diff --git a/Gemfile.lock b/Gemfile.lock
index 6ca852e2..850fb735 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,11 +1,12 @@
 PATH
   remote: .
   specs:
-    mrsk (0.4.0)
+    mrsk (0.5.1)
       activesupport (>= 7.0)
       dotenv (~> 2.8)
       sshkit (~> 1.21)
       thor (~> 1.2)
+      zeitwerk (~> 2.5)
 
 GEM
   remote: https://rubygems.org/
@@ -91,6 +92,7 @@ PLATFORMS
   arm64-darwin-22
   x86_64-darwin-20
   x86_64-darwin-21
+  x86_64-darwin-22
   x86_64-linux
 
 DEPENDENCIES
diff --git a/README.md b/README.md
index d9110c0f..e70b0670 100644
--- a/README.md
+++ b/README.md
@@ -319,9 +319,9 @@ Now run `mrsk accessory start mysql` to start the MySQL server on 1.1.1.3. See `
 
 ## Commands
 
-### Running remote execution and runners
+### Running commands on servers
 
-If you need to execute commands inside the Rails containers, you can use `mrsk app exec` and `mrsk app runner`. Examples:
+You can execute one-off commands on the servers:
 
 ```bash
 # Runs command on all servers
@@ -364,13 +364,25 @@ Database adapter          sqlite3
 Database schema version   20221231233303
 
 # Run Rails runner on primary server
-mrsk app runner -p 'puts Rails.application.config.time_zone'
+mrsk app exec -p 'bin/rails runner "puts Rails.application.config.time_zone"'
 UTC
 ```
 
-### Running a Rails console
+### Running interactive commands over SSH
+
+You can run interactive commands, like a Rails console or a bash session, on a server (default is primary, use `--hosts` to connect to another):
+
+```bash
+# Starts a bash session in a new container made from the most recent app image
+mrsk app exec -i bash
+
+# Starts a bash session in the currently running container for the app
+mrsk app exec -i --reuse bash
+
+# Starts a Rails console in a new container made from the most recent app image
+mrsk app exec -i 'bin/rails console'
+```
 
-If you need to interact with the production console for the app, you can use `mrsk app console`, which will start a Rails console session on the primary host. You can start the console on a different host using `mrsk app console --host 192.168.0.2`. Be mindful that this is a live wire! Any changes made to the production database will take effect immeditately.
 
 ### Running details to see state of containers
 
diff --git a/bin/mrsk b/bin/mrsk
index d156bed1..dac9af62 100755
--- a/bin/mrsk
+++ b/bin/mrsk
@@ -4,7 +4,7 @@
 Thread.report_on_exception = false
 
 require "dotenv/load"
-require "mrsk/cli"
+require "mrsk"
 
 begin
   Mrsk::Cli::Main.start(ARGV)
diff --git a/lib/mrsk.rb b/lib/mrsk.rb
index 3adf2bef..19b86051 100644
--- a/lib/mrsk.rb
+++ b/lib/mrsk.rb
@@ -1,5 +1,9 @@
 module Mrsk
 end
 
-require "mrsk/version"
-require "mrsk/commander"
+require "zeitwerk"
+
+loader = Zeitwerk::Loader.for_gem
+loader.ignore("#{__dir__}/mrsk/sshkit_with_ext.rb")
+loader.setup
+loader.eager_load # We need all commands loaded.
diff --git a/lib/mrsk/cli.rb b/lib/mrsk/cli.rb
index 35fc8f44..62323076 100644
--- a/lib/mrsk/cli.rb
+++ b/lib/mrsk/cli.rb
@@ -1,9 +1,5 @@
-require "mrsk"
-
 module Mrsk::Cli
 end
 
 # SSHKit uses instance eval, so we need a global const for ergonomics
 MRSK = Mrsk::Commander.new
-
-require "mrsk/cli/main"
diff --git a/lib/mrsk/cli/accessory.rb b/lib/mrsk/cli/accessory.rb
index 2263fe48..5bf9ff9b 100644
--- a/lib/mrsk/cli/accessory.rb
+++ b/lib/mrsk/cli/accessory.rb
@@ -1,5 +1,3 @@
-require "mrsk/cli/base"
-
 class Mrsk::Cli::Accessory < Mrsk::Cli::Base
   desc "boot [NAME]", "Boot accessory service on host (use NAME=all to boot all accessories)"
   def boot(name)
@@ -9,7 +7,10 @@ class Mrsk::Cli::Accessory < Mrsk::Cli::Base
       with_accessory(name) do |accessory|
         directories(name)
         upload(name)
-        on(accessory.host) { execute *accessory.run }
+        on(accessory.host) do
+          execute *MRSK.auditor.record("accessory #{name} boot"), verbosity: :debug
+          execute *accessory.run
+        end
       end
     end
   end
@@ -18,6 +19,8 @@ class Mrsk::Cli::Accessory < Mrsk::Cli::Base
   def upload(name)
     with_accessory(name) do |accessory|
       on(accessory.host) do
+        execute *MRSK.auditor.record("accessory #{name} upload files"), verbosity: :debug
+
         accessory.files.each do |(local, remote)|
           accessory.ensure_local_file_present(local)
 
@@ -33,6 +36,8 @@ class Mrsk::Cli::Accessory < Mrsk::Cli::Base
   def directories(name)
     with_accessory(name) do |accessory|
       on(accessory.host) do
+        execute *MRSK.auditor.record("accessory #{name} create directories"), verbosity: :debug
+
         accessory.directories.keys.each do |host_path|
           execute *accessory.make_directory(host_path)
         end
@@ -52,14 +57,20 @@ class Mrsk::Cli::Accessory < Mrsk::Cli::Base
   desc "start [NAME]", "Start existing accessory on host"
   def start(name)
     with_accessory(name) do |accessory|
-      on(accessory.host) { execute *accessory.start }
+      on(accessory.host) do
+        execute *MRSK.auditor.record("accessory #{name} start"), verbosity: :debug
+        execute *accessory.start
+      end
     end
   end
 
   desc "stop [NAME]", "Stop accessory on host"
   def stop(name)
     with_accessory(name) do |accessory|
-      on(accessory.host) { execute *accessory.stop, raise_on_non_zero_exit: false }
+      on(accessory.host) do
+        execute *MRSK.auditor.record("accessory #{name} stop"), verbosity: :debug
+        execute *accessory.stop, raise_on_non_zero_exit: false
+      end
     end
   end
 
@@ -82,39 +93,33 @@ class Mrsk::Cli::Accessory < Mrsk::Cli::Base
     end
   end
 
-  desc "exec [NAME] [CMD]", "Execute a custom command on accessory host"
-  option :method, aliases: "-m", default: "exec", desc: "Execution method: [exec] perform inside container / [run] perform in new container / [ssh] perform over ssh"
+  desc "exec [NAME] [CMD]", "Execute a custom command on servers"
+  option :interactive, aliases: "-i", type: :boolean, default: false, desc: "Execute command over ssh for an interactive shell (use for console/bash)"
+  option :reuse, type: :boolean, default: false, desc: "Reuse currently running container instead of starting a new one"
   def exec(name, cmd)
-    runner = \
-      case options[:method]
-      when "exec"     then "exec"
-      when "run"      then "run_exec"
-      when "ssh_exec" then "exec_over_ssh"
-      when "ssh_run"  then "run_over_ssh"
-      else raise "Unknown method: #{options[:method]}"
-      end.inquiry
-
     with_accessory(name) do |accessory|
-      if runner.exec_over_ssh? || runner.run_over_ssh?
-        run_locally do
-          info "Launching command on #{accessory.host}"
-          exec accessory.send(runner, cmd)
-        end
-      else
+      case
+      when options[:interactive] && options[:reuse]
+        say "Launching interactive command with via SSH from existing container...", :magenta
+        run_locally { exec accessory.execute_in_existing_container_over_ssh(cmd) }
+
+      when options[:interactive]
+        say "Launching interactive command via SSH from new container...", :magenta
+        run_locally { exec accessory.execute_in_new_container_over_ssh(cmd) }
+
+      when options[:reuse]
+        say "Launching command from existing container...", :magenta
         on(accessory.host) do
-          info "Launching command on #{accessory.host}"
-          execute *accessory.send(runner, cmd)
+          execute *MRSK.auditor.record("accessory #{name} cmd '#{cmd}'"), verbosity: :debug
+          capture_with_info(*accessory.execute_in_existing_container(cmd))
         end
-      end
-    end
-  end
 
