dash 2.12.0

data/lib/kamal/cli/proxy.rb

@@ -0,0 +1,419 @@
+class Kamal::Cli::Proxy < Kamal::Cli::Base
+  desc "boot", "Boot proxy on servers"
+  def boot
+    modify(lock: true) do
+      on(KAMAL.hosts) do |host|
+        execute *KAMAL.docker.create_network
+      rescue SSHKit::Command::Failed => e
+        raise unless e.message.include?("already exists")
+      end
+
+      # Skip proxy on loadbalancer host - the loadbalancer will handle it
+      proxy_hosts = KAMAL.proxy_hosts
+      if KAMAL.config.proxy.loadbalancer_on_proxy_host?
+        proxy_hosts = proxy_hosts - [ KAMAL.config.proxy.effective_loadbalancer ]
+      end
+
+      on(proxy_hosts) do |host|
+        execute *KAMAL.registry.login
+
+        version = capture_with_info(*KAMAL.proxy(host).version).strip.presence
+
+        if version && Kamal::Utils.older_version?(version, Kamal::Configuration::Proxy::Run::MINIMUM_VERSION)
+          raise "kamal-proxy version #{version} is too old, run `kamal proxy reboot` in order to update to at least #{Kamal::Configuration::Proxy::Run::MINIMUM_VERSION}"
+        end
+        execute *KAMAL.proxy(host).ensure_apps_config_directory
+        execute *KAMAL.proxy(host).start_or_run
+      end
+
+      if KAMAL.config.proxy.load_balancing?
+        on(KAMAL.config.proxy.effective_loadbalancer) do |host|
+          info "Starting loadbalancer on #{host}..."
+          execute *KAMAL.registry.login
+          execute *KAMAL.loadbalancer.ensure_apps_config_directory
+          execute *KAMAL.loadbalancer.start_or_run
+        end
+      end
+    end
+  end
+
+  desc "boot_config <set|get|reset>", "Manage kamal-proxy boot configuration"
+  option :publish, type: :boolean, default: true, desc: "Publish the proxy ports on the host"
+  option :publish_host_ip, type: :string, repeatable: true, default: nil, desc: "Host IP address to bind HTTP/HTTPS traffic to. Defaults to all interfaces"
+  option :http_port, type: :numeric, default: Kamal::Configuration::Proxy::Run::DEFAULT_HTTP_PORT, desc: "HTTP port to publish on the host"
+  option :https_port, type: :numeric, default: Kamal::Configuration::Proxy::Run::DEFAULT_HTTPS_PORT, desc: "HTTPS port to publish on the host"
+  option :log_max_size, type: :string, default: Kamal::Configuration::Proxy::Run::DEFAULT_LOG_MAX_SIZE, desc: "Max size of proxy logs"
+  option :registry, type: :string, default: nil, desc: "Registry to use for the proxy image"
+  option :repository, type: :string, default: nil, desc: "Repository for the proxy image"
+  option :image_version, type: :string, default: nil, desc: "Version of the proxy to run"
+  option :metrics_port, type: :numeric, default: nil, desc: "Port to report prometheus metrics on"
+  option :debug, type: :boolean, default: false, desc: "Whether to run the proxy in debug mode"
+  option :docker_options, type: :array, default: [], desc: "Docker options to pass to the proxy container", banner: "option=value option2=value2"
+  def boot_config(subcommand)
+    say "The proxy boot_config command is deprecated - set the config in the deploy YAML at proxy/run instead", :yellow
+    proxy_boot_config = KAMAL.config.proxy_boot
+
+    case subcommand
+    when "set"
+      boot_options = [
+        *(proxy_boot_config.publish_args(options[:http_port], options[:https_port], options[:publish_host_ip]) if options[:publish]),
+        *(proxy_boot_config.logging_args(options[:log_max_size])),
+        *("--expose=#{options[:metrics_port]}" if options[:metrics_port]),
+        *options[:docker_options].map { |option| "--#{option}" }
+      ]
+
+      image = [
+        options[:registry].presence,
+        options[:repository].presence || proxy_boot_config.repository_name,
+        proxy_boot_config.image_name
+      ].compact.join("/")
+
+      image_version = options[:image_version]
+
+      run_command_options = { debug: options[:debug] || nil, "metrics-port": options[:metrics_port] }.compact
+      run_command = "kamal-proxy run #{Kamal::Utils.optionize(run_command_options).join(" ")}" if run_command_options.any?
