Rename to Kamal

lib/kamal/commands/accessory.rb

@@ -0,0 +1,113 @@
+class Kamal::Commands::Accessory < Kamal::Commands::Base
+  attr_reader :accessory_config
+  delegate :service_name, :image, :hosts, :port, :files, :directories, :cmd,
+           :publish_args, :env_args, :volume_args, :label_args, :option_args, to: :accessory_config
+
+  def initialize(config, name:)
+    super(config)
+    @accessory_config = config.accessory(name)
+  end
+
+  def run
+    docker :run,
+      "--name", service_name,
+      "--detach",
+      "--restart", "unless-stopped",
+      *config.logging_args,
+      *publish_args,
+      *env_args,
+      *volume_args,
+      *label_args,
+      *option_args,
+      image,
+      cmd
+  end
+
+  def start
+    docker :container, :start, service_name
+  end
+
+  def stop
+    docker :container, :stop, service_name
+  end
+
+  def info
+    docker :ps, *service_filter
+  end
+
+
+  def logs(since: nil, lines: nil, grep: nil)
+    pipe \
+      docker(:logs, service_name, (" --since #{since}" if since), (" --tail #{lines}" if lines), "--timestamps", "2>&1"),
+      ("grep '#{grep}'" if grep)
+  end
+
+  def follow_logs(grep: nil)
+    run_over_ssh \
+      pipe \
+        docker(:logs, service_name, "--timestamps", "--tail", "10", "--follow", "2>&1"),
+        (%(grep "#{grep}") if grep)
+  end
+
+
+  def execute_in_existing_container(*command, interactive: false)
+    docker :exec,
+      ("-it" if interactive),
+      service_name,
+      *command
+  end
+
+  def execute_in_new_container(*command, interactive: false)
+    docker :run,
+      ("-it" if interactive),
+      "--rm",
+      *env_args,
+      *volume_args,
+      image,
+      *command
+  end
+
+  def execute_in_existing_container_over_ssh(*command)
+    run_over_ssh execute_in_existing_container(*command, interactive: true)
+  end
+
+  def execute_in_new_container_over_ssh(*command)
+    run_over_ssh execute_in_new_container(*command, interactive: true)
+  end
+
+  def run_over_ssh(command)
+    super command, host: hosts.first
+  end
+
+
+  def ensure_local_file_present(local_file)
+    if !local_file.is_a?(StringIO) && !Pathname.new(local_file).exist?
+      raise "Missing file: #{local_file}"
+    end
+  end
+
+  def make_directory_for(remote_file)
+    make_directory Pathname.new(remote_file).dirname.to_s
+  end
+
+  def make_directory(path)
+    [ :mkdir, "-p", path ]
+  end
+
+  def remove_service_directory
+    [ :rm, "-rf", service_name ]
+  end
+
+  def remove_container
+    docker :container, :prune, "--force", *service_filter
+  end
+
+  def remove_image
+    docker :image, :rm, "--force", image
+  end
+
+  private
+    def service_filter
+      [ "--filter", "label=service=#{service_name}" ]
+    end
+end