-  desc "bash [NAME]", "Start a bash session on primary host (or specific host set by --hosts)"
-  def bash(name)
-    with_accessory(name) do |accessory|
-      run_locally do
-        info "Launching bash session on #{accessory.host}"
-        exec accessory.bash
+      else
+        say "Launching command from new container...", :magenta
+        on(accessory.host) do
+          execute *MRSK.auditor.record("accessory #{name} cmd '#{cmd}'"), verbosity: :debug
+          capture_with_info(*accessory.execute_in_new_container(cmd))
+        end
       end
     end
   end
@@ -162,21 +167,30 @@ class Mrsk::Cli::Accessory < Mrsk::Cli::Base
   desc "remove_container [NAME]", "Remove accessory container from host"
   def remove_container(name)
     with_accessory(name) do |accessory|
-      on(accessory.host) { execute *accessory.remove_container }
+      on(accessory.host) do
+        execute *MRSK.auditor.record("accessory #{name} remove container"), verbosity: :debug
+        execute *accessory.remove_container
+      end
     end
   end
 
   desc "remove_image [NAME]", "Remove accessory image from host"
   def remove_image(name)
     with_accessory(name) do |accessory|
-      on(accessory.host) { execute *accessory.remove_image }
+      on(accessory.host) do
+        execute *MRSK.auditor.record("accessory #{name} remove image"), verbosity: :debug
+        execute *accessory.remove_image
+      end
     end
   end
 
   desc "remove_service_directory [NAME]", "Remove accessory directory used for uploaded files and data directories from host"
   def remove_service_directory(name)
     with_accessory(name) do |accessory|
-      on(accessory.host) { execute *accessory.remove_service_directory }
+      on(accessory.host) do
+        execute *MRSK.auditor.record("accessory #{name} remove service directory"), verbosity: :debug
+        execute *accessory.remove_service_directory
+      end
     end
   end
 
diff --git a/lib/mrsk/cli/app.rb b/lib/mrsk/cli/app.rb
index 36816178..e4c71493 100644
--- a/lib/mrsk/cli/app.rb
+++ b/lib/mrsk/cli/app.rb
@@ -1,22 +1,26 @@
-require "mrsk/cli/base"
-
 class Mrsk::Cli::App < Mrsk::Cli::Base
-  desc "boot", "Boot app on servers (or start them if they've already been booted)"
+  desc "boot", "Boot app on servers (or reboot app if already running)"
   def boot
     cli = self
 
+    say "Ensure no other version of the app is running...", :magenta
+    stop
+
+    say "Get most recent version available as an image...", :magenta unless options[:version]
     using_version(options[:version] || most_recent_version_available) do |version|
+      say "Start container with version #{version} (or reboot if already running)...", :magenta
+
       MRSK.config.roles.each do |role|
         on(role.hosts) do |host|
+          execute *MRSK.auditor.record("app boot version #{version}"), verbosity: :debug
+
           begin
             execute *MRSK.app.run(role: role.name)
           rescue SSHKit::Command::Failed => e
             if e.message =~ /already in use/
               error "Rebooting container with same version already deployed on #{host}"
 
-              cli.stop
               cli.remove_container version
-
               execute *MRSK.app.run(role: role.name)
             else
               raise
@@ -27,78 +31,69 @@ class Mrsk::Cli::App < Mrsk::Cli::Base
     end
   end
 
-  desc "reboot", "Reboot app on host (stop container, remove container, start new container with latest image)"
-  def reboot
-    old_version = current_running_version
-
-    stop
-    remove_container old_version
-    boot
-  end
-
   desc "start", "Start existing app on servers (use --version=<git-hash> to designate specific version)"
   def start
-    on(MRSK.hosts) { execute *MRSK.app.start, raise_on_non_zero_exit: false }
+    on(MRSK.hosts) do
+      execute *MRSK.auditor.record("app start version #{MRSK.version}"), verbosity: :debug
+      execute *MRSK.app.start, raise_on_non_zero_exit: false
+    end
   end
-  
+
   desc "stop", "Stop app on servers"
   def stop
-    on(MRSK.hosts) { execute *MRSK.app.stop, raise_on_non_zero_exit: false }
+    on(MRSK.hosts) do
+      execute *MRSK.auditor.record("app stop"), verbosity: :debug
+      execute *MRSK.app.stop, raise_on_non_zero_exit: false
+    end
   end
-  
+
   desc "details", "Display details about app containers"
   def details
     on(MRSK.hosts) { |host| puts_by_host host, capture_with_info(*MRSK.app.info) }
   end
-  
+
   desc "exec [CMD]", "Execute a custom command on servers"
-  option :method, aliases: "-m", default: "exec", desc: "Execution method: [exec] perform inside app container / [run] perform in new container / [ssh] perform over ssh"
+  option :interactive, aliases: "-i", type: :boolean, default: false, desc: "Execute command over ssh for an interactive shell (use for console/bash)"
+  option :reuse, type: :boolean, default: false, desc: "Reuse currently running container instead of starting a new one"
   def exec(cmd)
-    runner = \
-      case options[:method]
-      when "exec" then "exec"
-      when "run"  then "run_exec"
-      when "ssh"  then "exec_over_ssh"
-      else raise "Unknown method: #{options[:method]}"
-      end.inquiry
-
-    if runner.exec_over_ssh?
-      run_locally do
-        info "Launching command on #{MRSK.primary_host}"
-        exec MRSK.app.exec_over_ssh(cmd, host: MRSK.primary_host)
+    case
+    when options[:interactive] && options[:reuse]
+      say "Get current version of running container...", :magenta unless options[:version]
+      using_version(options[:version] || current_running_version) do |version|
+        say "Launching interactive command with version #{version} via SSH from existing container on #{MRSK.primary_host}...", :magenta
+        run_locally { exec MRSK.app.execute_in_existing_container_over_ssh(cmd, host: MRSK.primary_host) }
       end
-    else
-      on(MRSK.hosts) { |host| puts_by_host host, capture_with_info(*MRSK.app.send(runner, cmd)) }
-    end
-  end
 
-  desc "console", "Start Rails Console on primary host (or specific host set by --hosts)"
-  def console
-    using_version(options[:version] || most_recent_version_available) do
-      run_locally do
-        if version
-          info "Launching Rails console on #{MRSK.primary_host} [Version: #{version}]"
-          exec MRSK.app.console(host: MRSK.primary_host)
-        else
-          error "No image available for #{MRSK.config.repository}"
+    when options[:interactive]
+      say "Get most recent version available as an image...", :magenta unless options[:version]
+      using_version(options[:version] || most_recent_version_available) do |version|
+        say "Launching interactive command with version #{version} via SSH from new container on #{MRSK.primary_host}...", :magenta
+        run_locally { exec MRSK.app.execute_in_new_container_over_ssh(cmd, host: MRSK.primary_host) }
+      end
+
+    when options[:reuse]
+      say "Get current version of running container...", :magenta unless options[:version]
+      using_version(options[:version] || current_running_version) do |version|
+        say "Launching command with version #{version} from existing container...", :magenta
+
+        on(MRSK.hosts) do |host|
+          execute *MRSK.auditor.record("app cmd '#{cmd}' with version #{version}"), verbosity: :debug
+          puts_by_host host, capture_with_info(*MRSK.app.execute_in_existing_container(cmd))
+        end
+      end
+
+    else
+      say "Get most recent version available as an image...", :magenta unless options[:version]
+      using_version(options[:version] || most_recent_version_available) do |version|
+        say "Launching command with version #{version} from new container...", :magenta
+        on(MRSK.hosts) do |host|
+          execute *MRSK.auditor.record("app cmd '#{cmd}' with version #{version}"), verbosity: :debug
+          puts_by_host host, capture_with_info(*MRSK.app.execute_in_new_container(cmd))
         end
       end
     end
   end
 
