Escape secrets in inline command substitution

Kamal "inlines" calls to `kamal secrets` in the dotenv file, but the results of the calls were not being escaped properly. To "fix" this `kamal secrets fetch` escaped the JSON string before returning it. The two errors cancelled out, but it meant that the commands didn't work from a shell. To fix, we'll escape the inline command results and remove the escaping from `kamal secrets fetch`.
2024-09-30 10:45:11 +01:00
121 changed files with 627 additions and 3231 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,7 +4,6 @@ on:
    branches:
      - main
  pull_request:
-  workflow_dispatch:
 jobs:
  rubocop:
    name: RuboCop
@@ -23,13 +22,11 @@ jobs:
        run: bundle exec rubocop --parallel
  tests:
    strategy:
-      fail-fast: false
      matrix:
        ruby-version:
          - "3.1"
          - "3.2"
          - "3.3"
-          - "3.4"
        gemfile:
          - Gemfile
          - gemfiles/rails_edge.gemfile
@@ -38,14 +35,12 @@ jobs:
            gemfile: gemfiles/rails_edge.gemfile
    name: ${{ format('Tests (Ruby {0})', matrix.ruby-version) }}
    runs-on: ubuntu-latest
+    continue-on-error: true
    env:
      BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gemfile }}
    steps:
      - uses: actions/checkout@v4

-      - name: Remove gemfile.lock
-        run: rm Gemfile.lock
-
      - name: Install Ruby
        uses: ruby/setup-ruby@v1
        with:
@@ -54,5 +49,3 @@ jobs:

      - name: Run tests
        run: bin/test
-        env:
-          RUBYOPT: ${{ startsWith(matrix.ruby-version, '3.4.') && '--enable=frozen-string-literal' || '' }}
--- a/5
+++ b/5
@@ -1,4 +1,5 @@
-FROM ruby:3.3-alpine
+# Use the official Ruby 3.2.0 Alpine image as the base image
+FROM ruby:3.2.0-alpine

 # Install docker/buildx-bin
 COPY --from=docker/buildx-bin /buildx /usr/libexec/docker/cli-plugins/docker-buildx
@@ -32,7 +33,7 @@ WORKDIR /workdir

 # Tell git it's safe to access /workdir/.git even if
 # the directory is owned by a different user
-RUN git config --global --add safe.directory '*'
+RUN git config --global --add safe.directory /workdir

 # Set the entrypoint to run the installed binary in /workdir
 # Example:  docker run -it -v "$PWD:/workdir" kamal init
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,155 +1,152 @@
 PATH
  remote: .
  specs:
-    kamal (2.5.0)
+    kamal (2.0.0)
      activesupport (>= 7.0)
      base64 (~> 0.2)
      bcrypt_pbkdf (~> 1.0)
      concurrent-ruby (~> 1.2)
      dotenv (~> 3.1)
      ed25519 (~> 1.2)
-      net-ssh (~> 7.3)
+      net-ssh (~> 7.0)
      sshkit (>= 1.23.0, < 2.0)
      thor (~> 1.3)
-      zeitwerk (>= 2.6.18, < 3.0)
+      zeitwerk (~> 2.5)

 GEM
  remote: https://rubygems.org/
  specs:
-    actionpack (8.0.0.1)
-      actionview (= 8.0.0.1)
-      activesupport (= 8.0.0.1)
+    actionpack (7.1.3.4)
+      actionview (= 7.1.3.4)
+      activesupport (= 7.1.3.4)
      nokogiri (>= 1.8.5)
+      racc
      rack (>= 2.2.4)
      rack-session (>= 1.0.1)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
-      useragent (~> 0.16)
-    actionview (8.0.0.1)
-      activesupport (= 8.0.0.1)
+    actionview (7.1.3.4)
+      activesupport (= 7.1.3.4)
      builder (~> 3.1)
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
-    activesupport (8.0.0.1)
+    activesupport (7.1.3.4)
      base64
-      benchmark (>= 0.3)
      bigdecimal
-      concurrent-ruby (~> 1.0, >= 1.3.1)
+      concurrent-ruby (~> 1.0, >= 1.0.2)
      connection_pool (>= 2.2.5)
      drb
      i18n (>= 1.6, < 2)
-      logger (>= 1.4.2)
      minitest (>= 5.1)
-      securerandom (>= 0.3)
-      tzinfo (~> 2.0, >= 2.0.5)
-      uri (>= 0.13.1)
+      mutex_m
+      tzinfo (~> 2.0)
    ast (2.4.2)
    base64 (0.2.0)
    bcrypt_pbkdf (1.1.1)
    bcrypt_pbkdf (1.1.1-arm64-darwin)
    bcrypt_pbkdf (1.1.1-x86_64-darwin)
-    benchmark (0.4.0)
    bigdecimal (3.1.8)
    builder (3.3.0)
-    concurrent-ruby (1.3.4)
+    concurrent-ruby (1.3.3)
    connection_pool (2.4.1)
    crass (1.0.6)
-    date (3.4.1)
    debug (1.9.2)
      irb (~> 1.10)
      reline (>= 0.3.8)
-    dotenv (3.1.5)
+    dotenv (3.1.2)
    drb (2.2.1)
    ed25519 (1.3.0)
    erubi (1.13.0)
-    i18n (1.14.6)
+    i18n (1.14.5)
      concurrent-ruby (~> 1.0)
-    io-console (0.8.0)
-    irb (1.14.2)
+    io-console (0.7.2)
+    irb (1.14.0)
      rdoc (>= 4.0.0)
      reline (>= 0.4.2)
-    json (2.9.0)
+    json (2.7.2)
    language_server-protocol (3.17.0.3)
-    logger (1.6.3)
-    loofah (2.23.1)
+    loofah (2.22.0)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
-    minitest (5.25.4)
-    mocha (2.7.1)
+    minitest (5.24.1)
+    mocha (2.4.5)
      ruby2_keywords (>= 0.0.5)
+    mutex_m (0.2.0)
    net-scp (4.0.0)
      net-ssh (>= 2.6.5, < 8.0.0)
    net-sftp (4.0.0)
      net-ssh (>= 5.0.0, < 8.0.0)
-    net-ssh (7.3.0)
-    nokogiri (1.17.2-arm64-darwin)
+    net-ssh (7.2.3)
+    nokogiri (1.16.7-arm64-darwin)
      racc (~> 1.4)
-    nokogiri (1.17.2-x86_64-darwin)
+    nokogiri (1.16.7-x86_64-darwin)
      racc (~> 1.4)
-    nokogiri (1.17.2-x86_64-linux)
+    nokogiri (1.16.7-x86_64-linux)
      racc (~> 1.4)
-    ostruct (0.6.1)
-    parallel (1.26.3)
-    parser (3.3.6.0)
+    parallel (1.25.1)
+    parser (3.3.4.0)
      ast (~> 2.4.1)
      racc
-    psych (5.2.1)
-      date
+    psych (5.1.2)
      stringio
    racc (1.8.1)
-    rack (3.1.8)
+    rack (3.1.7)
    rack-session (2.0.0)
      rack (>= 3.0.0)
    rack-test (2.1.0)
      rack (>= 1.3)
-    rackup (2.2.1)
+    rackup (2.1.0)
      rack (>= 3)
+      webrick (~> 1.8)
    rails-dom-testing (2.2.0)
      activesupport (>= 5.0.0)
      minitest
      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.2)
+    rails-html-sanitizer (1.6.0)
      loofah (~> 2.21)
-      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (8.0.0.1)
-      actionpack (= 8.0.0.1)
-      activesupport (= 8.0.0.1)
-      irb (~> 1.13)
+      nokogiri (~> 1.14)
+    railties (7.1.3.4)
+      actionpack (= 7.1.3.4)
+      activesupport (= 7.1.3.4)
+      irb
      rackup (>= 1.0.0)
      rake (>= 12.2)
      thor (~> 1.0, >= 1.2.2)
      zeitwerk (~> 2.6)
    rainbow (3.1.1)
    rake (13.2.1)
-    rdoc (6.8.1)
+    rdoc (6.7.0)
      psych (>= 4.0.0)
-    regexp_parser (2.9.3)
-    reline (0.5.12)
+    regexp_parser (2.9.2)
+    reline (0.5.9)
      io-console (~> 0.5)
-    rubocop (1.69.2)
+    rexml (3.3.4)
+      strscan
+    rubocop (1.65.1)
      json (~> 2.3)
      language_server-protocol (>= 3.17.0)
      parallel (~> 1.10)
      parser (>= 3.3.0.2)
      rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.36.2, < 2.0)
+      regexp_parser (>= 2.4, < 3.0)
+      rexml (>= 3.2.5, < 4.0)
+      rubocop-ast (>= 1.31.1, < 2.0)
      ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.36.2)
+      unicode-display_width (>= 2.4.0, < 3.0)
+    rubocop-ast (1.32.0)
      parser (>= 3.3.1.0)
-    rubocop-minitest (0.36.0)
+    rubocop-minitest (0.35.1)
      rubocop (>= 1.61, < 2.0)
      rubocop-ast (>= 1.31.1, < 2.0)
-    rubocop-performance (1.23.0)
+    rubocop-performance (1.21.1)
      rubocop (>= 1.48.1, < 2.0)
      rubocop-ast (>= 1.31.1, < 2.0)
-    rubocop-rails (2.27.0)
+    rubocop-rails (2.25.1)
      activesupport (>= 4.2.0)
      rack (>= 1.1)
-      rubocop (>= 1.52.0, < 2.0)
+      rubocop (>= 1.33.0, < 2.0)
      rubocop-ast (>= 1.31.1, < 2.0)
    rubocop-rails-omakase (1.0.0)
      rubocop
@@ -158,23 +155,19 @@ GEM
      rubocop-rails
    ruby-progressbar (1.13.0)
    ruby2_keywords (0.0.5)
-    securerandom (0.4.0)
-    sshkit (1.23.2)
+    sshkit (1.23.0)
      base64
      net-scp (>= 1.1.2)
      net-sftp (>= 2.1.2)
      net-ssh (>= 2.8.0)
-      ostruct
-    stringio (3.1.2)
-    thor (1.3.2)
+    stringio (3.1.1)
+    strscan (3.1.0)
+    thor (1.3.1)
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
-    unicode-display_width (3.1.2)
-      unicode-emoji (~> 4.0, >= 4.0.4)
-    unicode-emoji (4.0.4)
-    uri (1.0.2)
-    useragent (0.16.11)
-    zeitwerk (2.7.1)
+    unicode-display_width (2.5.0)
+    webrick (1.8.1)
+    zeitwerk (2.6.17)

 PLATFORMS
  arm64-darwin
--- a/kamal.gemspec
+++ b/kamal.gemspec
@@ -13,10 +13,10 @@ Gem::Specification.new do |spec|

  spec.add_dependency "activesupport", ">= 7.0"
  spec.add_dependency "sshkit", ">= 1.23.0", "< 2.0"
-  spec.add_dependency "net-ssh", "~> 7.3"
+  spec.add_dependency "net-ssh", "~> 7.0"
  spec.add_dependency "thor", "~> 1.3"
  spec.add_dependency "dotenv", "~> 3.1"
-  spec.add_dependency "zeitwerk", ">= 2.6.18", "< 3.0"
+  spec.add_dependency "zeitwerk", "~> 2.5"
  spec.add_dependency "ed25519", "~> 1.2"
  spec.add_dependency "bcrypt_pbkdf", "~> 1.0"
  spec.add_dependency "concurrent-ruby", "~> 1.2"
--- a/lib/kamal/cli.rb
+++ b/lib/kamal/cli.rb
@@ -2,7 +2,6 @@ module Kamal::Cli
  class BootError < StandardError; end
  class HookError < StandardError; end
  class LockError < StandardError; end
-  class DependencyError < StandardError; end
 end

 # SSHKit uses instance eval, so we need a global const for ergonomics
--- a/lib/kamal/cli/accessory.rb
+++ b/lib/kamal/cli/accessory.rb
@@ -1,5 +1,3 @@
-require "active_support/core_ext/array/conversions"
-
 class Kamal::Cli::Accessory < Kamal::Cli::Base
  desc "boot [NAME]", "Boot new accessory service on host (use NAME=all to boot all accessories)"
  def boot(name, prepare: true)
@@ -18,11 +16,6 @@ class Kamal::Cli::Accessory < Kamal::Cli::Base
            execute *accessory.ensure_env_directory
            upload! accessory.secrets_io, accessory.secrets_path, mode: "0600"
            execute *accessory.run
-
-            if accessory.running_proxy?
-              target = capture_with_info(*accessory.container_id_for(container_name: accessory.service_name, only_running: true)).strip
-              execute *accessory.deploy(target: target)
-            end
          end
        end
      end
@@ -80,10 +73,6 @@ class Kamal::Cli::Accessory < Kamal::Cli::Base
        on(hosts) do
          execute *KAMAL.auditor.record("Started #{name} accessory"), verbosity: :debug
          execute *accessory.start
-          if accessory.running_proxy?
-            target = capture_with_info(*accessory.container_id_for(container_name: accessory.service_name, only_running: true)).strip
-            execute *accessory.deploy(target: target)
-          end
        end
      end
    end
@@ -96,11 +85,6 @@ class Kamal::Cli::Accessory < Kamal::Cli::Base
        on(hosts) do
          execute *KAMAL.auditor.record("Stopped #{name} accessory"), verbosity: :debug
          execute *accessory.stop, raise_on_non_zero_exit: false
-
-          if accessory.running_proxy?
-            target = capture_with_info(*accessory.container_id_for(container_name: accessory.service_name, only_running: true)).strip
-            execute *accessory.remove if target
-          end
        end
      end
    end
@@ -126,15 +110,14 @@ class Kamal::Cli::Accessory < Kamal::Cli::Base
    end
  end

-  desc "exec [NAME] [CMD...]", "Execute a custom command on servers within the accessory container (use --help to show options)"
+  desc "exec [NAME] [CMD]", "Execute a custom command on servers (use --help to show options)"
  option :interactive, aliases: "-i", type: :boolean, default: false, desc: "Execute command over ssh for an interactive shell (use for console/bash)"
  option :reuse, type: :boolean, default: false, desc: "Reuse currently running container instead of starting a new one"
-  def exec(name, *cmd)
-    cmd = Kamal::Utils.join_commands(cmd)
+  def exec(name, cmd)
    with_accessory(name) do |accessory, hosts|
      case
      when options[:interactive] && options[:reuse]
-        say "Launching interactive command via SSH from existing container...", :magenta
+        say "Launching interactive command with via SSH from existing container...", :magenta
        run_locally { exec accessory.execute_in_existing_container_over_ssh(cmd) }

      when options[:interactive]
@@ -143,16 +126,16 @@ class Kamal::Cli::Accessory < Kamal::Cli::Base

      when options[:reuse]
        say "Launching command from existing container...", :magenta
-        on(hosts) do |host|
+        on(hosts) do
          execute *KAMAL.auditor.record("Executed cmd '#{cmd}' on #{name} accessory"), verbosity: :debug
-          puts_by_host host, capture_with_info(*accessory.execute_in_existing_container(cmd))
+          capture_with_info(*accessory.execute_in_existing_container(cmd))
        end

      else
        say "Launching command from new container...", :magenta
-        on(hosts) do |host|
+        on(hosts) do
          execute *KAMAL.auditor.record("Executed cmd '#{cmd}' on #{name} accessory"), verbosity: :debug
-          puts_by_host host, capture_with_info(*accessory.execute_in_new_container(cmd))
+          capture_with_info(*accessory.execute_in_new_container(cmd))
        end
      end
    end
@@ -162,7 +145,7 @@ class Kamal::Cli::Accessory < Kamal::Cli::Base
  option :since, aliases: "-s", desc: "Show logs since timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)"
  option :lines, type: :numeric, aliases: "-n", desc: "Number of log lines to pull from each server"
  option :grep, aliases: "-g", desc: "Show lines with grep match only (use this to fetch specific requests by id)"
-  option :grep_options, desc: "Additional options supplied to grep"
+  option :grep_options, aliases: "-o", desc: "Additional options supplied to grep"
  option :follow, aliases: "-f", desc: "Follow logs on primary server (or specific host set by --hosts)"
  option :skip_timestamps, type: :boolean, aliases: "-T", desc: "Skip appending timestamps to logging output"
  def logs(name)
@@ -292,7 +275,7 @@ class Kamal::Cli::Accessory < Kamal::Cli::Base
    def prepare(name)
      with_accessory(name) do |accessory, hosts|
        on(hosts) do
-          execute *KAMAL.registry.login(registry_config: accessory.registry)
+          execute *KAMAL.registry.login
          execute *KAMAL.docker.create_network
        rescue SSHKit::Command::Failed => e
          raise unless e.message.include?("already exists")
--- a/lib/kamal/cli/alias/command.rb
+++ b/lib/kamal/cli/alias/command.rb
@@ -1,7 +1,6 @@
 class Kamal::Cli::Alias::Command < Thor::DynamicCommand
  def run(instance, args = [])
    if (_alias = KAMAL.config.aliases[name])
-      KAMAL.reset
      Kamal::Cli::Main.start(Shellwords.split(_alias.command) + ARGV[1..-1])
    else
      super
--- a/lib/kamal/cli/app.rb
+++ b/lib/kamal/cli/app.rb
@@ -16,18 +16,10 @@ class Kamal::Cli::App < Kamal::Cli::Base
        # Primary hosts and roles are returned first, so they can open the barrier
        barrier = Kamal::Cli::Healthcheck::Barrier.new

-        host_boot_groups.each do |hosts|
-          host_list = Array(hosts).join(",")
-          run_hook "pre-app-boot", hosts: host_list
-
-          on(hosts) do |host|
-            KAMAL.roles_on(host).each do |role|
-              Kamal::Cli::App::Boot.new(host, role, self, version, barrier).run
-            end
+        on(KAMAL.hosts, **KAMAL.boot_strategy) do |host|
+          KAMAL.roles_on(host).each do |role|
+            Kamal::Cli::App::Boot.new(host, role, self, version, barrier).run
          end
-
-          run_hook "post-app-boot", hosts: host_list
-          sleep KAMAL.config.boot.wait if KAMAL.config.boot.wait
        end

        # Tag once the app booted on all hosts
@@ -76,7 +68,7 @@ class Kamal::Cli::App < Kamal::Cli::Base
            version = capture_with_info(*app.current_running_version, raise_on_non_zero_exit: false).strip
            endpoint = capture_with_info(*app.container_id_for_version(version)).strip
            if endpoint.present?
-              execute *app.remove, raise_on_non_zero_exit: false
+              execute *app.remove(target: endpoint), raise_on_non_zero_exit: false
            end
          end

@@ -102,15 +94,9 @@ class Kamal::Cli::App < Kamal::Cli::Base
  option :interactive, aliases: "-i", type: :boolean, default: false, desc: "Execute command over ssh for an interactive shell (use for console/bash)"
  option :reuse, type: :boolean, default: false, desc: "Reuse currently running container instead of starting a new one"
  option :env, aliases: "-e", type: :hash, desc: "Set environment variables for the command"
-  option :detach, type: :boolean, default: false, desc: "Execute command in a detached container"
  def exec(*cmd)
-    if (incompatible_options = [ :interactive, :reuse ].select { |key| options[:detach] && options[key] }.presence)
-      raise ArgumentError, "Detach is not compatible with #{incompatible_options.join(" or ")}"
-    end
-
    cmd = Kamal::Utils.join_commands(cmd)
    env = options[:env]
-    detach = options[:detach]
    case
    when options[:interactive] && options[:reuse]
      say "Get current version of running container...", :magenta unless options[:version]
@@ -152,7 +138,7 @@ class Kamal::Cli::App < Kamal::Cli::Base

          roles.each do |role|
            execute *KAMAL.auditor.record("Executed cmd '#{cmd}' on app version #{version}"), verbosity: :debug
-            puts_by_host host, capture_with_info(*KAMAL.app(role: role, host: host).execute_in_new_container(cmd, env: env, detach: detach))
+            puts_by_host host, capture_with_info(*KAMAL.app(role: role, host: host).execute_in_new_container(cmd, env: env))
          end
        end
      end
@@ -200,17 +186,15 @@ class Kamal::Cli::App < Kamal::Cli::Base
  option :since, aliases: "-s", desc: "Show lines since timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)"
  option :lines, type: :numeric, aliases: "-n", desc: "Number of lines to show from each server"
  option :grep, aliases: "-g", desc: "Show lines with grep match only (use this to fetch specific requests by id)"
-  option :grep_options, desc: "Additional options supplied to grep"
+  option :grep_options, aliases: "-o", desc: "Additional options supplied to grep"
  option :follow, aliases: "-f", desc: "Follow log on primary server (or specific host set by --hosts)"
  option :skip_timestamps, type: :boolean, aliases: "-T", desc: "Skip appending timestamps to logging output"
-  option :container_id, desc: "Docker container ID to fetch logs"
  def logs
    # FIXME: Catch when app containers aren't running

    grep = options[:grep]
    grep_options = options[:grep_options]
    since = options[:since]
-    container_id = options[:container_id]
    timestamps = !options[:skip_timestamps]

    if options[:follow]
@@ -219,12 +203,12 @@ class Kamal::Cli::App < Kamal::Cli::Base
      run_locally do
        info "Following logs on #{KAMAL.primary_host}..."

-        KAMAL.specific_roles ||= [ KAMAL.primary_role.name ]
+        KAMAL.specific_roles ||= [ "web" ]
        role = KAMAL.roles_on(KAMAL.primary_host).first

        app = KAMAL.app(role: role, host: host)
-        info app.follow_logs(host: KAMAL.primary_host, container_id: container_id, timestamps: timestamps, lines: lines, grep: grep, grep_options: grep_options)
-        exec app.follow_logs(host: KAMAL.primary_host, container_id: container_id, timestamps: timestamps, lines: lines, grep: grep, grep_options: grep_options)
+        info app.follow_logs(host: KAMAL.primary_host, timestamps: timestamps, lines: lines, grep: grep, grep_options: grep_options)
+        exec app.follow_logs(host: KAMAL.primary_host, timestamps: timestamps, lines: lines, grep: grep, grep_options: grep_options)
      end
    else
      lines = options[:lines].presence || ((since || grep) ? nil : 100) # Default to 100 lines if since or grep isn't set
@@ -234,7 +218,7 @@ class Kamal::Cli::App < Kamal::Cli::Base

        roles.each do |role|
          begin
-            puts_by_host host, capture_with_info(*KAMAL.app(role: role, host: host).logs(container_id: container_id, timestamps: timestamps, since: since, lines: lines, grep: grep, grep_options: grep_options))
+            puts_by_host host, capture_with_info(*KAMAL.app(role: role, host: host).logs(timestamps: timestamps, since: since, lines: lines, grep: grep, grep_options: grep_options))
          rescue SSHKit::Command::Failed
            puts_by_host host, "Nothing found"
          end
@@ -348,8 +332,4 @@ class Kamal::Cli::App < Kamal::Cli::Base
        yield
      end
    end
-
-    def host_boot_groups
-      KAMAL.config.boot.limit ? KAMAL.hosts.each_slice(KAMAL.config.boot.limit).to_a : [ KAMAL.hosts ]
-    end
 end
--- a/lib/kamal/cli/app/boot.rb
+++ b/lib/kamal/cli/app/boot.rb
@@ -45,7 +45,7 @@ class Kamal::Cli::App::Boot

    def start_new_version
      audit "Booted app version #{version}"
-      hostname = "#{host.to_s[0...51].chomp(".")}-#{SecureRandom.hex(6)}"
+      hostname = "#{host.to_s[0...51].gsub(/\.+$/, '')}-#{SecureRandom.hex(6)}"

      execute *app.ensure_env_directory
      upload! role.secrets_io(host), role.secrets_path, mode: "0600"
@@ -91,7 +91,7 @@ class Kamal::Cli::App::Boot
      if barrier.close
        info "First #{KAMAL.primary_role} container is unhealthy on #{host}, not booting any other roles"
        begin
-          error capture_with_info(*app.logs(container_id: app.container_id_for_version(version)))
+          error capture_with_info(*app.logs(version: version))
          error capture_with_info(*app.container_health_log(version: version))
        rescue SSHKit::Command::Failed
          error "Could not fetch logs for #{version}"
--- a/lib/kamal/cli/base.rb
+++ b/lib/kamal/cli/base.rb
@@ -5,7 +5,7 @@ module Kamal::Cli
  class Base < Thor
    include SSHKit::DSL

-    def self.exit_on_failure?() true end
+    def self.exit_on_failure?() false end
    def self.dynamic_command_class() Kamal::Cli::Alias::Command end

    class_option :verbose, type: :boolean, aliases: "-v", desc: "Detailed logging"
@@ -30,7 +30,6 @@ module Kamal::Cli
      else
        super
      end
-
      initialize_commander unless KAMAL.configured?
    end

@@ -195,19 +194,5 @@ module Kamal::Cli
        ENV.clear
        ENV.update(current_env)
      end
-
-      def ensure_docker_installed
-        run_locally do
-          begin
-            execute *KAMAL.builder.ensure_docker_installed
-          rescue SSHKit::Command::Failed => e
-            error = e.message =~ /command not found/ ?
-              "Docker is not installed locally" :
-              "Docker buildx plugin is not installed locally"
-
-            raise DependencyError, error
-          end
-        end
-      end
  end
 end
--- a/lib/kamal/cli/build.rb
+++ b/lib/kamal/cli/build.rb
@@ -5,16 +5,15 @@ class Kamal::Cli::Build < Kamal::Cli::Base

  desc "deliver", "Build app and push app image to registry then pull image on servers"
  def deliver
-    invoke :push
-    invoke :pull
+    push
+    pull
  end

  desc "push", "Build and push app image to registry"
-  option :output, type: :string, default: "registry", banner: "export_type", desc: "Exported type for the build result, and may be any exported type supported by 'buildx --output'."
  def push
    cli = self

-    ensure_docker_installed
+    verify_local_dependencies
    run_hook "pre-build"

    uncommitted_changes = Kamal::Git.uncommitted_changes
@@ -50,7 +49,7 @@ class Kamal::Cli::Build < Kamal::Cli::Base
        end

        # Get the command here to ensure the Dir.chdir doesn't interfere with it
-        push = KAMAL.builder.push(cli.options[:output])
+        push = KAMAL.builder.push

        KAMAL.with_verbosity(:debug) do
          Dir.chdir(KAMAL.config.builder.build_directory) { execute *push }
@@ -109,42 +108,21 @@ class Kamal::Cli::Build < Kamal::Cli::Base
    end
  end

-  desc "dev", "Build using the working directory, tag it as dirty, and push to local image store."
-  option :output, type: :string, default: "docker", banner: "export_type", desc: "Exported type for the build result, and may be any exported type supported by 'buildx --output'."
-  def dev
-    cli = self
-
-    ensure_docker_installed
-
-    docker_included_files = Set.new(Kamal::Docker.included_files)
-    git_uncommitted_files = Set.new(Kamal::Git.uncommitted_files)
-    git_untracked_files = Set.new(Kamal::Git.untracked_files)
-
-    docker_uncommitted_files = docker_included_files & git_uncommitted_files
-    if docker_uncommitted_files.any?
-      say "WARNING: Files with uncommitted changes will be present in the dev container:", :yellow
-      docker_uncommitted_files.sort.each { |f| say "  #{f}", :yellow }
-      say
-    end
-
-    docker_untracked_files = docker_included_files & git_untracked_files
-    if docker_untracked_files.any?
-      say "WARNING: Untracked files will be present in the dev container:", :yellow
-      docker_untracked_files.sort.each { |f| say "  #{f}", :yellow }
-      say
-    end
-
-    with_env(KAMAL.config.builder.secrets) do
+  private
+    def verify_local_dependencies
      run_locally do
-        build = KAMAL.builder.push(cli.options[:output], tag_as_dirty: true)
-        KAMAL.with_verbosity(:debug) do
-          execute(*build)
+        begin
+          execute *KAMAL.builder.ensure_local_dependencies_installed
+        rescue SSHKit::Command::Failed => e
+          build_error = e.message =~ /command not found/ ?
+            "Docker is not installed locally" :
+            "Docker buildx plugin is not installed locally"
+
+          raise BuildError, build_error
        end
      end
    end
-  end

