dash 4.0.8 → 4.1.1

data/lib/dash/cli/build.rb

@@ -37,6 +37,9 @@ class Dash::Cli::Build < Dash::Cli::Base
       say "Building with uncommitted changes:\n #{uncommitted_changes}", :yellow
     end
 
+    parser = build_progress_parser
+    handler = handler_for(parser)
+
     forward_local_registry_port_for_remote_builder do
       with_env(DASH.config.builder.secrets) do
         run_locally do
@@ -60,19 +63,19 @@ class Dash::Cli::Build < Dash::Cli::Base
           push = DASH.builder.push(cli.options[:output], no_cache: cli.options[:no_cache])
 
           DASH.with_verbosity(:debug) do
-            Dir.chdir(DASH.config.builder.build_directory) { execute *push, env: DASH.builder.push_env }
+            Dir.chdir(DASH.config.builder.build_directory) { execute *push, env: DASH.builder.push_env, **handler }
           end
         end
       end
     end
+  ensure
+    record_build_report parser
   end
 
   desc "pull", "Pull app image from registry onto servers"
   def pull
-    login_to_registry_remotely unless DASH.registry.local?
-
     forward_local_registry_port(DASH.hosts, **DASH.config.ssh.options) do
-      if (first_hosts = mirror_hosts).any?
+      if (first_hosts = login_and_mirror_hosts).any?
         #  Pull on a single host per mirror first to seed them
         say "Pulling image on #{first_hosts.join(", ")} to seed the #{"mirror".pluralize(first_hosts.count)}...", :magenta
         pull_on_hosts(first_hosts)
@@ -147,17 +150,66 @@ class Dash::Cli::Build < Dash::Cli::Base
       say
     end
 
+    parser = build_progress_parser
+    handler = handler_for(parser)
+
     with_env(DASH.config.builder.secrets) do
       run_locally do
         build = DASH.builder.push(cli.options[:output], tag_as_dirty: true, no_cache: cli.options[:no_cache])
         DASH.with_verbosity(:debug) do
-          execute(*build)
+          execute(*build, **handler)
         end
       end
     end
+  ensure
+    # `dev` builds the working directory even when `push` would clone, so the advice reads
+    # the Dockerfile here rather than in a clone that may not exist.
+    record_build_report parser, build_directory: "."
   end
 
   private
+    # Buildpacks print a total and nothing else, so there is nothing for the parser to
+    # read and no reason to attach it.
+    def build_progress_parser
+      Dash::Build::ProgressParser.new unless DASH.builder.pack?
+    end
+
+    def handler_for(parser)
+      parser ? { interaction_handler: parser } : {}
+    end
+
+    # Runs whether the build succeeded or failed: a partial report naming the step that
+    # broke is exactly what an operator wants from a failed build. Measurement must never
+    # be the reason a build fails, so nothing in here is allowed to raise.
+    def record_build_report(parser, build_directory: DASH.config.builder.build_directory)
+      return unless parser
+
+      guarded_report do
+        parser.finish
+        DASH.report.build = parser.result
+
+        say "Deploy report unavailable: #{parser.error.class}: #{parser.error.message}", :yellow if parser.error
+
+        # Inside a deploy the phase table prints these at the end and the deploy runs its
+        # own analysis once the image is delivered. Standalone, this is the only chance.
+        unless DASH.report.build_entry
+          print_build_report
+          DASH.report.analyze!(DASH.config, build_directory: build_directory)
+          puts DASH.report.advice_lines
+        end
+      end
+    end
+
+    # A standalone `dash build push` has no phase table to sit under, but a CI pipeline
+    # that splits build from deploy should still see where the build time went.
+    def print_build_report
+      rows = DASH.report.build_lines
+      return if rows.empty?
+
+      puts "  Build"
+      puts rows
+    end
+
     def connect_to_remote_host(remote_host)
       remote_uri = URI.parse(remote_host)
       if remote_uri.scheme == "ssh"
@@ -171,26 +223,37 @@ class Dash::Cli::Build < Dash::Cli::Base
       end
     end
 
