveVolume(ctx, v.MachineID, v.Volume.Name, opts.force); err != nil {
+			if !errors.Is(err, api.ErrNotFound) {
+				removeErr = errors.Join(removeErr, fmt.Errorf("failed to remove volume '%s' on machine '%s': %w",
+					v.Volume.Name, v.MachineName, err))
+			}
+			continue
+		}
+
+		fmt.Printf("Volume '%s' removed from machine '%s'.\n", v.Volume.Name, v.MachineName)
+	}
+
+	return removeErr
+}