-  private
    def connect_to_remote_host(remote_host)
      remote_uri = URI.parse(remote_host)
      if remote_uri.scheme == "ssh"
--- a/lib/kamal/cli/main.rb
+++ b/lib/kamal/cli/main.rb
@@ -9,14 +9,15 @@ class Kamal::Cli::Main < Kamal::Cli::Base
        say "Ensure Docker is installed...", :magenta
        invoke "kamal:cli:server:bootstrap", [], invoke_options

-        deploy(boot_accessories: true)
+        invoke "kamal:cli:accessory:boot", [ "all" ], invoke_options
+        deploy
      end
    end
  end

  desc "deploy", "Deploy app to servers"
  option :skip_push, aliases: "-P", type: :boolean, default: false, desc: "Skip image build and push"
-  def deploy(boot_accessories: false)
+  def deploy
    runtime = print_runtime do
      invoke_options = deploy_options

@@ -37,8 +38,6 @@ class Kamal::Cli::Main < Kamal::Cli::Base
        say "Ensure kamal-proxy is running...", :magenta
        invoke "kamal:cli:proxy:boot", [], invoke_options

-        invoke "kamal:cli:accessory:boot", [ "all" ], invoke_options if boot_accessories
-
        say "Detect stale containers...", :magenta
        invoke "kamal:cli:app:stale_containers", [], invoke_options.merge(stop: true)

@@ -136,7 +135,7 @@ class Kamal::Cli::Main < Kamal::Cli::Base
    puts "No documentation found for #{section}"
  end

-  desc "init", "Create config stub in config/deploy.yml and secrets stub in .kamal"
+  desc "init", "Create config stub in config/deploy.yml and env stub in .env"
  option :bundle, type: :boolean, default: false, desc: "Add Kamal to the Gemfile and create a bin/kamal binstub"
  def init
    require "fileutils"
--- a/lib/kamal/cli/proxy.rb
+++ b/lib/kamal/cli/proxy.rb
@@ -14,26 +14,23 @@ class Kamal::Cli::Proxy < Kamal::Cli::Base
        version = capture_with_info(*KAMAL.proxy.version).strip.presence

        if version && Kamal::Utils.older_version?(version, Kamal::Configuration::PROXY_MINIMUM_VERSION)
-          raise "kamal-proxy version #{version} is too old, run `kamal proxy reboot` in order to update to at least #{Kamal::Configuration::PROXY_MINIMUM_VERSION}"
+          raise "kamal-proxy version #{version} is too old, please reboot to update to at least #{Kamal::Configuration::PROXY_MINIMUM_VERSION}"
        end
        execute *KAMAL.proxy.start_or_run
      end
    end
  end

-  desc "boot_config <set|get|reset>", "Manage kamal-proxy boot configuration"
+  desc "boot_config <set|get|clear>", "Mange kamal-proxy boot configuration"
  option :publish, type: :boolean, default: true, desc: "Publish the proxy ports on the host"
-  option :publish_host_ip, type: :string, repeatable: true, default: nil, desc: "Host IP address to bind HTTP/HTTPS traffic to. Defaults to all interfaces"
  option :http_port, type: :numeric, default: Kamal::Configuration::PROXY_HTTP_PORT, desc: "HTTP port to publish on the host"
  option :https_port, type: :numeric, default: Kamal::Configuration::PROXY_HTTPS_PORT, desc: "HTTPS port to publish on the host"
-  option :log_max_size, type: :string, default: Kamal::Configuration::PROXY_LOG_MAX_SIZE, desc: "Max size of proxy logs"
  option :docker_options, type: :array, default: [], desc: "Docker options to pass to the proxy container", banner: "option=value option2=value2"
  def boot_config(subcommand)
    case subcommand
    when "set"
      boot_options = [
-        *(KAMAL.config.proxy_publish_args(options[:http_port], options[:https_port], options[:publish_host_ip]) if options[:publish]),
-        *(KAMAL.config.proxy_logging_args(options[:log_max_size])),
+        *(KAMAL.config.proxy_publish_args(options[:http_port], options[:https_port]) if options[:publish]),
        *options[:docker_options].map { |option| "--#{option}" }
      ]

@@ -68,6 +65,9 @@ class Kamal::Cli::Proxy < Kamal::Cli::Base
            execute *KAMAL.auditor.record("Rebooted proxy"), verbosity: :debug
            execute *KAMAL.registry.login

+            "Stopping and removing Traefik on #{host}, if running..."
+            execute *KAMAL.proxy.cleanup_traefik
+
            "Stopping and removing kamal-proxy on #{host}, if running..."
            execute *KAMAL.proxy.stop, raise_on_non_zero_exit: false
            execute *KAMAL.proxy.remove_container
--- a/lib/kamal/cli/registry.rb
+++ b/lib/kamal/cli/registry.rb
@@ -3,8 +3,6 @@ class Kamal::Cli::Registry < Kamal::Cli::Base
  option :skip_local, aliases: "-L", type: :boolean, default: false, desc: "Skip local login"
  option :skip_remote, aliases: "-R", type: :boolean, default: false, desc: "Skip remote login"
  def login
-    ensure_docker_installed
-
    run_locally    { execute *KAMAL.registry.login } unless options[:skip_local]
    on(KAMAL.hosts) { execute *KAMAL.registry.login } unless options[:skip_remote]
  end
--- a/lib/kamal/cli/secrets.rb
+++ b/lib/kamal/cli/secrets.rb
@@ -1,19 +1,13 @@
 class Kamal::Cli::Secrets < Kamal::Cli::Base
  desc "fetch [SECRETS...]", "Fetch secrets from a vault"
  option :adapter, type: :string, aliases: "-a", required: true, desc: "Which vault adapter to use"
-  option :account, type: :string, required: false, desc: "The account identifier or username"
+  option :account, type: :string, required: true, desc: "The account identifier or username"
  option :from, type: :string, required: false, desc: "A vault or folder to fetch the secrets from"
  option :inline, type: :boolean, required: false, hidden: true
  def fetch(*secrets)
-    adapter = initialize_adapter(options[:adapter])
+    results = adapter(options[:adapter]).fetch(secrets, **options.slice(:account, :from).symbolize_keys)

-    if adapter.requires_account? && options[:account].blank?
-      return puts "No value provided for required options '--account'"
-    end
-
-    results = adapter.fetch(secrets, **options.slice(:account, :from).symbolize_keys)
-
-    return_or_puts JSON.dump(results).shellescape, inline: options[:inline]
+    return_or_puts JSON.dump(results), inline: options[:inline]
  end

  desc "extract", "Extract a single secret from the results of a fetch call"
@@ -27,15 +21,8 @@ class Kamal::Cli::Secrets < Kamal::Cli::Base
    return_or_puts value, inline: options[:inline]
  end

-  desc "print", "Print the secrets (for debugging)"
-  def print
-    KAMAL.config.secrets.to_h.each do |key, value|
-      puts "#{key}=#{value}"
-    end
-  end
-
  private
-    def initialize_adapter(adapter)
+    def adapter(adapter)
      Kamal::Secrets::Adapters.lookup(adapter)
    end

--- a/lib/kamal/cli/templates/deploy.yml
+++ b/lib/kamal/cli/templates/deploy.yml
@@ -13,15 +13,11 @@ servers:
  #     - 192.168.0.1
  #   cmd: bin/jobs

-# Enable SSL auto certification via Let's Encrypt and allow for multiple apps on a single web server.
-# Remove this section when using multiple web servers and ensure you terminate SSL at your load balancer.
-#
-# Note: If using Cloudflare, set encryption mode in SSL/TLS setting to "Full" to enable CF-to-app encryption.
+# Enable SSL auto certification via Let's Encrypt (and allow for multiple apps on one server).
+# Set ssl: false if using something like Cloudflare to terminate SSL (but keep host!).
 proxy:
  ssl: true
  host: app.example.com
-  # Proxy connects to your container on port 80 by default.
-  # app_port: 3000

 # Credentials for your image host.
 registry:
@@ -36,9 +32,6 @@ registry:
 # Configure builder setup.
 builder:
  arch: amd64
-  # Pass in additional build args needed for your Dockerfile.
-  # args:
-  #   RUBY_VERSION: <%= ENV["RBENV_VERSION"] || ENV["rvm_ruby_string"] || "#{RUBY_ENGINE}-#{RUBY_ENGINE_VERSION}" %>

 # Inject ENV variables into containers (secrets come from .kamal/secrets).
 #
@@ -49,7 +42,7 @@ builder:
 #     - RAILS_MASTER_KEY

 # Aliases are triggered with "bin/kamal <alias>". You can overwrite arguments on invocation:
-# "bin/kamal app logs -r job" will tail logs from the first server in the job section.
+# "bin/kamal logs -r job" will tail logs from the first server in the job section.
 #
 # aliases:
 #   shell: app exec --interactive --reuse "bash"
@@ -94,7 +87,7 @@ builder:
 #     directories:
 #       - data:/var/lib/mysql
 #   redis:
-#     image: valkey/valkey:8
+#     image: redis:7.0
 #     host: 192.168.0.2
 #     port: 6379
 #     directories:
--- a/lib/kamal/cli/templates/sample_hooks/docker-setup.sample
+++ b/lib/kamal/cli/templates/sample_hooks/docker-setup.sample
@@ -1,3 +1,13 @@
-#!/bin/sh
+#!/usr/bin/env ruby

-echo "Docker set up on $KAMAL_HOSTS..."
+# A sample docker-setup hook
+#
+# Sets up a Docker network on defined hosts which can then be used by the application’s containers
+
+hosts = ENV["KAMAL_HOSTS"].split(",")
+
+hosts.each do |ip|
+  destination = "root@#{ip}"
+  puts "Creating a Docker network \"kamal\" on #{destination}"
+  `ssh #{destination} docker network create kamal`
+end
--- a/lib/kamal/cli/templates/sample_hooks/post-app-boot.sample
+++ b/lib/kamal/cli/templates/sample_hooks/post-app-boot.sample
@@ -1,3 +0,0 @@
-#!/bin/sh
-
-echo "Booted app version $KAMAL_VERSION on $KAMAL_HOSTS..."
--- a/lib/kamal/cli/templates/sample_hooks/pre-app-boot.sample
+++ b/lib/kamal/cli/templates/sample_hooks/pre-app-boot.sample
@@ -1,3 +0,0 @@
-#!/bin/sh
-
-echo "Booting app version $KAMAL_VERSION on $KAMAL_HOSTS..."
--- a/lib/kamal/commander.rb
+++ b/lib/kamal/commander.rb
@@ -4,20 +4,13 @@ require "active_support/core_ext/object/blank"

 class Kamal::Commander
  attr_accessor :verbosity, :holding_lock, :connected
-  attr_reader :specific_roles, :specific_hosts
  delegate :hosts, :roles, :primary_host, :primary_role, :roles_on, :proxy_hosts, :accessory_hosts, to: :specifics

  def initialize
-    reset
-  end
-
-  def reset
    self.verbosity = :info
    self.holding_lock = false
    self.connected = false
-    @specifics = @specific_roles = @specific_hosts = nil
-    @config = @config_kwargs = nil
-    @commands = {}
+    @specifics = nil
  end

  def config
@@ -35,6 +28,8 @@ class Kamal::Commander
    @config || @config_kwargs
  end

+  attr_reader :specific_roles, :specific_hosts
+
  def specific_primary!
    @specifics = nil
    if specific_roles.present?
@@ -81,6 +76,11 @@ class Kamal::Commander
    config.accessories&.collect(&:name) || []
  end

+  def accessories_on(host)
+    config.accessories.select { |accessory| accessory.hosts.include?(host.to_s) }.map(&:name)
+  end
+
+
  def app(role: nil, host: nil)
    Kamal::Commands::App.new(config, role: role, host: host)
  end
@@ -94,41 +94,42 @@ class Kamal::Commander
  end

  def builder
-    @commands[:builder] ||= Kamal::Commands::Builder.new(config)
+    @builder ||= Kamal::Commands::Builder.new(config)
  end

  def docker
-    @commands[:docker] ||= Kamal::Commands::Docker.new(config)
+    @docker ||= Kamal::Commands::Docker.new(config)
  end

  def hook
-    @commands[:hook] ||= Kamal::Commands::Hook.new(config)
+    @hook ||= Kamal::Commands::Hook.new(config)
  end

  def lock
-    @commands[:lock] ||= Kamal::Commands::Lock.new(config)
+    @lock ||= Kamal::Commands::Lock.new(config)
  end

  def proxy
-    @commands[:proxy] ||= Kamal::Commands::Proxy.new(config)
+    @proxy ||= Kamal::Commands::Proxy.new(config)
  end

  def prune
-    @commands[:prune] ||= Kamal::Commands::Prune.new(config)
+    @prune ||= Kamal::Commands::Prune.new(config)
  end

  def registry
-    @commands[:registry] ||= Kamal::Commands::Registry.new(config)
+    @registry ||= Kamal::Commands::Registry.new(config)
  end

  def server
-    @commands[:server] ||= Kamal::Commands::Server.new(config)
+    @server ||= Kamal::Commands::Server.new(config)
  end

  def alias(name)
    config.aliases[name]
  end

+
  def with_verbosity(level)
    old_level = self.verbosity

@@ -141,6 +142,14 @@ class Kamal::Commander
    SSHKit.config.output_verbosity = old_level
  end

+  def boot_strategy
+    if config.boot.limit.present?
+      { in: :groups, limit: config.boot.limit, wait: config.boot.wait }
+    else
+      {}
+    end
+  end
+
  def holding_lock?
    self.holding_lock
  end
--- a/lib/kamal/commander/specifics.rb
+++ b/lib/kamal/commander/specifics.rb
@@ -43,12 +43,7 @@ class Kamal::Commander::Specifics
    end

    def specified_hosts
-      specified_hosts = specific_hosts || config.all_hosts
-
-      if (specific_role_hosts = specific_roles&.flat_map(&:hosts)).present?
-        specified_hosts.select { |host| specific_role_hosts.include?(host) }
-      else
-        specified_hosts
-      end
+      (specific_hosts || config.all_hosts) \
+        .select { |host| (specific_roles || config.roles).flat_map(&:hosts).include?(host) }
    end
 end
--- a/lib/kamal/commands/accessory.rb
+++ b/lib/kamal/commands/accessory.rb
@@ -1,12 +1,9 @@
 class Kamal::Commands::Accessory < Kamal::Commands::Base
-  include Proxy
-
  attr_reader :accessory_config
  delegate :service_name, :image, :hosts, :port, :files, :directories, :cmd,
-           :network_args, :publish_args, :env_args, :volume_args, :label_args, :option_args,
-           :secrets_io, :secrets_path, :env_directory, :proxy, :running_proxy?, :registry,
+           :publish_args, :env_args, :volume_args, :label_args, :option_args,
+           :secrets_io, :secrets_path, :env_directory,
           to: :accessory_config
-  delegate :proxy_container_name, to: :config

  def initialize(config, name:)
    super(config)
@@ -18,7 +15,7 @@ class Kamal::Commands::Accessory < Kamal::Commands::Base
      "--name", service_name,
      "--detach",
      "--restart", "unless-stopped",
-      *network_args,
+      "--network", "kamal",
      *config.logging_args,
      *publish_args,
      *env_args,
@@ -41,6 +38,7 @@ class Kamal::Commands::Accessory < Kamal::Commands::Base
    docker :ps, *service_filter
  end

+
  def logs(timestamps: true, since: nil, lines: nil, grep: nil, grep_options: nil)
    pipe \
      docker(:logs, service_name, (" --since #{since}" if since), (" --tail #{lines}" if lines), ("--timestamps" if timestamps), "2>&1"),
@@ -54,6 +52,7 @@ class Kamal::Commands::Accessory < Kamal::Commands::Base
        (%(grep "#{grep}"#{" #{grep_options}" if grep_options}) if grep)
  end

+
  def execute_in_existing_container(*command, interactive: false)
    docker :exec,
      ("-it" if interactive),
@@ -65,7 +64,7 @@ class Kamal::Commands::Accessory < Kamal::Commands::Base
    docker :run,
      ("-it" if interactive),
      "--rm",
-      *network_args,
+      "--network", "kamal",
      *env_args,
      *volume_args,
      image,
@@ -84,6 +83,7 @@ class Kamal::Commands::Accessory < Kamal::Commands::Base
    super command, host: hosts.first
  end

+
  def ensure_local_file_present(local_file)
    if !local_file.is_a?(StringIO) && !Pathname.new(local_file).exist?
      raise "Missing file: #{local_file}"
--- a/lib/kamal/commands/accessory/proxy.rb
+++ b/lib/kamal/commands/accessory/proxy.rb
@@ -1,16 +0,0 @@
-module Kamal::Commands::Accessory::Proxy
-  delegate :proxy_container_name, to: :config
-
-  def deploy(target:)
-    proxy_exec :deploy, service_name, *proxy.deploy_command_args(target: target)
-  end
-
-  def remove
-    proxy_exec :remove, service_name
-  end
-
-  private
-    def proxy_exec(*command)
-      docker :exec, proxy_container_name, "kamal-proxy", *command
-    end
-end
--- a/lib/kamal/commands/app.rb
+++ b/lib/kamal/commands/app.rb
@@ -47,7 +47,7 @@ class Kamal::Commands::App < Kamal::Commands::Base
  end

  def info
-    docker :ps, *container_filter_args
+    docker :ps, *filter_args
  end


@@ -67,7 +67,7 @@ class Kamal::Commands::App < Kamal::Commands::Base

  def list_versions(*docker_args, statuses: nil)
    pipe \
-      docker(:ps, *container_filter_args(statuses: statuses), *docker_args, "--format", '"{{.Names}}"'),
+      docker(:ps, *filter_args(statuses: statuses), *docker_args, "--format", '"{{.Names}}"'),
      extract_version_from_name
  end

@@ -91,15 +91,11 @@ class Kamal::Commands::App < Kamal::Commands::Base
    end

    def latest_container(format:, filters: nil)
-      docker :ps, "--latest", *format, *container_filter_args(statuses: ACTIVE_DOCKER_STATUSES), argumentize("--filter", filters)
+      docker :ps, "--latest", *format, *filter_args(statuses: ACTIVE_DOCKER_STATUSES), argumentize("--filter", filters)
    end

-    def container_filter_args(statuses: nil)
-      argumentize "--filter", container_filters(statuses: statuses)
-    end
-
-    def image_filter_args
-      argumentize "--filter", image_filters
+    def filter_args(statuses: nil)
+      argumentize "--filter", filters(statuses: statuses)
    end

    def extract_version_from_name
@@ -107,17 +103,13 @@ class Kamal::Commands::App < Kamal::Commands::Base
      %(while read line; do echo ${line##{role.container_prefix}-}; done)
    end

-    def container_filters(statuses: nil)
+    def filters(statuses: nil)
      [ "label=service=#{config.service}" ].tap do |filters|
-        filters << "label=destination=#{config.destination}"
+        filters << "label=destination=#{config.destination}" if config.destination
        filters << "label=role=#{role}" if role
        statuses&.each do |status|
          filters << "status=#{status}"
        end
      end
    end
-
-    def image_filters
-      [ "label=service=#{config.service}" ]
-    end
 end
--- a/lib/kamal/commands/app/assets.rb
+++ b/lib/kamal/commands/app/assets.rb
@@ -4,10 +4,10 @@ module Kamal::Commands::App::Assets

    combine \
      make_directory(role.asset_extracted_directory),
-      [ *docker(:container, :rm, asset_container, "2> /dev/null"), "|| true" ],
-      docker(:container, :create, "--name", asset_container, config.absolute_image),
-      docker(:container, :cp, "-L", "#{asset_container}:#{role.asset_path}/.", role.asset_extracted_directory),
-      docker(:container, :rm, asset_container),
+      [ *docker(:stop, "-t 1", asset_container, "2> /dev/null"), "|| true" ],
+      docker(:run, "--name", asset_container, "--detach", "--rm", "--entrypoint", "sleep", config.absolute_image, "1000000"),
+      docker(:cp, "-L", "#{asset_container}:#{role.asset_path}/.", role.asset_extracted_directory),
+      docker(:stop, "-t 1", asset_container),
      by: "&&"
  end

--- a/lib/kamal/commands/app/containers.rb
+++ b/lib/kamal/commands/app/containers.rb
@@ -2,7 +2,7 @@ module Kamal::Commands::App::Containers
  DOCKER_HEALTH_LOG_FORMAT    = "'{{json .State.Health}}'"

  def list_containers
-    docker :container, :ls, "--all", *container_filter_args
+    docker :container, :ls, "--all", *filter_args
  end

  def list_container_names
@@ -20,7 +20,7 @@ module Kamal::Commands::App::Containers
  end

  def remove_containers
-    docker :container, :prune, "--force", *container_filter_args
+    docker :container, :prune, "--force", *filter_args
  end

  def container_health_log(version:)
--- a/lib/kamal/commands/app/execution.rb
+++ b/lib/kamal/commands/app/execution.rb
@@ -7,15 +7,13 @@ module Kamal::Commands::App::Execution
      *command
  end

-  def execute_in_new_container(*command, interactive: false, detach: false, env:)
+  def execute_in_new_container(*command, interactive: false, env:)
    docker :run,
      ("-it" if interactive),
-      ("--detach" if detach),
-      ("--rm" unless detach),
+      "--rm",
      "--network", "kamal",
      *role&.env_args(host),
      *argumentize("--env", env),
-      *role.logging_args,
      *config.volume_args,
      *role&.option_args,
      config.absolute_image,
--- a/lib/kamal/commands/app/images.rb
+++ b/lib/kamal/commands/app/images.rb
@@ -4,7 +4,7 @@ module Kamal::Commands::App::Images
  end

  def remove_images
-    docker :image, :prune, "--all", "--force", *image_filter_args
+    docker :image, :prune, "--all", "--force", *filter_args
  end

  def tag_latest_image
--- a/lib/kamal/commands/app/logging.rb
+++ b/lib/kamal/commands/app/logging.rb
@@ -1,28 +1,18 @@
 module Kamal::Commands::App::Logging
-  def logs(container_id: nil, timestamps: true, since: nil, lines: nil, grep: nil, grep_options: nil)
+  def logs(version: nil, timestamps: true, since: nil, lines: nil, grep: nil, grep_options: nil)
    pipe \
-      container_id_command(container_id),
+      version ? container_id_for_version(version) : current_running_container_id,
      "xargs docker logs#{" --timestamps" if timestamps}#{" --since #{since}" if since}#{" --tail #{lines}" if lines} 2>&1",
      ("grep '#{grep}'#{" #{grep_options}" if grep_options}" if grep)
  end

-  def follow_logs(host:, container_id: nil, timestamps: true, lines: nil, grep: nil, grep_options: nil)
+  def follow_logs(host:, timestamps: true, lines: nil, grep: nil, grep_options: nil)
    run_over_ssh \
      pipe(
-        container_id_command(container_id),
+        current_running_container_id,
        "xargs docker logs#{" --timestamps" if timestamps}#{" --tail #{lines}" if lines} --follow 2>&1",
        (%(grep "#{grep}"#{" #{grep_options}" if grep_options}) if grep)
      ),
      host: host
  end
-
-  private
-
-  def container_id_command(container_id)
-    case container_id
-    when Array then container_id
-    when String, Symbol then "echo #{container_id}"
-    else current_running_container_id
-    end
-  end
 end
--- a/lib/kamal/commands/app/proxy.rb
+++ b/lib/kamal/commands/app/proxy.rb
@@ -5,8 +5,8 @@ module Kamal::Commands::App::Proxy
    proxy_exec :deploy, role.container_prefix, *role.proxy.deploy_command_args(target: target)
  end

-  def remove
-    proxy_exec :remove, role.container_prefix
+  def remove(target:)
+    proxy_exec :remove, role.container_prefix, *role.proxy.remove_command_args(target: target)
  end

  private
--- a/lib/kamal/commands/base.rb
+++ b/lib/kamal/commands/base.rb
@@ -11,7 +11,14 @@ module Kamal::Commands
    end

    def run_over_ssh(*command, host:)
-      "ssh#{ssh_proxy_args}#{ssh_keys_args} -t #{config.ssh.user}@#{host} -p #{config.ssh.port} '#{command.join(" ").gsub("'", "'\\\\''")}'"
+      "ssh".tap do |cmd|
+        if config.ssh.proxy && config.ssh.proxy.is_a?(Net::SSH::Proxy::Jump)
+          cmd << " -J #{config.ssh.proxy.jump_proxies}"
+        elsif config.ssh.proxy && config.ssh.proxy.is_a?(Net::SSH::Proxy::Command)
+          cmd << " -o ProxyCommand='#{config.ssh.proxy.command_line_template}'"
+        end
+        cmd << " -t #{config.ssh.user}@#{host} -p #{config.ssh.port} '#{command.join(" ").gsub("'", "'\\\\''")}'"
+      end
    end

    def container_id_for(container_name:, only_running: false)
@@ -34,12 +41,6 @@ module Kamal::Commands
      [ :rm, path ]
    end

-    def ensure_docker_installed
-      combine \
-        ensure_local_docker_installed,
-        ensure_local_buildx_installed
-    end
-
    private
      def combine(*commands, by: "&&")
        commands
@@ -91,32 +92,5 @@ module Kamal::Commands
      def tags(**details)
        Kamal::Tags.from_config(config, **details)
      end
-
-      def ssh_proxy_args
-        case config.ssh.proxy
-        when Net::SSH::Proxy::Jump
-          " -J #{config.ssh.proxy.jump_proxies}"
-        when Net::SSH::Proxy::Command
-          " -o ProxyCommand='#{config.ssh.proxy.command_line_template}'"
-        end
-      end
-
-      def ssh_keys_args
-        "#{ ssh_keys.join("") if ssh_keys}" + "#{" -o IdentitiesOnly=yes" if config.ssh&.keys_only}"
-      end
-
-      def ssh_keys
-        config.ssh.keys&.map do |key|
-          " -i #{key}"
-        end
-      end
-
-      def ensure_local_docker_installed
-        docker "--version"
-      end
-
-      def ensure_local_buildx_installed
-        docker :buildx, "version"
-      end
  end
 end
--- a/lib/kamal/commands/builder.rb
+++ b/lib/kamal/commands/builder.rb
@@ -1,8 +1,8 @@
 require "active_support/core_ext/string/filters"

 class Kamal::Commands::Builder < Kamal::Commands::Base
-  delegate :create, :remove, :dev, :push, :clean, :pull, :info, :inspect_builder, :validate_image, :first_mirror, to: :target
-  delegate :local?, :remote?, :cloud?, to: "config.builder"
+  delegate :create, :remove, :push, :clean, :pull, :info, :inspect_builder, :validate_image, :first_mirror, to: :target
+  delegate :local?, :remote?, to: "config.builder"

  include Clone

@@ -17,8 +17,6 @@ class Kamal::Commands::Builder < Kamal::Commands::Base
      else
        remote
      end
-    elsif cloud?
-      cloud
    else
      local
    end
@@ -36,7 +34,23 @@ class Kamal::Commands::Builder < Kamal::Commands::Base
    @hybrid ||= Kamal::Commands::Builder::Hybrid.new(config)
  end