lib/kamal/commands/app.rb

@@ -0,0 +1,175 @@
+class Kamal::Commands::App < Kamal::Commands::Base
+  ACTIVE_DOCKER_STATUSES = [ :running, :restarting ]
+
+  attr_reader :role
+
+  def initialize(config, role: nil)
+    super(config)
+    @role = role
+  end
+
+  def start_or_run(hostname: nil)
+    combine start, run(hostname: hostname), by: "||"
+  end
+
+  def run(hostname: nil)
+    role = config.role(self.role)
+
+    docker :run,
+      "--detach",
+      "--restart unless-stopped",
+      "--name", container_name,
+      *(["--hostname", hostname] if hostname),
+      "-e", "KAMAL_CONTAINER_NAME=\"#{container_name}\"",
+      *role.env_args,
+      *role.health_check_args,
+      *config.logging_args,
+      *config.volume_args,
+      *role.label_args,
+      *role.option_args,
+      config.absolute_image,
+      role.cmd
+  end
+
+  def start
+    docker :start, container_name
+  end
+
+  def status(version:)
+    pipe container_id_for_version(version), xargs(docker(:inspect, "--format", DOCKER_HEALTH_STATUS_FORMAT))
+  end
+
+  def stop(version: nil)
+    pipe \
+      version ? container_id_for_version(version) : current_running_container_id,
+      xargs(config.stop_wait_time ? docker(:stop, "-t", config.stop_wait_time) : docker(:stop))
+  end
+
+  def info
+    docker :ps, *filter_args
+  end
+
+
+  def logs(since: nil, lines: nil, grep: nil)
+    pipe \
+      current_running_container_id,
+      "xargs docker logs#{" --since #{since}" if since}#{" --tail #{lines}" if lines} 2>&1",
+      ("grep '#{grep}'" if grep)
+  end
+
+  def follow_logs(host:, grep: nil)
+    run_over_ssh \
+      pipe(
+        current_running_container_id,
+        "xargs docker logs --timestamps --tail 10 --follow 2>&1",
+        (%(grep "#{grep}") if grep)
+      ),
+      host: host
+  end
+
+
+  def execute_in_existing_container(*command, interactive: false)
+    docker :exec,
+      ("-it" if interactive),
+      container_name,
+      *command
+  end
+
+  def execute_in_new_container(*command, interactive: false)
+    role = config.role(self.role)
+
+    docker :run,
+      ("-it" if interactive),
+      "--rm",
+      *config.env_args,
+      *config.volume_args,
+      *role&.option_args,
+      config.absolute_image,
+      *command
+  end
+
+  def execute_in_existing_container_over_ssh(*command, host:)
+    run_over_ssh execute_in_existing_container(*command, interactive: true), host: host
+  end
+
+  def execute_in_new_container_over_ssh(*command, host:)
+    run_over_ssh execute_in_new_container(*command, interactive: true), host: host
+  end
+
+
+  def current_running_container_id
+    docker :ps, "--quiet", *filter_args(statuses: ACTIVE_DOCKER_STATUSES), "--latest"
+  end
+
+  def container_id_for_version(version, only_running: false)
+    container_id_for(container_name: container_name(version), only_running: only_running)
+  end
+
+  def current_running_version
+    list_versions("--latest", statuses: ACTIVE_DOCKER_STATUSES)
+  end
+
+  def list_versions(*docker_args, statuses: nil)
+    pipe \
+      docker(:ps, *filter_args(statuses: statuses), *docker_args, "--format", '"{{.Names}}"'),
+      %(while read line; do echo ${line##{service_role_dest}-}; done) # Extract SHA from "service-role-dest-SHA"
+  end
+
+  def list_containers
+    docker :container, :ls, "--all", *filter_args
+  end
+
+  def list_container_names
+    [ *list_containers, "--format", "'{{ .Names }}'" ]
+  end
+
+  def remove_container(version:)
+    pipe \
+      container_id_for(container_name: container_name(version)),
+      xargs(docker(:container, :rm))
+  end
+
+  def rename_container(version:, new_version:)
+    docker :rename, container_name(version), container_name(new_version)
+  end
+
+  def remove_containers
+    docker :container, :prune, "--force", *filter_args
+  end
+
+  def list_images
+    docker :image, :ls, config.repository
+  end
+
+  def remove_images
+    docker :image, :prune, "--all", "--force", *filter_args
+  end
+
+  def tag_current_as_latest
+    docker :tag, config.absolute_image, config.latest_image
+  end
+
+
+  private
+    def container_name(version = nil)
+      [ config.service, role, config.destination, version || config.version ].compact.join("-")
+    end
+
+    def filter_args(statuses: nil)
+      argumentize "--filter", filters(statuses: statuses)
+    end
+
+    def service_role_dest
+      [config.service, role, config.destination].compact.join("-")
+    end
+
+    def filters(statuses: nil)
+      [ "label=service=#{config.service}" ].tap do |filters|
+        filters << "label=destination=#{config.destination}" if config.destination
+        filters << "label=role=#{role}" if role
+        statuses&.each do |status|
+          filters << "status=#{status}"
+        end
+      end
+    end
+end