-    def mirror_hosts
-      if DASH.app_hosts.many?
-        mirror_hosts = Concurrent::Hash.new
-        on(DASH.app_hosts) do |host|
-          first_mirror = capture_with_info(*DASH.builder.first_mirror).strip.presence
-          mirror_hosts[first_mirror] ||= host.to_s if first_mirror
-        rescue SSHKit::Command::Failed => e
-          raise unless e.message =~ /error calling index: reflect: slice index out of range/
-        end
-        mirror_hosts.values
-      else
-        []
+    # The registry login and the mirror probe share one round trip per host. The probe only
+    # earns its keep where there is more than one app host to seed, so on a single host the
+    # login goes on its own; a local registry needs no login and the fold is the probe alone.
+    #
+    # A host with no mirror configured fails the `docker info` half with docker's own index
+    # error, which is what "no mirror" looks like. Anything else still raises - a rejected
+    # login short-circuits the `&&` and comes back with docker's `unauthorized`/`denied`,
+    # which this rescue does not match.
+    def login_and_mirror_hosts
+      unless DASH.app_hosts.many?
+        login_to_registry_remotely unless DASH.registry.local?
+        return []
+      end
+
+      mirror_hosts = Concurrent::Hash.new
+      on(DASH.app_hosts) do |host|
+        first_mirror = capture_with_info(*DASH.registry.login_then(DASH.builder.first_mirror)).strip.presence
+        mirror_hosts[first_mirror] ||= host.to_s if first_mirror
+      rescue SSHKit::Command::Failed => e
+        raise unless e.message =~ /error calling index: reflect: slice index out of range/
       end
+      mirror_hosts.values
     end
 
+    # Audit, clean and pull share one round trip. validate_image keeps its own: folding it
+    # in would put the pull under validate_image's trailing `|| (echo ... && exit 1)`, and
+    # a failed pull would then report a missing service label.
     def pull_on_hosts(hosts)
       on(hosts) do
-        execute *DASH.auditor.record("Pulled image with version #{DASH.config.version}"), verbosity: :debug
-        execute *DASH.builder.clean, raise_on_non_zero_exit: false
-        execute *DASH.builder.pull
+        execute *DASH.auditor.record_then("Pulled image with version #{DASH.config.version}",
+          DASH.builder.clean_then_pull)
         execute *DASH.builder.validate_image
       end
     end

data/lib/dash/cli/doctor/config_checks.rb

@@ -2,7 +2,7 @@
 # that are visible in deploy.yml alone, so they still run when every host is unreachable.
 class Dash::Cli::Doctor::ConfigChecks
   def run
-    readiness_results
+    readiness_results + dockerfile_results
   end
 
   private
@@ -25,4 +25,39 @@ class Dash::Cli::Doctor::ConfigChecks
           "add a `healthcheck:` block, or opt out with `healthcheck: false`"
       end
     end
+
+    # The static half of the deploy report's advice: the same rules, without a build to
+    # measure against. `advice: false` is not consulted — it silences the block printed
+    # next to a deploy, and this check is one the operator asked for by name.
+    def dockerfile_results
+      dockerfile = DASH.config.builder.dockerfile
+      path = File.expand_path(dockerfile)
+
+      unless File.exist?(path)
+        return [ result(:dockerfile, dockerfile, :fail, "not found — `dash build push` fails with Missing #{dockerfile}") ]
+      end
+
+      findings = analyzer(dockerfile, path).findings
+      return [ result(:dockerfile, dockerfile, :ok, "no findings") ] if findings.empty?
+
+      findings.map { |finding| finding_result(finding) }
+    rescue StandardError => e
+      [ result(:dockerfile, dockerfile, :warn, "could not be analysed (#{e.class}: #{e.message})") ]
+    end
+
+    def analyzer(dockerfile, path)
+      Dash::Dockerfile::Analyzer.new \
+        document: Dash::Dockerfile::Parser.parse(File.read(path)),
+        path: dockerfile,
+        context_dir: File.expand_path(DASH.config.builder.context),
+        builder: DASH.config.builder,
+        ignore: DASH.config.report.ignore,
+        hadolint: DASH.config.report.hadolint?
+    end
+
+    # An informational finding is not a reason to hold up a deploy, so it reports as ok
+    # with its message intact — visible, but never the difference between ready and not.
+    def finding_result(finding)
+      result :dockerfile, finding.location, (finding.warn? ? :warn : :ok), "#{finding.message} [#{finding.rule}]"
+    end
 end

data/lib/dash/cli/doctor.rb

@@ -17,7 +17,8 @@ class Dash::Cli::Doctor
     ports: "Ports",
     dns: "DNS",
     certificate: "Certificates",
-    readiness: "Readiness"
+    readiness: "Readiness",
+    dockerfile: "Dockerfile"
   }.freeze
 