+
+      on(KAMAL.proxy_hosts) do |host|
+        proxy = KAMAL.proxy(host)
+        execute(*proxy.ensure_proxy_directory)
+        if boot_options != proxy_boot_config.default_boot_options
+          upload! StringIO.new(boot_options.join(" ")), proxy_boot_config.options_file
+        else
+          execute *proxy.reset_boot_options, raise_on_non_zero_exit: false
+        end
+
+        if image != proxy_boot_config.image_default
+          upload! StringIO.new(image), proxy_boot_config.image_file
+        else
+          execute *proxy.reset_image, raise_on_non_zero_exit: false
+        end
+
+        if image_version
+          upload! StringIO.new(image_version), proxy_boot_config.image_version_file
+        else
+          execute *proxy.reset_image_version, raise_on_non_zero_exit: false
+        end
+
+        if run_command
+          upload! StringIO.new(run_command), proxy_boot_config.run_command_file
+        else
+          execute *proxy.reset_run_command, raise_on_non_zero_exit: false
+        end
+      end
+    when "get"
+
+      on(KAMAL.proxy_hosts) do |host|
+        puts "Host #{host}: #{capture_with_info(*KAMAL.proxy(host).boot_config)}"
+      end
+    when "reset"
+      on(KAMAL.proxy_hosts) do |host|
+        proxy = KAMAL.proxy(host)
+        execute *proxy.reset_boot_options, raise_on_non_zero_exit: false
+        execute *proxy.reset_image, raise_on_non_zero_exit: false
+        execute *proxy.reset_image_version, raise_on_non_zero_exit: false
+        execute *proxy.reset_run_command, raise_on_non_zero_exit: false
+      end
+    else
+      raise ArgumentError, "Unknown boot_config subcommand #{subcommand}"
+    end
+  end
+
+  desc "reboot", "Reboot proxy on servers (stop container, remove container, start new container)"
+  option :rolling, type: :boolean, default: false, desc: "Reboot proxy on hosts in sequence, rather than in parallel"
+  option :confirmed, aliases: "-y", type: :boolean, default: false, desc: "Proceed without confirmation question"
+  def reboot
+    confirming "This will cause a brief outage on each host. Are you sure?" do
+      modify(lock: true) do
+        # Skip proxy on loadbalancer host - it will be handled by loadbalancer reboot
+        proxy_hosts = KAMAL.proxy_hosts
+        if KAMAL.config.proxy.loadbalancer_on_proxy_host?
+          proxy_hosts = proxy_hosts - [ KAMAL.config.proxy.effective_loadbalancer ]
+        end
+
+        host_groups = options[:rolling] ? proxy_hosts : [ proxy_hosts ]
+        host_groups.each do |hosts|
+          next if Array(hosts).empty?
+
+          host_list = Array(hosts).join(",")
+          run_hook "pre-proxy-reboot", hosts: host_list
+          on(hosts) do |host|
+            proxy = KAMAL.proxy(host)
+            execute *KAMAL.auditor.record("Rebooted proxy"), verbosity: :debug
+            execute *KAMAL.registry.login
+
+            info "Stopping and removing kamal-proxy on #{host}, if running..."
+            execute *proxy.stop, raise_on_non_zero_exit: false
+            execute *proxy.remove_container
+            execute *proxy.ensure_apps_config_directory
+
+            execute *proxy.run
+          end
+          run_hook "post-proxy-reboot", hosts: host_list
+        end
+
+        if KAMAL.config.proxy.load_balancing?
+          lb_host = KAMAL.config.proxy.effective_loadbalancer
+          run_hook "pre-loadbalancer-reboot", hosts: lb_host
+
+          on(lb_host) do |host|
+            execute *KAMAL.auditor.record("Rebooted loadbalancer"), verbosity: :debug
+            execute *KAMAL.registry.login
+
+            info "Stopping and removing #{KAMAL.loadbalancer.container_name} on #{host}, if running..."