-  desc "bash", "Start a bash session on primary host (or specific host set by --hosts)"
-  def bash
-    run_locally do
-      info "Launching bash session on #{MRSK.primary_host}"
-      exec MRSK.app.bash(host: MRSK.primary_host)
-    end
-  end
-
-  desc "runner [EXPRESSION]", "Execute Rails runner with given expression"
-  def runner(expression)
-    on(MRSK.hosts) { |host| puts_by_host host, capture_with_info(*MRSK.app.exec("bin/rails", "runner", "'#{expression}'")) }
-  end
-
   desc "containers", "List all the app containers currently on servers"
   def containers
     on(MRSK.hosts) { |host| puts_by_host host, capture_with_info(*MRSK.app.list_containers) }
@@ -113,7 +108,7 @@ class Mrsk::Cli::App < Mrsk::Cli::Base
   def current
     on(MRSK.hosts) { |host| puts_by_host host, capture_with_info(*MRSK.app.current_container_id) }
   end
-  
+
   desc "logs", "Show lines from app on servers"
   option :since, aliases: "-s", desc: "Show logs since timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)"
   option :lines, type: :numeric, aliases: "-n", desc: "Number of log lines to pull from each server"
@@ -152,17 +147,31 @@ class Mrsk::Cli::App < Mrsk::Cli::Base
 
   desc "remove_container [VERSION]", "Remove app container with given version from servers"
   def remove_container(version)
-    on(MRSK.hosts) { execute *MRSK.app.remove_container(version: version) }
+    on(MRSK.hosts) do
+      execute *MRSK.auditor.record("app remove container #{version}"), verbosity: :debug
+      execute *MRSK.app.remove_container(version: version)
+    end
   end
 
   desc "remove_containers", "Remove all app containers from servers"
   def remove_containers
-    on(MRSK.hosts) { execute *MRSK.app.remove_containers }
+    on(MRSK.hosts) do
+      execute *MRSK.auditor.record("app remove containers"), verbosity: :debug
+      execute *MRSK.app.remove_containers
+    end
   end
 
   desc "remove_images", "Remove all app images from servers"
   def remove_images
-    on(MRSK.hosts) { execute *MRSK.app.remove_images }
+    on(MRSK.hosts) do
+      execute *MRSK.auditor.record("app remove images"), verbosity: :debug
+      execute *MRSK.app.remove_images
+    end
+  end
+
+  desc "current_version", "Shows the version currently running"
+  def current_version
+    on(MRSK.hosts) { |host| puts_by_host host, capture_with_info(*MRSK.app.current_running_version).strip }
   end
 
   private
diff --git a/lib/mrsk/cli/build.rb b/lib/mrsk/cli/build.rb
index 8a8e856d..f52c8223 100644
--- a/lib/mrsk/cli/build.rb
+++ b/lib/mrsk/cli/build.rb
@@ -1,5 +1,3 @@
-require "mrsk/cli/base"
-
 class Mrsk::Cli::Build < Mrsk::Cli::Base
   desc "deliver", "Deliver a newly built app image to servers"
   def deliver
@@ -11,7 +9,7 @@ class Mrsk::Cli::Build < Mrsk::Cli::Base
   def push
     cli = self
 
-    run_locally do 
+    run_locally do
       begin
         MRSK.with_verbosity(:debug) { execute *MRSK.builder.push }
       rescue SSHKit::Command::Failed => e
@@ -30,7 +28,10 @@ class Mrsk::Cli::Build < Mrsk::Cli::Base
 
   desc "pull", "Pull app image from the registry onto servers"
   def pull
-    on(MRSK.hosts) { execute *MRSK.builder.pull }
+    on(MRSK.hosts) do
+      execute *MRSK.auditor.record("build pull image #{MRSK.version}"), verbosity: :debug
+      execute *MRSK.builder.pull
+    end
   end
 
   desc "create", "Create a local build setup"
diff --git a/lib/mrsk/cli/main.rb b/lib/mrsk/cli/main.rb
index 3f2275ab..c1b985c3 100644
--- a/lib/mrsk/cli/main.rb
+++ b/lib/mrsk/cli/main.rb
@@ -1,13 +1,3 @@
-require "mrsk/cli/base"
-
-require "mrsk/cli/accessory"
-require "mrsk/cli/app"
-require "mrsk/cli/build"
-require "mrsk/cli/prune"
-require "mrsk/cli/registry"
-require "mrsk/cli/server"
-require "mrsk/cli/traefik"
-
 class Mrsk::Cli::Main < Mrsk::Cli::Base
   desc "setup", "Setup all accessories and deploy the app to servers"
   def setup
@@ -21,12 +11,21 @@ class Mrsk::Cli::Main < Mrsk::Cli::Base
   desc "deploy", "Deploy the app to servers"
   def deploy
     print_runtime do
+      say "Ensure Docker is installed...", :magenta
       invoke "mrsk:cli:server:bootstrap"
+
+      say "Log into image registry...", :magenta
       invoke "mrsk:cli:registry:login"
+
+      say "Build and push app image...", :magenta
       invoke "mrsk:cli:build:deliver"
+
+      say "Ensure Traefik is running...", :magenta
       invoke "mrsk:cli:traefik:boot"
-      invoke "mrsk:cli:app:stop"
+
       invoke "mrsk:cli:app:boot"
+
+      say "Prune old containers and images...", :magenta
       invoke "mrsk:cli:prune:all"
     end
   end
@@ -34,17 +33,23 @@ class Mrsk::Cli::Main < Mrsk::Cli::Base
   desc "redeploy", "Deploy new version of the app to servers (without bootstrapping servers, starting Traefik, pruning, and registry login)"
   def redeploy
     print_runtime do
+      say "Build and push app image...", :magenta
       invoke "mrsk:cli:build:deliver"
-      invoke "mrsk:cli:app:stop"
+
       invoke "mrsk:cli:app:boot"
     end
   end
 
-  desc "rollback [VERSION]", "Rollback the app to VERSION (that must already be on servers)"
+  desc "rollback [VERSION]", "Rollback the app to VERSION"
   def rollback(version)
+    MRSK.version = version
+
+    cli = self
+
+    cli.say "Stop current version, then start version #{version}...", :magenta
     on(MRSK.hosts) do
       execute *MRSK.app.stop, raise_on_non_zero_exit: false
-      execute *MRSK.app.start(version: version)
+      execute *MRSK.app.start
     end
   end
 
@@ -55,6 +60,13 @@ class Mrsk::Cli::Main < Mrsk::Cli::Base
     invoke "mrsk:cli:accessory:details", [ "all" ]
   end
 