-  def cloud
-    @cloud ||= Kamal::Commands::Builder::Cloud.new(config)
+
+  def ensure_local_dependencies_installed
+    if name.native?
+      ensure_local_docker_installed
+    else
+      combine \
+        ensure_local_docker_installed,
+        ensure_local_buildx_installed
+    end
  end
+
+  private
+    def ensure_local_docker_installed
+      docker "--version"
+    end
+
+    def ensure_local_buildx_installed
+      docker :buildx, "version"
+    end
 end
--- a/lib/kamal/commands/builder/base.rb
+++ b/lib/kamal/commands/builder/base.rb
@@ -6,19 +6,18 @@ class Kamal::Commands::Builder::Base < Kamal::Commands::Base
  delegate :argumentize, to: Kamal::Utils
  delegate \
    :args, :secrets, :dockerfile, :target, :arches, :local_arches, :remote_arches, :remote,
-    :cache_from, :cache_to, :ssh, :provenance, :sbom, :driver, :docker_driver?,
+    :cache_from, :cache_to, :ssh, :driver, :docker_driver?,
    to: :builder_config

  def clean
    docker :image, :rm, "--force", config.absolute_image
  end

-  def push(export_action = "registry", tag_as_dirty: false)
+  def push
    docker :buildx, :build,
-      "--output=type=#{export_action}",
+      "--push",
      *platform_options(arches),
      *([ "--builder", builder_name ] unless docker_driver?),
-      *build_tag_options(tag_as_dirty: tag_as_dirty),
      *build_options,
      build_context
  end
@@ -38,7 +37,7 @@ class Kamal::Commands::Builder::Base < Kamal::Commands::Base
  end

  def build_options
-    [ *build_cache, *build_labels, *build_args, *build_secrets, *build_dockerfile, *build_target, *build_ssh, *builder_provenance, *builder_sbom ]
+    [ *build_tags, *build_cache, *build_labels, *build_args, *build_secrets, *build_dockerfile, *build_target, *build_ssh ]
  end

  def build_context
@@ -59,14 +58,8 @@ class Kamal::Commands::Builder::Base < Kamal::Commands::Base
  end

  private
-    def build_tag_names(tag_as_dirty: false)
-      tag_names = [ config.absolute_image, config.latest_image ]
-      tag_names.map! { |t| "#{t}-dirty" } if tag_as_dirty
-      tag_names
-    end
-
-    def build_tag_options(tag_as_dirty: false)
-      build_tag_names(tag_as_dirty: tag_as_dirty).flat_map { |name| [ "-t", name ] }
+    def build_tags
+      [ "-t", config.absolute_image, "-t", config.latest_image ]
    end

    def build_cache
@@ -104,14 +97,6 @@ class Kamal::Commands::Builder::Base < Kamal::Commands::Base
      argumentize "--ssh", ssh if ssh.present?
    end

-    def builder_provenance
-      argumentize "--provenance", provenance unless provenance.nil?
-    end
-
-    def builder_sbom
-      argumentize "--sbom", sbom unless sbom.nil?
-    end
-
    def builder_config
      config.builder
    end
--- a/lib/kamal/commands/builder/clone.rb
+++ b/lib/kamal/commands/builder/clone.rb
@@ -1,31 +1,29 @@
 module Kamal::Commands::Builder::Clone
+  extend ActiveSupport::Concern
+
+  included do
+    delegate :clone_directory, :build_directory, to: :"config.builder"
+  end
+
  def clone
-    git :clone, escaped_root, "--recurse-submodules", path: config.builder.clone_directory.shellescape
+    git :clone, Kamal::Git.root, "--recurse-submodules", path: clone_directory
  end

  def clone_reset_steps
    [
-      git(:remote, "set-url", :origin, escaped_root, path: escaped_build_directory),
-      git(:fetch, :origin, path: escaped_build_directory),
-      git(:reset, "--hard", Kamal::Git.revision, path: escaped_build_directory),
-      git(:clean, "-fdx", path: escaped_build_directory),
-      git(:submodule, :update, "--init", path: escaped_build_directory)
+      git(:remote, "set-url", :origin, Kamal::Git.root, path: build_directory),
+      git(:fetch, :origin, path: build_directory),
+      git(:reset, "--hard", Kamal::Git.revision, path: build_directory),
+      git(:clean, "-fdx", path: build_directory),
+      git(:submodule, :update, "--init", path: build_directory)
    ]
  end

  def clone_status
-    git :status, "--porcelain", path: escaped_build_directory
+    git :status, "--porcelain", path: build_directory
  end

  def clone_revision
-    git :"rev-parse", :HEAD, path: escaped_build_directory
-  end
-
-  def escaped_root
-    Kamal::Git.root.shellescape
-  end
-
-  def escaped_build_directory
-    config.builder.build_directory.shellescape
+    git :"rev-parse", :HEAD, path: build_directory
  end
 end
--- a/lib/kamal/commands/builder/cloud.rb
+++ b/lib/kamal/commands/builder/cloud.rb
@@ -1,22 +0,0 @@
-class Kamal::Commands::Builder::Cloud < Kamal::Commands::Builder::Base
-  # Expects `driver` to be of format "cloud docker-org-name/builder-name"
-
-  def create
-    docker :buildx, :create, "--driver", driver
-  end
-
-  def remove
-    docker :buildx, :rm, builder_name
-  end
-
-  private
-    def builder_name
-      driver.gsub(/[ \/]/, "-")
-    end
-
-    def inspect_buildx
-      pipe \
-        docker(:buildx, :inspect, builder_name),
-        grep("-q", "Endpoint:.*cloud://.*")
-    end
-end
--- a/lib/kamal/commands/registry.rb
+++ b/lib/kamal/commands/registry.rb
@@ -1,16 +1,14 @@
 class Kamal::Commands::Registry < Kamal::Commands::Base
-  def login(registry_config: nil)
-    registry_config ||= config.registry
+  delegate :registry, to: :config

+  def login
    docker :login,
-      registry_config.server,
-      "-u", sensitive(Kamal::Utils.escape_shell_value(registry_config.username)),
-      "-p", sensitive(Kamal::Utils.escape_shell_value(registry_config.password))
+      registry.server,
+      "-u", sensitive(Kamal::Utils.escape_shell_value(registry.username)),
+      "-p", sensitive(Kamal::Utils.escape_shell_value(registry.password))
  end

-  def logout(registry_config: nil)
-    registry_config ||= config.registry
-
-    docker :logout, registry_config.server
+  def logout
+    docker :logout, registry.server
  end
 end
--- a/lib/kamal/configuration.rb
+++ b/lib/kamal/configuration.rb
@@ -14,15 +14,12 @@ class Kamal::Configuration

  include Validation

-  PROXY_MINIMUM_VERSION = "v0.8.4"
+  PROXY_MINIMUM_VERSION = "v0.6.0"
  PROXY_HTTP_PORT = 80
  PROXY_HTTPS_PORT = 443
-  PROXY_LOG_MAX_SIZE = "10m"

  class << self
    def create_from(config_file:, destination: nil, version: nil)
-      ENV["KAMAL_DESTINATION"] = destination
-
      raw_config = load_config_files(config_file, *destination_config_file(config_file, destination))

      new raw_config, destination: destination, version: version
@@ -37,7 +34,7 @@ class Kamal::Configuration
        if file.exist?
          # Newer Psych doesn't load aliases by default
          load_method = YAML.respond_to?(:unsafe_load) ? :unsafe_load : :load
-          YAML.send(load_method, ERB.new(File.read(file)).result).symbolize_keys
+          YAML.send(load_method, ERB.new(IO.read(file)).result).symbolize_keys
        else
          raise "Configuration file not found in #{file}"
        end
@@ -59,7 +56,7 @@ class Kamal::Configuration

    # Eager load config to validate it, these are first as they have dependencies later on
    @servers = Servers.new(config: self)
-    @registry = Registry.new(config: @raw_config, secrets: secrets)
+    @registry = Registry.new(config: self)

    @accessories = @raw_config.accessories&.keys&.collect { |name| Accessory.new(name, config: self) } || []
    @aliases = @raw_config.aliases&.keys&.to_h { |name| [ name, Alias.new(name, config: self) ] } || {}
@@ -82,6 +79,7 @@ class Kamal::Configuration
    ensure_unique_hosts_for_ssl_roles
  end

+
  def version=(version)
    @declared_version = version
  end
@@ -105,6 +103,7 @@ class Kamal::Configuration
    raw_config.minimum_version
  end

+
  def roles
    servers.roles
  end
@@ -117,6 +116,7 @@ class Kamal::Configuration
    accessories.detect { |a| a.name == name.to_s }
  end

+
  def all_hosts
    (roles + accessories).flat_map(&:hosts).uniq
  end
@@ -177,6 +177,7 @@ class Kamal::Configuration
    raw_config.retain_containers || 5
  end

+
  def volume_args
    if raw_config.volumes.present?
      argumentize "--volume", raw_config.volumes
@@ -189,6 +190,7 @@ class Kamal::Configuration
    logging.args
  end

+
  def readiness_delay
    raw_config.readiness_delay || 7
  end
@@ -201,6 +203,7 @@ class Kamal::Configuration
    raw_config.drain_timeout || 30
  end

+
  def run_directory
    ".kamal"
  end
@@ -221,6 +224,7 @@ class Kamal::Configuration
    File.join app_directory, "assets"
  end

+
  def hooks_path
    raw_config.hooks_path || ".kamal/hooks"
  end
@@ -229,6 +233,7 @@ class Kamal::Configuration
    raw_config.asset_path
  end

+
  def env_tags
    @env_tags ||= if (tags = raw_config.env["tags"])
      tags.collect { |name, config| Env::Tag.new(name, config: config, secrets: secrets) }
@@ -241,24 +246,12 @@ class Kamal::Configuration
    env_tags.detect { |t| t.name == name.to_s }
  end

-  def proxy_publish_args(http_port, https_port, bind_ips = nil)
-    ensure_valid_bind_ips(bind_ips)
-
-    (bind_ips || [ nil ]).map do |bind_ip|
-      bind_ip = format_bind_ip(bind_ip)
-      publish_http = [ bind_ip, http_port, PROXY_HTTP_PORT ].compact.join(":")
-      publish_https = [ bind_ip, https_port, PROXY_HTTPS_PORT ].compact.join(":")
-
-      argumentize "--publish", [ publish_http, publish_https ]
-    end.join(" ")
-  end
-
-  def proxy_logging_args(max_size)
-    argumentize "--log-opt", "max-size=#{max_size}" if max_size.present?
+  def proxy_publish_args(http_port, https_port)
+    argumentize "--publish", [ "#{http_port}:#{PROXY_HTTP_PORT}", "#{https_port}:#{PROXY_HTTPS_PORT}" ]
  end

  def proxy_options_default
-    [ *proxy_publish_args(PROXY_HTTP_PORT, PROXY_HTTPS_PORT), *proxy_logging_args(PROXY_LOG_MAX_SIZE) ]
+    proxy_publish_args PROXY_HTTP_PORT, PROXY_HTTPS_PORT
  end

  def proxy_image
@@ -277,6 +270,7 @@ class Kamal::Configuration
    File.join proxy_directory, "options"
  end

+
  def to_h
    {
      roles: role_names,
@@ -343,15 +337,6 @@ class Kamal::Configuration
      true
    end

-    def ensure_valid_bind_ips(bind_ips)
-      bind_ips.present? && bind_ips.each do |ip|
-        next if ip =~ Resolv::IPv4::Regex || ip =~ Resolv::IPv6::Regex
-        raise ArgumentError, "Invalid publish IP address: #{ip}"
-      end
-
-      true
-    end
-
    def ensure_retain_containers_valid
      raise Kamal::ConfigurationError, "Must retain at least 1 container" if retain_containers < 1

@@ -375,7 +360,7 @@ class Kamal::Configuration
    end

    def ensure_unique_hosts_for_ssl_roles
-      hosts = roles.select(&:ssl?).flat_map { |role| role.proxy.hosts }
+      hosts = roles.select(&:ssl?).map { |role| role.proxy.host }
      duplicates = hosts.tally.filter_map { |host, count| host if count > 1 }

      raise Kamal::ConfigurationError, "Different roles can't share the same host for SSL: #{duplicates.join(", ")}" if duplicates.any?
@@ -383,15 +368,6 @@ class Kamal::Configuration
      true
    end

-    def format_bind_ip(ip)
-      # Ensure IPv6 address inside square brackets - e.g. [::1]
-      if ip =~ Resolv::IPv6::Regex && ip !~ /\[.*\]/
-        "[#{ip}]"
-      else
-        ip
-      end
-    end
-
    def role_names
      raw_config.servers.is_a?(Array) ? [ "web" ] : raw_config.servers.keys.sort
    end
--- a/lib/kamal/configuration/accessory.rb
+++ b/lib/kamal/configuration/accessory.rb
@@ -1,11 +1,9 @@
 class Kamal::Configuration::Accessory
  include Kamal::Configuration::Validation

-  DEFAULT_NETWORK = "kamal"
-
  delegate :argumentize, :optionize, to: Kamal::Utils

-  attr_reader :name, :env, :proxy, :registry
+  attr_reader :name, :accessory_config, :env

  def initialize(name, config:)
    @name, @config, @accessory_config = name.inquiry, config, config.raw_config["accessories"][name]
@@ -16,11 +14,10 @@ class Kamal::Configuration::Accessory
      context: "accessories/#{name}",
      with: Kamal::Configuration::Validator::Accessory

-    ensure_valid_roles
-
-    @env = initialize_env
-    @proxy = initialize_proxy if running_proxy?
-    @registry = initialize_registry if accessory_config["registry"].present?
+    @env = Kamal::Configuration::Env.new \
+      config: accessory_config.fetch("env", {}),
+      secrets: config.secrets,
+      context: "accessories/#{name}/env"
  end

  def service_name
@@ -28,7 +25,7 @@ class Kamal::Configuration::Accessory
  end

  def image
-    [ registry&.server, accessory_config["image"] ].compact.join("/")
+    accessory_config["image"]
  end

  def hosts
@@ -41,10 +38,6 @@ class Kamal::Configuration::Accessory
    end
  end

-  def network_args
-    argumentize "--network", network
-  end
-
  def publish_args
    argumentize "--publish", port if port
  end
@@ -107,33 +100,8 @@ class Kamal::Configuration::Accessory
    accessory_config["cmd"]
  end

-  def running_proxy?
-    accessory_config["proxy"].present?
-  end
-
  private
-    attr_reader :config, :accessory_config
-
-    def initialize_env
-      Kamal::Configuration::Env.new \
-        config: accessory_config.fetch("env", {}),
-        secrets: config.secrets,
-        context: "accessories/#{name}/env"
-    end
-
-    def initialize_proxy
-      Kamal::Configuration::Proxy.new \
-        config: config,
-        proxy_config: accessory_config["proxy"],
-        context: "accessories/#{name}/proxy"
-    end
-
-    def initialize_registry
-      Kamal::Configuration::Registry.new \
-        config: accessory_config,
-        secrets: config.secrets,
-        context: "accessories/#{name}/registry"
-    end
+    attr_accessor :config

    def default_labels
      { "service" => service_name }
@@ -155,7 +123,7 @@ class Kamal::Configuration::Accessory
    end

    def read_dynamic_file(local_file)
-      StringIO.new(ERB.new(File.read(local_file)).result)
+      StringIO.new(ERB.new(IO.read(local_file)).result)
    end

    def expand_remote_file(remote_file)
@@ -202,17 +170,7 @@ class Kamal::Configuration::Accessory

    def hosts_from_roles
      if accessory_config.key?("roles")
-        accessory_config["roles"].flat_map { |role| config.role(role)&.hosts }
-      end
-    end
-
-    def network
-      accessory_config["network"] || DEFAULT_NETWORK
-    end
-
-    def ensure_valid_roles
-      if accessory_config["roles"] && (missing_roles = accessory_config["roles"] - config.roles.map(&:name)).any?
-        raise Kamal::ConfigurationError, "accessories/#{name}: unknown roles #{missing_roles.join(", ")}"
+        accessory_config["roles"].flat_map { |role| config.role(role).hosts }
      end
    end
 end
--- a/lib/kamal/configuration/builder.rb
+++ b/lib/kamal/configuration/builder.rb
@@ -53,10 +53,6 @@ class Kamal::Configuration::Builder
    !local_disabled? && (arches.empty? || local_arches.any?)
  end

-  def cloud?
-    driver.start_with? "cloud"
-  end
-
  def cached?
    !!builder_config["cache"]
  end
@@ -115,14 +111,6 @@ class Kamal::Configuration::Builder
    builder_config["ssh"]
  end

-  def provenance
-    builder_config["provenance"]
-  end
-
-  def sbom
-    builder_config["sbom"]
-  end
-
  def git_clone?
    Kamal::Git.used? && builder_config["context"].nil?
  end
@@ -178,7 +166,7 @@ class Kamal::Configuration::Builder
    end

    def cache_to_config_for_registry
-      [ "type=registry", "ref=#{cache_image_ref}", builder_config["cache"]&.fetch("options", nil) ].compact.join(",")
+      [ "type=registry", builder_config["cache"]&.fetch("options", nil), "ref=#{cache_image_ref}" ].compact.join(",")
    end

    def repo_basename
--- a/lib/kamal/configuration/docs/accessory.yml
+++ b/lib/kamal/configuration/docs/accessory.yml
@@ -23,27 +23,9 @@ accessories:

    # Image
    #
-    # The Docker image to use.
-    # Prefix it with its server when using root level registry different from Docker Hub.
-    # Define registry directly or via anchors when it differs from root level registry.
+    # The Docker image to use, prefix it with a registry if not using Docker Hub:
    image: mysql:8.0

-    # Registry
-    #
-    # By default accessories use Docker Hub registry.
-    # You can specify different registry per accessory with this option.
-    # Don't prefix image with this registry server.
-    # Use anchors if you need to set the same specific registry for several accessories.
-    #
-    # ```yml
-    # registry:
-    #   <<: *specific-registry
-    # ```
-    #
-    # See kamal docs registry for more information:
-    registry:
-      ...
-
    # Accessory hosts
    #
    # Specify one of `host`, `hosts`, or `roles`:
@@ -61,8 +43,8 @@ accessories:

    # Port mappings
    #
-    # See [https://docs.docker.com/network/](https://docs.docker.com/network/), and
-    # especially note the warning about the security implications of exposing ports publicly.
+    # See https://docs.docker.com/network/, and especially note the warning about the security
+    # implications of exposing ports publicly.
    port: "127.0.0.1:3306:3306"

    # Labels
@@ -108,16 +90,3 @@ accessories:
    # They are not created or copied before mounting:
    volumes:
      - /path/to/mysql-logs:/var/log/mysql
-
-    # Network
-    #
-    # The network the accessory will be attached to.
-    #
-    # Defaults to kamal:
-    network: custom
-
-    # Proxy
-    #
-    # You can run your accessory behind the Kamal proxy. See kamal docs proxy for more information
-    proxy:
-      ...
--- a/lib/kamal/configuration/docs/alias.yml
+++ b/lib/kamal/configuration/docs/alias.yml
@@ -5,12 +5,12 @@
 # For example, for a Rails app, you might open a console with:
 #
 # ```shell
-# kamal app exec -i --reuse "bin/rails console"
+# kamal app exec -i -r console "rails console"
 # ```
 #
 # By defining an alias, like this:
 aliases:
-  console: app exec -i --reuse "bin/rails console"
+  console: app exec -r console -i "rails console"
 # You can now open the console with:
 #
 # ```shell
--- a/lib/kamal/configuration/docs/builder.yml
+++ b/lib/kamal/configuration/docs/builder.yml
@@ -102,18 +102,3 @@ builder:
  #
  # The build driver to use, defaults to `docker-container`:
  driver: docker
-  #
-  # If you want to use Docker Build Cloud (https://www.docker.com/products/build-cloud/), you can set the driver to:
-  driver: cloud org-name/builder-name
-
-  # Provenance
-  #
-  # It is used to configure provenance attestations for the build result.
-  # The value can also be a boolean to enable or disable provenance attestations.
-  provenance: mode=max
-
-  # SBOM (Software Bill of Materials)
-  #
-  # It is used to configure SBOM generation for the build result.
-  # The value can also be a boolean to enable or disable SBOM generation.
-  sbom: true
--- a/lib/kamal/configuration/docs/proxy.yml
+++ b/lib/kamal/configuration/docs/proxy.yml
@@ -17,19 +17,16 @@
 # `proxy: true` or providing a proxy configuration.
 proxy:

-  # Hosts
+  # Host
  #
  # The hosts that will be used to serve the app. The proxy will only route requests
  # to this host to your app.
  #
  # If no hosts are set, then all requests will be forwarded, except for matching
  # requests for other apps deployed on that server that do have a host set.
-  #
-  # Specify one of `host` or `hosts`.
  host: foo.example.com
-  hosts:
-    - foo.example.com
-    - bar.example.com
+  # If multiple hosts are needed, these can be specified by comma-separating the hosts.
+  host: foo.example.com,bar.example.com

  # App port
  #
@@ -46,22 +43,9 @@ proxy:
  # The host value must point to the server we are deploying to, and port 443 must be
  # open for the Let's Encrypt challenge to succeed.
  #
-  # If you set `ssl` to `true`, `kamal-proxy` will stop forwarding headers to your app,
-  # unless you explicitly set `forward_headers: true`
-  #
  # Defaults to `false`:
  ssl: true

-  # Forward headers
-  #
-  # Whether to forward the `X-Forwarded-For` and `X-Forwarded-Proto` headers.
-  #
-  # If you are behind a trusted proxy, you can set this to `true` to forward the headers.
-  #
-  # By default, kamal-proxy will not forward the headers if the `ssl` option is set to `true`, and
-  # will forward them if it is set to `false`.
-  forward_headers: true
-
  # Response timeout
  #
  # How long to wait for requests to complete before timing out, defaults to 30 seconds:
@@ -106,3 +90,13 @@ proxy:
    response_headers:
      - X-Request-ID
      - X-Request-Start
+
+  # Forward headers
+  #
+  # Whether to forward the `X-Forwarded-For` and `X-Forwarded-Proto` headers.
+  #
+  # If you are behind a trusted proxy, you can set this to `true` to forward the headers.
+  #
+  # By default, kamal-proxy will not forward the headers if the `ssl` option is set to `true`, and
+  # will forward them if it is set to `false`.
+  forward_headers: true
--- a/lib/kamal/configuration/docs/registry.yml
+++ b/lib/kamal/configuration/docs/registry.yml
@@ -2,10 +2,6 @@
 #
 # The default registry is Docker Hub, but you can change it using `registry/server`.
 #
-# By default, Docker Hub creates public repositories. To avoid making your images public,
-# set up a private repository before deploying, or change the default repository privacy
-# settings to private in your [Docker Hub settings](https://hub.docker.com/repository-settings/default-privacy).
-#
 # A reference to a secret (in this case, `DOCKER_REGISTRY_TOKEN`) will look up the secret
 # in the local environment:
 registry:
--- a/lib/kamal/configuration/docs/ssh.yml
+++ b/lib/kamal/configuration/docs/ssh.yml
@@ -61,10 +61,3 @@ ssh:
  # An array of strings, with each element of the array being
  # a raw private key in PEM format.
  key_data: [ "-----BEGIN OPENSSH PRIVATE KEY-----" ]
-
-  # Config
-  #
-  # Set to true to load the default OpenSSH config files (~/.ssh/config,
-  # /etc/ssh_config), to false ignore config files, or to a file path
-  # (or array of paths) to load specific configuration. Defaults to true.
-  config: true
--- a/lib/kamal/configuration/proxy.rb
+++ b/lib/kamal/configuration/proxy.rb
@@ -22,14 +22,14 @@ class Kamal::Configuration::Proxy
    proxy_config.fetch("ssl", false)
  end

-  def hosts
-    proxy_config["hosts"] || proxy_config["host"]&.split(",") || []
+  def host
+    proxy_config["host"]
  end

  def deploy_options
    {
-      host: hosts,
-      tls: proxy_config["ssl"].presence,
+      host: proxy_config["host"],
+      tls: proxy_config["ssl"] ? true : nil,
      "deploy-timeout": seconds_duration(config.deploy_timeout),
      "drain-timeout": seconds_duration(config.drain_timeout),
      "health-check-interval": seconds_duration(proxy_config.dig("healthcheck", "interval")),
@@ -48,7 +48,11 @@ class Kamal::Configuration::Proxy
  end

  def deploy_command_args(target:)
-    optionize ({ target: "#{target}:#{app_port}" }).merge(deploy_options), with: "="
+    optionize ({ target: "#{target}:#{app_port}" }).merge(deploy_options)
+  end
+
+  def remove_command_args(target:)
+    optionize({ target: "#{target}:#{app_port}" })
  end

  def merge(other)
--- a/lib/kamal/configuration/registry.rb
+++ b/lib/kamal/configuration/registry.rb
@@ -1,10 +1,12 @@
 class Kamal::Configuration::Registry
  include Kamal::Configuration::Validation

-  def initialize(config:, secrets:, context: "registry")
-    @registry_config = config["registry"] || {}
-    @secrets = secrets
-    validate! registry_config, context: context, with: Kamal::Configuration::Validator::Registry
+  attr_reader :registry_config, :secrets
+
+  def initialize(config:)
+    @registry_config = config.raw_config.registry || {}
+    @secrets = config.secrets
+    validate! registry_config, with: Kamal::Configuration::Validator::Registry
  end

  def server
@@ -20,8 +22,6 @@ class Kamal::Configuration::Registry
  end

  private
-    attr_reader :registry_config, :secrets
-
    def lookup(key)
      if registry_config[key].is_a?(Array)
        secrets[registry_config[key].first]
--- a/lib/kamal/configuration/role.rb
+++ b/lib/kamal/configuration/role.rb
@@ -10,7 +10,7 @@ class Kamal::Configuration::Role
  def initialize(name, config:)
    @name, @config = name.inquiry, config
    validate! \
-      role_config,
+      specializations,
      example: validation_yml["servers"]["workers"],
      context: "servers/#{name}",
      with: Kamal::Configuration::Validator::Role
@@ -204,11 +204,11 @@ class Kamal::Configuration::Role
    end

    def specializations
-      @specializations ||= role_config.is_a?(Array) ? {} : role_config
-    end
-
-    def role_config
-      @role_config ||= config.raw_config.servers.is_a?(Array) ? {} : config.raw_config.servers[name]
+      if config.raw_config.servers.is_a?(Array) || config.raw_config.servers[name].is_a?(Array)
+        {}
+      else
+        config.raw_config.servers[name]
+      end
    end

    def custom_labels
--- a/lib/kamal/configuration/validator/proxy.rb
+++ b/lib/kamal/configuration/validator/proxy.rb
@@ -3,13 +3,9 @@ class Kamal::Configuration::Validator::Proxy < Kamal::Configuration::Validator
    unless config.nil?
      super

-      if config["host"].blank? && config["hosts"].blank? && config["ssl"]
+      if config["host"].blank? && config["ssl"]
        error "Must set a host to enable automatic SSL"
      end
-
-      if (config.keys & [ "host", "hosts" ]).size > 1
-        error "Specify one of 'host' or 'hosts', not both"
-      end
    end
  end
 end
--- a/lib/kamal/configuration/validator/role.rb
+++ b/lib/kamal/configuration/validator/role.rb
@@ -3,7 +3,7 @@ class Kamal::Configuration::Validator::Role < Kamal::Configuration::Validator
    validate_type! config, Array, Hash

    if config.is_a?(Array)
-      validate_servers!(config)
+      validate_servers! "servers", config
    else
      super
    end
--- a/lib/kamal/docker.rb
+++ b/lib/kamal/docker.rb
@@ -1,30 +0,0 @@
-require "tempfile"
-require "open3"
-
-module Kamal::Docker
-  extend self
-  BUILD_CHECK_TAG = "kamal-local-build-check"
-
-  def included_files
-    Tempfile.create do |dockerfile|
-      dockerfile.write(<<~DOCKERFILE)
-        FROM busybox
-        COPY . app
-        WORKDIR app
-        CMD find . -type f | sed "s|^\./||"
-      DOCKERFILE
-      dockerfile.close
-
-      cmd = "docker buildx build -t=#{BUILD_CHECK_TAG} -f=#{dockerfile.path} ."
-      system(cmd) || raise("failed to build check image")
-    end
-
-    cmd = "docker run --rm #{BUILD_CHECK_TAG}"
-    out, err, status = Open3.capture3(cmd)
-    unless status
-      raise "failed to run check image:\n#{err}"
-    end
-
-    out.lines.map(&:strip)
-  end
-end
--- a/lib/kamal/env_file.rb
+++ b/lib/kamal/env_file.rb
@@ -37,8 +37,6 @@ class Kamal::EnvFile
    def escape_docker_env_file_ascii_value(value)
      # Doublequotes are treated literally in docker env files
      # so remove leading and trailing ones and unescape any others
-      value.to_s.dump[1..-2]
-        .gsub(/\\"/, "\"")
-        .gsub(/\\#/, "#")
+      value.to_s.dump[1..-2].gsub(/\\"/, "\"")
    end
 end
--- a/lib/kamal/git.rb
+++ b/lib/kamal/git.rb
@@ -24,14 +24,4 @@ module Kamal::Git
  def root
    `git rev-parse --show-toplevel`.strip
  end
-
-  # returns an array of relative path names of files with uncommitted changes
-  def uncommitted_files
-    `git ls-files --modified`.lines.map(&:strip)
-  end
-
-  # returns an array of relative path names of untracked files, including gitignored files
-  def untracked_files
-    `git ls-files --others`.lines.map(&:strip)
-  end
 end
--- a/lib/kamal/secrets.rb
+++ b/lib/kamal/secrets.rb
@@ -1,10 +1,13 @@
 require "dotenv"

 class Kamal::Secrets
+  attr_reader :secrets_files
+
  Kamal::Secrets::Dotenv::InlineCommandSubstitution.install!