+            execute *KAMAL.loadbalancer.stop, raise_on_non_zero_exit: false
+            execute *KAMAL.loadbalancer.remove_container
+            execute *KAMAL.loadbalancer.ensure_apps_config_directory
+
+            execute *KAMAL.loadbalancer.run
+          end
+
+          run_hook "post-loadbalancer-reboot", hosts: lb_host
+        end
+      end
+    end
+  end
+
+  desc "upgrade", "Upgrade to kamal-proxy on servers (stop container, remove container, start new container, reboot app)", hide: true
+  option :rolling, type: :boolean, default: false, desc: "Reboot proxy on hosts in sequence, rather than in parallel"
+  option :confirmed, aliases: "-y", type: :boolean, default: false, desc: "Proceed without confirmation question"
+  def upgrade
+    invoke_options = { "version" => KAMAL.config.latest_tag }.merge(options)
+
+    confirming "This will cause a brief outage on each host. Are you sure?" do
+      host_groups = options[:rolling] ? KAMAL.hosts : [ KAMAL.hosts ]
+      host_groups.each do |hosts|
+        host_list = Array(hosts).join(",")
+        say "Upgrading proxy on #{host_list}...", :magenta
+        run_hook "pre-proxy-reboot", hosts: host_list
+        on(hosts) do |host|
+          proxy = KAMAL.proxy(host)
+          execute *KAMAL.auditor.record("Rebooted proxy"), verbosity: :debug
+          execute *KAMAL.registry.login
+
+          info "Stopping and removing Traefik on #{host}, if running..."
+          execute *proxy.cleanup_traefik
+
+          info "Stopping and removing kamal-proxy on #{host}, if running..."
+          execute *proxy.stop, raise_on_non_zero_exit: false
+          execute *proxy.remove_container
+          execute *proxy.remove_image
+        end
+
+        KAMAL.with_specific_hosts(hosts) do
+          invoke "kamal:cli:proxy:boot", [], invoke_options
+          reset_invocation(Kamal::Cli::Proxy)
+          invoke "kamal:cli:app:boot", [], invoke_options
+          reset_invocation(Kamal::Cli::App)
+          invoke "kamal:cli:prune:all", [], invoke_options
+          reset_invocation(Kamal::Cli::Prune)
+        end
+
+        run_hook "post-proxy-reboot", hosts: host_list
+        say "Upgraded proxy on #{host_list}", :magenta
+      end
+    end
+  end
+
+  desc "start", "Start existing proxy container on servers"
+  def start
+    modify(lock: true) do
+      on(KAMAL.proxy_hosts) do |host|
+        execute *KAMAL.auditor.record("Started proxy"), verbosity: :debug
+        execute *KAMAL.proxy(host).start
+      end
+    end
+  end
+
+  desc "stop", "Stop existing proxy container on servers"
+  def stop
+    modify(lock: true) do
+      on(KAMAL.proxy_hosts) do |host|
+        execute *KAMAL.auditor.record("Stopped proxy"), verbosity: :debug
+        execute *KAMAL.proxy(host).stop, raise_on_non_zero_exit: false
+      end
+    end
+  end
+
+  desc "restart", "Restart existing proxy container on servers"
+  def restart
+    modify(lock: true) do
+      stop
+      start
+    end
+  end
+
+  desc "details", "Show details about proxy container from servers"
+  def details
+    quiet = options[:quiet]
+    on(KAMAL.proxy_hosts) { |host| puts_by_host host, capture_with_info(*KAMAL.proxy(host).info), type: "Proxy", quiet: quiet }
+
+    if KAMAL.config.proxy.load_balancing?
+      on(KAMAL.config.proxy.effective_loadbalancer) do |host|
+        puts_by_host host, capture_with_info(*KAMAL.loadbalancer.info), type: "Loadbalancer"
+      end
+    end
+  end
+
+  desc "logs", "Show log lines from proxy on servers"
+  option :since, aliases: "-s", desc: "Show logs since timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)"
+  option :lines, type: :numeric, aliases: "-n", desc: "Number of log lines to pull from each server"
+  option :grep, aliases: "-g", desc: "Show lines with grep match only (use this to fetch specific requests by id)"
+  option :follow, aliases: "-f", desc: "Follow logs on primary server (or specific host set by --hosts)"
+  option :skip_timestamps, type: :boolean, aliases: "-T", desc: "Skip appending timestamps to logging output"
+  def logs
+    grep = options[:grep]
+    timestamps = !options[:skip_timestamps]
+
+    if options[:follow]
+      run_locally do
+        proxy = KAMAL.proxy(KAMAL.primary_host)
+        info "Following logs on #{KAMAL.primary_host}..."