lib/kamal/commands/auditor.rb

@@ -0,0 +1,28 @@
+class Kamal::Commands::Auditor < Kamal::Commands::Base
+  attr_reader :details
+
+  def initialize(config, **details)
+    super(config)
+    @details = details
+  end
+
+  # Runs remotely
+  def record(line, **details)
+    append \
+      [ :echo, audit_tags(**details).except(:version, :service_version).to_s, line ],
+      audit_log_file
+  end
+
+  def reveal
+    [ :tail, "-n", 50, audit_log_file ]
+  end
+
+  private
+    def audit_log_file
+      [ "kamal", config.service, config.destination, "audit.log" ].compact.join("-")
+    end
+
+    def audit_tags(**details)
+      tags(**self.details, **details)
+    end
+end

lib/kamal/commands/base.rb

@@ -0,0 +1,65 @@
+module Kamal::Commands
+  class Base
+    delegate :sensitive, :argumentize, to: Kamal::Utils
+
+    DOCKER_HEALTH_STATUS_FORMAT = "'{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}'"
+    DOCKER_HEALTH_LOG_FORMAT    = "'{{json .State.Health}}'"
+
+    attr_accessor :config
+
+    def initialize(config)
+      @config = config
+    end
+
+    def run_over_ssh(*command, host:)
+      "ssh".tap do |cmd|
+        if config.ssh.proxy && config.ssh.proxy.is_a?(Net::SSH::Proxy::Jump)
+          cmd << " -J #{config.ssh.proxy.jump_proxies}"
+        elsif config.ssh.proxy && config.ssh.proxy.is_a?(Net::SSH::Proxy::Command)
+          cmd << " -o ProxyCommand='#{config.ssh.proxy.command_line_template}'"
+        end
+        cmd << " -t #{config.ssh.user}@#{host} '#{command.join(" ")}'"
+      end
+    end
+
+    def container_id_for(container_name:, only_running: false)
+      docker :container, :ls, *("--all" unless only_running), "--filter", "name=^#{container_name}$", "--quiet"
+    end
+
+    private
+      def combine(*commands, by: "&&")
+        commands
+          .compact
+          .collect { |command| Array(command) + [ by ] }.flatten # Join commands
+          .tap     { |commands| commands.pop } # Remove trailing combiner
+      end
+
+      def chain(*commands)
+        combine *commands, by: ";"
+      end
+
+      def pipe(*commands)
+        combine *commands, by: "|"
+      end
+
+      def append(*commands)
+        combine *commands, by: ">>"
+      end
+
+      def write(*commands)
+        combine *commands, by: ">"
+      end
+
+      def xargs(command)
+        [ :xargs, command ].flatten
+      end
+
+      def docker(*args)
+        args.compact.unshift :docker
+      end
+
+      def tags(**details)
+        Kamal::Tags.from_config(config, **details)
+      end
+  end
+end

lib/kamal/commands/builder.rb

@@ -0,0 +1,62 @@
+class Kamal::Commands::Builder < Kamal::Commands::Base
+  delegate :create, :remove, :push, :clean, :pull, :info, to: :target
+
+  def name
+    target.class.to_s.remove("Kamal::Commands::Builder::").underscore.inquiry
+  end
+
+  def target
+    case
+    when !config.builder.multiarch? && !config.builder.cached?
+      native
+    when !config.builder.multiarch? && config.builder.cached?
+      native_cached
+    when config.builder.local? && config.builder.remote?
+      multiarch_remote
+    when config.builder.remote?
+      native_remote
+    else
+      multiarch
+    end
+  end
+
+  def native
+    @native ||= Kamal::Commands::Builder::Native.new(config)
+  end
+
+  def native_cached
+    @native ||= Kamal::Commands::Builder::Native::Cached.new(config)
+  end
+
+  def native_remote
+    @native ||= Kamal::Commands::Builder::Native::Remote.new(config)
+  end
+
+  def multiarch
+    @multiarch ||= Kamal::Commands::Builder::Multiarch.new(config)
+  end
+
+  def multiarch_remote
+    @multiarch_remote ||= Kamal::Commands::Builder::Multiarch::Remote.new(config)
+  end
+
+
+  def ensure_local_dependencies_installed
+    if name.native?
+      ensure_local_docker_installed
+    else
+      combine \
+        ensure_local_docker_installed,
+        ensure_local_buildx_installed
+    end
+  end
+
+  private
+    def ensure_local_docker_installed
+      docker "--version"
+    end
+
+    def ensure_local_buildx_installed
+      docker :buildx, "version"
+    end
+end