  def initialize(destination: nil)
-    @destination = destination
+    @secrets_files = \
+      [ ".kamal/secrets-common", ".kamal/secrets#{(".#{destination}" if destination)}" ].select { |f| File.exist?(f) }
    @mutex = Mutex.new
  end

@@ -14,10 +17,10 @@ class Kamal::Secrets
      secrets.fetch(key)
    end
  rescue KeyError
-    if secrets_files.present?
+    if secrets_files
      raise Kamal::ConfigurationError, "Secret '#{key}' not found in #{secrets_files.join(", ")}"
    else
-      raise Kamal::ConfigurationError, "Secret '#{key}' not found, no secret files (#{secrets_filenames.join(", ")}) provided"
+      raise Kamal::ConfigurationError, "Secret '#{key}' not found, no secret files provided"
    end
  end

@@ -25,18 +28,10 @@ class Kamal::Secrets
    secrets
  end

-  def secrets_files
-    @secrets_files ||= secrets_filenames.select { |f| File.exist?(f) }
-  end
-
  private
    def secrets
      @secrets ||= secrets_files.inject({}) do |secrets, secrets_file|
-        secrets.merge!(::Dotenv.parse(secrets_file, overwrite: true))
+        secrets.merge!(::Dotenv.parse(secrets_file))
      end
    end
-
-    def secrets_filenames
-      [ ".kamal/secrets-common", ".kamal/secrets#{(".#{@destination}" if @destination)}" ]
-    end
 end
--- a/lib/kamal/secrets/adapters.rb
+++ b/lib/kamal/secrets/adapters.rb
@@ -3,8 +3,6 @@ module Kamal::Secrets::Adapters
  def self.lookup(name)
    name = "one_password" if name.downcase == "1password"
    name = "last_pass" if name.downcase == "lastpass"
-    name = "gcp_secret_manager" if name.downcase == "gcp"
-    name = "bitwarden_secrets_manager" if name.downcase == "bitwarden-sm"
    adapter_class(name)
  end

--- a/lib/kamal/secrets/adapters/aws_secrets_manager.rb
+++ b/lib/kamal/secrets/adapters/aws_secrets_manager.rb
@@ -1,50 +0,0 @@
-class Kamal::Secrets::Adapters::AwsSecretsManager < Kamal::Secrets::Adapters::Base
-  def requires_account?
-    false
-  end
-
-  private
-    def login(_account)
-      nil
-    end
-
-    def fetch_secrets(secrets, from:, account: nil, session:)
-      {}.tap do |results|
-        get_from_secrets_manager(prefixed_secrets(secrets, from: from), account: account).each do |secret|
-          secret_name = secret["Name"]
-          secret_string = JSON.parse(secret["SecretString"])
-
-          secret_string.each do |key, value|
-            results["#{secret_name}/#{key}"] = value
-          end
-        rescue JSON::ParserError
-          results["#{secret_name}"] = secret["SecretString"]
-        end
-      end
-    end
-
-    def get_from_secrets_manager(secrets, account: nil)
-      args = [ "aws", "secretsmanager", "batch-get-secret-value", "--secret-id-list" ] + secrets.map(&:shellescape)
-      args += [ "--profile", account.shellescape ] if account
-      cmd = args.join(" ")
-
-      `#{cmd}`.tap do |secrets|
-        raise RuntimeError, "Could not read #{secrets} from AWS Secrets Manager" unless $?.success?
-
-        secrets = JSON.parse(secrets)
-
-        return secrets["SecretValues"] unless secrets["Errors"].present?
-
-        raise RuntimeError, secrets["Errors"].map { |error| "#{error['SecretId']}: #{error['Message']}" }.join(" ")
-      end
-    end
-
-    def check_dependencies!
-      raise RuntimeError, "AWS CLI is not installed" unless cli_installed?
-    end
-
-    def cli_installed?
-      `aws --version 2> /dev/null`
-      $?.success?
-    end
-end
--- a/lib/kamal/secrets/adapters/base.rb
+++ b/lib/kamal/secrets/adapters/base.rb
@@ -1,17 +1,10 @@
 class Kamal::Secrets::Adapters::Base
  delegate :optionize, to: Kamal::Utils

-  def fetch(secrets, account: nil, from: nil)
-    raise RuntimeError, "Missing required option '--account'" if requires_account? && account.blank?
-
-    check_dependencies!
-
+  def fetch(secrets, account:, from: nil)
    session = login(account)
-    fetch_secrets(secrets, from: from, account: account, session: session)
-  end
-
-  def requires_account?
-    true
+    full_secrets = secrets.map { |secret| [ from, secret ].compact.join("/") }
+    fetch_secrets(full_secrets, account: account, session: session)
  end

  private
@@ -22,12 +15,4 @@ class Kamal::Secrets::Adapters::Base
    def fetch_secrets(...)
      raise NotImplementedError
    end
-
-    def check_dependencies!
-      raise NotImplementedError
-    end
-
-    def prefixed_secrets(secrets, from:)
-      secrets.map { |secret| [ from, secret ].compact.join("/") }
-    end
 end
--- a/lib/kamal/secrets/adapters/bitwarden.rb
+++ b/lib/kamal/secrets/adapters/bitwarden.rb
@@ -21,35 +21,27 @@ class Kamal::Secrets::Adapters::Bitwarden < Kamal::Secrets::Adapters::Base
      session
    end

-    def fetch_secrets(secrets, from:, account:, session:)
+    def fetch_secrets(secrets, account:, session:)
      {}.tap do |results|
-        items_fields(prefixed_secrets(secrets, from: from)).each do |item, fields|
+        items_fields(secrets).each do |item, fields|
          item_json = run_command("get item #{item.shellescape}", session: session, raw: true)
-          raise RuntimeError, "Could not read #{item} from Bitwarden" unless $?.success?
+          raise RuntimeError, "Could not read #{secret} from Bitwarden" unless $?.success?
          item_json = JSON.parse(item_json)
+
          if fields.any?
-            results.merge! fetch_secrets_from_fields(fields, item, item_json)
-          elsif item_json.dig("login", "password")
-            results[item] = item_json.dig("login", "password")
-          elsif item_json["fields"]&.any?
-            fields = item_json["fields"].pluck("name")
-            results.merge! fetch_secrets_from_fields(fields, item, item_json)
+            fields.each do |field|
+              item_field = item_json["fields"].find { |f| f["name"] == field }
+              raise RuntimeError, "Could not find field #{field} in item #{item} in Bitwarden" unless item_field
+              value = item_field["value"]
+              results["#{item}/#{field}"] = value
+            end
          else
-            raise RuntimeError, "Item #{item} is not a login type item and no fields were specified"
+            results[item] = item_json["login"]["password"]
          end
        end
      end
    end

-    def fetch_secrets_from_fields(fields, item, item_json)
-      fields.to_h do |field|
-        item_field = item_json["fields"].find { |f| f["name"] == field }
-        raise RuntimeError, "Could not find field #{field} in item #{item} in Bitwarden" unless item_field
-        value = item_field["value"]
-        [ "#{item}/#{field}", value ]
-      end
-    end
-
    def items_fields(secrets)
      {}.tap do |items|
        secrets.each do |secret|
@@ -69,13 +61,4 @@ class Kamal::Secrets::Adapters::Bitwarden < Kamal::Secrets::Adapters::Base
      result = `#{full_command}`.strip
      raw ? result : JSON.parse(result)
    end
-
-    def check_dependencies!
-      raise RuntimeError, "Bitwarden CLI is not installed" unless cli_installed?
-    end
-
-    def cli_installed?
-      `bw --version 2> /dev/null`
-      $?.success?
-    end
 end
--- a/lib/kamal/secrets/adapters/bitwarden_secrets_manager.rb
+++ b/lib/kamal/secrets/adapters/bitwarden_secrets_manager.rb
@@ -1,72 +0,0 @@
-class Kamal::Secrets::Adapters::BitwardenSecretsManager < Kamal::Secrets::Adapters::Base
-  def requires_account?
-    false
-  end
-
-  private
-    LIST_ALL_SELECTOR = "all"
-    LIST_ALL_FROM_PROJECT_SUFFIX = "/all"
-    LIST_COMMAND = "secret list -o env"
-    GET_COMMAND = "secret get -o env"
-
-    def fetch_secrets(secrets, from:, account:, session:)
-      raise RuntimeError, "You must specify what to retrieve from Bitwarden Secrets Manager" if secrets.length == 0
-
-      secrets = prefixed_secrets(secrets, from: from)
-      command, project = extract_command_and_project(secrets)
-
-      {}.tap do |results|
-        if command.nil?
-          secrets.each do |secret_uuid|
-            secret = run_command("#{GET_COMMAND} #{secret_uuid.shellescape}")
-            raise RuntimeError, "Could not read #{secret_uuid} from Bitwarden Secrets Manager" unless $?.success?
-            key, value = parse_secret(secret)
-            results[key] = value
-          end
-        else
-          secrets = run_command(command)
-          raise RuntimeError, "Could not read secrets from Bitwarden Secrets Manager" unless $?.success?
-          secrets.split("\n").each do |secret|
-            key, value = parse_secret(secret)
-            results[key] = value
-          end
-        end
-      end
-    end
-
-    def extract_command_and_project(secrets)
-      if secrets.length == 1
-        if secrets[0] == LIST_ALL_SELECTOR
-          [ LIST_COMMAND, nil ]
-        elsif secrets[0].end_with?(LIST_ALL_FROM_PROJECT_SUFFIX)
-          project = secrets[0].split(LIST_ALL_FROM_PROJECT_SUFFIX).first
-          [ "#{LIST_COMMAND} #{project.shellescape}", project ]
-        end
-      end
-    end
-
-    def parse_secret(secret)
-      key, value = secret.split("=", 2)
-      value = value.gsub(/^"|"$/, "")
-      [ key, value ]
-    end
-
-    def run_command(command, session: nil)
-      full_command = [ "bws", command ].join(" ")
-      `#{full_command}`
-    end
-
-    def login(account)
-      run_command("run 'echo OK'")
-      raise RuntimeError, "Could not authenticate to Bitwarden Secrets Manager. Did you set a valid access token?" unless $?.success?
-    end
-
-    def check_dependencies!
-      raise RuntimeError, "Bitwarden Secrets Manager CLI is not installed" unless cli_installed?
-    end
-
-    def cli_installed?
-      `bws --version 2> /dev/null`
-      $?.success?
-    end
-end
--- a/lib/kamal/secrets/adapters/doppler.rb
+++ b/lib/kamal/secrets/adapters/doppler.rb
@@ -1,57 +0,0 @@
-class Kamal::Secrets::Adapters::Doppler < Kamal::Secrets::Adapters::Base
-  def requires_account?
-    false
-  end
-
-  private
-    def login(*)
-      unless loggedin?
-        `doppler login -y`
-        raise RuntimeError, "Failed to login to Doppler" unless $?.success?
-      end
-    end
-
-    def loggedin?
-      `doppler me --json 2> /dev/null`
-      $?.success?
-    end
-
-    def fetch_secrets(secrets, from:, **)
-      secrets = prefixed_secrets(secrets, from: from)
-      flags = secrets_get_flags(secrets)
-
-      secret_names = secrets.collect { |s| s.split("/").last }
-
-      items = `doppler secrets get #{secret_names.map(&:shellescape).join(" ")} --json #{flags}`
-      raise RuntimeError, "Could not read #{secrets} from Doppler" unless $?.success?
-
-      items = JSON.parse(items)
-
-      items.transform_values { |value| value["computed"] }
-    end
-
-    def secrets_get_flags(secrets)
-      unless service_token_set?
-        project, config, _ = secrets.first.split("/")
-
-        unless project && config
-          raise RuntimeError, "Missing project or config from '--from=project/config' option"
-        end
-
-        project_and_config_flags = "-p #{project.shellescape} -c #{config.shellescape}"
-      end
-    end
-
-    def service_token_set?
-      ENV["DOPPLER_TOKEN"] && ENV["DOPPLER_TOKEN"][0, 5] == "dp.st"
-    end
-
-    def check_dependencies!
-      raise RuntimeError, "Doppler CLI is not installed" unless cli_installed?
-    end
-
-    def cli_installed?
-      `doppler --version 2> /dev/null`
-      $?.success?
-    end
-end
--- a/lib/kamal/secrets/adapters/enpass.rb
+++ b/lib/kamal/secrets/adapters/enpass.rb
@@ -1,71 +0,0 @@
-##
-# Enpass is different from most password managers, in a way that it's offline and doesn't need an account.
-#
-# Usage
-#
-# Fetch all password from FooBar item
-# `kamal secrets fetch --adapter enpass --from /Users/YOUR_USERNAME/Library/Containers/in.sinew.Enpass-Desktop/Data/Documents/Vaults/primary FooBar`
-#
-# Fetch only DB_PASSWORD from FooBar item
-# `kamal secrets fetch --adapter enpass --from /Users/YOUR_USERNAME/Library/Containers/in.sinew.Enpass-Desktop/Data/Documents/Vaults/primary FooBar/DB_PASSWORD`
-class Kamal::Secrets::Adapters::Enpass < Kamal::Secrets::Adapters::Base
-  def requires_account?
-    false
-  end
-
-  private
-    def fetch_secrets(secrets, from:, account:, session:)
-      secrets_titles = fetch_secret_titles(secrets)
-
-      result = `enpass-cli -json -vault #{from.shellescape} show #{secrets_titles.map(&:shellescape).join(" ")}`.strip
-
-      parse_result_and_take_secrets(result, secrets)
-    end
-
-    def check_dependencies!
-      raise RuntimeError, "Enpass CLI is not installed" unless cli_installed?
-    end
-
-    def cli_installed?
-      `enpass-cli version 2> /dev/null`
-      $?.success?
-    end
-
-    def login(account)
-      nil
-    end
-
-    def fetch_secret_titles(secrets)
-      secrets.reduce(Set.new) do |secret_titles, secret|
-        # Sometimes secrets contain a '/', when the intent is to fetch a single password for an item. Example: FooBar/DB_PASSWORD
-        # Another case is, when the intent is to fetch all passwords for an item. Example: FooBar (and FooBar may have multiple different passwords)
-        key, separator, value = secret.rpartition("/")
-        if key.empty?
-          secret_titles << value
-        else
-          secret_titles << key
-        end
-      end.to_a
-    end
-
-    def parse_result_and_take_secrets(unparsed_result, secrets)
-      result = JSON.parse(unparsed_result)
-
-      result.reduce({}) do |secrets_with_passwords, item|
-        title = item["title"]
-        label = item["label"]
-        password = item["password"]
-
-        if title && password.present?
-          key = [ title, label ].compact.reject(&:empty?).join("/")
-
-          if secrets.include?(title) || secrets.include?(key)
-            raise RuntimeError, "#{key} is present more than once" if secrets_with_passwords[key]
-            secrets_with_passwords[key] = password
-          end
-        end
-
-        secrets_with_passwords
-      end
-    end
-end
--- a/lib/kamal/secrets/adapters/gcp_secret_manager.rb
+++ b/lib/kamal/secrets/adapters/gcp_secret_manager.rb
@@ -1,112 +0,0 @@
-class Kamal::Secrets::Adapters::GcpSecretManager < Kamal::Secrets::Adapters::Base
-  private
-    def login(account)
-      # Since only the account option is passed from the cli, we'll use it for both account and service account
-      # impersonation.
-      #
-      # Syntax:
-      # ACCOUNT: USER | USER "|" DELEGATION_CHAIN
-      # USER: DEFAULT_USER | EMAIL
-      # DELEGATION_CHAIN: EMAIL | EMAIL "," DELEGATION_CHAIN
-      # EMAIL: <The email address of the user or service account, like "my-user@example.com" >
-      # DEFAULT_USER: "default"
-      #
-      # Some valid examples:
-      # - "my-user@example.com" sets the user
-      # - "my-user@example.com|my-service-user@example.com" will use my-user and enable service account impersonation as my-service-user
-      # - "default" will use the default user and no impersonation
-      # - "default|my-service-user@example.com" will use the default user, and enable service account impersonation as my-service-user
-      # - "default|my-service-user@example.com,another-service-user@example.com" same as above, but with an impersonation delegation chain
-
-      unless logged_in?
-        `gcloud auth login`
-        raise RuntimeError, "could not login to gcloud" unless logged_in?
-      end
-
-      nil
-    end
-
-    def fetch_secrets(secrets, from:, account:, session:)
-      user, service_account = parse_account(account)
-
-      {}.tap do |results|
-        secrets_with_metadata(prefixed_secrets(secrets, from: from)).each do |secret, (project, secret_name, secret_version)|
-          item_name = "#{project}/#{secret_name}"
-          results[item_name] = fetch_secret(project, secret_name, secret_version, user, service_account)
-          raise RuntimeError, "Could not read #{item_name} from Google Secret Manager" unless $?.success?
-        end
-      end
-    end
-
-    def fetch_secret(project, secret_name, secret_version, user, service_account)
-      secret = run_command(
-        "secrets versions access #{secret_version.shellescape} --secret=#{secret_name.shellescape}",
-        project: project,
-        user: user,
-        service_account: service_account
-      )
-      Base64.decode64(secret.dig("payload", "data"))
-    end
-
-    # The secret needs to at least contain a secret name, but project name, and secret version can also be specified.
-    #
-    # The string "default" can be used to refer to the default project configured for gcloud.
-    #
-    # The version can be either the string "latest", or a version number.
-    #
-    # The following formats are valid:
-    #
-    # - The following are all equivalent, and sets project: default, secret name: my-secret, version: latest
-    #   - "my-secret"
-    #   - "default/my-secret"
-    #   - "default/my-secret/latest"
-    #   - "my-secret/latest" in combination with --from=default
-    # - "my-secret/123" (only in combination with --from=some-project) -> project: some-project, secret name: my-secret, version: 123
-    # - "some-project/my-secret/123" -> project: some-project, secret name: my-secret, version: 123
-    def secrets_with_metadata(secrets)
-      {}.tap do |items|
-        secrets.each do |secret|
-          parts = secret.split("/")
-          parts.unshift("default") if parts.length == 1
-          project = parts.shift
-          secret_name = parts.shift
-          secret_version = parts.shift || "latest"
-
-          items[secret] = [ project, secret_name, secret_version ]
-        end
-      end
-    end
-
-    def run_command(command, project: "default", user: "default", service_account: nil)
-      full_command = [ "gcloud", command ]
-      full_command << "--project=#{project.shellescape}" unless project == "default"
-      full_command << "--account=#{user.shellescape}" unless user == "default"
-      full_command << "--impersonate-service-account=#{service_account.shellescape}" if service_account
-      full_command << "--format=json"
-      full_command = full_command.join(" ")
-
-      result = `#{full_command}`.strip
-      JSON.parse(result)
-    end
-
-    def check_dependencies!
-      raise RuntimeError, "gcloud CLI is not installed" unless cli_installed?
-    end
-
-    def cli_installed?
-      `gcloud --version 2> /dev/null`
-      $?.success?
-    end
-
-    def logged_in?
-      JSON.parse(`gcloud auth list --format=json`).any?
-    end
-
-    def parse_account(account)
-      account.split("|", 2)
-    end
-
-    def is_user?(candidate)
-      candidate.include?("@")
-    end
-end
--- a/lib/kamal/secrets/adapters/last_pass.rb
+++ b/lib/kamal/secrets/adapters/last_pass.rb
@@ -11,8 +11,7 @@ class Kamal::Secrets::Adapters::LastPass < Kamal::Secrets::Adapters::Base
      `lpass status --color never`.strip == "Logged in as #{account}."
    end

-    def fetch_secrets(secrets, from:, account:, session:)
-      secrets = prefixed_secrets(secrets, from: from)
+    def fetch_secrets(secrets, account:, session:)
      items = `lpass show #{secrets.map(&:shellescape).join(" ")} --json`
      raise RuntimeError, "Could not read #{secrets} from LastPass" unless $?.success?

@@ -24,17 +23,8 @@ class Kamal::Secrets::Adapters::LastPass < Kamal::Secrets::Adapters::Base
        end

        if (missing_items = secrets - results.keys).any?
-          raise RuntimeError, "Could not find #{missing_items.join(", ")} in LastPass"
+          raise RuntimeError, "Could not find #{missing_items.join(", ")} in LassPass"
        end
      end
    end
-
-    def check_dependencies!
-      raise RuntimeError, "LastPass CLI is not installed" unless cli_installed?
-    end
-
-    def cli_installed?
-      `lpass --version 2> /dev/null`
-      $?.success?
-    end
 end
--- a/lib/kamal/secrets/adapters/one_password.rb
+++ b/lib/kamal/secrets/adapters/one_password.rb
@@ -15,9 +15,9 @@ class Kamal::Secrets::Adapters::OnePassword < Kamal::Secrets::Adapters::Base
      $?.success?
    end

-    def fetch_secrets(secrets, from:, account:, session:)
+    def fetch_secrets(secrets, account:, session:)
      {}.tap do |results|
-        vaults_items_fields(prefixed_secrets(secrets, from: from)).map do |vault, items|
+        vaults_items_fields(secrets).map do |vault, items|
          items.each do |item, fields|
            fields_json = JSON.parse(op_item_get(vault, item, fields, account: account, session: session))
            fields_json = [ fields_json ] if fields.one?
@@ -58,13 +58,4 @@ class Kamal::Secrets::Adapters::OnePassword < Kamal::Secrets::Adapters::Base
        raise RuntimeError, "Could not read #{fields.join(", ")} from #{item} in the #{vault} 1Password vault" unless $?.success?
      end
    end
-
-    def check_dependencies!
-      raise RuntimeError, "1Password CLI is not installed" unless cli_installed?
-    end
-
-    def cli_installed?
-      `op --version 2> /dev/null`
-      $?.success?
-    end
 end
--- a/lib/kamal/secrets/adapters/test.rb
+++ b/lib/kamal/secrets/adapters/test.rb
@@ -4,11 +4,7 @@ class Kamal::Secrets::Adapters::Test < Kamal::Secrets::Adapters::Base
      true
    end

-    def fetch_secrets(secrets, from:, account:, session:)
-      prefixed_secrets(secrets, from: from).to_h { |secret| [ secret, secret.reverse ] }
-    end
-
-    def check_dependencies!
-      # no op
+    def fetch_secrets(secrets, account:, session:)
+      secrets.to_h { |secret| [ secret, secret.reverse ] }
    end
 end
--- a/lib/kamal/secrets/dotenv/inline_command_substitution.rb
+++ b/lib/kamal/secrets/dotenv/inline_command_substitution.rb
@@ -16,7 +16,7 @@ class Kamal::Secrets::Dotenv::InlineCommandSubstitution
        else
          if command =~ /\A\s*kamal\s*secrets\s+/
            # Inline the command
-            inline_secrets_command(command)
+            inline_secrets_command(command).shellescape
          else
            # Execute the command and return the value
            `#{command}`.chomp
--- a/lib/kamal/utils.rb
+++ b/lib/kamal/utils.rb
@@ -12,8 +12,6 @@ module Kamal::Utils
        attr = "#{key}=#{escape_shell_value(value)}"
        attr = self.sensitive(attr, redaction: "#{key}=[REDACTED]") if sensitive
        [ argument, attr ]
-      elsif value == false
-        [ argument, "#{key}=false" ]
      else
        [ argument, key ]
      end
--- a/lib/kamal/version.rb
+++ b/lib/kamal/version.rb
@@ -1,3 +1,3 @@
 module Kamal
-  VERSION = "2.5.0"
+  VERSION = "2.0.0"
 end
--- a/test/cli/accessory_test.rb
+++ b/test/cli/accessory_test.rb
@@ -14,8 +14,8 @@ class CliAccessoryTest < CliTestCase
    Kamal::Cli::Accessory.any_instance.expects(:upload).with("mysql")

    run_command("boot", "mysql").tap do |output|
-      assert_match "docker login private.registry -u [REDACTED] -p [REDACTED] on 1.1.1.3", output
-      assert_match "docker run --name app-mysql --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 3306:3306 --env MYSQL_ROOT_HOST=\"%\" --env-file .kamal/apps/app/env/accessories/mysql.env --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=\"app-mysql\" private.registry/mysql:5.7 on 1.1.1.3", output
+      assert_match /docker login.*on 1.1.1.3/, output
+      assert_match "docker run --name app-mysql --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 3306:3306 --env MYSQL_ROOT_HOST=\"%\" --env-file .kamal/apps/app/env/accessories/mysql.env --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=\"app-mysql\" mysql:5.7 on 1.1.1.3", output
    end
  end

@@ -24,21 +24,17 @@ class CliAccessoryTest < CliTestCase
    Kamal::Cli::Accessory.any_instance.expects(:upload).with("mysql")
    Kamal::Cli::Accessory.any_instance.expects(:directories).with("redis")
    Kamal::Cli::Accessory.any_instance.expects(:upload).with("redis")
-    Kamal::Cli::Accessory.any_instance.expects(:directories).with("busybox")
-    Kamal::Cli::Accessory.any_instance.expects(:upload).with("busybox")

    run_command("boot", "all").tap do |output|
-      assert_match "docker login private.registry -u [REDACTED] -p [REDACTED] on 1.1.1.3", output
-      assert_match "docker login private.registry -u [REDACTED] -p [REDACTED] on 1.1.1.1", output
-      assert_match "docker login private.registry -u [REDACTED] -p [REDACTED] on 1.1.1.2", output
-      assert_match "docker login other.registry -u [REDACTED] -p [REDACTED] on 1.1.1.3", output
+      assert_match /docker login.*on 1.1.1.3/, output
+      assert_match /docker login.*on 1.1.1.1/, output
+      assert_match /docker login.*on 1.1.1.2/, output
      assert_match /docker network create kamal.*on 1.1.1.1/, output
      assert_match /docker network create kamal.*on 1.1.1.2/, output
      assert_match /docker network create kamal.*on 1.1.1.3/, output
-      assert_match "docker run --name app-mysql --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 3306:3306 --env MYSQL_ROOT_HOST=\"%\" --env-file .kamal/apps/app/env/accessories/mysql.env --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=\"app-mysql\" private.registry/mysql:5.7 on 1.1.1.3", output
+      assert_match "docker run --name app-mysql --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 3306:3306 --env MYSQL_ROOT_HOST=\"%\" --env-file .kamal/apps/app/env/accessories/mysql.env --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=\"app-mysql\" mysql:5.7 on 1.1.1.3", output
      assert_match "docker run --name app-redis --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/apps/app/env/accessories/redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.1", output
      assert_match "docker run --name app-redis --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/apps/app/env/accessories/redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.2", output
-      assert_match "docker run --name custom-box --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --env-file .kamal/apps/app/env/accessories/busybox.env --label service=\"custom-box\" other.registry/busybox:latest on 1.1.1.3", output
    end
  end