+  desc "audit", "Show audit log from servers"
+  def audit
+    on(MRSK.hosts) do |host|
+      puts_by_host host, capture_with_info(*MRSK.auditor.reveal)
+    end
+  end
+
   desc "config", "Show combined config"
   def config
     run_locally do
diff --git a/lib/mrsk/cli/prune.rb b/lib/mrsk/cli/prune.rb
index 37bb4f08..91e881ce 100644
--- a/lib/mrsk/cli/prune.rb
+++ b/lib/mrsk/cli/prune.rb
@@ -1,5 +1,3 @@
-require "mrsk/cli/base"
-
 class Mrsk::Cli::Prune < Mrsk::Cli::Base
   desc "all", "Prune unused images and stopped containers"
   def all
@@ -9,11 +7,17 @@ class Mrsk::Cli::Prune < Mrsk::Cli::Base
 
   desc "images", "Prune unused images older than 30 days"
   def images
-    on(MRSK.hosts) { execute *MRSK.prune.images }
+    on(MRSK.hosts) do
+      execute *MRSK.auditor.record("prune images"), verbosity: :debug
+      execute *MRSK.prune.images
+    end
   end
 
   desc "containers", "Prune stopped containers for the service older than 3 days"
   def containers
-    on(MRSK.hosts) { execute *MRSK.prune.containers }
+    on(MRSK.hosts) do
+      execute *MRSK.auditor.record("prune containers"), verbosity: :debug
+      execute *MRSK.prune.containers
+    end
   end
 end
diff --git a/lib/mrsk/cli/registry.rb b/lib/mrsk/cli/registry.rb
index f86702ac..5342c32f 100644
--- a/lib/mrsk/cli/registry.rb
+++ b/lib/mrsk/cli/registry.rb
@@ -1,9 +1,7 @@
-require "mrsk/cli/base"
-
 class Mrsk::Cli::Registry < Mrsk::Cli::Base
   desc "login", "Login to the registry locally and remotely"
   def login
-    run_locally           { execute *MRSK.registry.login }
+    run_locally    { execute *MRSK.registry.login }
     on(MRSK.hosts) { execute *MRSK.registry.login }
   rescue ArgumentError => e
     puts e.message
diff --git a/lib/mrsk/cli/server.rb b/lib/mrsk/cli/server.rb
index f015d1d0..ce8ab2cd 100644
--- a/lib/mrsk/cli/server.rb
+++ b/lib/mrsk/cli/server.rb
@@ -1,5 +1,3 @@
-require "mrsk/cli/base"
-
 class Mrsk::Cli::Server < Mrsk::Cli::Base
   desc "bootstrap", "Ensure Docker is installed on the servers"
   def bootstrap
diff --git a/lib/mrsk/cli/traefik.rb b/lib/mrsk/cli/traefik.rb
index ca62bbd3..b77d16ce 100644
--- a/lib/mrsk/cli/traefik.rb
+++ b/lib/mrsk/cli/traefik.rb
@@ -1,5 +1,3 @@
-require "mrsk/cli/base"
-
 class Mrsk::Cli::Traefik < Mrsk::Cli::Base
   desc "boot", "Boot Traefik on servers"
   def boot
@@ -15,12 +13,18 @@ class Mrsk::Cli::Traefik < Mrsk::Cli::Base
 
   desc "start", "Start existing Traefik on servers"
   def start
-    on(MRSK.traefik_hosts) { execute *MRSK.traefik.start, raise_on_non_zero_exit: false }
+    on(MRSK.traefik_hosts) do
+      execute *MRSK.auditor.record("traefik start"), verbosity: :debug
+      execute *MRSK.traefik.start, raise_on_non_zero_exit: false
+    end
   end
 
   desc "stop", "Stop Traefik on servers"
   def stop
-    on(MRSK.traefik_hosts) { execute *MRSK.traefik.stop, raise_on_non_zero_exit: false }
+    on(MRSK.traefik_hosts) do
+      execute *MRSK.auditor.record("traefik stop"), verbosity: :debug
+      execute *MRSK.traefik.stop, raise_on_non_zero_exit: false
+    end
   end
 
   desc "restart", "Restart Traefik on servers"
@@ -67,11 +71,17 @@ class Mrsk::Cli::Traefik < Mrsk::Cli::Base
 
   desc "remove_container", "Remove Traefik container from servers"
   def remove_container
-    on(MRSK.traefik_hosts) { execute *MRSK.traefik.remove_container }
+    on(MRSK.traefik_hosts) do
+      execute *MRSK.auditor.record("traefik remove container"), verbosity: :debug
+      execute *MRSK.traefik.remove_container
+    end
   end
 
   desc "remove_container", "Remove Traefik image from servers"
   def remove_image
-    on(MRSK.traefik_hosts) { execute *MRSK.traefik.remove_image }
+    on(MRSK.traefik_hosts) do
+      execute *MRSK.auditor.record("traefik remove image"), verbosity: :debug
+      execute *MRSK.traefik.remove_image
+    end
   end
 end
diff --git a/lib/mrsk/commander.rb b/lib/mrsk/commander.rb
index c8d929fd..661f8a15 100644
--- a/lib/mrsk/commander.rb
+++ b/lib/mrsk/commander.rb
@@ -1,13 +1,5 @@
 require "active_support/core_ext/enumerable"
 
-require "mrsk/configuration"
-require "mrsk/commands/accessory"
-require "mrsk/commands/app"
-require "mrsk/commands/builder"
-require "mrsk/commands/prune"
-require "mrsk/commands/traefik"
-require "mrsk/commands/registry"
-
 class Mrsk::Commander
   attr_accessor :config_file, :destination, :verbosity, :version
 
@@ -77,8 +69,12 @@ class Mrsk::Commander
     Mrsk::Commands::Accessory.new(config, name: name)
   end
 
+  def auditor
+    @auditor ||= Mrsk::Commands::Auditor.new(config)
+  end
 
-  def with_verbosity(level) 
+
+  def with_verbosity(level)
     old_level = SSHKit.config.output_verbosity
     SSHKit.config.output_verbosity = level
     yield
@@ -89,7 +85,7 @@ class Mrsk::Commander
   # Test-induced damage!
   def reset
     @config = @config_file = @destination = @version = nil
-    @app = @builder = @traefik = @registry = @prune = nil
+    @app = @builder = @traefik = @registry = @prune = @auditor = nil
     @verbosity = :info
   end
 
diff --git a/lib/mrsk/commands/accessory.rb b/lib/mrsk/commands/accessory.rb
index a8f8c661..0e9c5c12 100644
--- a/lib/mrsk/commands/accessory.rb
+++ b/lib/mrsk/commands/accessory.rb
@@ -1,5 +1,3 @@
-require "mrsk/commands/base"
-
 class Mrsk::Commands::Accessory < Mrsk::Commands::Base
   attr_reader :accessory_config
   delegate :service_name, :image, :host, :port, :files, :directories, :env_args, :volume_args, :label_args, to: :accessory_config
@@ -10,7 +8,7 @@ class Mrsk::Commands::Accessory < Mrsk::Commands::Base
   end
 
   def run
-    docker :run, 
+    docker :run,
       "--name", service_name,
       "-d",
       "--restart", "unless-stopped",
@@ -33,6 +31,7 @@ class Mrsk::Commands::Accessory < Mrsk::Commands::Base
     docker :ps, *service_filter
   end
 
+
   def logs(since: nil, lines: nil, grep: nil)
     pipe \
       docker(:logs, service_name, (" --since #{since}" if since), (" -n #{lines}" if lines), "-t", "2>&1"),
@@ -46,14 +45,15 @@ class Mrsk::Commands::Accessory < Mrsk::Commands::Base
     ).join(" ")
   end
 
-  def exec(*command, interactive: false)
+
+  def execute_in_existing_container(*command, interactive: false)
     docker :exec,
       ("-it" if interactive),
       service_name,
       *command
   end
 