+        info proxy.follow_logs(host: KAMAL.primary_host, timestamps: timestamps, grep: grep)
+        exec proxy.follow_logs(host: KAMAL.primary_host, timestamps: timestamps, grep: grep)
+      end
+    else
+      since = options[:since]
+      lines = options[:lines].presence || ((since || grep) ? nil : 100) # Default to 100 lines if since or grep isn't set
+
+      on(KAMAL.proxy_hosts) do |host|
+        puts_by_host host, capture(*KAMAL.proxy(host).logs(timestamps: timestamps, since: since, lines: lines, grep: grep)), type: "Proxy"
+      end
+    end
+  end
+
+  desc "remove", "Remove proxy container and image from servers"
+  option :force, type: :boolean, default: false, desc: "Force removing proxy when apps are still installed"
+  def remove
+    modify(lock: true) do
+      if removal_allowed?(options[:force])
+        stop
+        remove_container
+        remove_image
+        remove_proxy_directory
+      end
+    end
+  end
+
+  desc "loadbalancer STATUS", "Manage the load balancer"
+  def loadbalancer(status)
+    case status
+    when "info"
+      if KAMAL.config.proxy.load_balancing?
+        on(KAMAL.config.proxy.effective_loadbalancer) do |host|
+          puts "Loadbalancer status on #{host}:"
+          puts capture_with_info(*KAMAL.loadbalancer.info)
+        end
+      else
+        puts "Load balancing is not configured"
+      end
+    when "start"
+      if KAMAL.config.proxy.load_balancing?
+        on(KAMAL.config.proxy.effective_loadbalancer) do |host|
+          execute *KAMAL.registry.login
+          execute *KAMAL.loadbalancer.start_or_run
+        end
+      else
+        puts "Load balancing is not configured"
+      end
+    when "stop"
+      if KAMAL.config.proxy.load_balancing?
+        on(KAMAL.config.proxy.effective_loadbalancer) do |host|
+          execute *KAMAL.loadbalancer.stop, raise_on_non_zero_exit: false
+        end
+      else
+        puts "Load balancing is not configured"
+      end
+    when "logs"
+      if KAMAL.config.proxy.load_balancing?
+        on(KAMAL.config.proxy.effective_loadbalancer) do |host|
+          puts_by_host host, capture(*KAMAL.loadbalancer.logs(timestamps: true)), type: "Loadbalancer"
+        end
+      else
+        puts "Load balancing is not configured"
+      end
+    when "deploy"
+      if KAMAL.config.proxy.load_balancing?
+        targets = []
+        KAMAL.config.roles.each do |role|
+          next unless role.running_proxy?
+
+          role.hosts.each do |host|
+            targets << host
+          end
+        end
+
+        on(KAMAL.config.proxy.effective_loadbalancer) do |host|
+          info "Deploying to loadbalancer on #{host} with targets: #{targets.join(', ')}"
+          execute *KAMAL.loadbalancer.deploy(targets: targets)
+        end
+      else
+        puts "Load balancing is not configured"
+      end
+    else
+      puts "Unknown loadbalancer subcommand: #{status}. Available: info, start, stop, logs, deploy"
+    end
+  end
+
+  desc "remove_container", "Remove proxy container from servers", hide: true
+  def remove_container
+    modify(lock: true) do
+      on(KAMAL.proxy_hosts) do
+        execute *KAMAL.auditor.record("Removed proxy container"), verbosity: :debug
+        execute *KAMAL.proxy(host).remove_container
+      end
+
+      if KAMAL.config.proxy.load_balancing?
+        on(KAMAL.config.proxy.effective_loadbalancer) do
+          execute *KAMAL.auditor.record("Removed loadbalancer container"), verbosity: :debug
+          execute *KAMAL.loadbalancer.remove_container
+        end
+      end
+    end
+  end
+
+  desc "remove_image", "Remove proxy image from servers", hide: true
+  def remove_image
+    modify(lock: true) do
+      on(KAMAL.proxy_hosts) do
+        execute *KAMAL.auditor.record("Removed proxy image"), verbosity: :debug
+        execute *KAMAL.proxy(host).remove_image
+      end
+
+      if KAMAL.config.proxy.load_balancing?