lib/kamal/commands/builder/base.rb

@@ -0,0 +1,60 @@
+
+class Kamal::Commands::Builder::Base < Kamal::Commands::Base
+  class BuilderError < StandardError; end
+
+  delegate :argumentize, to: Kamal::Utils
+  delegate :args, :secrets, :dockerfile, :local_arch, :local_host, :remote_arch, :remote_host, :cache_from, :cache_to, to: :builder_config
+
+  def clean
+    docker :image, :rm, "--force", config.absolute_image
+  end
+
+  def pull
+    docker :pull, config.absolute_image
+  end
+
+  def build_options
+    [ *build_tags, *build_cache, *build_labels, *build_args, *build_secrets, *build_dockerfile ]
+  end
+
+  def build_context
+    config.builder.context
+  end
+
+
+  private
+    def build_tags
+      [ "-t", config.absolute_image, "-t", config.latest_image ]
+    end
+
+    def build_cache
+      if cache_to && cache_from
+        ["--cache-to", cache_to,
+          "--cache-from", cache_from]
+      end
+    end
+
+    def build_labels
+      argumentize "--label", { service: config.service }
+    end
+
+    def build_args
+      argumentize "--build-arg", args, sensitive: true
+    end
+
+    def build_secrets
+      argumentize "--secret", secrets.collect { |secret| [ "id", secret ] }
+    end
+
+    def build_dockerfile
+      if Pathname.new(File.expand_path(dockerfile)).exist?
+        argumentize "--file", dockerfile
+      else
+        raise BuilderError, "Missing #{dockerfile}"
+      end
+    end
+
+    def builder_config
+      config.builder
+    end
+end

lib/kamal/commands/builder/multiarch.rb

@@ -0,0 +1,29 @@
+class Kamal::Commands::Builder::Multiarch < Kamal::Commands::Builder::Base
+  def create
+    docker :buildx, :create, "--use", "--name", builder_name
+  end
+
+  def remove
+    docker :buildx, :rm, builder_name
+  end
+
+  def push
+    docker :buildx, :build,
+      "--push",
+      "--platform", "linux/amd64,linux/arm64",
+      "--builder", builder_name,
+      *build_options,
+      build_context
+  end
+
+  def info
+    combine \
+      docker(:context, :ls),
+      docker(:buildx, :ls)
+  end
+
+  private
+    def builder_name
+      "kamal-#{config.service}-multiarch"
+    end
+end

lib/kamal/commands/builder/multiarch/remote.rb

@@ -0,0 +1,51 @@
+class Kamal::Commands::Builder::Multiarch::Remote < Kamal::Commands::Builder::Multiarch
+  def create
+    combine \
+      create_contexts,
+      create_local_buildx,
+      append_remote_buildx
+  end
+
+  def remove
+    combine \
+      remove_contexts,
+      super
+  end
+
+  private
+    def builder_name
+      super + "-remote"
+    end
+
+    def builder_name_with_arch(arch)
+      "#{builder_name}-#{arch}"
+    end
+
+    def create_local_buildx
+      docker :buildx, :create, "--name", builder_name, builder_name_with_arch(local_arch), "--platform", "linux/#{local_arch}"
+    end
+
+    def append_remote_buildx
+      docker :buildx, :create, "--append", "--name", builder_name, builder_name_with_arch(remote_arch), "--platform", "linux/#{remote_arch}"
+    end
+
+    def create_contexts
+      combine \
+        create_context(local_arch, local_host),
+        create_context(remote_arch, remote_host)
+    end
+
+    def create_context(arch, host)
+      docker :context, :create, builder_name_with_arch(arch), "--description", "'#{builder_name} #{arch} native host'", "--docker", "'host=#{host}'"
+    end
+
+    def remove_contexts
+      combine \
+        remove_context(local_arch),
+        remove_context(remote_arch)
+    end
+
+    def remove_context(arch)
+      docker :context, :rm, builder_name_with_arch(arch)
+    end
+end