-  def run_exec(*command, interactive: false)
+  def execute_in_new_container(*command, interactive: false)
     docker :run,
       ("-it" if interactive),
       "--rm",
@@ -63,17 +63,18 @@ class Mrsk::Commands::Accessory < Mrsk::Commands::Base
       *command
   end
 
+  def execute_in_existing_container_over_ssh(*command)
+    run_over_ssh execute_in_existing_container(*command, interactive: true).join(" ")
+  end
+
+  def execute_in_new_container_over_ssh(*command)
+    run_over_ssh execute_in_new_container(*command, interactive: true).join(" ")
+  end
+
   def run_over_ssh(command)
     super command, host: host
   end
 
-  def exec_over_ssh(*command)
-    run_over_ssh run_exec(*command, interactive: true).join(" ")
-  end
-
-  def bash
-    exec_over_ssh "bash"
-  end
 
   def ensure_local_file_present(local_file)
     if !local_file.is_a?(StringIO) && !Pathname.new(local_file).exist?
diff --git a/lib/mrsk/commands/app.rb b/lib/mrsk/commands/app.rb
index 2ea27aa7..ae4fce97 100644
--- a/lib/mrsk/commands/app.rb
+++ b/lib/mrsk/commands/app.rb
@@ -1,9 +1,4 @@
-require "mrsk/commands/base"
-require "mrsk/commands/concerns/repository"
-
 class Mrsk::Commands::App < Mrsk::Commands::Base
-  include Mrsk::Commands::Concerns::Repository
-
   def run(role: :web)
     role = config.role(role)
 
@@ -23,18 +18,15 @@ class Mrsk::Commands::App < Mrsk::Commands::Base
     docker :start, service_with_version
   end
 
-  def current_container_id
-    docker :ps, "-q", *service_filter
-  end
-
   def stop
-    pipe current_container_id, "xargs docker stop"
+    pipe current_container_id, xargs(docker(:stop))
   end
 
   def info
     docker :ps, *service_filter
   end
 
+
   def logs(since: nil, lines: nil, grep: nil)
     pipe \
       current_container_id,
@@ -42,28 +34,6 @@ class Mrsk::Commands::App < Mrsk::Commands::Base
       ("grep '#{grep}'" if grep)
   end
 
-  def exec(*command, interactive: false)
-    docker :exec,
-      ("-it" if interactive),
-      config.service_with_version,
-      *command
-  end
-
-  def run_exec(*command, interactive: false)
-    docker :run,
-      ("-it" if interactive),
-      "--rm",
-      *rails_master_key_arg,
-      *config.env_args,
-      *config.volume_args,
-      config.absolute_image,
-      *command
-  end
-
-  def exec_over_ssh(*command, host:)
-    run_over_ssh run_exec(*command, interactive: true).join(" "), host: host
-  end
-
   def follow_logs(host:, grep: nil)
     run_over_ssh pipe(
       current_container_id,
@@ -72,14 +42,57 @@ class Mrsk::Commands::App < Mrsk::Commands::Base
     ).join(" "), host: host
   end
 
-  def console(host:)
-    exec_over_ssh "bin/rails", "c", host: host
+
+  def execute_in_existing_container(*command, interactive: false)
+    docker :exec,
+      ("-it" if interactive),
+      config.service_with_version,
+      *command
   end
 
-  def bash(host:)
-    exec_over_ssh "bash", host: host
+  def execute_in_new_container(*command, interactive: false)
+    docker :run,
+      ("-it" if interactive),
+      "--rm",
+      *rails_master_key_arg,
+      *config.env_args,
+      *config.volume_args,
+      config.absolute_image,
+      *command
   end
 
+  def execute_in_existing_container_over_ssh(*command, host:)
+    run_over_ssh execute_in_existing_container(*command, interactive: true).join(" "), host: host
+  end
+
+  def execute_in_new_container_over_ssh(*command, host:)
+    run_over_ssh execute_in_new_container(*command, interactive: true).join(" "), host: host
+  end
+
+
+  def current_container_id
+    docker :ps, "-q", *service_filter
+  end
+
+  def container_id_for(container_name:)
+    docker :container, :ls, "-a", "-f", "name=#{container_name}", "-q"
+  end
+
+  def current_running_version
+    # FIXME: Find more graceful way to extract the version from "app-version" than using sed and tail!
+    pipe \
+      docker(:ps, "--filter", "label=service=#{config.service}", "--format", '"{{.Names}}"'),
+      %(sed 's/-/\\n/g'),
+      "tail -n 1"
+  end
+
+  def most_recent_version_from_available_images
+    pipe \
+      docker(:image, :ls, "--format", '"{{.Tag}}"', config.repository),
+      "head -n 1"
+  end
+
+
   def list_containers
     docker :container, :ls, "-a", *service_filter
   end
@@ -87,7 +100,7 @@ class Mrsk::Commands::App < Mrsk::Commands::Base
   def remove_container(version:)
     pipe \
       container_id_for(container_name: service_with_version(version)),
-      docker(:container, :rm)
+      xargs(docker(:container, :rm))
   end
 
   def remove_containers
@@ -102,6 +115,7 @@ class Mrsk::Commands::App < Mrsk::Commands::Base
     docker :image, :prune, "-a", "-f", *service_filter
   end
 
+
   private
     def service_with_version(version = nil)
       if version
diff --git a/lib/mrsk/commands/auditor.rb b/lib/mrsk/commands/auditor.rb
new file mode 100644
index 00000000..692844c8
--- /dev/null
+++ b/lib/mrsk/commands/auditor.rb
@@ -0,0 +1,34 @@
+require "active_support/core_ext/time/conversions"
+
+class Mrsk::Commands::Auditor < Mrsk::Commands::Base
+  def record(line)
+    append \
+      [ :echo, tagged_line(line) ],
+      audit_log_file
+  end
+
+  def reveal
+    [ :tail, "-n", 50, audit_log_file ]
+  end
+
+  private
+    def audit_log_file
+      "mrsk-#{config.service}-audit.log"
+    end
+
+    def tagged_line(line)
+      "'#{tags} #{line}'"
+    end
+
+    def tags
+      "[#{timestamp}] [#{performer}]"
+    end
+
+    def performer
+      `whoami`.strip
+    end
+
+    def timestamp
+      Time.now.to_fs(:db)
+    end
+end
diff --git a/lib/mrsk/commands/base.rb b/lib/mrsk/commands/base.rb
index 5b50b745..b4d145e6 100644
--- a/lib/mrsk/commands/base.rb
+++ b/lib/mrsk/commands/base.rb
@@ -34,6 +34,14 @@ module Mrsk::Commands
         combine *commands, by: "|"
       end
 
+      def append(*commands)
+        combine *commands, by: ">>"
+      end
+
+      def xargs(command)
+        [ :xargs, command ].flatten
+      end
+
       def docker(*args)
         args.compact.unshift :docker
       end
diff --git a/lib/mrsk/commands/builder.rb b/lib/mrsk/commands/builder.rb
index e24768d1..70957afe 100644
--- a/lib/mrsk/commands/builder.rb
+++ b/lib/mrsk/commands/builder.rb
@@ -1,5 +1,3 @@
-require "mrsk/commands/base"
-
 class Mrsk::Commands::Builder < Mrsk::Commands::Base
   delegate :create, :remove, :push, :pull, :info, to: :target
 