@@ -64,16 +60,13 @@ class CliAccessoryTest < CliTestCase
  end

  test "reboot all" do
-    Kamal::Commands::Registry.any_instance.expects(:login).times(4)
+    Kamal::Commands::Registry.any_instance.expects(:login).times(3)
    Kamal::Cli::Accessory.any_instance.expects(:stop).with("mysql")
    Kamal::Cli::Accessory.any_instance.expects(:remove_container).with("mysql")
    Kamal::Cli::Accessory.any_instance.expects(:boot).with("mysql", prepare: false)
    Kamal::Cli::Accessory.any_instance.expects(:stop).with("redis")
    Kamal::Cli::Accessory.any_instance.expects(:remove_container).with("redis")
    Kamal::Cli::Accessory.any_instance.expects(:boot).with("redis", prepare: false)
-    Kamal::Cli::Accessory.any_instance.expects(:stop).with("busybox")
-    Kamal::Cli::Accessory.any_instance.expects(:remove_container).with("busybox")
-    Kamal::Cli::Accessory.any_instance.expects(:boot).with("busybox", prepare: false)

    run_command("reboot", "all")
  end
@@ -101,7 +94,7 @@ class CliAccessoryTest < CliTestCase
  end

  test "details with non-existent accessory" do
-    assert_equal "No accessory by the name of 'hello' (options: mysql, redis, and busybox)", stderred { run_command("details", "hello") }
+    assert_equal "No accessory by the name of 'hello' (options: mysql and redis)", stderred { run_command("details", "hello") }
  end

  test "details with all" do
@@ -187,10 +180,6 @@ class CliAccessoryTest < CliTestCase
    Kamal::Cli::Accessory.any_instance.expects(:remove_container).with("redis")
    Kamal::Cli::Accessory.any_instance.expects(:remove_image).with("redis")
    Kamal::Cli::Accessory.any_instance.expects(:remove_service_directory).with("redis")
-    Kamal::Cli::Accessory.any_instance.expects(:stop).with("busybox")
-    Kamal::Cli::Accessory.any_instance.expects(:remove_container).with("busybox")
-    Kamal::Cli::Accessory.any_instance.expects(:remove_image).with("busybox")
-    Kamal::Cli::Accessory.any_instance.expects(:remove_service_directory).with("busybox")

    run_command("remove", "all", "-y")
  end
@@ -200,7 +189,7 @@ class CliAccessoryTest < CliTestCase
  end

  test "remove_image" do
-    assert_match "docker image rm --force private.registry/mysql:5.7", run_command("remove_image", "mysql")
+    assert_match "docker image rm --force mysql", run_command("remove_image", "mysql")
  end

  test "remove_service_directory" do
@@ -212,8 +201,8 @@ class CliAccessoryTest < CliTestCase
    Kamal::Cli::Accessory.any_instance.expects(:upload).with("redis")

    run_command("boot", "redis", "--hosts", "1.1.1.1").tap do |output|
-      assert_match "docker login private.registry -u [REDACTED] -p [REDACTED] on 1.1.1.1", output
-      assert_no_match "docker login private.registry -u [REDACTED] -p [REDACTED] on 1.1.1.2", output
+      assert_match /docker login.*on 1.1.1.1/, output
+      assert_no_match /docker login.*on 1.1.1.2/, output
      assert_match "docker run --name app-redis --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/apps/app/env/accessories/redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.1", output
      assert_no_match "docker run --name app-redis --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/apps/app/env/accessories/redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.2", output
    end
@@ -224,8 +213,8 @@ class CliAccessoryTest < CliTestCase
    Kamal::Cli::Accessory.any_instance.expects(:upload).with("redis")

    run_command("boot", "redis", "--hosts", "1.1.1.1,1.1.1.3").tap do |output|
-      assert_match "docker login private.registry -u [REDACTED] -p [REDACTED] on 1.1.1.1", output
-      assert_no_match "docker login private.registry -u [REDACTED] -p [REDACTED] on 1.1.1.3", output
+      assert_match /docker login.*on 1.1.1.1/, output
+      assert_no_match /docker login.*on 1.1.1.3/, output
      assert_match "docker run --name app-redis --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/apps/app/env/accessories/redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.1", output
      assert_no_match "docker run --name app-redis --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 6379:6379 --env-file .kamal/apps/app/env/accessories/redis.env --volume $PWD/app-redis/data:/data --label service=\"app-redis\" redis:latest on 1.1.1.3", output
    end
@@ -236,7 +225,7 @@ class CliAccessoryTest < CliTestCase
      assert_match "Upgrading all accessories on 1.1.1.3,1.1.1.1,1.1.1.2...", output
      assert_match "docker network create kamal on 1.1.1.3", output
      assert_match "docker container stop app-mysql on 1.1.1.3", output
-      assert_match "docker run --name app-mysql --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 3306:3306 --env MYSQL_ROOT_HOST="%" --env-file .kamal/apps/app/env/accessories/mysql.env --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=\"app-mysql\" private.registry/mysql:5.7 on 1.1.1.3", output
+      assert_match "docker run --name app-mysql --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 3306:3306 --env MYSQL_ROOT_HOST="%" --env-file .kamal/apps/app/env/accessories/mysql.env --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=\"app-mysql\" mysql:5.7 on 1.1.1.3", output
      assert_match "Upgraded all accessories on 1.1.1.3,1.1.1.1,1.1.1.2...", output
    end
  end
@@ -246,13 +235,14 @@ class CliAccessoryTest < CliTestCase
      assert_match "Upgrading all accessories on 1.1.1.3...", output
      assert_match "docker network create kamal on 1.1.1.3", output
      assert_match "docker container stop app-mysql on 1.1.1.3", output
-      assert_match "docker run --name app-mysql --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 3306:3306 --env MYSQL_ROOT_HOST="%" --env-file .kamal/apps/app/env/accessories/mysql.env --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=\"app-mysql\" private.registry/mysql:5.7 on 1.1.1.3", output
+      assert_match "docker run --name app-mysql --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --publish 3306:3306 --env MYSQL_ROOT_HOST="%" --env-file .kamal/apps/app/env/accessories/mysql.env --volume $PWD/app-mysql/etc/mysql/my.cnf:/etc/mysql/my.cnf --volume $PWD/app-mysql/data:/var/lib/mysql --label service=\"app-mysql\" mysql:5.7 on 1.1.1.3", output
      assert_match "Upgraded all accessories on 1.1.1.3", output
    end
  end

+
  private
    def run_command(*command)
-      stdouted { Kamal::Cli::Accessory.start([ *command, "-c", "test/fixtures/deploy_with_accessories_with_different_registries.yml" ]) }
+      stdouted { Kamal::Cli::Accessory.start([ *command, "-c", "test/fixtures/deploy_with_accessories.yml" ]) }
    end
 end
--- a/test/cli/app_test.rb
+++ b/test/cli/app_test.rb
@@ -19,7 +19,7 @@ class CliAppTest < CliTestCase
      .returns("12345678") # running version

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-      .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
+      .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
      .returns("123") # old version

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
@@ -37,20 +37,13 @@ class CliAppTest < CliTestCase
  end

  test "boot uses group strategy when specified" do
-    Kamal::Cli::App.any_instance.stubs(:on).with("1.1.1.1").twice
-    Kamal::Cli::App.any_instance.stubs(:on).with([ "1.1.1.1", "1.1.1.2", "1.1.1.3", "1.1.1.4" ]).times(3)
+    Kamal::Cli::App.any_instance.stubs(:on).with("1.1.1.1").times(2) # ensure locks dir, acquire & release lock
+    Kamal::Cli::App.any_instance.stubs(:on).with([ "1.1.1.1" ]) # tag container

    # Strategy is used when booting the containers
-    Kamal::Cli::App.any_instance.expects(:on).with([ "1.1.1.1", "1.1.1.2", "1.1.1.3" ]).with_block_given
-    Kamal::Cli::App.any_instance.expects(:on).with([ "1.1.1.4" ]).with_block_given
-    Object.any_instance.expects(:sleep).with(2).twice
+    Kamal::Cli::App.any_instance.expects(:on).with([ "1.1.1.1" ], in: :groups, limit: 3, wait: 2).with_block_given

-    Kamal::Commands::Hook.any_instance.stubs(:hook_exists?).returns(true)
-
-    run_command("boot", config: :with_boot_strategy, host: nil).tap do |output|
-      assert_hook_ran "pre-app-boot", output, count: 2
-      assert_hook_ran "post-app-boot", output, count: 2
-    end
+    run_command("boot", config: :with_boot_strategy)
  end

  test "boot errors don't leave lock in place" do
@@ -70,7 +63,7 @@ class CliAppTest < CliTestCase
      .returns("12345678") # running version

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-      .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
+      .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
      .returns("123").twice # old version

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
@@ -80,7 +73,7 @@ class CliAppTest < CliTestCase
    run_command("boot", config: :with_assets).tap do |output|
      assert_match "docker tag dhh/app:latest dhh/app:latest", output
      assert_match "/usr/bin/env mkdir -p .kamal/apps/app/assets/volumes/web-latest ; cp -rnT .kamal/apps/app/assets/extracted/web-latest .kamal/apps/app/assets/volumes/web-latest ; cp -rnT .kamal/apps/app/assets/extracted/web-latest .kamal/apps/app/assets/volumes/web-123 || true ; cp -rnT .kamal/apps/app/assets/extracted/web-123 .kamal/apps/app/assets/volumes/web-latest || true", output
-      assert_match "/usr/bin/env mkdir -p .kamal/apps/app/assets/extracted/web-latest && docker container rm app-web-assets 2> /dev/null || true && docker container create --name app-web-assets dhh/app:latest && docker container cp -L app-web-assets:/public/assets/. .kamal/apps/app/assets/extracted/web-latest && docker container rm app-web-assets", output
+      assert_match "/usr/bin/env mkdir -p .kamal/apps/app/assets/extracted/web-latest && docker stop -t 1 app-web-assets 2> /dev/null || true && docker run --name app-web-assets --detach --rm --entrypoint sleep dhh/app:latest 1000000 && docker cp -L app-web-assets:/public/assets/. .kamal/apps/app/assets/extracted/web-latest && docker stop -t 1 app-web-assets", output
      assert_match /docker run --detach --restart unless-stopped --name app-web-latest --network kamal --hostname 1.1.1.1-[0-9a-f]{12} /, output
      assert_match "docker container ls --all --filter name=^app-web-123$ --quiet | xargs docker stop", output
      assert_match "/usr/bin/env find .kamal/apps/app/assets/extracted -maxdepth 1 -name 'web-*' ! -name web-latest -exec rm -rf \"{}\" + ; find .kamal/apps/app/assets/volumes -maxdepth 1 -name 'web-*' ! -name web-latest -exec rm -rf \"{}\" +", output
@@ -99,7 +92,7 @@ class CliAppTest < CliTestCase
      .returns("12345678") # running version

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-      .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
+      .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
      .returns("123") # old version

    run_command("boot", config: :with_env_tags).tap do |output|
@@ -137,7 +130,7 @@ class CliAppTest < CliTestCase
    SSHKit::Backend::Abstract.any_instance.stubs(:execute)
      .with(:docker, :container, :ls, "--all", "--filter", "name=^app-web-latest$", "--quiet", "|", :xargs, :docker, :stop, raise_on_non_zero_exit: false)
    SSHKit::Backend::Abstract.any_instance.expects(:execute)
-      .with(:docker, :exec, "kamal-proxy", "kamal-proxy", :deploy, "app-web", "--target=\"123:80\"", "--deploy-timeout=\"1s\"", "--drain-timeout=\"30s\"", "--buffer-requests", "--buffer-responses", "--log-request-header=\"Cache-Control\"", "--log-request-header=\"Last-Modified\"", "--log-request-header=\"User-Agent\"").raises(SSHKit::Command::Failed.new("Failed to deploy"))
+      .with(:docker, :exec, "kamal-proxy", "kamal-proxy", :deploy, "app-web", "--target", "\"123:80\"", "--deploy-timeout", "\"1s\"", "--drain-timeout", "\"30s\"", "--buffer-requests", "--buffer-responses", "--log-request-header", "\"Cache-Control\"", "--log-request-header", "\"Last-Modified\"", "--log-request-header", "\"User-Agent\"").raises(SSHKit::Command::Failed.new("Failed to deploy"))

    stderred do
      run_command("boot", config: :with_roles, host: nil, allow_execute_error: true).tap do |output|
@@ -197,23 +190,23 @@ class CliAppTest < CliTestCase

    run_command("start").tap do |output|
      assert_match "docker start app-web-999", output
-      assert_match "docker exec kamal-proxy kamal-proxy deploy app-web --target=\"999:80\" --deploy-timeout=\"30s\" --drain-timeout=\"30s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\"", output
+      assert_match "docker exec kamal-proxy kamal-proxy deploy app-web --target \"999:80\" --deploy-timeout \"30s\" --drain-timeout \"30s\" --buffer-requests --buffer-responses --log-request-header \"Cache-Control\" --log-request-header \"Last-Modified\"", output
    end
  end

  test "stop" do
    run_command("stop").tap do |output|
-      assert_match "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker stop", output
+      assert_match "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker stop", output
    end
  end

  test "stale_containers" do
    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-      .with(:docker, :ps, "--filter", "label=service=app", "--filter", "label=destination=", "--filter", "label=role=web", "--format", "\"{{.Names}}\"", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
+      .with(:docker, :ps, "--filter", "label=service=app", "--filter", "label=role=web", "--format", "\"{{.Names}}\"", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
      .returns("12345678\n87654321\n")

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-      .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
+      .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
      .returns("12345678\n")

    run_command("stale_containers").tap do |output|
@@ -223,11 +216,11 @@ class CliAppTest < CliTestCase

  test "stop stale_containers" do
    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-      .with(:docker, :ps, "--filter", "label=service=app", "--filter", "label=destination=", "--filter", "label=role=web", "--format", "\"{{.Names}}\"", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
+      .with(:docker, :ps, "--filter", "label=service=app", "--filter", "label=role=web", "--format", "\"{{.Names}}\"", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
      .returns("12345678\n87654321\n")

    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-      .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
+      .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
      .returns("12345678\n")

    run_command("stale_containers", "--stop").tap do |output|
@@ -238,13 +231,13 @@ class CliAppTest < CliTestCase

  test "details" do
    run_command("details").tap do |output|
-      assert_match "docker ps --filter label=service=app --filter label=destination= --filter label=role=web", output
+      assert_match "docker ps --filter label=service=app --filter label=role=web", output
    end
  end

  test "remove" do
    run_command("remove").tap do |output|
-      assert_match /#{Regexp.escape("sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker stop")}/, output
+      assert_match /#{Regexp.escape("sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker stop")}/, output
      assert_match /#{Regexp.escape("docker container prune --force --filter label=service=app")}/, output
      assert_match /#{Regexp.escape("docker image prune --all --force --filter label=service=app")}/, output
    end
@@ -270,50 +263,26 @@ class CliAppTest < CliTestCase

  test "exec" do
    run_command("exec", "ruby -v").tap do |output|
-      assert_match "docker run --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env --log-opt max-size=\"10m\" dhh/app:latest ruby -v", output
+      assert_match "docker run --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env dhh/app:latest ruby -v", output
    end
  end

  test "exec separate arguments" do
    run_command("exec", "ruby", " -v").tap do |output|
-      assert_match "docker run --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env --log-opt max-size=\"10m\" dhh/app:latest ruby -v", output
-    end
-  end
-
-  test "exec detach" do
-    run_command("exec", "--detach", "ruby -v").tap do |output|
-      assert_match "docker run --detach --network kamal --env-file .kamal/apps/app/env/roles/web.env --log-opt max-size=\"10m\" dhh/app:latest ruby -v", output
-    end
-  end
-
-  test "exec detach with reuse" do
-    assert_raises(ArgumentError, "Detach is not compatible with reuse") do
-      run_command("exec", "--detach", "--reuse", "ruby -v")
-    end
-  end
-
-  test "exec detach with interactive" do
-    assert_raises(ArgumentError, "Detach is not compatible with interactive") do
-      run_command("exec", "--interactive", "--detach", "ruby -v")
-    end
-  end
-
-  test "exec detach with interactive and reuse" do
-    assert_raises(ArgumentError, "Detach is not compatible with interactive or reuse") do
-      run_command("exec", "--interactive", "--detach", "--reuse", "ruby -v")
+      assert_match "docker run --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env dhh/app:latest ruby -v", output
    end
  end

  test "exec with reuse" do
    run_command("exec", "--reuse", "ruby -v").tap do |output|
-      assert_match "sh -c 'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | while read line; do echo ${line#app-web-}; done", output # Get current version
+      assert_match "sh -c 'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | while read line; do echo ${line#app-web-}; done", output # Get current version
      assert_match "docker exec app-web-999 ruby -v", output
    end
  end

  test "exec interactive" do
    SSHKit::Backend::Abstract.any_instance.expects(:exec)
-      .with("ssh -t root@1.1.1.1 -p 22 'docker run -it --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env --log-opt max-size=\"10m\" dhh/app:latest ruby -v'")
+      .with("ssh -t root@1.1.1.1 -p 22 'docker run -it --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env dhh/app:latest ruby -v'")
    run_command("exec", "-i", "ruby -v").tap do |output|
      assert_match "Get most recent version available as an image...", output
      assert_match "Launching interactive command with version latest via SSH from new container on 1.1.1.1...", output
@@ -325,7 +294,7 @@ class CliAppTest < CliTestCase
      .with("ssh -t root@1.1.1.1 -p 22 'docker exec -it app-web-999 ruby -v'")
    run_command("exec", "-i", "--reuse", "ruby -v").tap do |output|
      assert_match "Get current version of running container...", output
-      assert_match "Running /usr/bin/env sh -c 'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | while read line; do echo ${line#app-web-}; done on 1.1.1.1", output
+      assert_match "Running /usr/bin/env sh -c 'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | while read line; do echo ${line#app-web-}; done on 1.1.1.1", output
      assert_match "Launching interactive command with version 999 via SSH from existing container on 1.1.1.1...", output
    end
  end
@@ -344,55 +313,46 @@ class CliAppTest < CliTestCase

  test "logs" do
    SSHKit::Backend::Abstract.any_instance.stubs(:exec)
-      .with("ssh -t root@1.1.1.1 'sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1| xargs docker logs --timestamps --tail 10 2>&1'")
+      .with("ssh -t root@1.1.1.1 'sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1| xargs docker logs --timestamps --tail 10 2>&1'")

-    assert_match "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps --tail 100 2>&1", run_command("logs")
+    assert_match "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps --tail 100 2>&1", run_command("logs")

-    assert_match "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps 2>&1 | grep 'hey'", run_command("logs", "--grep", "hey")
+    assert_match "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps 2>&1 | grep 'hey'", run_command("logs", "--grep", "hey")

-    assert_match "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps 2>&1 | grep 'hey' -C 2", run_command("logs", "--grep", "hey", "--grep-options", "-C 2")
+    assert_match "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps 2>&1 | grep 'hey' -C 2", run_command("logs", "--grep", "hey", "--grep-options", "-C 2")
  end

  test "logs with follow" do
    SSHKit::Backend::Abstract.any_instance.stubs(:exec)
-      .with("ssh -t root@1.1.1.1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --tail 10 --follow 2>&1'")
+      .with("ssh -t root@1.1.1.1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --tail 10 --follow 2>&1'")

-    assert_match "sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --tail 10 --follow 2>&1", run_command("logs", "--follow")
-  end
-
-  test "logs with follow and container_id" do
-    SSHKit::Backend::Abstract.any_instance.stubs(:exec)
-      .with("ssh -t root@1.1.1.1 -p 22 'echo ID123 | xargs docker logs --timestamps --tail 10 --follow 2>&1'")
-
-    assert_match "echo ID123 | xargs docker logs --timestamps --tail 10 --follow 2>&1", run_command("logs", "--follow", "--container-id", "ID123")
+    assert_match "sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --tail 10 --follow 2>&1", run_command("logs", "--follow")
  end

  test "logs with follow and grep" do
    SSHKit::Backend::Abstract.any_instance.stubs(:exec)
-      .with("ssh -t root@1.1.1.1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --follow 2>&1 | grep \"hey\"'")
+      .with("ssh -t root@1.1.1.1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --follow 2>&1 | grep \"hey\"'")

-    assert_match "sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --follow 2>&1 | grep \"hey\"", run_command("logs", "--follow", "--grep", "hey")
+    assert_match "sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --follow 2>&1 | grep \"hey\"", run_command("logs", "--follow", "--grep", "hey")
  end

  test "logs with follow, grep and grep options" do
    SSHKit::Backend::Abstract.any_instance.stubs(:exec)
-      .with("ssh -t root@1.1.1.1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --follow 2>&1 | grep \"hey\" -C 2'")
+      .with("ssh -t root@1.1.1.1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --follow 2>&1 | grep \"hey\" -C 2'")

-    assert_match "sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --follow 2>&1 | grep \"hey\" -C 2", run_command("logs", "--follow", "--grep", "hey", "--grep-options", "-C 2")
+    assert_match "sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --follow 2>&1 | grep \"hey\" -C 2", run_command("logs", "--follow", "--grep", "hey", "--grep-options", "-C 2")
  end

  test "version" do
    run_command("version").tap do |output|
-      assert_match "sh -c 'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | while read line; do echo ${line#app-web-}; done", output
+      assert_match "sh -c 'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | while read line; do echo ${line#app-web-}; done", output
    end
  end


  test "version through main" do
-    with_argv([ "app", "version", "-c", "test/fixtures/deploy_with_accessories.yml", "--hosts", "1.1.1.1" ]) do
-      stdouted { Kamal::Cli::Main.start }.tap do |output|
-        assert_match "sh -c 'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | while read line; do echo ${line#app-web-}; done", output
-      end
+    stdouted { Kamal::Cli::Main.start([ "app", "version", "-c", "test/fixtures/deploy_with_accessories.yml", "--hosts", "1.1.1.1" ]) }.tap do |output|
+      assert_match "sh -c 'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | while read line; do echo ${line#app-web-}; done", output
    end
  end

@@ -423,7 +383,7 @@ class CliAppTest < CliTestCase
      assert_match /Renaming container .* to .* as already deployed on 1.1.1.1/, output # Rename
      assert_match /docker rename app-web-latest app-web-latest_replaced_[0-9a-f]{16}/, output
      assert_match /docker run --detach --restart unless-stopped --name app-web-latest --network kamal --hostname 1.1.1.1-[0-9a-f]{12} -e KAMAL_CONTAINER_NAME="app-web-latest" -e KAMAL_VERSION="latest" --env-file .kamal\/apps\/app\/env\/roles\/web.env --log-opt max-size="10m" --label service="app" --label role="web" --label destination dhh\/app:latest/, output
-      assert_match /docker exec kamal-proxy kamal-proxy deploy app-web --target="123:80"/, output
+      assert_match /docker exec kamal-proxy kamal-proxy deploy app-web --target "123:80"/, output
      assert_match "docker container ls --all --filter name=^app-web-123$ --quiet | xargs docker stop", output
    end
  end
@@ -432,8 +392,8 @@ class CliAppTest < CliTestCase
    SSHKit::Backend::Abstract.any_instance.stubs(:capture_with_info).returns("123") # old version

    run_command("boot", config: :with_proxy_roles, host: nil).tap do |output|
-      assert_match "docker exec kamal-proxy kamal-proxy deploy app-web --target=\"123:80\" --deploy-timeout=\"6s\" --drain-timeout=\"30s\" --target-timeout=\"10s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\" --log-request-header=\"User-Agent\"", output
-      assert_match "docker exec kamal-proxy kamal-proxy deploy app-web2 --target=\"123:80\" --deploy-timeout=\"6s\" --drain-timeout=\"30s\" --target-timeout=\"15s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\" --log-request-header=\"User-Agent\"", output
+      assert_match "docker exec kamal-proxy kamal-proxy deploy app-web --target \"123:80\" --deploy-timeout \"6s\" --drain-timeout \"30s\" --target-timeout \"10s\" --buffer-requests --buffer-responses --log-request-header \"Cache-Control\" --log-request-header \"Last-Modified\" --log-request-header \"User-Agent\"", output
+      assert_match "docker exec kamal-proxy kamal-proxy deploy app-web2 --target \"123:80\" --deploy-timeout \"6s\" --drain-timeout \"30s\" --target-timeout \"15s\" --buffer-requests --buffer-responses --log-request-header \"Cache-Control\" --log-request-header \"Last-Modified\" --log-request-header \"User-Agent\"", output
    end
  end

--- a/test/cli/build_test.rb
+++ b/test/cli/build_test.rb
@@ -11,6 +11,7 @@ class CliBuildTest < CliTestCase
  test "push" do
    with_build_directory do |build_directory|
      Kamal::Commands::Hook.any_instance.stubs(:hook_exists?).returns(true)
+      hook_variables = { version: 999, service_version: "app@999", hosts: "1.1.1.1,1.1.1.2,1.1.1.3,1.1.1.4", command: "build", subcommand: "push" }

      SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
        .with(:git, "-C", anything, :"rev-parse", :HEAD)
@@ -21,33 +22,11 @@ class CliBuildTest < CliTestCase
        .returns("")

      run_command("push", "--verbose").tap do |output|
-        assert_hook_ran "pre-build", output
+        assert_hook_ran "pre-build", output, **hook_variables
        assert_match /Cloning repo into build directory/, output
        assert_match /git -C #{Dir.tmpdir}\/kamal-clones\/app-#{pwd_sha} clone #{Dir.pwd}/, output
        assert_match /docker --version && docker buildx version/, output
-        assert_match /docker buildx build --output=type=registry --platform linux\/amd64 --builder kamal-local-docker-container -t dhh\/app:999 -t dhh\/app:latest --label service="app" --file Dockerfile \. as .*@localhost/, output
-      end
-    end
-  end
-
-  test "push --output=docker" do
-    with_build_directory do |build_directory|
-      Kamal::Commands::Hook.any_instance.stubs(:hook_exists?).returns(true)
-
-      SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-        .with(:git, "-C", anything, :"rev-parse", :HEAD)
-        .returns(Kamal::Git.revision)
-
-      SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-        .with(:git, "-C", anything, :status, "--porcelain")
-        .returns("")
-
-      run_command("push", "--output=docker", "--verbose").tap do |output|
-        assert_hook_ran "pre-build", output
-        assert_match /Cloning repo into build directory/, output
-        assert_match /git -C #{Dir.tmpdir}\/kamal-clones\/app-#{pwd_sha} clone #{Dir.pwd}/, output
-        assert_match /docker --version && docker buildx version/, output
-        assert_match /docker buildx build --output=type=docker --platform linux\/amd64 --builder kamal-local-docker-container -t dhh\/app:999 -t dhh\/app:latest --label service="app" --file Dockerfile \. as .*@localhost/, output
+        assert_match /docker buildx build --push --platform linux\/amd64 --builder kamal-local-docker-container -t dhh\/app:999 -t dhh\/app:latest --label service="app" --file Dockerfile \. as .*@localhost/, output
      end
    end
  end
@@ -70,7 +49,7 @@ class CliBuildTest < CliTestCase
      SSHKit::Backend::Abstract.any_instance.expects(:execute).with(:git, "-C", build_directory, :submodule, :update, "--init")

      SSHKit::Backend::Abstract.any_instance.expects(:execute)
-        .with(:docker, :buildx, :build, "--output=type=registry", "--platform", "linux/amd64", "--builder", "kamal-local-docker-container", "-t", "dhh/app:999", "-t", "dhh/app:latest", "--label", "service=\"app\"", "--file", "Dockerfile", ".")
+        .with(:docker, :buildx, :build, "--push", "--platform", "linux/amd64", "--builder", "kamal-local-docker-container", "-t", "dhh/app:999", "-t", "dhh/app:latest", "--label", "service=\"app\"", "--file", "Dockerfile", ".")

      SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
        .with(:git, "-C", anything, :"rev-parse", :HEAD)
@@ -89,12 +68,13 @@ class CliBuildTest < CliTestCase

  test "push without clone" do
    Kamal::Commands::Hook.any_instance.stubs(:hook_exists?).returns(true)
+    hook_variables = { version: 999, service_version: "app@999", hosts: "1.1.1.1,1.1.1.2,1.1.1.3,1.1.1.4", command: "build", subcommand: "push" }

    run_command("push", "--verbose", fixture: :without_clone).tap do |output|
      assert_no_match /Cloning repo into build directory/, output
-      assert_hook_ran "pre-build", output
+      assert_hook_ran "pre-build", output, **hook_variables
      assert_match /docker --version && docker buildx version/, output
-      assert_match /docker buildx build --output=type=registry --platform linux\/amd64 --builder kamal-local-docker-container -t dhh\/app:999 -t dhh\/app:latest --label service="app" --file Dockerfile . as .*@localhost/, output
+      assert_match /docker buildx build --push --platform linux\/amd64 --builder kamal-local-docker-container -t dhh\/app:999 -t dhh\/app:latest --label service="app" --file Dockerfile . as .*@localhost/, output
    end
  end

@@ -160,7 +140,7 @@ class CliBuildTest < CliTestCase
        .returns("")

      SSHKit::Backend::Abstract.any_instance.expects(:execute)
-        .with(:docker, :buildx, :build, "--output=type=registry", "--platform", "linux/amd64", "--builder", "kamal-local-docker-container", "-t", "dhh/app:999", "-t", "dhh/app:latest", "--label", "service=\"app\"", "--file", "Dockerfile", ".")
+        .with(:docker, :buildx, :build, "--push", "--platform", "linux/amd64", "--builder", "kamal-local-docker-container", "-t", "dhh/app:999", "-t", "dhh/app:latest", "--label", "service=\"app\"", "--file", "Dockerfile", ".")

      run_command("push").tap do |output|
        assert_match /WARN Missing compatible builder, so creating a new one first/, output
@@ -175,7 +155,7 @@ class CliBuildTest < CliTestCase
      .raises(SSHKit::Command::Failed.new("no buildx"))

    Kamal::Commands::Builder.any_instance.stubs(:native_and_local?).returns(false)
-    assert_raises(Kamal::Cli::DependencyError) { run_command("push") }
+    assert_raises(Kamal::Cli::Build::BuildError) { run_command("push") }
  end

  test "push pre-build hook failure" do
@@ -255,12 +235,6 @@ class CliBuildTest < CliTestCase
    end
  end

-  test "create cloud" do
-    run_command("create", fixture: :with_cloud_builder).tap do |output|
-      assert_match /docker buildx create --driver cloud example_org\/cloud_builder/, output
-    end
-  end
-
  test "create with error" do
    stub_setup
    SSHKit::Backend::Abstract.any_instance.stubs(:execute)
@@ -278,12 +252,6 @@ class CliBuildTest < CliTestCase
    end
  end

-  test "remove cloud" do
-    run_command("remove", fixture: :with_cloud_builder).tap do |output|
-      assert_match /docker buildx rm cloud-example_org-cloud_builder/, output
-    end
-  end
-
  test "details" do
    SSHKit::Backend::Abstract.any_instance.stubs(:capture)
      .with(:docker, :context, :ls, "&&", :docker, :buildx, :ls)
@@ -295,30 +263,6 @@ class CliBuildTest < CliTestCase
    end
  end

-  test "dev" do
-    with_build_directory do |build_directory|
-      Kamal::Commands::Hook.any_instance.stubs(:hook_exists?).returns(true)
-
-      run_command("dev", "--verbose").tap do |output|
-        assert_no_match(/Cloning repo into build directory/, output)
-        assert_match(/docker --version && docker buildx version/, output)
-        assert_match(/docker buildx build --output=type=docker --platform linux\/amd64 --builder kamal-local-docker-container -t dhh\/app:999-dirty -t dhh\/app:latest-dirty --label service="app" --file Dockerfile \. as .*@localhost/, output)
-      end
-    end
-  end
-
-  test "dev --output=local" do
-    with_build_directory do |build_directory|
-      Kamal::Commands::Hook.any_instance.stubs(:hook_exists?).returns(true)
-
-      run_command("dev", "--output=local", "--verbose").tap do |output|
-        assert_no_match(/Cloning repo into build directory/, output)
-        assert_match(/docker --version && docker buildx version/, output)
-        assert_match(/docker buildx build --output=type=local --platform linux\/amd64 --builder kamal-local-docker-container -t dhh\/app:999-dirty -t dhh\/app:latest-dirty --label service="app" --file Dockerfile \. as .*@localhost/, output)
-      end
-    end
-  end
-
  private
    def run_command(*command, fixture: :with_accessories)
      stdouted { Kamal::Cli::Build.start([ *command, "-c", "test/fixtures/deploy_#{fixture}.yml" ]) }
@@ -330,4 +274,17 @@ class CliBuildTest < CliTestCase
      SSHKit::Backend::Abstract.any_instance.stubs(:execute)
        .with { |*args| args[0..1] == [ :docker, :buildx ] }
    end
+
+    def with_build_directory
+      build_directory = File.join Dir.tmpdir, "kamal-clones", "app-#{pwd_sha}", "kamal"
+      FileUtils.mkdir_p build_directory
+      FileUtils.touch File.join build_directory, "Dockerfile"
+      yield build_directory + "/"
+    ensure
+      FileUtils.rm_rf build_directory
+    end
+
+    def pwd_sha
+      Digest::SHA256.hexdigest(Dir.pwd)[0..12]
+    end
 end
--- a/test/cli/cli_test_case.rb
+++ b/test/cli/cli_test_case.rb
@@ -40,9 +40,8 @@ class CliTestCase < ActiveSupport::TestCase
        .with(:docker, :buildx, :inspect, "kamal-local-docker-container")
    end

-    def assert_hook_ran(hook, output, count: 1)
-      regexp = ([ "/usr/bin/env .kamal/hooks/#{hook}" ] * count).join(".*")
-      assert_match /#{regexp}/m, output
+    def assert_hook_ran(hook, output, version:, service_version:, hosts:, command:, subcommand: nil, runtime: false, secrets: false)
+      assert_match %r{usr/bin/env\s\.kamal/hooks/#{hook}}, output
    end

    def with_argv(*argv)
@@ -52,17 +51,4 @@ class CliTestCase < ActiveSupport::TestCase
    ensure
      ARGV.replace(old_argv)
    end
-
-    def with_build_directory
-      build_directory = File.join Dir.tmpdir, "kamal-clones", "app-#{pwd_sha}", "kamal"
-      FileUtils.mkdir_p build_directory
-      FileUtils.touch File.join build_directory, "Dockerfile"
-      yield build_directory + "/"
-    ensure
-      FileUtils.rm_rf build_directory
-    end
-
-    def pwd_sha
-      Digest::SHA256.hexdigest(Dir.pwd)[0..12]
-    end
 end
--- a/test/cli/main_test.rb
+++ b/test/cli/main_test.rb
@@ -8,7 +8,8 @@ class CliMainTest < CliTestCase
    invoke_options = { "config_file" => "test/fixtures/deploy_simple.yml", "version" => "999", "skip_hooks" => false }

    Kamal::Cli::Main.any_instance.expects(:invoke).with("kamal:cli:server:bootstrap", [], invoke_options)
-    Kamal::Cli::Main.any_instance.expects(:deploy).with(boot_accessories: true)
+    Kamal::Cli::Main.any_instance.expects(:invoke).with("kamal:cli:accessory:boot", [ "all" ], invoke_options)
+    Kamal::Cli::Main.any_instance.expects(:deploy)

    run_command("setup").tap do |output|
      assert_match /Ensure Docker is installed.../, output
@@ -53,16 +54,17 @@ class CliMainTest < CliTestCase
      Kamal::Cli::Main.any_instance.expects(:invoke).with("kamal:cli:prune:all", [], invoke_options)

      Kamal::Commands::Hook.any_instance.stubs(:hook_exists?).returns(true)
+      hook_variables = { version: 999, service_version: "app@999", hosts: "1.1.1.1,1.1.1.2", command: "deploy" }

      run_command("deploy", "--verbose").tap do |output|
-        assert_hook_ran "pre-connect", output
+        assert_hook_ran "pre-connect", output, **hook_variables
        assert_match /Log into image registry/, output
        assert_match /Build and push app image/, output
-        assert_hook_ran "pre-deploy", output
+        assert_hook_ran "pre-deploy", output, **hook_variables, secrets: true
        assert_match /Ensure kamal-proxy is running/, output
        assert_match /Detect stale containers/, output
        assert_match /Prune old containers and images/, output
-        assert_hook_ran "post-deploy", output
+        assert_hook_ran "post-deploy", output, **hook_variables, runtime: true, secrets: true
      end
    end
  end
@@ -204,12 +206,14 @@ class CliMainTest < CliTestCase

    Kamal::Commands::Hook.any_instance.stubs(:hook_exists?).returns(true)

+    hook_variables = { version: 999, service_version: "app@999", hosts: "1.1.1.1,1.1.1.2", command: "redeploy" }
+
    run_command("redeploy", "--verbose").tap do |output|
-      assert_hook_ran "pre-connect", output
+      assert_hook_ran "pre-connect", output, **hook_variables
      assert_match /Build and push app image/, output
-      assert_hook_ran "pre-deploy", output
+      assert_hook_ran "pre-deploy", output, **hook_variables
      assert_match /Running the pre-deploy hook.../, output
-      assert_hook_ran "post-deploy", output
+      assert_hook_ran "post-deploy", output, **hook_variables, runtime: true
    end
  end

@@ -246,7 +250,7 @@ class CliMainTest < CliTestCase
        .with(:docker, :container, :ls, "--all", "--filter", "name=^app-#{role}-123$", "--quiet")
        .returns("version-to-rollback\n").at_least_once
      SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-        .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=#{role} --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=#{role} --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-#{role}-}; done", raise_on_non_zero_exit: false)
+        .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=#{role} --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=#{role} --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-#{role}-}; done", raise_on_non_zero_exit: false)
        .returns("version-to-rollback\n").at_least_once
    end

@@ -255,13 +259,14 @@ class CliMainTest < CliTestCase
      .returns("running").at_least_once # health check

    Kamal::Commands::Hook.any_instance.stubs(:hook_exists?).returns(true)
+    hook_variables = { version: 123, service_version: "app@123", hosts: "1.1.1.1,1.1.1.2,1.1.1.3,1.1.1.4", command: "rollback" }

    run_command("rollback", "--verbose", "123", config_file: "deploy_with_accessories").tap do |output|
-      assert_hook_ran "pre-deploy", output
+      assert_hook_ran "pre-deploy", output, **hook_variables
      assert_match "docker tag dhh/app:123 dhh/app:latest", output
      assert_match "docker run --detach --restart unless-stopped --name app-web-123", output
      assert_match "docker container ls --all --filter name=^app-web-version-to-rollback$ --quiet | xargs docker stop", output, "Should stop the container that was previously running"
-      assert_hook_ran "post-deploy", output
+      assert_hook_ran "post-deploy", output, **hook_variables, runtime: true
    end
  end

@@ -275,7 +280,7 @@ class CliMainTest < CliTestCase
      .with(:docker, :container, :ls, "--all", "--filter", "name=^app-web-123$", "--quiet")
      .returns("123").at_least_once
    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-      .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
+      .with(:sh, "-c", "'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'", "|", :head, "-1", "|", "while read line; do echo ${line#app-web-}; done", raise_on_non_zero_exit: false)
      .returns("").at_least_once

    run_command("rollback", "123").tap do |output|
@@ -455,7 +460,6 @@ class CliMainTest < CliTestCase

  test "run an alias for a console" do
    run_command("console", config_file: "deploy_with_aliases").tap do |output|
-      assert_no_match "App Host: 1.1.1.4", output
      assert_match "docker exec app-console-999 bin/console on 1.1.1.5", output
      assert_match "App Host: 1.1.1.5", output
    end
@@ -482,33 +486,6 @@ class CliMainTest < CliTestCase
    end
  end

-  test "switch config file with an alias" do
-    with_config_files do
-      with_argv([ "other_config" ]) do
-        stdouted { Kamal::Cli::Main.start }.tap do |output|
-          assert_match ":service_with_version: app2-999", output
-        end
-      end
-    end
-  end
-
-  test "switch destination with an alias" do
-    with_config_files do
-      with_argv([ "other_destination_config" ]) do
-        stdouted { Kamal::Cli::Main.start }.tap do |output|
-          assert_match ":service_with_version: app3-999", output
-        end
-      end
-    end
-  end
-
-  test "run on primary via alias" do
-    run_command("primary_details", config_file: "deploy_with_aliases").tap do |output|
-      assert_match "App Host: 1.1.1.1", output
-      assert_no_match "App Host: 1.1.1.2", output
-    end
-  end
-
  test "upgrade" do
    invoke_options = { "config_file" => "test/fixtures/deploy_with_accessories.yml", "skip_hooks" => false, "confirmed" => true, "rolling" => false }
    Kamal::Cli::Main.any_instance.expects(:invoke).with("kamal:cli:proxy:upgrade", [], invoke_options)
@@ -553,20 +530,6 @@ class CliMainTest < CliTestCase
      end
    end

-    def with_config_files
-      Dir.mktmpdir do |tmpdir|
-        config_dir = File.join(tmpdir, "config")
-        FileUtils.mkdir_p(config_dir)
-        FileUtils.cp "test/fixtures/deploy.yml", config_dir
-        FileUtils.cp "test/fixtures/deploy2.yml", config_dir
-        FileUtils.cp "test/fixtures/deploy.elsewhere.yml", config_dir
-
-        Dir.chdir(tmpdir) do
-          yield
-        end
-      end
-    end
-
    def assert_file(file, content)
      assert_match content, File.read(file)
    end
--- a/test/cli/proxy_test.rb
+++ b/test/cli/proxy_test.rb
@@ -4,7 +4,7 @@ class CliProxyTest < CliTestCase
  test "boot" do
    run_command("boot").tap do |output|
      assert_match "docker login", output
-      assert_match "docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443 --log-opt max-size=10m\") #{KAMAL.config.proxy_image}", output
+      assert_match "docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443\") #{KAMAL.config.proxy_image}", output
    end
  end

@@ -18,11 +18,11 @@ class CliProxyTest < CliTestCase
    exception = assert_raises do
      run_command("boot").tap do |output|
        assert_match "docker login", output
-        assert_match "docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443 --log-opt max-size=10m\") #{KAMAL.config.proxy_image}", output
+        assert_match "docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443\") #{KAMAL.config.proxy_image}", output
      end
    end

-    assert_includes exception.message, "kamal-proxy version v0.0.1 is too old, run `kamal proxy reboot` in order to update to at least #{Kamal::Configuration::PROXY_MINIMUM_VERSION}"
+    assert_includes exception.message, "kamal-proxy version v0.0.1 is too old, please reboot to update to at least #{Kamal::Configuration::PROXY_MINIMUM_VERSION}"
  ensure
    Thread.report_on_exception = false
  end
@@ -36,7 +36,7 @@ class CliProxyTest < CliTestCase

    run_command("boot").tap do |output|
      assert_match "docker login", output
-      assert_match "docker container start kamal-proxy || docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443 --log-opt max-size=10m\") #{KAMAL.config.proxy_image}", output
+      assert_match "docker container start kamal-proxy || docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443\") #{KAMAL.config.proxy_image}", output
    end
  ensure
    Thread.report_on_exception = false
@@ -55,14 +55,16 @@ class CliProxyTest < CliTestCase

    run_command("reboot", "-y").tap do |output|
      assert_match "docker container stop kamal-proxy on 1.1.1.1", output
+      assert_match "Running docker container stop traefik ; docker container prune --force --filter label=org.opencontainers.image.title=Traefik && docker image prune --all --force --filter label=org.opencontainers.image.title=Traefik on 1.1.1.1", output
      assert_match "docker container prune --force --filter label=org.opencontainers.image.title=kamal-proxy on 1.1.1.1", output
-      assert_match "docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443 --log-opt max-size=10m\") #{KAMAL.config.proxy_image} on 1.1.1.1", output
-      assert_match "docker exec kamal-proxy kamal-proxy deploy app-web --target=\"abcdefabcdef:80\" --deploy-timeout=\"6s\" --drain-timeout=\"30s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\" --log-request-header=\"User-Agent\" on 1.1.1.1", output
+      assert_match "docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443\") #{KAMAL.config.proxy_image} on 1.1.1.1", output
+      assert_match "docker exec kamal-proxy kamal-proxy deploy app-web --target \"abcdefabcdef:80\" --deploy-timeout \"6s\" --drain-timeout \"30s\" --buffer-requests --buffer-responses --log-request-header \"Cache-Control\" --log-request-header \"Last-Modified\" --log-request-header \"User-Agent\" on 1.1.1.1", output

      assert_match "docker container stop kamal-proxy on 1.1.1.2", output
+      assert_match "Running docker container stop traefik ; docker container prune --force --filter label=org.opencontainers.image.title=Traefik && docker image prune --all --force --filter label=org.opencontainers.image.title=Traefik on 1.1.1.2", output
      assert_match "docker container prune --force --filter label=org.opencontainers.image.title=kamal-proxy on 1.1.1.2", output
-      assert_match "docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443 --log-opt max-size=10m\") #{KAMAL.config.proxy_image} on 1.1.1.2", output
-      assert_match "docker exec kamal-proxy kamal-proxy deploy app-web --target=\"abcdefabcdef:80\" --deploy-timeout=\"6s\" --drain-timeout=\"30s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\" --log-request-header=\"User-Agent\" on 1.1.1.2", output
+      assert_match "docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443\") #{KAMAL.config.proxy_image} on 1.1.1.2", output
+      assert_match "docker exec kamal-proxy kamal-proxy deploy app-web --target \"abcdefabcdef:80\" --deploy-timeout \"6s\" --drain-timeout \"30s\" --buffer-requests --buffer-responses --log-request-header \"Cache-Control\" --log-request-header \"Last-Modified\" --log-request-header \"User-Agent\" on 1.1.1.2", output
    end
  end

@@ -196,13 +198,13 @@ class CliProxyTest < CliTestCase
      assert_match "/usr/bin/env mkdir -p .kamal", output
      assert_match "docker network create kamal", output
      assert_match "docker login -u [REDACTED] -p [REDACTED]", output
-      assert_match "docker container start kamal-proxy || docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443 --log-opt max-size=10m\") basecamp/kamal-proxy:#{Kamal::Configuration::PROXY_MINIMUM_VERSION}", output
+      assert_match "docker container start kamal-proxy || docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443\") basecamp/kamal-proxy:#{Kamal::Configuration::PROXY_MINIMUM_VERSION}", output
      assert_match "/usr/bin/env mkdir -p .kamal", output
      assert_match %r{docker rename app-web-latest app-web-latest_replaced_.*}, output
      assert_match "/usr/bin/env mkdir -p .kamal/apps/app/env/roles", output
      assert_match "Uploading \"\\n\" to .kamal/apps/app/env/roles/web.env", output
      assert_match %r{docker run --detach --restart unless-stopped --name app-web-latest --network kamal --hostname 1.1.1.1-.* -e KAMAL_CONTAINER_NAME="app-web-latest" -e KAMAL_VERSION="latest" --env-file .kamal/apps/app/env/roles/web.env --log-opt max-size="10m" --label service="app" --label role="web" --label destination dhh/app:latest}, output
-      assert_match "docker exec kamal-proxy kamal-proxy deploy app-web --target=\"12345678:80\" --deploy-timeout=\"6s\" --drain-timeout=\"30s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\" --log-request-header=\"User-Agent\"", output
+      assert_match "docker exec kamal-proxy kamal-proxy deploy app-web --target \"12345678:80\" --deploy-timeout \"6s\" --drain-timeout \"30s\" --buffer-requests --buffer-responses --log-request-header \"Cache-Control\" --log-request-header \"Last-Modified\" --log-request-header \"User-Agent\"", output
      assert_match "docker container ls --all --filter name=^app-web-12345678$ --quiet | xargs docker stop", output
      assert_match "docker tag dhh/app:latest dhh/app:latest", output
      assert_match "/usr/bin/env mkdir -p .kamal", output
@@ -238,7 +240,7 @@ class CliProxyTest < CliTestCase
    run_command("boot_config", "set").tap do |output|
      %w[ 1.1.1.1 1.1.1.2 ].each do |host|
        assert_match "Running /usr/bin/env mkdir -p .kamal/proxy on #{host}", output
-        assert_match "Uploading \"--publish 80:80 --publish 443:443 --log-opt max-size=10m\" to .kamal/proxy/options on #{host}", output
+        assert_match "Uploading \"--publish 80:80 --publish 443:443\" to .kamal/proxy/options on #{host}", output
      end
    end
  end
@@ -247,25 +249,7 @@ class CliProxyTest < CliTestCase
    run_command("boot_config", "set", "--publish", "false").tap do |output|
      %w[ 1.1.1.1 1.1.1.2 ].each do |host|
        assert_match "Running /usr/bin/env mkdir -p .kamal/proxy on #{host}", output
-        assert_match "Uploading \"--log-opt max-size=10m\" to .kamal/proxy/options on #{host}", output
-      end
-    end
-  end
-
-  test "boot_config set custom max_size" do
-    run_command("boot_config", "set", "--log-max-size", "100m").tap do |output|
-      %w[ 1.1.1.1 1.1.1.2 ].each do |host|
-        assert_match "Running /usr/bin/env mkdir -p .kamal/proxy on #{host}", output
-        assert_match "Uploading \"--publish 80:80 --publish 443:443 --log-opt max-size=100m\" to .kamal/proxy/options on #{host}", output
-      end
-    end
-  end
-
-  test "boot_config set no log max size" do
-    run_command("boot_config", "set", "--log-max-size=").tap do |output|
-      %w[ 1.1.1.1 1.1.1.2 ].each do |host|
-        assert_match "Running /usr/bin/env mkdir -p .kamal/proxy on #{host}", output
-        assert_match "Uploading \"--publish 80:80 --publish 443:443\" to .kamal/proxy/options on #{host}", output
+        assert_match "Uploading \"\" to .kamal/proxy/options on #{host}", output
      end
    end
  end
@@ -274,49 +258,23 @@ class CliProxyTest < CliTestCase
    run_command("boot_config", "set", "--http-port", "8080", "--https-port", "8443").tap do |output|
      %w[ 1.1.1.1 1.1.1.2 ].each do |host|
        assert_match "Running /usr/bin/env mkdir -p .kamal/proxy on #{host}", output
-        assert_match "Uploading \"--publish 8080:80 --publish 8443:443 --log-opt max-size=10m\" to .kamal/proxy/options on #{host}", output
+        assert_match "Uploading \"--publish 8080:80 --publish 8443:443\" to .kamal/proxy/options on #{host}", output
      end
    end
  end

-  test "boot_config set bind IP" do
-    run_command("boot_config", "set", "--publish-host-ip", "127.0.0.1").tap do |output|
-      %w[ 1.1.1.1 1.1.1.2 ].each do |host|
-        assert_match "Running /usr/bin/env mkdir -p .kamal/proxy on #{host}", output
-        assert_match "Uploading \"--publish 127.0.0.1:80:80 --publish 127.0.0.1:443:443 --log-opt max-size=10m\" to .kamal/proxy/options on #{host}", output
-      end
-    end
-  end
-
-  test "boot_config set multiple bind IPs" do
-    run_command("boot_config", "set", "--publish-host-ip", "127.0.0.1", "--publish-host-ip", "::1").tap do |output|
-      %w[ 1.1.1.1 1.1.1.2 ].each do |host|
-        assert_match "Running /usr/bin/env mkdir -p .kamal/proxy on #{host}", output
-        assert_match "Uploading \"--publish 127.0.0.1:80:80 --publish 127.0.0.1:443:443 --publish [::1]:80:80 --publish [::1]:443:443 --log-opt max-size=10m\" to .kamal/proxy/options on #{host}", output
-      end
-    end
-  end
-
-  test "boot_config set invalid bind IPs" do
-    exception = assert_raises do
-      run_command("boot_config", "set", "--publish-host-ip", "1.2.3.invalidIP", "--publish-host-ip", "::1")
-    end
-
-    assert_includes exception.message, "Invalid publish IP address: 1.2.3.invalidIP"
-  end
-
  test "boot_config set docker options" do
    run_command("boot_config", "set", "--docker_options", "label=foo=bar", "add_host=thishost:thathost").tap do |output|
      %w[ 1.1.1.1 1.1.1.2 ].each do |host|
        assert_match "Running /usr/bin/env mkdir -p .kamal/proxy on #{host}", output
-        assert_match "Uploading \"--publish 80:80 --publish 443:443 --log-opt max-size=10m --label=foo=bar --add_host=thishost:thathost\" to .kamal/proxy/options on #{host}", output
+        assert_match "Uploading \"--publish 80:80 --publish 443:443 --label=foo=bar --add_host=thishost:thathost\" to .kamal/proxy/options on #{host}", output
      end
    end
  end

  test "boot_config get" do
    SSHKit::Backend::Abstract.any_instance.expects(:capture_with_info)
-      .with(:cat, ".kamal/proxy/options", "||", :echo, "\"--publish 80:80 --publish 443:443 --log-opt max-size=10m\"")
+      .with(:cat, ".kamal/proxy/options", "||", :echo, "\"--publish 80:80 --publish 443:443\"")
      .returns("--publish 80:80 --publish 8443:443 --label=foo=bar")
      .twice

--- a/test/cli/registry_test.rb
+++ b/test/cli/registry_test.rb
@@ -43,16 +43,6 @@ class CliRegistryTest < CliTestCase
    end
  end

-  test "login with no docker" do
-    stub_setup
-    SSHKit::Backend::Abstract.any_instance.stubs(:execute)
-      .with(:docker, "--version", "&&", :docker, :buildx, "version")
-      .raises(SSHKit::Command::Failed.new("command not found"))
-
-    assert_raises(Kamal::Cli::DependencyError) { run_command("login") }
-  end
-
-
  private
    def run_command(*command)
      stdouted { Kamal::Cli::Registry.start([ *command, "-c", "test/fixtures/deploy_with_accessories.yml" ]) }
--- a/test/cli/secrets_test.rb
+++ b/test/cli/secrets_test.rb
@@ -3,16 +3,10 @@ require_relative "cli_test_case"
 class CliSecretsTest < CliTestCase
  test "fetch" do
    assert_equal \
-      "\\{\\\"foo\\\":\\\"oof\\\",\\\"bar\\\":\\\"rab\\\",\\\"baz\\\":\\\"zab\\\"\\}",
+      "{\"foo\":\"oof\",\"bar\":\"rab\",\"baz\":\"zab\"}",
      run_command("fetch", "foo", "bar", "baz", "--account", "myaccount", "--adapter", "test")
  end

-  test "fetch missing --acount" do
-    assert_equal \
-      "No value provided for required options '--account'",
-      run_command("fetch", "foo", "bar", "baz", "--adapter", "test")
-  end
-
  test "extract" do
    assert_equal "oof", run_command("extract", "foo", "{\"foo\":\"oof\", \"bar\":\"rab\", \"baz\":\"zab\"}")
  end
@@ -21,12 +15,6 @@ class CliSecretsTest < CliTestCase
    assert_equal "oof", run_command("extract", "foo", "{\"abc/foo\":\"oof\", \"bar\":\"rab\", \"baz\":\"zab\"}")
  end

-  test "print" do
-    with_test_secrets("secrets" => "SECRET1=ABC\nSECRET2=${SECRET1}DEF\n") do
-      assert_equal "SECRET1=ABC\nSECRET2=ABCDEF", run_command("print")
-    end
-  end
-
  private
    def run_command(*command)
      stdouted { Kamal::Cli::Secrets.start([ *command, "-c", "test/fixtures/deploy_with_accessories.yml" ]) }
--- a/test/commander_test.rb
+++ b/test/commander_test.rb
@@ -104,6 +104,28 @@ class CommanderTest < ActiveSupport::TestCase
    assert_equal [ "web", "workers" ], @kamal.roles_on("1.1.1.1").map(&:name)
  end

+  test "default group strategy" do
+    assert_empty @kamal.boot_strategy
+  end
+
+  test "specific limit group strategy" do
+    configure_with(:deploy_with_boot_strategy)
+
+    assert_equal({ in: :groups, limit: 3, wait: 2 }, @kamal.boot_strategy)
+  end
+
+  test "percentage-based group strategy" do
+    configure_with(:deploy_with_percentage_boot_strategy)
+
+    assert_equal({ in: :groups, limit: 1, wait: 2 }, @kamal.boot_strategy)
+  end
+
+  test "percentage-based group strategy limit is at least 1" do
+    configure_with(:deploy_with_low_percentage_boot_strategy)
+
+    assert_equal({ in: :groups, limit: 1, wait: 2 }, @kamal.boot_strategy)
+  end
+
  test "try to match the primary role from a list of specific roles" do
    configure_with(:deploy_primary_web_role_override)

@@ -128,27 +150,6 @@ class CommanderTest < ActiveSupport::TestCase
    assert_equal [ "1.1.1.2" ], @kamal.proxy_hosts
  end