+        on(KAMAL.config.proxy.effective_loadbalancer) do
+          execute *KAMAL.auditor.record("Removed loadbalancer image"), verbosity: :debug
+          execute *KAMAL.loadbalancer.remove_image
+        end
+      end
+    end
+  end
+
+  desc "remove_proxy_directory", "Remove the proxy directory from servers", hide: true
+  def remove_proxy_directory
+    modify(lock: true) do
+      on(KAMAL.proxy_hosts) do
+        execute *KAMAL.proxy(host).remove_proxy_directory, raise_on_non_zero_exit: false
+      end
+    end
+  end
+
+  private
+    def removal_allowed?(force)
+      on(KAMAL.proxy_hosts) do |host|
+        app_count = capture_with_info(*KAMAL.server.app_directory_count).chomp.to_i
+        raise "The are other applications installed on #{host}" if app_count > 0
+      end
+
+      true
+    rescue SSHKit::Runner::ExecuteError => e
+      raise unless e.message.include?("The are other applications installed on")
+
+      if force
+        say "Forcing, so removing the proxy, even though other apps are installed", :magenta
+      else
+        say "Not removing the proxy, as other apps are installed, ignore this check with kamal proxy remove --force", :magenta
+      end
+
+      force
+    end
+end

data/lib/kamal/cli/prune.rb

@@ -0,0 +1,34 @@
+class Kamal::Cli::Prune < Kamal::Cli::Base
+  desc "all", "Prune unused images and stopped containers"
+  def all
+    modify(lock: true) do
+      containers
+      images
+    end
+  end
+
+  desc "images", "Prune unused images"
+  def images
+    modify(lock: true) do
+      on(KAMAL.hosts) do
+        execute *KAMAL.auditor.record("Pruned images"), verbosity: :debug
+        execute *KAMAL.prune.dangling_images
+        execute *KAMAL.prune.tagged_images
+      end
+    end
+  end
+
+  desc "containers", "Prune all stopped containers, except the last n (default 5)"
+  option :retain, type: :numeric, default: nil, desc: "Number of containers to retain"
+  def containers
+    retain = options.fetch(:retain, KAMAL.config.retain_containers)
+    raise "retain must be at least 1" if retain < 1
+
+    modify(lock: true) do
+      on(KAMAL.hosts) do
+        execute *KAMAL.auditor.record("Pruned containers"), verbosity: :debug
+        execute *KAMAL.prune.app_containers(retain: retain)
+      end
+    end
+  end
+end

data/lib/kamal/cli/registry.rb

@@ -0,0 +1,49 @@
+class Kamal::Cli::Registry < Kamal::Cli::Base
+  desc "setup", "Setup local registry or log in to remote registry locally and remotely"
+  option :skip_local, aliases: "-L", type: :boolean, default: false, desc: "Skip local login"
+  option :skip_remote, aliases: "-R", type: :boolean, default: false, desc: "Skip remote login"
+  def setup
+    ensure_docker_installed unless options[:skip_local]
+
+    if KAMAL.registry.local?
+      run_locally    { execute *KAMAL.registry.setup } unless options[:skip_local]
+    else
+      run_locally    { execute *KAMAL.registry.login } unless options[:skip_local]
+      on(KAMAL.hosts) { execute *KAMAL.registry.login } unless options[:skip_remote]
+    end
+  end
+
+  desc "remove", "Remove local registry or log out of remote registry locally and remotely"
+  option :skip_local, aliases: "-L", type: :boolean, default: false, desc: "Skip local login"
+  option :skip_remote, aliases: "-R", type: :boolean, default: false, desc: "Skip remote login"
+  def remove
+    if KAMAL.registry.local?
+      run_locally    { execute *KAMAL.registry.remove, raise_on_non_zero_exit: false } unless options[:skip_local]
+    else
+      run_locally    { execute *KAMAL.registry.logout } unless options[:skip_local]
+      on(KAMAL.hosts) { execute *KAMAL.registry.logout } unless options[:skip_remote]
+    end
+  end
+
+  desc "login", "Log in to remote registry locally and remotely"
+  option :skip_local, aliases: "-L", type: :boolean, default: false, desc: "Skip local login"
+  option :skip_remote, aliases: "-R", type: :boolean, default: false, desc: "Skip remote login"
+  def login
+    if KAMAL.registry.local?
+      raise "Cannot use login command with a local registry. Use `kamal registry setup` instead."
+    end
+
+    setup
+  end
+
+  desc "logout", "Log out of remote registry locally and remotely"
+  option :skip_local, aliases: "-L", type: :boolean, default: false, desc: "Skip local login"
+  option :skip_remote, aliases: "-R", type: :boolean, default: false, desc: "Skip remote login"
+  def logout
+    if KAMAL.registry.local?
+      raise "Cannot use logout command with a local registry. Use `kamal registry remove` instead."