@@ -36,8 +34,3 @@ class Mrsk::Commands::Builder < Mrsk::Commands::Base
     @multiarch_remote ||= Mrsk::Commands::Builder::Multiarch::Remote.new(config)
   end
 end
-
-require "mrsk/commands/builder/native"
-require "mrsk/commands/builder/native/remote"
-require "mrsk/commands/builder/multiarch"
-require "mrsk/commands/builder/multiarch/remote"
diff --git a/lib/mrsk/commands/builder/base.rb b/lib/mrsk/commands/builder/base.rb
index 792ebee1..8e0003c7 100644
--- a/lib/mrsk/commands/builder/base.rb
+++ b/lib/mrsk/commands/builder/base.rb
@@ -1,5 +1,3 @@
-require "mrsk/commands/base"
-
 class Mrsk::Commands::Builder::Base < Mrsk::Commands::Base
   delegate :argumentize, to: Mrsk::Utils
 
diff --git a/lib/mrsk/commands/builder/multiarch.rb b/lib/mrsk/commands/builder/multiarch.rb
index bc87a86f..9b1fcb19 100644
--- a/lib/mrsk/commands/builder/multiarch.rb
+++ b/lib/mrsk/commands/builder/multiarch.rb
@@ -1,5 +1,3 @@
-require "mrsk/commands/builder/base"
-
 class Mrsk::Commands::Builder::Multiarch < Mrsk::Commands::Builder::Base
   def create
     docker :buildx, :create, "--use", "--name", builder_name
diff --git a/lib/mrsk/commands/builder/multiarch/remote.rb b/lib/mrsk/commands/builder/multiarch/remote.rb
index b49de328..5ca10048 100644
--- a/lib/mrsk/commands/builder/multiarch/remote.rb
+++ b/lib/mrsk/commands/builder/multiarch/remote.rb
@@ -1,5 +1,3 @@
-require "mrsk/commands/builder/multiarch"
-
 class Mrsk::Commands::Builder::Multiarch::Remote < Mrsk::Commands::Builder::Multiarch
   def create
     combine \
diff --git a/lib/mrsk/commands/builder/native.rb b/lib/mrsk/commands/builder/native.rb
index 310ace07..18140eb3 100644
--- a/lib/mrsk/commands/builder/native.rb
+++ b/lib/mrsk/commands/builder/native.rb
@@ -1,5 +1,3 @@
-require "mrsk/commands/builder/base"
-
 class Mrsk::Commands::Builder::Native < Mrsk::Commands::Builder::Base
   def create
     # No-op on native
diff --git a/lib/mrsk/commands/builder/native/remote.rb b/lib/mrsk/commands/builder/native/remote.rb
index d3089fdb..4a457309 100644
--- a/lib/mrsk/commands/builder/native/remote.rb
+++ b/lib/mrsk/commands/builder/native/remote.rb
@@ -1,5 +1,3 @@
-require "mrsk/commands/builder/native"
-
 class Mrsk::Commands::Builder::Native::Remote < Mrsk::Commands::Builder::Native
   def create
     chain \
diff --git a/lib/mrsk/commands/concerns/repository.rb b/lib/mrsk/commands/concerns/repository.rb
deleted file mode 100644
index 8df4171b..00000000
--- a/lib/mrsk/commands/concerns/repository.rb
+++ /dev/null
@@ -1,21 +0,0 @@
-module Mrsk::Commands::Concerns
-  module Repository
-    def container_id_for(container_name:)
-      docker :container, :ls, "-a", "-f", "name=#{container_name}", "-q"
-    end
-
-    def current_running_version
-      # FIXME: Find more graceful way to extract the version from "app-version" than using sed and tail!
-      pipe \
-        docker(:ps, "--filter", "label=service=#{config.service}", "--format", '"{{.Names}}"'),
-        "sed 's/-/\n/g'",
-        "tail -n 1"
-    end
-
-    def most_recent_version_from_available_images
-      pipe \
-        docker(:image, :ls, "--format", '"{{.Tag}}"', config.repository),
-        "head -n 1"
-    end
-  end
-end
diff --git a/lib/mrsk/commands/prune.rb b/lib/mrsk/commands/prune.rb
index 19451b67..dd9b14b8 100644
--- a/lib/mrsk/commands/prune.rb
+++ b/lib/mrsk/commands/prune.rb
@@ -1,4 +1,3 @@
-require "mrsk/commands/base"
 require "active_support/duration"
 require "active_support/core_ext/numeric/time"
 
diff --git a/lib/mrsk/commands/registry.rb b/lib/mrsk/commands/registry.rb
index 8d05b0cb..4e9b1ce4 100644
--- a/lib/mrsk/commands/registry.rb
+++ b/lib/mrsk/commands/registry.rb
@@ -1,5 +1,3 @@
-require "mrsk/commands/base"
-
 class Mrsk::Commands::Registry < Mrsk::Commands::Base
   delegate :registry, to: :config
 
diff --git a/lib/mrsk/commands/traefik.rb b/lib/mrsk/commands/traefik.rb
index f8f7aee7..dd0715cf 100644
--- a/lib/mrsk/commands/traefik.rb
+++ b/lib/mrsk/commands/traefik.rb
@@ -1,5 +1,3 @@
-require "mrsk/commands/base"
-
 class Mrsk::Commands::Traefik < Mrsk::Commands::Base
   def run
     docker :run, "--name traefik",
diff --git a/lib/mrsk/configuration.rb b/lib/mrsk/configuration.rb
index 1f03d8f4..4ce9caec 100644
--- a/lib/mrsk/configuration.rb
+++ b/lib/mrsk/configuration.rb
@@ -1,9 +1,3 @@
-require "active_support/ordered_options"
-require "active_support/core_ext/string/inquiry"
-require "active_support/core_ext/module/delegation"
-require "pathname"
-require "erb"
-require "mrsk/utils"
 require "net/ssh/proxy/jump"
 
 class Mrsk::Configuration
@@ -183,6 +177,3 @@ class Mrsk::Configuration
       raw_config.servers.is_a?(Array) ? [ "web" ] : raw_config.servers.keys.sort
     end
 end
-
-require "mrsk/configuration/role"
-require "mrsk/configuration/accessory"
diff --git a/lib/mrsk/version.rb b/lib/mrsk/version.rb
index 96e26016..99c8c23e 100644
--- a/lib/mrsk/version.rb
+++ b/lib/mrsk/version.rb
@@ -1,3 +1,3 @@
 module Mrsk
-  VERSION = "0.4.0"
+  VERSION = "0.5.1"
 end
diff --git a/mrsk.gemspec b/mrsk.gemspec
index 78952cb6..7cbfb888 100644
--- a/mrsk.gemspec
+++ b/mrsk.gemspec
@@ -16,4 +16,5 @@ Gem::Specification.new do |spec|
   spec.add_dependency "sshkit", "~> 1.21"
   spec.add_dependency "thor", "~> 1.2"
   spec.add_dependency "dotenv", "~> 2.8"
+  spec.add_dependency "zeitwerk", "~> 2.5"
 end
diff --git a/test/cli/accessory_test.rb b/test/cli/accessory_test.rb
index f3373f84..dde44a61 100644
--- a/test/cli/accessory_test.rb
+++ b/test/cli/accessory_test.rb
@@ -17,6 +17,20 @@ class CliAccessoryTest < CliTestCase
     assert_match "Running docker run --name app-mysql -d --restart unless-stopped -p 3306:3306 -e [REDACTED] -e MYSQL_ROOT_HOST=% --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=app-mysql mysql:5.7 on 1.1.1.3", run_command("boot", "mysql")
   end
 