   STATUS_COLORS = { ok: :green, warn: :yellow, fail: :red }.freeze

data/lib/dash/cli/healthcheck/poller.rb

@@ -3,13 +3,19 @@ module Dash::Cli::Healthcheck::Poller
 
   NO_HEALTHCHECK = Dash::Commands::Base::NO_HEALTHCHECK
 
+  # The wait itself happens on the host now (Dash::Commands::App#wait_for_ready), which
+  # returns the moment the status is one this poller accepts and otherwise waits out the
+  # deadline it is given. So the block is called once for the wait - and once more only to
+  # confirm an unchecked container is still running after its readiness delay. Every
+  # decision below is the one the client-side poll made, in the same words; what shrank is
+  # the number of round trips it took to reach them.
   def wait_for_healthy(role:, &block)
     attempt = 1
     timeout_at = Time.now + DASH.config.deploy_timeout
     readiness_delay = role.readiness_delay
 
     begin
-      status = block.call
+      status = block.call(:wait, seconds_left(timeout_at))
 
       if unchecked?(status)
         ensure_no_healthcheck_drift(role, status)
@@ -20,7 +26,7 @@ module Dash::Cli::Healthcheck::Poller
           # Wait for the readiness delay and confirm it is still running
           if readiness_delay > 0
             sleep readiness_delay
-            status = block.call
+            status = block.call(:confirm)
             ensure_no_healthcheck_drift(role, status)
           end
         end
@@ -55,8 +61,14 @@ module Dash::Cli::Healthcheck::Poller
       status.to_s.delete_prefix("#{NO_HEALTHCHECK}:")
     end
 
+    # Shared with the host-side wait, which stops looking on exactly these - see
+    # Dash::Commands::Base::READY_STATUSES for why the two have to agree.
     def acceptable?(status)
-      status == "healthy" || (unchecked?(status) && docker_state(status) == "running")
+      Dash::Commands::Base::READY_STATUSES.include?(status)
+    end
+
+    def seconds_left(timeout_at)
+      [ (timeout_at - Time.now).ceil, 0 ].max
     end
 
     # The config asked docker to probe this container and docker is not probing it — the flags

data/lib/dash/cli/healthcheck/progress_reporter.rb

@@ -0,0 +1,39 @@
+# Turns the server-side readiness wait's progress lines back into the beacon the
+# client-side poll used to print. It is an SSHKit interaction handler, so it sees the
+# wait's stderr as it streams — the operator gets the same once-a-second feedback they
+# got when the laptop was the thing doing the polling, for one round trip instead of one
+# per attempt. The cadence is fixed at a second because the host loop's is.
+#
+# The stream is line-oriented but arrives in chunks (the SSH backend splits on packet
+# boundaries, not newlines), so data is buffered and only whole lines are reported. Only
+# stderr is buffered: the wait's stdout carries the final status, and stdout and stderr are
+# separate SSH streams whose chunks can interleave — folding both into one buffer would let
+# the status land in the middle of a half-arrived progress line and corrupt them both.
+# Anything on stderr that is not a progress line (docker's own complaints) is ignored.
+class Dash::Cli::Healthcheck::ProgressReporter
+  LINE = /\A#{Regexp.escape(Dash::Commands::Base::READINESS_PROGRESS_PREFIX)} (?<elapsed>\d+) (?<left>\d+)(?: |\z)/
+
+  def initialize
+    @buffer = +""
+    @mutex = Mutex.new
+  end
+
+  # SSHKit's interaction-handler contract.
+  def on_data(_command, stream_name, data, _channel = nil)
+    return unless stream_name == :stderr
+
+    @mutex.synchronize do
+      @buffer << data.to_s
+      while (newline = @buffer.index("\n"))
+        report @buffer.slice!(0..newline).chomp
+      end
+    end
+  end
+
+  private
+    def report(line)
+      match = LINE.match(line) or return
+
+      SSHKit.config.output.info "Container not ready yet, retrying in 1s (#{match[:elapsed]}s elapsed, #{match[:left]}s left)"
+    end
+end