-  test "accessory hosts without filtering" do
-    configure_with(:deploy_with_single_accessory)
-    assert_equal [ "1.1.1.5" ], @kamal.accessory_hosts
-
-    configure_with(:deploy_with_accessories_on_independent_server)
-    assert_equal [ "1.1.1.5", "1.1.1.1", "1.1.1.2" ], @kamal.accessory_hosts
-  end
-
-  test "accessory hosts with role filtering" do
-    configure_with(:deploy_with_single_accessory)
-    @kamal.specific_roles = [ "web" ]
-    assert_equal [], @kamal.accessory_hosts
-
-    configure_with(:deploy_with_accessories_on_independent_server)
-    @kamal.specific_roles = [ "web" ]
-    assert_equal [ "1.1.1.1", "1.1.1.2" ], @kamal.accessory_hosts
-
-    @kamal.specific_roles = [ "workers" ]
-    assert_equal [], @kamal.accessory_hosts
-  end
-
  private
    def configure_with(variant)
      @kamal = Kamal::Commander.new.tap do |kamal|
--- a/test/commands/accessory_test.rb
+++ b/test/commands/accessory_test.rb
@@ -5,9 +5,7 @@ class CommandsAccessoryTest < ActiveSupport::TestCase
    setup_test_secrets("secrets" => "MYSQL_ROOT_PASSWORD=secret123")

    @config = {
-      service: "app",
-      image: "dhh/app",
-      registry: { "server" => "private.registry", "username" => "dhh", "password" => "secret" },
+      service: "app", image: "dhh/app", registry: { "server" => "private.registry", "username" => "dhh", "password" => "secret" },
      servers: [ "1.1.1.1" ],
      builder: { "arch" => "amd64" },
      accessories: {
@@ -41,11 +39,7 @@ class CommandsAccessoryTest < ActiveSupport::TestCase
        "busybox" => {
          "service" => "custom-busybox",
          "image" => "busybox:latest",
-          "registry" => { "server" => "other.registry", "username" => "user", "password" => "pw" },
-          "host" => "1.1.1.7",
-          "proxy" => {
-            "host" => "busybox.example.com"
-          }
+          "host" => "1.1.1.7"
        }
      }
    }
@@ -65,7 +59,7 @@ class CommandsAccessoryTest < ActiveSupport::TestCase
      new_command(:redis).run.join(" ")

    assert_equal \
-      "docker run --name custom-busybox --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --env-file .kamal/apps/app/env/accessories/busybox.env --label service=\"custom-busybox\" other.registry/busybox:latest",
+      "docker run --name custom-busybox --detach --restart unless-stopped --network kamal --log-opt max-size=\"10m\" --env-file .kamal/apps/app/env/accessories/busybox.env --label service=\"custom-busybox\" busybox:latest",
      new_command(:busybox).run.join(" ")
  end

@@ -73,18 +67,10 @@ class CommandsAccessoryTest < ActiveSupport::TestCase
    @config[:logging] = { "driver" => "local", "options" => { "max-size" => "100m", "max-file" => "3" } }

    assert_equal \
-      "docker run --name custom-busybox --detach --restart unless-stopped --network kamal --log-driver \"local\" --log-opt max-size=\"100m\" --log-opt max-file=\"3\" --env-file .kamal/apps/app/env/accessories/busybox.env --label service=\"custom-busybox\" other.registry/busybox:latest",
+      "docker run --name custom-busybox --detach --restart unless-stopped --network kamal --log-driver \"local\" --log-opt max-size=\"100m\" --log-opt max-file=\"3\" --env-file .kamal/apps/app/env/accessories/busybox.env --label service=\"custom-busybox\" busybox:latest",
      new_command(:busybox).run.join(" ")
  end

-  test "run in custom network" do
-    @config[:accessories]["mysql"]["network"] = "custom"
-
-    assert_equal \
-      "docker run --name app-mysql --detach --restart unless-stopped --network custom --log-opt max-size=\"10m\" --publish 3306:3306 --env MYSQL_ROOT_HOST=\"%\" --env-file .kamal/apps/app/env/accessories/mysql.env --label service=\"app-mysql\" private.registry/mysql:8.0",
-      new_command(:mysql).run.join(" ")
-  end
-
  test "start" do
    assert_equal \
      "docker container start app-mysql",
@@ -103,6 +89,7 @@ class CommandsAccessoryTest < ActiveSupport::TestCase
      new_command(:mysql).info.join(" ")
  end

+
  test "execute in new container" do
    assert_equal \
      "docker run --rm --network kamal --env MYSQL_ROOT_HOST=\"%\" --env-file .kamal/apps/app/env/accessories/mysql.env private.registry/mysql:8.0 mysql -u root",
@@ -129,6 +116,8 @@ class CommandsAccessoryTest < ActiveSupport::TestCase
    end
  end

+
+
  test "logs" do
    assert_equal \
      "docker logs app-mysql --timestamps 2>&1",
@@ -169,18 +158,6 @@ class CommandsAccessoryTest < ActiveSupport::TestCase
      new_command(:mysql).remove_image.join(" ")
  end

-  test "deploy" do
-    assert_equal \
-      "docker exec kamal-proxy kamal-proxy deploy custom-busybox --target=\"172.1.0.2:80\" --host=\"busybox.example.com\" --deploy-timeout=\"30s\" --drain-timeout=\"30s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\" --log-request-header=\"User-Agent\"",
-      new_command(:busybox).deploy(target: "172.1.0.2").join(" ")
-  end
-
-  test "remove" do
-    assert_equal \
-      "docker exec kamal-proxy kamal-proxy remove custom-busybox",
-      new_command(:busybox).remove.join(" ")
-  end
-
  private
    def new_command(accessory)
      Kamal::Commands::Accessory.new(Kamal::Configuration.new(@config), name: accessory)
--- a/test/commands/app_test.rb
+++ b/test/commands/app_test.rb
@@ -79,18 +79,18 @@ class CommandsAppTest < ActiveSupport::TestCase

  test "stop" do
    assert_equal \
-      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker stop",
+      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker stop",
      new_command.stop.join(" ")
  end

  test "stop with custom drain timeout" do
    @config[:drain_timeout] = 20
    assert_equal \
-      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker stop",
+      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker stop",
      new_command.stop.join(" ")

    assert_equal \
-      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=workers --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=workers --filter status=running --filter status=restarting' | head -1 | xargs docker stop -t 20",
+      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=workers --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=workers --filter status=running --filter status=restarting' | head -1 | xargs docker stop -t 20",
      new_command(role: "workers").stop.join(" ")
  end

@@ -102,7 +102,7 @@ class CommandsAppTest < ActiveSupport::TestCase

  test "info" do
    assert_equal \
-      "docker ps --filter label=service=app --filter label=destination= --filter label=role=web",
+      "docker ps --filter label=service=app --filter label=role=web",
      new_command.info.join(" ")
  end

@@ -115,162 +115,114 @@ class CommandsAppTest < ActiveSupport::TestCase

  test "deploy" do
    assert_equal \
-      "docker exec kamal-proxy kamal-proxy deploy app-web --target=\"172.1.0.2:80\" --deploy-timeout=\"30s\" --drain-timeout=\"30s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\" --log-request-header=\"User-Agent\"",
-      new_command.deploy(target: "172.1.0.2").join(" ")
-  end
-
-  test "deploy with SSL" do
-    @config[:proxy] = { "ssl" => true, "host" => "example.com" }
-
-    assert_equal \
-      "docker exec kamal-proxy kamal-proxy deploy app-web --target=\"172.1.0.2:80\" --host=\"example.com\" --tls --deploy-timeout=\"30s\" --drain-timeout=\"30s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\" --log-request-header=\"User-Agent\"",
-      new_command.deploy(target: "172.1.0.2").join(" ")
-  end
-
-  test "deploy with SSL targeting multiple hosts" do
-    @config[:proxy] = { "ssl" => true, "hosts" => [ "example.com", "anotherexample.com" ] }
-
-    assert_equal \
-      "docker exec kamal-proxy kamal-proxy deploy app-web --target=\"172.1.0.2:80\" --host=\"example.com\" --host=\"anotherexample.com\" --tls --deploy-timeout=\"30s\" --drain-timeout=\"30s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\" --log-request-header=\"User-Agent\"",
-      new_command.deploy(target: "172.1.0.2").join(" ")
-  end
-
-  test "deploy with SSL false" do
-    @config[:proxy] = { "ssl" => false }
-
-    assert_equal \
-      "docker exec kamal-proxy kamal-proxy deploy app-web --target=\"172.1.0.2:80\" --deploy-timeout=\"30s\" --drain-timeout=\"30s\" --buffer-requests --buffer-responses --log-request-header=\"Cache-Control\" --log-request-header=\"Last-Modified\" --log-request-header=\"User-Agent\"",
+      "docker exec kamal-proxy kamal-proxy deploy app-web --target \"172.1.0.2:80\" --deploy-timeout \"30s\" --drain-timeout \"30s\" --buffer-requests --buffer-responses --log-request-header \"Cache-Control\" --log-request-header \"Last-Modified\" --log-request-header \"User-Agent\"",
      new_command.deploy(target: "172.1.0.2").join(" ")
  end

  test "remove" do
    assert_equal \
-      "docker exec kamal-proxy kamal-proxy remove app-web",
-      new_command.remove.join(" ")
+      "docker exec kamal-proxy kamal-proxy remove app-web --target \"172.1.0.2:80\"",
+      new_command.remove(target: "172.1.0.2").join(" ")
  end



  test "logs" do
    assert_equal \
-      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps 2>&1",
+      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps 2>&1",
      new_command.logs.join(" ")
  end

-  test "logs with container_id" do
-    assert_equal \
-      "echo C137 | xargs docker logs --timestamps 2>&1",
-      new_command.logs(container_id: "C137").join(" ")
-  end
-
  test "logs with since" do
    assert_equal \
-      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps --since 5m 2>&1",
+      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps --since 5m 2>&1",
      new_command.logs(since: "5m").join(" ")
  end

  test "logs with lines" do
    assert_equal \
-      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps --tail 100 2>&1",
+      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps --tail 100 2>&1",
      new_command.logs(lines: "100").join(" ")
  end

  test "logs with since and lines" do
    assert_equal \
-      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps --since 5m --tail 100 2>&1",
+      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps --since 5m --tail 100 2>&1",
      new_command.logs(since: "5m", lines: "100").join(" ")
  end

  test "logs with grep" do
    assert_equal \
-      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps 2>&1 | grep 'my-id'",
+      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps 2>&1 | grep 'my-id'",
      new_command.logs(grep: "my-id").join(" ")
  end

  test "logs with grep and grep options" do
    assert_equal \
-      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps 2>&1 | grep 'my-id' -C 2",
+      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps 2>&1 | grep 'my-id' -C 2",
      new_command.logs(grep: "my-id", grep_options: "-C 2").join(" ")
  end

  test "logs with since, grep and grep options" do
    assert_equal \
-      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps --since 5m 2>&1 | grep 'my-id' -C 2",
+      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps --since 5m 2>&1 | grep 'my-id' -C 2",
      new_command.logs(since: "5m", grep: "my-id", grep_options: "-C 2").join(" ")
  end

  test "logs with since and grep" do
    assert_equal \
-      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps --since 5m 2>&1 | grep 'my-id'",
+      "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | xargs docker logs --timestamps --since 5m 2>&1 | grep 'my-id'",
      new_command.logs(since: "5m", grep: "my-id").join(" ")
  end

  test "follow logs" do
    assert_equal \
-      "ssh -t root@app-1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --follow 2>&1'",
+      "ssh -t root@app-1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --follow 2>&1'",
      new_command.follow_logs(host: "app-1")

    assert_equal \
-      "ssh -t root@app-1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --follow 2>&1 | grep \"Completed\"'",
+      "ssh -t root@app-1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --follow 2>&1 | grep \"Completed\"'",
      new_command.follow_logs(host: "app-1", grep: "Completed")

    assert_equal \
-      "ssh -t root@app-1 -p 22 'echo ID321 | xargs docker logs --timestamps --follow 2>&1'",
-      new_command.follow_logs(host: "app-1", container_id: "ID321")
-
-    assert_equal \
-      "ssh -t root@app-1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --tail 123 --follow 2>&1'",
+      "ssh -t root@app-1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --tail 123 --follow 2>&1'",
      new_command.follow_logs(host: "app-1", lines: 123)

    assert_equal \
-      "ssh -t root@app-1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --tail 123 --follow 2>&1 | grep \"Completed\"'",
+      "ssh -t root@app-1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --timestamps --tail 123 --follow 2>&1 | grep \"Completed\"'",
      new_command.follow_logs(host: "app-1", lines: 123, grep: "Completed")

    assert_equal \
-      "ssh -t root@app-1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --tail 123 --follow 2>&1 | grep \"Completed\"'",
+      "ssh -t root@app-1 -p 22 'sh -c '\\''docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''\\'\\'''\\''{{.ID}}'\\''\\'\\'''\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting'\\'' | head -1 | xargs docker logs --tail 123 --follow 2>&1 | grep \"Completed\"'",
      new_command.follow_logs(host: "app-1", timestamps: false, lines: 123, grep: "Completed")
  end


  test "execute in new container" do
    assert_equal \
-      "docker run --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env --log-opt max-size=\"10m\" dhh/app:999 bin/rails db:setup",
-      new_command.execute_in_new_container("bin/rails", "db:setup", env: {}).join(" ")
-  end
-
-  test "execute in new container with logging" do
-    @config[:logging] = { "driver" => "local", "options" => { "max-size" => "100m", "max-file" => "3" } }
-
-    assert_equal \
-      "docker run --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env --log-driver \"local\" --log-opt max-size=\"100m\" --log-opt max-file=\"3\" dhh/app:999 bin/rails db:setup",
+      "docker run --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env dhh/app:999 bin/rails db:setup",
      new_command.execute_in_new_container("bin/rails", "db:setup", env: {}).join(" ")
  end

  test "execute in new container with env" do
    assert_equal \
-      "docker run --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env --env foo=\"bar\" --log-opt max-size=\"10m\" dhh/app:999 bin/rails db:setup",
+      "docker run --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env --env foo=\"bar\" dhh/app:999 bin/rails db:setup",
      new_command.execute_in_new_container("bin/rails", "db:setup", env: { "foo" => "bar" }).join(" ")
  end

-  test "execute in new detached container" do
-    assert_equal \
-      "docker run --detach --network kamal --env-file .kamal/apps/app/env/roles/web.env --log-opt max-size=\"10m\" dhh/app:999 bin/rails db:setup",
-      new_command.execute_in_new_container("bin/rails", "db:setup", detach: true, env: {}).join(" ")
-  end
-
  test "execute in new container with tags" do
    @config[:servers] = [ { "1.1.1.1" => "tag1" } ]
    @config[:env]["tags"] = { "tag1" => { "ENV1" => "value1" } }

    assert_equal \
-      "docker run --rm --network kamal --env ENV1=\"value1\" --env-file .kamal/apps/app/env/roles/web.env --log-opt max-size=\"10m\" dhh/app:999 bin/rails db:setup",
+      "docker run --rm --network kamal --env ENV1=\"value1\" --env-file .kamal/apps/app/env/roles/web.env dhh/app:999 bin/rails db:setup",
      new_command.execute_in_new_container("bin/rails", "db:setup", env: {}).join(" ")
  end

  test "execute in new container with custom options" do
    @config[:servers] = { "web" => { "hosts" => [ "1.1.1.1" ], "options" => { "mount" => "somewhere", "cap-add" => true } } }
    assert_equal \
-      "docker run --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env --log-opt max-size=\"10m\" --mount \"somewhere\" --cap-add dhh/app:999 bin/rails db:setup",
+      "docker run --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env --mount \"somewhere\" --cap-add dhh/app:999 bin/rails db:setup",
      new_command.execute_in_new_container("bin/rails", "db:setup", env: {}).join(" ")
  end

@@ -287,7 +239,7 @@ class CommandsAppTest < ActiveSupport::TestCase
  end

  test "execute in new container over ssh" do
-    assert_match %r{docker run -it --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env --log-opt max-size="10m" dhh/app:999 bin/rails c},
+    assert_match %r{docker run -it --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env dhh/app:999 bin/rails c},
      new_command.execute_in_new_container_over_ssh("bin/rails", "c", env: {})
  end

@@ -295,13 +247,13 @@ class CommandsAppTest < ActiveSupport::TestCase
    @config[:servers] = [ { "1.1.1.1" => "tag1" } ]
    @config[:env]["tags"] = { "tag1" => { "ENV1" => "value1" } }

-    assert_equal "ssh -t root@1.1.1.1 -p 22 'docker run -it --rm --network kamal --env ENV1=\"value1\" --env-file .kamal/apps/app/env/roles/web.env --log-opt max-size=\"10m\" dhh/app:999 bin/rails c'",
+    assert_equal "ssh -t root@1.1.1.1 -p 22 'docker run -it --rm --network kamal --env ENV1=\"value1\" --env-file .kamal/apps/app/env/roles/web.env dhh/app:999 bin/rails c'",
      new_command.execute_in_new_container_over_ssh("bin/rails", "c", env: {})
  end

  test "execute in new container with custom options over ssh" do
    @config[:servers] = { "web" => { "hosts" => [ "1.1.1.1" ], "options" => { "mount" => "somewhere", "cap-add" => true } } }
-    assert_match %r{docker run -it --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env --log-opt max-size=\"10m\" --mount \"somewhere\" --cap-add dhh/app:999 bin/rails c},
+    assert_match %r{docker run -it --rm --network kamal --env-file .kamal/apps/app/env/roles/web.env --mount \"somewhere\" --cap-add dhh/app:999 bin/rails c},
      new_command.execute_in_new_container_over_ssh("bin/rails", "c", env: {})
  end

@@ -339,16 +291,6 @@ class CommandsAppTest < ActiveSupport::TestCase
    assert_equal "ssh -J root@2.2.2.2 -t app@1.1.1.1 -p 22 'ls'", new_command.run_over_ssh("ls", host: "1.1.1.1")
  end

-  test "run over ssh with keys config" do
-    @config[:ssh] = { "keys" => [ "path_to_key.pem" ] }
-    assert_equal "ssh -i path_to_key.pem -t root@1.1.1.1 -p 22 'ls'", new_command.run_over_ssh("ls", host: "1.1.1.1")
-  end
-
-  test "run over ssh with keys config with keys_only" do
-    @config[:ssh] = { "keys" => [ "path_to_key.pem" ], "keys_only" => true }
-    assert_equal "ssh -i path_to_key.pem -o IdentitiesOnly=yes -t root@1.1.1.1 -p 22 'ls'", new_command.run_over_ssh("ls", host: "1.1.1.1")
-  end
-
  test "run over ssh with proxy_command" do
    @config[:ssh] = { "proxy_command" => "ssh -W %h:%p user@proxy-server" }
    assert_equal "ssh -o ProxyCommand='ssh -W %h:%p user@proxy-server' -t root@1.1.1.1 -p 22 'ls'", new_command.run_over_ssh("ls", host: "1.1.1.1")
@@ -356,7 +298,7 @@ class CommandsAppTest < ActiveSupport::TestCase

  test "current_running_container_id" do
    assert_equal \
-    "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1",
+    "sh -c 'docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --quiet --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1",
      new_command.current_running_container_id.join(" ")
  end

@@ -375,23 +317,23 @@ class CommandsAppTest < ActiveSupport::TestCase

  test "current_running_version" do
    assert_equal \
-      "sh -c 'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting' | head -1 | while read line; do echo ${line#app-web-}; done",
+      "sh -c 'docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --filter ancestor=$(docker image ls --filter reference=dhh/app:latest --format '\\''{{.ID}}'\\'') ; docker ps --latest --format '\\''{{.Names}}'\\'' --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting' | head -1 | while read line; do echo ${line#app-web-}; done",
      new_command.current_running_version.join(" ")
  end

  test "list_versions" do
    assert_equal \
-      "docker ps --filter label=service=app --filter label=destination= --filter label=role=web --format \"{{.Names}}\" | while read line; do echo ${line#app-web-}; done",
+      "docker ps --filter label=service=app --filter label=role=web --format \"{{.Names}}\" | while read line; do echo ${line#app-web-}; done",
      new_command.list_versions.join(" ")

    assert_equal \
-      "docker ps --filter label=service=app --filter label=destination= --filter label=role=web --filter status=running --filter status=restarting --latest --format \"{{.Names}}\" | while read line; do echo ${line#app-web-}; done",
+      "docker ps --filter label=service=app --filter label=role=web --filter status=running --filter status=restarting --latest --format \"{{.Names}}\" | while read line; do echo ${line#app-web-}; done",
      new_command.list_versions("--latest", statuses: [ :running, :restarting ]).join(" ")
  end

  test "list_containers" do
    assert_equal \
-      "docker container ls --all --filter label=service=app --filter label=destination= --filter label=role=web",
+      "docker container ls --all --filter label=service=app --filter label=role=web",
      new_command.list_containers.join(" ")
  end

@@ -404,7 +346,7 @@ class CommandsAppTest < ActiveSupport::TestCase

  test "list_container_names" do
    assert_equal \
-      "docker container ls --all --filter label=service=app --filter label=destination= --filter label=role=web --format '{{ .Names }}'",
+      "docker container ls --all --filter label=service=app --filter label=role=web --format '{{ .Names }}'",
      new_command.list_container_names.join(" ")
  end

@@ -423,7 +365,7 @@ class CommandsAppTest < ActiveSupport::TestCase

  test "remove_containers" do
    assert_equal \
-      "docker container prune --force --filter label=service=app --filter label=destination= --filter label=role=web",
+      "docker container prune --force --filter label=service=app --filter label=role=web",
      new_command.remove_containers.join(" ")
  end

@@ -442,14 +384,14 @@ class CommandsAppTest < ActiveSupport::TestCase

  test "remove_images" do
    assert_equal \
-      "docker image prune --all --force --filter label=service=app",
+      "docker image prune --all --force --filter label=service=app --filter label=role=web",
      new_command.remove_images.join(" ")
  end

  test "remove_images with destination" do
    @destination = "staging"
    assert_equal \
-      "docker image prune --all --force --filter label=service=app",
+      "docker image prune --all --force --filter label=service=app --filter label=destination=staging --filter label=role=web",
      new_command.remove_images.join(" ")
  end

@@ -469,10 +411,10 @@ class CommandsAppTest < ActiveSupport::TestCase
  test "extract assets" do
    assert_equal [
      :mkdir, "-p", ".kamal/apps/app/assets/extracted/web-999", "&&",
-      :docker, :container, :rm, "app-web-assets", "2> /dev/null", "|| true", "&&",
-      :docker, :container, :create, "--name", "app-web-assets", "dhh/app:999", "&&",
-      :docker, :container, :cp, "-L", "app-web-assets:/public/assets/.", ".kamal/apps/app/assets/extracted/web-999", "&&",
-      :docker, :container, :rm, "app-web-assets"
+      :docker, :stop, "-t 1", "app-web-assets", "2> /dev/null", "|| true", "&&",
+      :docker, :run, "--name", "app-web-assets", "--detach", "--rm", "--entrypoint", "sleep", "dhh/app:999", "1000000", "&&",
+      :docker, :cp, "-L", "app-web-assets:/public/assets/.", ".kamal/apps/app/assets/extracted/web-999", "&&",
+      :docker, :stop, "-t 1", "app-web-assets"
    ], new_command(asset_path: "/public/assets").extract_assets
  end

--- a/test/commands/builder_test.rb
+++ b/test/commands/builder_test.rb
@@ -9,7 +9,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
    builder = new_builder_command(builder: { "cache" => { "type" => "gha" } })
    assert_equal "local", builder.name
    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
+      "docker buildx build --push --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
      builder.push.join(" ")
  end

@@ -17,7 +17,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
    builder = new_builder_command(builder: { "arch" => [ "amd64" ] })
    assert_equal "local", builder.name
    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile .",
+      "docker buildx build --push --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile .",
      builder.push.join(" ")
  end

@@ -25,7 +25,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
    builder = new_builder_command(builder: { "cache" => { "type" => "gha" } })
    assert_equal "local", builder.name
    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
+      "docker buildx build --push --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
      builder.push.join(" ")
  end

@@ -33,7 +33,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
    builder = new_builder_command(builder: { "arch" => [ "amd64", "arm64" ], "remote" => "ssh://app@127.0.0.1", "cache" => { "type" => "gha" } })
    assert_equal "hybrid", builder.name
    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/amd64,linux/arm64 --builder kamal-hybrid-docker-container-ssh---app-127-0-0-1 -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
+      "docker buildx build --push --platform linux/amd64,linux/arm64 --builder kamal-hybrid-docker-container-ssh---app-127-0-0-1 -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
      builder.push.join(" ")
  end

@@ -41,7 +41,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
    builder = new_builder_command(builder: { "arch" => [ "amd64", "arm64" ], "remote" => "ssh://app@127.0.0.1", "cache" => { "type" => "gha" }, "local" => false })
    assert_equal "remote", builder.name
    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/amd64,linux/arm64 --builder kamal-remote-ssh---app-127-0-0-1 -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
+      "docker buildx build --push --platform linux/amd64,linux/arm64 --builder kamal-remote-ssh---app-127-0-0-1 -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
      builder.push.join(" ")
  end

@@ -49,7 +49,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
    builder = new_builder_command(builder: { "arch" => [ "#{remote_arch}" ], "remote" => "ssh://app@host", "cache" => { "type" => "gha" } })
    assert_equal "remote", builder.name
    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/#{remote_arch} --builder kamal-remote-ssh---app-host -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
+      "docker buildx build --push --platform linux/#{remote_arch} --builder kamal-remote-ssh---app-host -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
      builder.push.join(" ")
  end

@@ -57,22 +57,14 @@ class CommandsBuilderTest < ActiveSupport::TestCase
    builder = new_builder_command(builder: { "arch" => [ "#{local_arch}" ], "remote" => "ssh://app@host", "cache" => { "type" => "gha" } })
    assert_equal "local", builder.name
    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/#{local_arch} --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
-      builder.push.join(" ")
-  end
-
-  test "cloud builder" do
-    builder = new_builder_command(builder: { "arch" => [ "#{local_arch}" ], "driver" => "cloud docker-org-name/builder-name" })
-    assert_equal "cloud", builder.name
-    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/#{local_arch} --builder cloud-docker-org-name-builder-name -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile .",
+      "docker buildx build --push --platform linux/#{local_arch} --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --cache-to type=gha --cache-from type=gha --label service=\"app\" --file Dockerfile .",
      builder.push.join(" ")
  end

  test "build args" do
    builder = new_builder_command(builder: { "args" => { "a" => 1, "b" => 2 } })
    assert_equal \
-      "--label service=\"app\" --build-arg a=\"1\" --build-arg b=\"2\" --file Dockerfile",
+      "-t dhh/app:123 -t dhh/app:latest --label service=\"app\" --build-arg a=\"1\" --build-arg b=\"2\" --file Dockerfile",
      builder.target.build_options.join(" ")
  end

@@ -81,7 +73,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
      FileUtils.touch("Dockerfile")
      builder = new_builder_command(builder: { "secrets" => [ "token_a", "token_b" ] })
      assert_equal \
-        "--label service=\"app\" --secret id=\"token_a\" --secret id=\"token_b\" --file Dockerfile",
+        "-t dhh/app:123 -t dhh/app:latest --label service=\"app\" --secret id=\"token_a\" --secret id=\"token_b\" --file Dockerfile",
        builder.target.build_options.join(" ")
    end
  end
@@ -90,7 +82,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
    Pathname.any_instance.expects(:exist?).returns(true).once
    builder = new_builder_command(builder: { "dockerfile" => "Dockerfile.xyz" })
    assert_equal \
-      "--label service=\"app\" --file Dockerfile.xyz",
+      "-t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile.xyz",
      builder.target.build_options.join(" ")
  end

@@ -105,21 +97,21 @@ class CommandsBuilderTest < ActiveSupport::TestCase
  test "build target" do
    builder = new_builder_command(builder: { "target" => "prod" })
    assert_equal \
-      "--label service=\"app\" --file Dockerfile --target prod",
+      "-t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile --target prod",
      builder.target.build_options.join(" ")
  end

  test "build context" do
    builder = new_builder_command(builder: { "context" => ".." })
    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile ..",
+      "docker buildx build --push --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile ..",
      builder.push.join(" ")
  end

  test "push with build args" do
    builder = new_builder_command(builder: { "args" => { "a" => 1, "b" => 2 } })
    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --build-arg a=\"1\" --build-arg b=\"2\" --file Dockerfile .",
+      "docker buildx build --push --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --build-arg a=\"1\" --build-arg b=\"2\" --file Dockerfile .",
      builder.push.join(" ")
  end