+  test "exec" do
+    run_command("exec", "mysql", "mysql -v").tap do |output|
+      assert_match /Launching command from new container/, output
+      assert_match /mysql -v/, output
+    end
+  end
+
+  test "exec with reuse" do
+    run_command("exec", "mysql", "--reuse", "mysql -v").tap do |output|
+      assert_match /Launching command from existing container/, output
+      assert_match %r[docker exec app-mysql mysql -v], output
+    end
+  end
+
   private
     def run_command(*command)
       stdouted { Mrsk::Cli::Accessory.start([*command, "-c", "test/fixtures/deploy_with_accessories.yml"]) }
diff --git a/test/cli/app_test.rb b/test/cli/app_test.rb
index 2b77f447..734659e4 100644
--- a/test/cli/app_test.rb
+++ b/test/cli/app_test.rb
@@ -15,32 +15,48 @@ class CliAppTest < CliTestCase
 
     run_command("boot").tap do |output|
       assert_match /Rebooting container with same version already deployed/, output # Can't start what's already running
-      assert_match /docker ps -q --filter label=service=app | xargs docker stop/, output # Stop what's running
-      assert_match /docker container ls -a -f name=app-999 -q | docker container rm/, output # Remove old container
+      assert_match /docker ps -q --filter label=service=app \| xargs docker stop/, output # Stop what's running
+      assert_match /docker container ls -a -f name=app-999 -q \| xargs docker container rm/, output # Remove old container
       assert_match /docker run/, output # Start new container
     end
   ensure
     Thread.report_on_exception = true
   end
 
-  test "reboot to default version" do
-    run_command("reboot").tap do |output|
-      assert_match /docker ps --filter label=service=app/, output # Find current container
-      assert_match /docker stop/, output # Stop old container
-      assert_match /docker container rm/, output # Remove old container
-      assert_match /docker run -d --restart unless-stopped .* dhh\/app:999/, output # Start new container
+  test "start" do
+    run_command("start").tap do |output|
+      assert_match /docker start app-999/, output
     end
   end
 
-  test "reboot to specific version" do
-    run_command("reboot", "--version", "456").tap do |output|
-      assert_match /docker run -d --restart unless-stopped .* dhh\/app:456/, output
+  test "stop" do
+    run_command("stop").tap do |output|
+      assert_match /docker ps -q --filter label=service=app \| xargs docker stop/, output
+    end
+  end
+
+  test "details" do
+    run_command("details").tap do |output|
+      assert_match /docker ps --filter label=service=app/, output
     end
   end
 
   test "remove_container" do
     run_command("remove_container", "1234567").tap do |output|
-      assert_match /docker container ls -a -f name=app-1234567 -q | docker container rm/, output
+      assert_match /docker container ls -a -f name=app-1234567 -q \| xargs docker container rm/, output
+    end
+  end
+
+  test "exec" do
+    run_command("exec", "ruby -v").tap do |output|
+      assert_match /ruby -v/, output
+    end
+  end
+
+  test "exec with reuse" do
+    run_command("exec", "--reuse", "ruby -v").tap do |output|
+      assert_match %r[docker ps --filter label=service=app --format \"{{.Names}}\" | sed 's/-/\\n/g' | tail -n 1], output # Get current version
+      assert_match %r[docker exec app-999 ruby -v], output
     end
   end
 
diff --git a/test/cli/cli_test_case.rb b/test/cli/cli_test_case.rb
index c0cecbdd..f7a0ad07 100644
--- a/test/cli/cli_test_case.rb
+++ b/test/cli/cli_test_case.rb
@@ -1,6 +1,5 @@
 require "test_helper"
 require "active_support/testing/stream"
-require "mrsk/cli"
 
 class CliTestCase < ActiveSupport::TestCase
   include ActiveSupport::Testing::Stream
diff --git a/test/commander_test.rb b/test/commander_test.rb
index 5b3ed297..89ac4627 100644
--- a/test/commander_test.rb
+++ b/test/commander_test.rb
@@ -1,5 +1,4 @@
 require "test_helper"
-require "mrsk/commander"
 
 class CommanderTest < ActiveSupport::TestCase
   setup do
diff --git a/test/commands/accessory_test.rb b/test/commands/accessory_test.rb
index 5294d48c..8a68cbb7 100644
--- a/test/commands/accessory_test.rb
+++ b/test/commands/accessory_test.rb
@@ -1,10 +1,8 @@
 require "test_helper"
-require "mrsk/configuration"
-require "mrsk/commands/accessory"
 
 class CommandsAccessoryTest < ActiveSupport::TestCase
   setup do
-    @config = { 
+    @config = {
       service: "app", image: "dhh/app", registry: { "username" => "dhh", "password" => "secret" },
       servers: [ "1.1.1.1" ],
       accessories: {
@@ -41,18 +39,20 @@ class CommandsAccessoryTest < ActiveSupport::TestCase
     @config = Mrsk::Configuration.new(@config)
     @mysql  = Mrsk::Commands::Accessory.new(@config, name: :mysql)
     @redis  = Mrsk::Commands::Accessory.new(@config, name: :redis)
+
+    ENV["MYSQL_ROOT_PASSWORD"] = "secret123"
+  end
+
+  teardown do
+    ENV.delete("MYSQL_ROOT_PASSWORD")
   end
 
   test "run" do
-    ENV["MYSQL_ROOT_PASSWORD"] = "secret123"
-
     assert_equal \
       [:docker, :run, "--name", "app-mysql", "-d", "--restart", "unless-stopped", "-p", "3306:3306", "-e", "MYSQL_ROOT_PASSWORD=secret123", "-e", "MYSQL_ROOT_HOST=%", "--label", "service=app-mysql", "mysql:8.0"], @mysql.run
 
     assert_equal \
       [:docker, :run, "--name", "app-redis", "-d", "--restart", "unless-stopped", "-p", "6379:6379", "-e", "SOMETHING=else", "--volume", "/var/lib/redis:/data", "--label", "service=app-redis", "--label", "cache=true", "redis:latest"], @redis.run
-  ensure
-    ENV["MYSQL_ROOT_PASSWORD"] = nil
   end
 
   test "start" do
@@ -67,6 +67,35 @@ class CommandsAccessoryTest < ActiveSupport::TestCase
     assert_equal [:docker, :ps, "--filter", "label=service=app-mysql"], @mysql.info
   end
 
+
+  test "execute in new container" do
+    assert_equal \
+      [ :docker, :run, "--rm", "-e", "MYSQL_ROOT_PASSWORD=secret123", "-e", "MYSQL_ROOT_HOST=%", "mysql:8.0", "mysql", "-u", "root" ],
+      @mysql.execute_in_new_container("mysql", "-u", "root")
+  end
+
+  test "execute in existing container" do
+    assert_equal \
+      [ :docker, :exec, "app-mysql", "mysql", "-u", "root" ],
+      @mysql.execute_in_existing_container("mysql", "-u", "root")
+  end
+
+  test "execute in new container over ssh" do
+    @mysql.stub(:run_over_ssh, ->(cmd) { cmd }) do
+      assert_match %r|docker run -it --rm -e MYSQL_ROOT_PASSWORD=secret123 -e MYSQL_ROOT_HOST=% mysql:8.0 mysql -u root|,
+        @mysql.execute_in_new_container_over_ssh("mysql", "-u", "root")
+    end
+  end
+
+  test "execute in existing container over ssh" do
+    @mysql.stub(:run_over_ssh, ->(cmd) { cmd }) do
+      assert_match %r|docker exec -it app-mysql mysql -u root|,
+        @mysql.execute_in_existing_container_over_ssh("mysql", "-u", "root")
+    end
+  end
+
+
+
   test "logs" do
     assert_equal [:docker, :logs, "app-mysql", "-t", "2>&1"], @mysql.logs
     assert_equal [:docker, :logs, "app-mysql", " --since 5m", " -n 100", "-t", "2>&1", "|", "grep 'thing'"], @mysql.logs(since: "5m", lines: 100, grep: "thing")
diff --git a/test/commands/app_test.rb b/test/commands/app_test.rb
index ca00e180..aab55244 100644
--- a/test/commands/app_test.rb
+++ b/test/commands/app_test.rb
@@ -1,6 +1,4 @@
 require "test_helper"
-require "mrsk/configuration"
-require "mrsk/commands/app"
 
 class CommandsAppTest < ActiveSupport::TestCase
   setup do
@@ -26,12 +24,34 @@ class CommandsAppTest < ActiveSupport::TestCase
       [:docker, :run, "-d", "--restart unless-stopped", "--name", "app-missing", "-e", "RAILS_MASTER_KEY=456", "--volume", "/local/path:/container/path", "--label", "service=app", "--label", "role=web", "--label", "traefik.http.routers.app.rule='PathPrefix(`/`)'", "--label", "traefik.http.services.app.loadbalancer.healthcheck.path=/up", "--label", "traefik.http.services.app.loadbalancer.healthcheck.interval=1s", "--label", "traefik.http.middlewares.app.retry.attempts=3", "--label", "traefik.http.middlewares.app.retry.initialinterval=500ms", "dhh/app:missing"], @app.run
   end
 