data/lib/dash/cli/main.rb

@@ -26,16 +26,23 @@ class Dash::Cli::Main < Dash::Cli::Base
         print_config_banner
 
         say "Validate configuration and secrets...", :magenta
-        DASH.config.validate_secrets!(include_accessories: boot_accessories)
+        timed("Validate config and secrets") { DASH.config.validate_secrets!(include_accessories: boot_accessories) }
 
         if options[:skip_push]
           say "Pull app image...", :magenta
           timed("Pull app image") { invoke "dash:cli:build:pull", [], invoke_options }
         else
           say "Build and push app image...", :magenta
-          timed("Build and push app image") { invoke "dash:cli:build:deliver", [], invoke_options }
+          timed("Build and push app image") do |entry|
+            DASH.report.build_entry = entry
+            invoke "dash:cli:build:deliver", [], invoke_options
+          end
         end
 
+        # Before the boot, so the advice still prints when a boot fails — a slow build is
+        # exactly the kind of thing an operator wants to see on a deploy that went wrong.
+        analyze_report
+
         modify(lock: true) do
           run_hook "pre-deploy", secrets: true
 
@@ -59,7 +66,7 @@ class Dash::Cli::Main < Dash::Cli::Base
         end
       end
 
-      run_hook "post-deploy", secrets: true, runtime: runtime.round.to_s
+      run_hook "post-deploy", secrets: true, runtime: runtime.round.to_s, **report_hook_details
     end
   end
 
@@ -74,16 +81,23 @@ class Dash::Cli::Main < Dash::Cli::Base
         print_config_banner
 
         say "Validate configuration and secrets...", :magenta
-        DASH.config.validate_secrets!
+        timed("Validate config and secrets") { DASH.config.validate_secrets! }
 
         if options[:skip_push]
           say "Pull app image...", :magenta
           timed("Pull app image") { invoke "dash:cli:build:pull", [], invoke_options }
         else
           say "Build and push app image...", :magenta
-          timed("Build and push app image") { invoke "dash:cli:build:deliver", [], invoke_options }
+          timed("Build and push app image") do |entry|
+            DASH.report.build_entry = entry
+            invoke "dash:cli:build:deliver", [], invoke_options
+          end
         end
 
+        # Before the boot, so the advice still prints when a boot fails — a slow build is
+        # exactly the kind of thing an operator wants to see on a deploy that went wrong.
+        analyze_report
+
         modify(lock: true) do
           run_hook "pre-deploy", secrets: true
 
@@ -99,7 +113,7 @@ class Dash::Cli::Main < Dash::Cli::Base
         end
       end
 
-      run_hook "post-deploy", secrets: true, runtime: runtime.round.to_s
+      run_hook "post-deploy", secrets: true, runtime: runtime.round.to_s, **report_hook_details
     end
   end
 
@@ -125,7 +139,7 @@ class Dash::Cli::Main < Dash::Cli::Base
         end
       end
 
-      run_hook "post-deploy", secrets: true, runtime: runtime.round.to_s if rolled_back
+      run_hook "post-deploy", secrets: true, runtime: runtime.round.to_s, **report_hook_details if rolled_back
     end
   end
 
@@ -299,6 +313,9 @@ class Dash::Cli::Main < Dash::Cli::Base
   desc "prune", "Prune old application images and containers"
   subcommand "prune", Dash::Cli::Prune
 
+  desc "report", "Read the deploy reports saved under .dash/reports"
+  subcommand "report", Dash::Cli::Report
+
   desc "registry", "Login and -out of the image registry"
   subcommand "registry", Dash::Cli::Registry
 

data/lib/dash/cli/proxy/drift.rb

@@ -7,8 +7,23 @@ class Dash::Cli::Proxy::Drift
     @sshkit = sshkit
   end
 
+  # One `docker inspect` for everything a boot asks about the running proxy: whether it
+  # exists, which image tag it runs, and the digest it was booted with. Captured once per
+  # instance - `dash proxy boot` reads all three off it, and `dash doctor` only the first.
+  def state
+    @state ||= Dash::Commands::Proxy::State.parse(
+      capture_with_info(*proxy.inspect_state, raise_on_non_zero_exit: false)
+    )
+  end
+
   def container_exists?
-    capture_with_info(*proxy.container_id, raise_on_non_zero_exit: false).strip.present?
+    state.exists?
+  end
+
+  # The tag the running proxy was booted from, for the minimum-version gate. Nil when
+  # nothing is running - a host with no proxy has no version to be too old.
+  def version
+    state.version
   end
 