lib/kamal/commands/builder/native.rb

@@ -0,0 +1,20 @@
+class Kamal::Commands::Builder::Native < Kamal::Commands::Builder::Base
+  def create
+    # No-op on native without cache
+  end
+
+  def remove
+    # No-op on native without cache
+  end
+
+  def push
+    combine \
+      docker(:build, *build_options, build_context),
+      docker(:push, config.absolute_image),
+      docker(:push, config.latest_image)
+  end
+
+  def info
+    # No-op on native
+  end
+end

lib/kamal/commands/builder/native/cached.rb

@@ -0,0 +1,16 @@
+class Kamal::Commands::Builder::Native::Cached < Kamal::Commands::Builder::Native
+  def create
+    docker :buildx, :create, "--use", "--driver=docker-container"
+  end
+
+  def remove
+    docker :buildx, :rm, builder_name
+  end
+
+  def push
+    docker :buildx, :build,
+      "--push",
+      *build_options,
+      build_context
+  end
+end

lib/kamal/commands/builder/native/remote.rb

@@ -0,0 +1,59 @@
+class Kamal::Commands::Builder::Native::Remote < Kamal::Commands::Builder::Native
+  def create
+    chain \
+      create_context,
+      create_buildx
+  end
+
+  def remove
+    chain \
+      remove_context,
+      remove_buildx
+  end
+
+  def push
+    docker :buildx, :build,
+      "--push",
+      "--platform", platform,
+      "--builder", builder_name,
+      *build_options,
+      build_context
+  end
+
+  def info
+    chain \
+      docker(:context, :ls),
+      docker(:buildx, :ls)
+  end
+
+
+  private
+    def builder_name
+      "kamal-#{config.service}-native-remote"
+    end
+
+    def builder_name_with_arch
+      "#{builder_name}-#{remote_arch}"
+    end
+
+    def platform
+      "linux/#{remote_arch}"
+    end
+
+    def create_context
+      docker :context, :create,
+        builder_name_with_arch, "--description", "'#{builder_name} #{remote_arch} native host'", "--docker", "'host=#{remote_host}'"
+    end
+
+    def remove_context
+      docker :context, :rm, builder_name_with_arch
+    end
+
+    def create_buildx
+      docker :buildx, :create, "--name", builder_name, builder_name_with_arch, "--platform", platform
+    end
+
+    def remove_buildx
+      docker :buildx, :rm, builder_name
+    end
+end

lib/kamal/commands/docker.rb

@@ -0,0 +1,21 @@
+class Kamal::Commands::Docker < Kamal::Commands::Base
+  # Install Docker using the https://github.com/docker/docker-install convenience script.
+  def install
+    pipe [ :curl, "-fsSL", "https://get.docker.com" ], :sh
+  end
+
+  # Checks the Docker client version. Fails if Docker is not installed.
+  def installed?
+    docker "-v"
+  end
+
+  # Checks the Docker server version. Fails if Docker is not running.
+  def running?
+    docker :version
+  end
+
+  # Do we have superuser access to install Docker and start system services?
+  def superuser?
+    [ '[ "${EUID:-$(id -u)}" -eq 0 ]' ]
+  end
+end