-  test "run with" do
+
+  test "execute in new container" do
     assert_equal \
       [ :docker, :run, "--rm", "-e", "RAILS_MASTER_KEY=456", "dhh/app:missing", "bin/rails", "db:setup" ],
-      @app.run_exec("bin/rails", "db:setup")
+      @app.execute_in_new_container("bin/rails", "db:setup")
   end
 
+  test "execute in existing container" do
+    assert_equal \
+      [ :docker, :exec, "app-missing", "bin/rails", "db:setup" ],
+      @app.execute_in_existing_container("bin/rails", "db:setup")
+  end
+
+  test "execute in new container over ssh" do
+    @app.stub(:run_over_ssh, ->(cmd, host:) { cmd }) do
+      assert_match %r|docker run -it --rm -e RAILS_MASTER_KEY=456 dhh/app:missing bin/rails c|,
+        @app.execute_in_new_container_over_ssh("bin/rails", "c", host: "app-1")
+    end
+  end
+
+  test "execute in existing container over ssh" do
+    @app.stub(:run_over_ssh, ->(cmd, host:) { cmd }) do
+      assert_match %r|docker exec -it app-missing bin/rails c|,
+        @app.execute_in_existing_container_over_ssh("bin/rails", "c", host: "app-1")
+    end
+  end
+
+
   test "run without master key" do
     ENV["RAILS_MASTER_KEY"] = nil
     @app = Mrsk::Commands::App.new Mrsk::Configuration.new(@config.tap { |c| c[:skip_master_key] = true })
diff --git a/test/commands/builder_test.rb b/test/commands/builder_test.rb
index 14aee153..dfd43313 100644
--- a/test/commands/builder_test.rb
+++ b/test/commands/builder_test.rb
@@ -1,6 +1,4 @@
 require "test_helper"
-require "mrsk/configuration"
-require "mrsk/commands/builder"
 
 class CommandsBuilderTest < ActiveSupport::TestCase
   setup do
diff --git a/test/commands/registry_test.rb b/test/commands/registry_test.rb
index 390f2208..15a2c312 100755
--- a/test/commands/registry_test.rb
+++ b/test/commands/registry_test.rb
@@ -1,10 +1,8 @@
 require "test_helper"
-require "mrsk/configuration"
-require "mrsk/commands/registry"
 
 class CommandsRegistryTest < ActiveSupport::TestCase
   setup do
-    @config = { service: "app", 
+    @config = { service: "app",
       image: "dhh/app",
       registry: { "username" => "dhh",
         "password" => "secret",
diff --git a/test/commands/traefik_test.rb b/test/commands/traefik_test.rb
index 8f204ea5..b529b3bc 100644
--- a/test/commands/traefik_test.rb
+++ b/test/commands/traefik_test.rb
@@ -1,6 +1,4 @@
 require "test_helper"
-require "mrsk/configuration"
-require "mrsk/commands/traefik"
 
 class CommandsTraefikTest < ActiveSupport::TestCase
   setup do
diff --git a/test/configuration/accessory_test.rb b/test/configuration/accessory_test.rb
index cee4511c..7f90e82a 100644
--- a/test/configuration/accessory_test.rb
+++ b/test/configuration/accessory_test.rb
@@ -1,5 +1,4 @@
 require "test_helper"
-require "mrsk/configuration"
 
 class ConfigurationAccessoryTest < ActiveSupport::TestCase
   setup do
@@ -66,7 +65,7 @@ class ConfigurationAccessoryTest < ActiveSupport::TestCase
   test "missing host" do
     @deploy[:accessories]["mysql"]["host"] = nil
     @config = Mrsk::Configuration.new(@deploy)
-    
+
     assert_raises(ArgumentError) do
       @config.accessory(:mysql).host
     end
diff --git a/test/configuration/role_test.rb b/test/configuration/role_test.rb
index 5c67b798..52970395 100644
--- a/test/configuration/role_test.rb
+++ b/test/configuration/role_test.rb
@@ -1,5 +1,4 @@
 require "test_helper"
-require "mrsk/configuration"
 
 class ConfigurationRoleTest < ActiveSupport::TestCase
   setup do
@@ -63,7 +62,7 @@ class ConfigurationRoleTest < ActiveSupport::TestCase
   end
 
   test "default traefik label on non-web role" do
-    config = Mrsk::Configuration.new(@deploy_with_roles.tap { |c| 
+    config = Mrsk::Configuration.new(@deploy_with_roles.tap { |c|
       c[:servers]["beta"] = { "traefik" => "true", "hosts" => [ "1.1.1.5" ] }
     })
 
@@ -97,7 +96,7 @@ class ConfigurationRoleTest < ActiveSupport::TestCase
 
     ENV["REDIS_PASSWORD"] = "secret456"
     ENV["DB_PASSWORD"] = "secret123"
-    
+
     assert_equal ["-e", "REDIS_PASSWORD=secret456", "-e", "DB_PASSWORD=secret123", "-e", "REDIS_URL=redis://a/b", "-e", "WEB_CONCURRENCY=4"], @config_with_roles.role(:workers).env_args
   ensure
     ENV["REDIS_PASSWORD"] = nil
@@ -116,7 +115,7 @@ class ConfigurationRoleTest < ActiveSupport::TestCase
     }
 
     ENV["DB_PASSWORD"] = "secret123"
-    
+
     assert_equal ["-e", "DB_PASSWORD=secret123", "-e", "REDIS_URL=redis://a/b", "-e", "WEB_CONCURRENCY=4"], @config_with_roles.role(:workers).env_args
   ensure
     ENV["DB_PASSWORD"] = nil
@@ -133,7 +132,7 @@ class ConfigurationRoleTest < ActiveSupport::TestCase
     }
 
     ENV["REDIS_PASSWORD"] = "secret456"
-    
+
     assert_equal ["-e", "REDIS_PASSWORD=secret456", "-e", "REDIS_URL=redis://a/b", "-e", "WEB_CONCURRENCY=4"], @config_with_roles.role(:workers).env_args
   ensure
     ENV["REDIS_PASSWORD"] = nil
diff --git a/test/configuration_test.rb b/test/configuration_test.rb
index 937abed0..808b9c62 100644
--- a/test/configuration_test.rb
+++ b/test/configuration_test.rb
@@ -1,5 +1,4 @@
 require "test_helper"
-require "mrsk/configuration"
 
 class ConfigurationTest < ActiveSupport::TestCase
   setup do
diff --git a/test/test_helper.rb b/test/test_helper.rb
index 3da81a65..4c381df2 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -2,8 +2,10 @@ require "bundler/setup"
 require "active_support/test_case"
 require "active_support/testing/autorun"
 require "debug"
-require "mocha/minitest"
+require "mocha/minitest" # using #stubs that can alter returns
+require "minitest/autorun" # using #stub that take args
 require "sshkit"
+require "mrsk"
 
 ActiveSupport::LogSubscriber.logger = ActiveSupport::Logger.new(STDOUT) if ENV["VERBOSE"]