@@ -128,7 +120,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
      FileUtils.touch("Dockerfile")
      builder = new_builder_command(builder: { "secrets" => [ "a", "b" ] })
      assert_equal \
-        "docker buildx build --output=type=registry --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --secret id=\"a\" --secret id=\"b\" --file Dockerfile .",
+        "docker buildx build --push --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --secret id=\"a\" --secret id=\"b\" --file Dockerfile .",
        builder.push.join(" ")
    end
  end
@@ -137,7 +129,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
    builder = new_builder_command(builder: { "ssh" => "default=$SSH_AUTH_SOCK" })

    assert_equal \
-      "--label service=\"app\" --file Dockerfile --ssh default=$SSH_AUTH_SOCK",
+      "-t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile --ssh default=$SSH_AUTH_SOCK",
      builder.target.build_options.join(" ")
  end

@@ -148,35 +140,7 @@ class CommandsBuilderTest < ActiveSupport::TestCase
  test "context build" do
    builder = new_builder_command(builder: { "context" => "./foo" })
    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile ./foo",
-      builder.push.join(" ")
-  end
-
-  test "push with provenance" do
-    builder = new_builder_command(builder: { "provenance" => "mode=max" })
-    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile --provenance mode=max .",
-      builder.push.join(" ")
-  end
-
-  test "push with provenance false" do
-    builder = new_builder_command(builder: { "provenance" => false })
-    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile --provenance false .",
-      builder.push.join(" ")
-  end
-
-  test "push with sbom" do
-    builder = new_builder_command(builder: { "sbom" => true })
-    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile --sbom true .",
-      builder.push.join(" ")
-  end
-
-  test "push with sbom false" do
-    builder = new_builder_command(builder: { "sbom" => false })
-    assert_equal \
-      "docker buildx build --output=type=registry --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile --sbom false .",
+      "docker buildx build --push --platform linux/amd64 --builder kamal-local-docker-container -t dhh/app:123 -t dhh/app:latest --label service=\"app\" --file Dockerfile ./foo",
      builder.push.join(" ")
  end

@@ -185,26 +149,15 @@ class CommandsBuilderTest < ActiveSupport::TestCase
    assert_equal "docker info --format '{{index .RegistryConfig.Mirrors 0}}'", command.first_mirror.join(" ")
  end

-  test "clone path with spaces" do
-    command = new_builder_command
-    Kamal::Git.stubs(:root).returns("/absolute/path with spaces")
-    clone_command = command.clone.join(" ")
-    clone_reset_commands = command.clone_reset_steps.map { |a| a.join(" ") }
-
-    assert_match(%r{path\\ with\\ space}, clone_command)
-    assert_no_match(%r{path with spaces}, clone_command)
-
-    clone_reset_commands.each do |command|
-      assert_match(%r{path\\ with\\ space}, command)
-      assert_no_match(%r{path with spaces}, command)
-    end
-  end
-
  private
    def new_builder_command(additional_config = {})
      Kamal::Commands::Builder.new(Kamal::Configuration.new(@config.deep_merge(additional_config), version: "123"))
    end

+    def build_directory
+      "#{Dir.tmpdir}/kamal-clones/app/kamal/"
+    end
+
    def local_arch
      Kamal::Utils.docker_arch
    end
--- a/test/commands/proxy_test.rb
+++ b/test/commands/proxy_test.rb
@@ -15,7 +15,7 @@ class CommandsProxyTest < ActiveSupport::TestCase

  test "run" do
    assert_equal \
-      "docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443 --log-opt max-size=10m\") basecamp/kamal-proxy:#{Kamal::Configuration::PROXY_MINIMUM_VERSION}",
+      "docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443\") basecamp/kamal-proxy:#{Kamal::Configuration::PROXY_MINIMUM_VERSION}",
      new_command.run.join(" ")
  end

@@ -23,7 +23,7 @@ class CommandsProxyTest < ActiveSupport::TestCase
    @config.delete(:proxy)

    assert_equal \
-      "docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443 --log-opt max-size=10m\") basecamp/kamal-proxy:#{Kamal::Configuration::PROXY_MINIMUM_VERSION}",
+      "docker run --name kamal-proxy --network kamal --detach --restart unless-stopped --volume kamal-proxy-config:/home/kamal-proxy/.config/kamal-proxy $(cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443\") basecamp/kamal-proxy:#{Kamal::Configuration::PROXY_MINIMUM_VERSION}",
      new_command.run.join(" ")
  end

@@ -113,7 +113,7 @@ class CommandsProxyTest < ActiveSupport::TestCase

  test "get_boot_options" do
    assert_equal \
-      "cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443 --log-opt max-size=10m\"",
+      "cat .kamal/proxy/options || echo \"--publish 80:80 --publish 443:443\"",
      new_command.get_boot_options.join(" ")
  end

--- a/test/commands/registry_test.rb
+++ b/test/commands/registry_test.rb
@@ -2,27 +2,14 @@ require "test_helper"

 class CommandsRegistryTest < ActiveSupport::TestCase
  setup do
-    @config = {
-      service: "app",
+    @config = { service: "app",
      image: "dhh/app",
-      registry: {
-        "username" => "dhh",
+      registry: { "username" => "dhh",
        "password" => "secret",
        "server" => "hub.docker.com"
      },
      builder: { "arch" => "amd64" },
-      servers: [ "1.1.1.1" ],
-      accessories: {
-        "db" => {
-          "image" => "mysql:8.0",
-          "hosts" => [ "1.1.1.1" ],
-          "registry" => {
-            "username" => "user",
-            "password" => "pw",
-            "server" => "other.hub.docker.com"
-          }
-        }
-      }
+      servers: [ "1.1.1.1" ]
    }
  end

@@ -32,24 +19,13 @@ class CommandsRegistryTest < ActiveSupport::TestCase
      registry.login.join(" ")
  end

-  test "given registry login" do
-    assert_equal \
-      "docker login other.hub.docker.com -u \"user\" -p \"pw\"",
-      registry.login(registry_config: accessory_registry_config).join(" ")
-  end
-
  test "registry login with ENV password" do
-    with_test_secrets("secrets" => "KAMAL_REGISTRY_PASSWORD=more-secret\nKAMAL_MYSQL_REGISTRY_PASSWORD=secret-pw") do
+    with_test_secrets("secrets" => "KAMAL_REGISTRY_PASSWORD=more-secret") do
      @config[:registry]["password"] = [ "KAMAL_REGISTRY_PASSWORD" ]
-      @config[:accessories]["db"]["registry"]["password"] = [ "KAMAL_MYSQL_REGISTRY_PASSWORD" ]

      assert_equal \
        "docker login hub.docker.com -u \"dhh\" -p \"more-secret\"",
        registry.login.join(" ")
-
-      assert_equal \
-        "docker login other.hub.docker.com -u \"user\" -p \"secret-pw\"",
-        registry.login(registry_config: accessory_registry_config).join(" ")
    end
  end

@@ -79,22 +55,8 @@ class CommandsRegistryTest < ActiveSupport::TestCase
      registry.logout.join(" ")
  end

-  test "given registry logout" do
-    assert_equal \
-      "docker logout other.hub.docker.com",
-      registry.logout(registry_config: accessory_registry_config).join(" ")
-  end
-
  private
    def registry
-      Kamal::Commands::Registry.new main_config
-    end
-
-    def main_config
-      Kamal::Configuration.new(@config)
-    end
-
-    def accessory_registry_config
-      main_config.accessory("db").registry
+      Kamal::Commands::Registry.new Kamal::Configuration.new(@config)
    end
 end
--- a/test/configuration/accessory_test.rb
+++ b/test/configuration/accessory_test.rb
@@ -3,9 +3,7 @@ require "test_helper"
 class ConfigurationAccessoryTest < ActiveSupport::TestCase
  setup do
    @deploy = {
-      service: "app",
-      image: "dhh/app",
-      registry: { "username" => "dhh", "password" => "secret" },
+      service: "app", image: "dhh/app", registry: { "username" => "dhh", "password" => "secret" },
      servers: {
        "web" => [ "1.1.1.1", "1.1.1.2" ],
        "workers" => [ "1.1.1.3", "1.1.1.4" ]
@@ -14,7 +12,7 @@ class ConfigurationAccessoryTest < ActiveSupport::TestCase
      env: { "REDIS_URL" => "redis://x/y" },
      accessories: {
        "mysql" => {
-          "image" => "public.registry/mysql:8.0",
+          "image" => "mysql:8.0",
          "host" => "1.1.1.5",
          "port" => "3306",
          "env" => {
@@ -54,7 +52,6 @@ class ConfigurationAccessoryTest < ActiveSupport::TestCase
        "monitoring" => {
          "service" => "custom-monitoring",
          "image" => "monitoring:latest",
-          "registry" => { "server" => "other.registry", "username" => "user", "password" => "pw" },
          "roles" => [ "web" ],
          "port" => "4321:4321",
          "labels" => {
@@ -66,9 +63,6 @@ class ConfigurationAccessoryTest < ActiveSupport::TestCase
          "options" => {
            "cpus" => "4",
            "memory" => "2GB"
-          },
-          "proxy" => {
-            "host" => "monitoring.example.com"
          }
        }
      }
@@ -83,21 +77,6 @@ class ConfigurationAccessoryTest < ActiveSupport::TestCase
    assert_equal "custom-monitoring", @config.accessory(:monitoring).service_name
  end

-  test "image" do
-    assert_equal "public.registry/mysql:8.0", @config.accessory(:mysql).image
-    assert_equal "redis:latest", @config.accessory(:redis).image
-    assert_equal "other.registry/monitoring:latest", @config.accessory(:monitoring).image
-  end
-
-  test "registry" do
-    assert_nil @config.accessory(:mysql).registry
-    assert_nil @config.accessory(:redis).registry
-    monitoring_registry = @config.accessory(:monitoring).registry
-    assert_equal "other.registry", monitoring_registry.server
-    assert_equal "user", monitoring_registry.username
-    assert_equal "pw", monitoring_registry.password
-  end
-
  test "port" do
    assert_equal "3306:3306", @config.accessory(:mysql).port
    assert_equal "6379:6379", @config.accessory(:redis).port
@@ -173,18 +152,4 @@ class ConfigurationAccessoryTest < ActiveSupport::TestCase
  test "options" do
    assert_equal [ "--cpus", "\"4\"", "--memory", "\"2GB\"" ], @config.accessory(:redis).option_args
  end
-
-  test "network_args default" do
-    assert_equal [ "--network", "kamal" ], @config.accessory(:mysql).network_args
-  end
-
-  test "network_args with configured options" do
-    @deploy[:accessories]["mysql"]["network"] = "database"
-    assert_equal [ "--network", "database" ], @config.accessory(:mysql).network_args
-  end
-
-  test "proxy" do
-    assert @config.accessory(:monitoring).running_proxy?
-    assert_equal [ "monitoring.example.com" ], @config.accessory(:monitoring).proxy.hosts
-  end
 end
--- a/test/configuration/boot_test.rb
+++ b/test/configuration/boot_test.rb
@@ -1,54 +0,0 @@
-require "test_helper"
-
-class ConfigurationBootTest < ActiveSupport::TestCase
-  test "no group strategy" do
-    deploy = {
-      service: "app", image: "dhh/app", registry: { "username" => "dhh", "password" => "secret" }, builder: { "arch" => "amd64" },
-      servers: { "web" => [ "1.1.1.1", "1.1.1.2" ], "workers" => [ "1.1.1.3", "1.1.1.4" ] }
-    }
-
-    config = Kamal::Configuration.new(deploy)
-
-    assert_nil config.boot.limit
-    assert_nil config.boot.wait
-  end
-
-  test "specific limit group strategy" do
-    deploy = {
-      service: "app", image: "dhh/app", registry: { "username" => "dhh", "password" => "secret" }, builder: { "arch" => "amd64" },
-      servers: { "web" => [ "1.1.1.1", "1.1.1.2" ], "workers" => [ "1.1.1.3", "1.1.1.4" ] },
-      boot: { "limit" => 3, "wait" => 2 }
-    }
-
-    config = Kamal::Configuration.new(deploy)
-
-    assert_equal 3, config.boot.limit
-    assert_equal 2, config.boot.wait
-  end
-
-  test "percentage-based group strategy" do
-    deploy = {
-      service: "app", image: "dhh/app", registry: { "username" => "dhh", "password" => "secret" }, builder: { "arch" => "amd64" },
-      servers: { "web" => [ "1.1.1.1", "1.1.1.2" ], "workers" => [ "1.1.1.3", "1.1.1.4" ] },
-      boot: { "limit" => "50%", "wait" => 2 }
-    }
-
-    config = Kamal::Configuration.new(deploy)
-
-    assert_equal 2, config.boot.limit
-    assert_equal 2, config.boot.wait
-  end
-
-  test "percentage-based group strategy limit is at least 1" do
-    deploy = {
-      service: "app", image: "dhh/app", registry: { "username" => "dhh", "password" => "secret" }, builder: { "arch" => "amd64" },
-      servers: { "web" => [ "1.1.1.1", "1.1.1.2" ], "workers" => [ "1.1.1.3", "1.1.1.4" ] },
-      boot: { "limit" => "1%", "wait" => 2 }
-    }
-
-    config = Kamal::Configuration.new(deploy)
-
-    assert_equal 1, config.boot.limit
-    assert_equal 2, config.boot.wait
-  end
-end
--- a/test/configuration/builder_test.rb
+++ b/test/configuration/builder_test.rb
@@ -64,7 +64,7 @@ class ConfigurationBuilderTest < ActiveSupport::TestCase
    @deploy[:builder] = { "arch" => "amd64", "cache" => { "type" => "registry", "options" => "mode=max,image-manifest=true,oci-mediatypes=true" } }

    assert_equal "type=registry,ref=dhh/app-build-cache", config.builder.cache_from
-    assert_equal "type=registry,ref=dhh/app-build-cache,mode=max,image-manifest=true,oci-mediatypes=true", config.builder.cache_to
+    assert_equal "type=registry,mode=max,image-manifest=true,oci-mediatypes=true,ref=dhh/app-build-cache", config.builder.cache_to
  end

  test "setting registry cache when using a custom registry" do
@@ -72,14 +72,14 @@ class ConfigurationBuilderTest < ActiveSupport::TestCase
    @deploy[:builder] = { "arch" => "amd64", "cache" => { "type" => "registry", "options" => "mode=max,image-manifest=true,oci-mediatypes=true" } }

    assert_equal "type=registry,ref=registry.example.com/dhh/app-build-cache", config.builder.cache_from
-    assert_equal "type=registry,ref=registry.example.com/dhh/app-build-cache,mode=max,image-manifest=true,oci-mediatypes=true", config.builder.cache_to
+    assert_equal "type=registry,mode=max,image-manifest=true,oci-mediatypes=true,ref=registry.example.com/dhh/app-build-cache", config.builder.cache_to
  end

  test "setting registry cache with image" do
    @deploy[:builder] = { "arch" => "amd64", "cache" => { "type" => "registry", "image" => "kamal", "options" => "mode=max" } }

    assert_equal "type=registry,ref=kamal", config.builder.cache_from
-    assert_equal "type=registry,ref=kamal,mode=max", config.builder.cache_to
+    assert_equal "type=registry,mode=max,ref=kamal", config.builder.cache_to
  end

  test "args" do
@@ -134,26 +134,6 @@ class ConfigurationBuilderTest < ActiveSupport::TestCase
    assert_equal "default=$SSH_AUTH_SOCK", config.builder.ssh
  end

-  test "provenance" do
-    assert_nil config.builder.provenance
-  end
-
-  test "setting provenance" do
-    @deploy[:builder]["provenance"] = "mode=max"
-
-    assert_equal "mode=max", config.builder.provenance
-  end
-
-  test "sbom" do
-    assert_nil config.builder.sbom
-  end
-
-  test "setting sbom" do
-    @deploy[:builder]["sbom"] = true
-
-    assert_equal true, config.builder.sbom
-  end
-
  test "local disabled but no remote set" do
    @deploy[:builder]["local"] = false

--- a/test/configuration/proxy_test.rb
+++ b/test/configuration/proxy_test.rb
@@ -13,29 +13,15 @@ class ConfigurationProxyTest < ActiveSupport::TestCase
    assert_equal true, config.proxy.ssl?
  end

-  test "ssl with multiple hosts passed via host" do
-    @deploy[:proxy] = { "ssl" => true, "host" => "example.com,anotherexample.com" }
-    assert_equal true, config.proxy.ssl?
-  end
-
-  test "ssl with multiple hosts passed via hosts" do
-    @deploy[:proxy] = { "ssl" => true, "hosts" => [ "example.com", "anotherexample.com" ] }
-    assert_equal true, config.proxy.ssl?
-  end
-
  test "ssl with no host" do
    @deploy[:proxy] = { "ssl" => true }
    assert_raises(Kamal::ConfigurationError) { config.proxy.ssl? }
  end

-  test "ssl with both host and hosts" do
-    @deploy[:proxy] = { "ssl" => true, host: "example.com", hosts: [ "anotherexample.com" ] }
-    assert_raises(Kamal::ConfigurationError) { config.proxy.ssl? }
-  end
-
  test "ssl false" do
    @deploy[:proxy] = { "ssl" => false }
    assert_not config.proxy.ssl?
+    assert_not config.proxy.deploy_options.has_key?(:tls)
  end

  private
--- a/test/configuration_test.rb
+++ b/test/configuration_test.rb
@@ -222,13 +222,6 @@ class ConfigurationTest < ActiveSupport::TestCase
    assert_equal "my-user", config.registry.username
  end

-  test "destination is loaded into env" do
-    dest_config_file = Pathname.new(File.expand_path("fixtures/deploy_for_dest.yml", __dir__))
-
-    config = Kamal::Configuration.create_from config_file: dest_config_file, destination: "world"
-    assert_equal ENV["KAMAL_DESTINATION"], "world"
-  end
-
  test "destination yml config merge" do
    dest_config_file = Pathname.new(File.expand_path("fixtures/deploy_for_dest.yml", __dir__))

@@ -384,15 +377,4 @@ class ConfigurationTest < ActiveSupport::TestCase

    assert_equal "Different roles can't share the same host for SSL: foo.example.com", exception.message
  end
-
-  test "two proxy ssl roles with same host in a hosts array" do
-    @deploy_with_roles[:servers]["web"] = { "hosts" => [ "1.1.1.1" ], "proxy" => { "ssl" => true, "hosts" => [ "foo.example.com", "bar.example.com" ] } }
-    @deploy_with_roles[:servers]["workers"] = { "hosts" => [ "1.1.1.1" ], "proxy" => { "ssl" => true, "hosts" => [ "www.example.com", "foo.example.com" ] } }
-
-    exception = assert_raises(Kamal::ConfigurationError) do
-      Kamal::Configuration.new(@deploy_with_roles)
-    end
-
-    assert_equal "Different roles can't share the same host for SSL: foo.example.com", exception.message
-  end
 end
--- a/test/env_file_test.rb
+++ b/test/env_file_test.rb
@@ -11,16 +11,6 @@ class EnvFileTest < ActiveSupport::TestCase
      Kamal::EnvFile.new(env).to_s
  end

-  test "to_s won't escape '#'" do
-    env = {
-      "foo" => '#$foo',
-      "bar" => '#{bar}'
-    }
-
-    assert_equal "foo=\#$foo\nbar=\#{bar}\n", \
-      Kamal::EnvFile.new(env).to_s
-  end
-
  test "to_str won't escape chinese characters" do
    env = {
      "foo" => '你好 means hello, "欢迎" means welcome, that\'s simple! 😃 {smile}'
--- a/test/fixtures/deploy.elsewhere.yml
+++ b/test/fixtures/deploy.elsewhere.yml
@@ -1,12 +0,0 @@
-service: app3
-image: dhh/app3
-servers:
-  - "1.1.1.3"
-  - "1.1.1.4"
-registry:
-  username: user
-  password: pw
-builder:
-  arch: amd64
-aliases:
-  other_config: config -c config/deploy2.yml
--- a/test/fixtures/deploy.yml
+++ b/test/fixtures/deploy.yml
@@ -1,13 +0,0 @@
-service: app
-image: dhh/app
-servers:
-  - "1.1.1.1"
-  - "1.1.1.2"
-registry:
-  username: user
-  password: pw
-builder:
-  arch: amd64
-aliases:
-  other_config: config -c config/deploy2.yml
-  other_destination_config: config -d elsewhere
--- a/test/fixtures/deploy2.yml
+++ b/test/fixtures/deploy2.yml
@@ -1,12 +0,0 @@
-service: app2
-image: dhh/app2
-servers:
-  - "1.1.1.1"
-  - "1.1.1.2"
-registry:
-  username: user2
-  password: pw2
-builder:
-  arch: amd64
-aliases:
-  other_config: config -c config/deploy2.yml
--- a/test/fixtures/deploy_with_accessories_on_independent_server.yml
+++ b/test/fixtures/deploy_with_accessories_on_independent_server.yml
@@ -1,38 +0,0 @@
-service: app
-image: dhh/app
-servers:
-  web:
-    - "1.1.1.1"
-    - "1.1.1.2"
-  workers:
-    - "1.1.1.3"
-    - "1.1.1.4"
-registry:
-  username: user
-  password: pw
-builder:
-  arch: amd64
-
-accessories:
-  mysql:
-    image: mysql:5.7
-    host: 1.1.1.5
-    port: 3306
-    env:
-      clear:
-        MYSQL_ROOT_HOST: '%'
-      secret:
-        - MYSQL_ROOT_PASSWORD
-    files:
-      - test/fixtures/files/my.cnf:/etc/mysql/my.cnf
-    directories:
-      - data:/var/lib/mysql
-  redis:
-    image: redis:latest
-    roles:
-      - web
-    port: 6379
-    directories:
-      - data:/data
-
-readiness_delay: 0
--- a/test/fixtures/deploy_with_accessories_with_different_registries.yml
+++ b/test/fixtures/deploy_with_accessories_with_different_registries.yml
@@ -1,47 +0,0 @@
-service: app
-image: dhh/app
-servers:
-  web:
-    - "1.1.1.1"
-    - "1.1.1.2"
-  workers:
-    - "1.1.1.3"
-    - "1.1.1.4"
-registry:
-  server: private.registry
-  username: user
-  password: pw
-builder:
-  arch: amd64
-
-accessories:
-  mysql:
-    image: private.registry/mysql:5.7
-    host: 1.1.1.3
-    port: 3306
-    env:
-      clear:
-        MYSQL_ROOT_HOST: '%'
-      secret:
-        - MYSQL_ROOT_PASSWORD
-    files:
-      - test/fixtures/files/my.cnf:/etc/mysql/my.cnf
-    directories:
-      - data:/var/lib/mysql
-  redis:
-    image: redis:latest
-    roles:
-      - web
-    port: 6379
-    directories:
-      - data:/data
-  busybox:
-    service: custom-box
-    image: busybox:latest
-    host: 1.1.1.3
-    registry:
-      server: other.registry
-      username: other_user
-      password: other_pw
-
-readiness_delay: 0
--- a/test/fixtures/deploy_with_aliases.yml
+++ b/test/fixtures/deploy_with_aliases.yml
@@ -21,6 +21,3 @@ aliases:
  console: app exec --reuse -p -r console "bin/console"
  exec: app exec --reuse -p -r console
  rails: app exec --reuse -p -r console rails
-  primary_details: details -p
-  deploy_secondary: deploy -d secondary
-
--- a/test/fixtures/deploy_with_cloud_builder.yml
+++ b/test/fixtures/deploy_with_cloud_builder.yml
@@ -1,40 +0,0 @@
-service: app
-image: dhh/app
-servers:
-  web:
-    - "1.1.1.1"
-    - "1.1.1.2"
-  workers:
-    - "1.1.1.3"
-    - "1.1.1.4"
-registry:
-  username: user
-  password: pw
-
-accessories:
-  mysql:
-    image: mysql:5.7
-    host: 1.1.1.3
-    port: 3306
-    env:
-      clear:
-        MYSQL_ROOT_HOST: '%'
-      secret:
-        - MYSQL_ROOT_PASSWORD
-    files:
-      - test/fixtures/files/my.cnf:/etc/mysql/my.cnf
-    directories:
-      - data:/var/lib/mysql
-  redis:
-    image: redis:latest
-    roles:
-      - web
-    port: 6379
-    directories:
-      - data:/data
-
-readiness_delay: 0
-
-builder:
-  arch: <%= Kamal::Utils.docker_arch == "arm64" ? "amd64" : "arm64" %>
-  driver: cloud example_org/cloud_builder
--- a/test/fixtures/deploy_with_low_percentage_boot_strategy.yml
+++ b/test/fixtures/deploy_with_low_percentage_boot_strategy.yml
@@ -0,0 +1,19 @@
+service: app
+image: dhh/app
+servers:
+  web:
+    - "1.1.1.1"
+    - "1.1.1.2"
+  workers:
+    - "1.1.1.3"
+    - "1.1.1.4"
+builder:
+  arch: amd64
+
+registry:
+  username: user
+  password: pw
+
+boot:
+  limit: 1%
+  wait: 2
--- a/test/fixtures/deploy_with_percentage_boot_strategy.yml
+++ b/test/fixtures/deploy_with_percentage_boot_strategy.yml
@@ -0,0 +1,19 @@
+service: app
+image: dhh/app
+servers:
+  web:
+    - "1.1.1.1"
+    - "1.1.1.2"
+  workers:
+    - "1.1.1.3"
+    - "1.1.1.4"
+builder:
+  arch: amd64
+
+registry:
+  username: user
+  password: pw
+
+boot:
+  limit: 1%
+  wait: 2
--- a/test/fixtures/deploy_with_single_accessory.yml
+++ b/test/fixtures/deploy_with_single_accessory.yml
@@ -1,29 +0,0 @@
-service: app
-image: dhh/app
-servers:
-  web:
-    - "1.1.1.1"
-    - "1.1.1.2"
-  workers:
-    - "1.1.1.3"
-    - "1.1.1.4"
-registry:
-  username: user
-  password: pw
-builder:
-  arch: amd64
-
-accessories:
-  mysql:
-    image: mysql:5.7
-    host: 1.1.1.5
-    port: 3306
-    env:
-      clear:
-        MYSQL_ROOT_HOST: '%'
-      secret:
-        - MYSQL_ROOT_PASSWORD
-    files:
-      - test/fixtures/files/my.cnf:/etc/mysql/my.cnf
-    directories:
-      - data:/var/lib/mysql
--- a/test/integration/app_test.rb
+++ b/test/integration/app_test.rb
@@ -8,16 +8,14 @@ class AppTest < IntegrationTest

    kamal :app, :stop

-    assert_app_not_found
+    assert_app_is_down

    kamal :app, :start

    # kamal app start does not wait
    wait_for_app_to_be_up

-    output = kamal :app, :boot, "--verbose", capture: true
-    assert_match "Booting app on vm1,vm2...", output
-    assert_match "Booted app on vm1,vm2...", output
+    kamal :app, :boot

    wait_for_app_to_be_up

@@ -50,7 +48,7 @@ class AppTest < IntegrationTest

    kamal :app, :remove

-    assert_app_not_found
+    assert_app_is_down
    assert_app_directory_removed
  end
 end
--- a/test/integration/docker/deployer/Dockerfile
+++ b/test/integration/docker/deployer/Dockerfile
@@ -20,7 +20,6 @@ COPY *.sh .
 COPY app/ app/
 COPY app_with_roles/ app_with_roles/
 COPY app_with_traefik/ app_with_traefik/
-COPY app_with_proxied_accessory/ app_with_proxied_accessory/

 RUN rm -rf /root/.ssh
 RUN ln -s /shared/ssh /root/.ssh
@@ -31,7 +30,6 @@ RUN git config --global user.name "Deployer"
 RUN cd app && git init && git add . && git commit -am "Initial version"
 RUN cd app_with_roles && git init && git add . && git commit -am "Initial version"
 RUN cd app_with_traefik && git init && git add . && git commit -am "Initial version"
-RUN cd app_with_proxied_accessory && git init && git add . && git commit -am "Initial version"

 HEALTHCHECK --interval=1s CMD pgrep sleep

--- a/Show More
+++ b/Show More