lib/kamal/commands/healthcheck.rb

@@ -0,0 +1,57 @@
+class Kamal::Commands::Healthcheck < Kamal::Commands::Base
+  EXPOSED_PORT = 3999
+
+  def run
+    web = config.role(:web)
+
+    docker :run,
+      "--detach",
+      "--name", container_name_with_version,
+      "--publish", "#{EXPOSED_PORT}:#{config.healthcheck["port"]}",
+      "--label", "service=#{container_name}",
+      "-e", "KAMAL_CONTAINER_NAME=\"#{container_name}\"",
+      *web.env_args,
+      *web.health_check_args,
+      *config.volume_args,
+      *web.option_args,
+      config.absolute_image,
+      web.cmd
+  end
+
+  def status
+    pipe container_id, xargs(docker(:inspect, "--format", DOCKER_HEALTH_STATUS_FORMAT))
+  end
+
+  def container_health_log
+    pipe container_id, xargs(docker(:inspect, "--format", DOCKER_HEALTH_LOG_FORMAT))
+  end
+
+  def logs
+    pipe container_id, xargs(docker(:logs, "--tail", 50, "2>&1"))
+  end
+
+  def stop
+    pipe container_id, xargs(docker(:stop))
+  end
+
+  def remove
+    pipe container_id, xargs(docker(:container, :rm))
+  end
+
+  private
+    def container_name
+      [ "healthcheck", config.service, config.destination ].compact.join("-")
+    end
+
+    def container_name_with_version
+      "#{container_name}-#{config.version}"
+    end
+
+    def container_id
+      container_id_for(container_name: container_name_with_version)
+    end
+
+    def health_url
+      "http://localhost:#{EXPOSED_PORT}#{config.healthcheck["path"]}"
+    end
+end

lib/kamal/commands/hook.rb

@@ -0,0 +1,14 @@
+class Kamal::Commands::Hook < Kamal::Commands::Base
+  def run(hook, **details)
+    [ hook_file(hook), env: tags(**details).env ]
+  end
+
+  def hook_exists?(hook)
+    Pathname.new(hook_file(hook)).exist?
+  end
+
+  private
+    def hook_file(hook)
+      "#{config.hooks_path}/#{hook}"
+    end
+end

lib/kamal/commands/lock.rb

@@ -0,0 +1,63 @@
+require "active_support/duration"
+require "time"
+
+class Kamal::Commands::Lock < Kamal::Commands::Base
+  def acquire(message, version)
+    combine \
+      [:mkdir, lock_dir],
+      write_lock_details(message, version)
+  end
+
+  def release
+    combine \
+      [:rm, lock_details_file],
+      [:rm, "-r", lock_dir]
+  end
+
+  def status
+    combine \
+      stat_lock_dir,
+      read_lock_details
+  end
+
+  private
+    def write_lock_details(message, version)
+      write \
+        [:echo, "\"#{Base64.encode64(lock_details(message, version))}\""],
+        lock_details_file
+    end
+
+    def read_lock_details
+      pipe \
+        [:cat, lock_details_file],
+        [:base64, "-d"]
+    end
+
+    def stat_lock_dir
+      write \
+        [:stat, lock_dir],
+        "/dev/null"
+    end
+
+    def lock_dir
+      "kamal_lock-#{config.service}"
+    end
+
+    def lock_details_file
+      [lock_dir, :details].join("/")
+    end
+
+    def lock_details(message, version)
+      <<~DETAILS.strip
+        Locked by: #{locked_by} at #{Time.now.utc.iso8601}
+        Version: #{version}
+        Message: #{message}
+      DETAILS
+    end
+
+    def locked_by
+      `git config user.name`.strip
+    rescue Errno::ENOENT
+      "Unknown"
+    end
+end

lib/kamal/commands/prune.rb

@@ -0,0 +1,38 @@
+require "active_support/duration"
+require "active_support/core_ext/numeric/time"
+
+class Kamal::Commands::Prune < Kamal::Commands::Base
+  def dangling_images
+    docker :image, :prune, "--force", "--filter", "label=service=#{config.service}", "--filter", "dangling=true"
+  end
+
+  def tagged_images
+    pipe \
+      docker(:image, :ls, *service_filter, "--format", "'{{.ID}} {{.Repository}}:{{.Tag}}'"),
+      "grep -v -w \"#{active_image_list}\"",
+      "while read image tag; do docker rmi $tag; done"
+  end
+
+  def containers(keep_last: 5)
+    pipe \
+      docker(:ps, "-q", "-a", *service_filter, *stopped_containers_filters),
+      "tail -n +#{keep_last + 1}",
+      "while read container_id; do docker rm $container_id; done"
+  end
+
+  private
+    def stopped_containers_filters
+      [ "created", "exited", "dead" ].flat_map { |status| ["--filter", "status=#{status}"] }
+    end
+
+    def active_image_list
+      # Pull the images that are used by any containers
+      # Append repo:latest - to avoid deleting the latest tag
+      # Append repo:<none> - to avoid deleting dangling images that are in use. Unused dangling images are deleted separately
+      "$(docker container ls -a --format '{{.Image}}\\|' --filter label=service=#{config.service} | tr -d '\\n')#{config.latest_image}\\|#{config.repository}:<none>"
+    end
+
+    def service_filter
+      [ "--filter", "label=service=#{config.service}" ]
+    end
+end