+    end
+
+    remove
+  end
+end

data/lib/kamal/cli/secrets.rb

@@ -0,0 +1,50 @@
+class Kamal::Cli::Secrets < Kamal::Cli::Base
+  desc "fetch [SECRETS...]", "Fetch secrets from a vault"
+  option :adapter, type: :string, aliases: "-a", required: true, desc: "Which vault adapter to use"
+  option :account, type: :string, required: false, desc: "The account identifier or username"
+  option :from, type: :string, required: false, desc: "A vault or folder to fetch the secrets from"
+  option :inline, type: :boolean, required: false, hidden: true
+  def fetch(*secrets)
+    adapter = initialize_adapter(options[:adapter])
+
+    if adapter.requires_account? && options[:account].blank?
+      return puts "No value provided for required options '--account'"
+    end
+
+    results = adapter.fetch(secrets, **options.slice(:account, :from).symbolize_keys)
+    json = JSON.dump(results)
+
+    return_or_puts options[:inline] ? json.shellescape : json, inline: options[:inline]
+  end
+
+  desc "extract", "Extract a single secret from the results of a fetch call"
+  option :inline, type: :boolean, required: false, hidden: true
+  def extract(name, secrets)
+    parsed_secrets = JSON.parse(secrets)
+    value = parsed_secrets[name] || parsed_secrets.find { |k, v| k.end_with?("/#{name}") }&.last
+
+    raise "Could not find secret #{name}" if value.nil?
+
+    return_or_puts value, inline: options[:inline]
+  end
+
+  desc "print", "Print the secrets (for debugging)"
+  def print
+    KAMAL.config.secrets.to_h.each do |key, value|
+      puts "#{key}=#{value}"
+    end
+  end
+
+  private
+    def initialize_adapter(adapter)
+      Kamal::Secrets::Adapters.lookup(adapter)
+    end
+
+    def return_or_puts(value, inline: nil)
+      if inline
+        value
+      else
+        puts value
+      end
+    end
+end

data/lib/kamal/cli/server.rb

@@ -0,0 +1,70 @@
+class Kamal::Cli::Server < Kamal::Cli::Base
+  desc "exec", "Run a custom command on the server (use --help to show options)"
+  option :interactive, type: :boolean, aliases: "-i", default: false, desc: "Run the command interactively (use for console/bash)"
+  option :raw, type: :boolean, default: false, desc: "Output raw, unmodified stdout"
+  def exec(*cmd)
+    raw = options[:raw]
+
+    if raw && options[:interactive]
+      raise ArgumentError, "Raw is not compatible with interactive"
+    end
+
+    with_raw_output(raw) do
+      pre_connect_if_required
+
+      cmd = Kamal::Utils.join_commands(cmd)
+      hosts = KAMAL.hosts
+      quiet = options[:quiet]
+
+      case
+      when options[:interactive]
+        host = KAMAL.primary_host
+
+        say "Running '#{cmd}' on #{host} interactively...", :magenta
+
+        run_locally { exec KAMAL.server.run_over_ssh(cmd, host: host) }
+      else
+        say "Running '#{cmd}' on #{hosts.join(', ')}...", :magenta
+
+        on(hosts) do |host|
+          execute *KAMAL.auditor.record("Executed cmd '#{cmd}' on #{host}"), verbosity: :debug
+          puts_by_host host, capture_with_info(cmd, strip: !raw), quiet: quiet, raw: raw
+        end
+      end
+    end
+  end
+
+  desc "bootstrap", "Set up Docker to run Kamal apps"
+  def bootstrap
+    modify(lock: true) do
+      missing = []
+
+      on(KAMAL.hosts) do |host|
+        unless execute(*KAMAL.docker.installed?, raise_on_non_zero_exit: false)
+          if execute(*KAMAL.docker.superuser?, raise_on_non_zero_exit: false)
+            info "Missing Docker on #{host}. Installing…"
+            execute *KAMAL.docker.install
+
+            unless execute(*KAMAL.docker.root?, raise_on_non_zero_exit: false) ||
+                   execute(*KAMAL.docker.in_docker_group?, raise_on_non_zero_exit: false)
+              execute *KAMAL.docker.add_to_docker_group
+              begin
+                execute *KAMAL.docker.refresh_session
+              rescue IOError
+                info "Session refreshed due to group change."
+              end
+            end
+          else
+            missing << host
+          end
+        end
+      end
+
+      if missing.any?
+        raise "Docker is not installed on #{missing.join(", ")} and can't be automatically installed without having root access and either `wget` or `curl`. Install Docker manually: https://docs.docker.com/engine/install/"
+      end
+
+      run_hook "docker-setup"
+    end
+  end
+end