lib/kamal/commands/registry.rb

@@ -0,0 +1,20 @@
+class Kamal::Commands::Registry < Kamal::Commands::Base
+  delegate :registry, to: :config
+
+  def login
+    docker :login, registry["server"], "-u", sensitive(lookup("username")), "-p", sensitive(lookup("password"))
+  end
+
+  def logout
+    docker :logout, registry["server"]
+  end
+
+  private
+    def lookup(key)
+      if registry[key].is_a?(Array)
+        ENV.fetch(registry[key].first).dup
+      else
+        registry[key]
+      end
+    end
+end

lib/kamal/commands/traefik.rb

@@ -0,0 +1,104 @@
+class Kamal::Commands::Traefik < Kamal::Commands::Base
+  delegate :argumentize, :argumentize_env_with_secrets, :optionize, to: Kamal::Utils
+
+  DEFAULT_IMAGE = "traefik:v2.9"
+  CONTAINER_PORT = 80
+  DEFAULT_ARGS = {
+    'log.level' => 'DEBUG'
+  }
+
+  def run
+    docker :run, "--name traefik",
+      "--detach",
+      "--restart", "unless-stopped",
+      "--publish", port,
+      "--volume", "/var/run/docker.sock:/var/run/docker.sock",
+      *env_args,
+      *config.logging_args,
+      *label_args,
+      *docker_options_args,
+      image,
+      "--providers.docker",
+      *cmd_option_args
+  end
+
+  def start
+    docker :container, :start, "traefik"
+  end
+
+  def stop
+    docker :container, :stop, "traefik"
+  end
+
+  def start_or_run
+    combine start, run, by: "||"
+  end
+
+  def info
+    docker :ps, "--filter", "name=^traefik$"
+  end
+
+  def logs(since: nil, lines: nil, grep: nil)
+    pipe \
+      docker(:logs, "traefik", (" --since #{since}" if since), (" --tail #{lines}" if lines), "--timestamps", "2>&1"),
+      ("grep '#{grep}'" if grep)
+  end
+
+  def follow_logs(host:, grep: nil)
+    run_over_ssh pipe(
+      docker(:logs, "traefik", "--timestamps", "--tail", "10", "--follow", "2>&1"),
+      (%(grep "#{grep}") if grep)
+    ).join(" "), host: host
+  end
+
+  def remove_container
+    docker :container, :prune, "--force", "--filter", "label=org.opencontainers.image.title=Traefik"
+  end
+
+  def remove_image
+    docker :image, :prune, "--all", "--force", "--filter", "label=org.opencontainers.image.title=Traefik"
+  end
+
+  def port
+    "#{host_port}:#{CONTAINER_PORT}"
+  end
+
+  private
+    def label_args
+      argumentize "--label", labels
+    end
+
+    def env_args
+      env_config = config.traefik["env"] || {}
+
+      if env_config.present?
+        argumentize_env_with_secrets(env_config)
+      else
+        []
+      end
+    end
+
+    def labels
+      config.traefik["labels"] || []
+    end
+
+    def image
+      config.traefik.fetch("image") { DEFAULT_IMAGE }
+    end
+
+    def docker_options_args
+      optionize(config.traefik["options"] || {})
+    end
+
+    def cmd_option_args
+      if args = config.traefik["args"]
+        optionize DEFAULT_ARGS.merge(args), with: "="
+      else
+        optionize DEFAULT_ARGS, with: "="
+      end
+    end
+
+    def host_port
+      config.traefik["host_port"] || CONTAINER_PORT
+    end
+end