   # A proxy container has drifted when it was started with a different config
@@ -30,7 +45,7 @@ class Dash::Cli::Proxy::Drift
 
   private
     def current_digest
-      capture_with_info(*proxy.config_digest, raise_on_non_zero_exit: false).strip
+      state.digest.to_s
     end
 
     def proxy

data/lib/dash/cli/proxy/legacy_rename.rb

@@ -23,6 +23,13 @@
 # so a second deploy is a no-op. Nothing here removes the legacy network or
 # volume: an operator who wants them gone removes them by hand, and stage 3d
 # deletes this class outright.
+#
+# All three travel as one command (Dash::Commands::Proxy#prepare_boot), guarded on a
+# marker the host writes once it is verifiably past the rename - so a migrated host, and
+# a host installed fresh on 4.x that never had a kamal-proxy, run no docker command here
+# at all. The round trip itself is one the host already pays: the command carries the
+# apps-config `mkdir -p` too, which reads nothing the bridge writes. Stage 3d keeps the
+# mkdir and deletes the rest.
 class Dash::Cli::Proxy::LegacyRename
   attr_reader :host, :sshkit
   delegate :execute, to: :sshkit
@@ -33,26 +40,6 @@ class Dash::Cli::Proxy::LegacyRename
   end
 
   def run
-    bridge_network
-    adopt_config_volume
-    replace_legacy_container
+    execute *DASH.proxy(host).prepare_boot
   end
-
-  private
-    def bridge_network
-      execute *DASH.docker.connect_legacy_network_containers
-    end
-
-    def adopt_config_volume
-      execute *DASH.proxy(host).copy_legacy_config_volume
-    end
-
-    # The drain timeout the proxy is configured with, so a busy host is not cut
-    # off mid-request any more abruptly than a normal reboot would.
-    def replace_legacy_container
-      proxy = DASH.proxy(host)
-
-      execute *proxy.remove_legacy_container(timeout: DASH.config.drain_timeout)
-      execute *proxy.remove_legacy_holder_container
-    end
 end

data/lib/dash/cli/proxy/loadbalancer_reboot.rb

@@ -21,6 +21,14 @@ class Dash::Cli::Proxy::LoadbalancerReboot
     execute *DASH.registry.login
     ensure_network
 
+    # After the network the bridge attaches the legacy network's containers to,
+    # and before anything that could create the new container or let `docker
+    # run --volume` create dash-loadbalancer-config empty: adopt the legacy
+    # volume's routing table, dynamic domains and ACME cache. Carries the
+    # apps-config mkdir this reboot paid a round trip for anyway
+    # (zoolutions/dash#168, see Dash::Commands::Loadbalancer#legacy_rename).
+    execute *DASH.loadbalancer.prepare_boot
+
     info "Stopping and removing #{DASH.loadbalancer.container_name} on #{host}, if running..."
     execute *DASH.loadbalancer.stop, raise_on_non_zero_exit: false
     execute *DASH.loadbalancer.remove_container
@@ -32,7 +40,6 @@ class Dash::Cli::Proxy::LoadbalancerReboot
       execute *DASH.loadbalancer.remove_proxy_secrets_file, raise_on_non_zero_exit: false
     end
 
-    execute *DASH.loadbalancer.ensure_apps_config_directory
     Dash::Cli::Proxy::LoadbalancerClaim.new(host, sshkit).claim_run_config(replace: true)
     execute *DASH.loadbalancer.run
 

data/lib/dash/cli/proxy/reboot.rb

@@ -37,7 +37,12 @@ class Dash::Cli::Proxy::Reboot
 
     def replace_container
       execute *proxy.ensure_proxy_directory
-      execute *proxy.ensure_apps_config_directory
+      # Before the new container - and the new config volume `docker run
+      # --volume` would otherwise create empty - exists: bring a host still on
+      # pre-rename identity across. Carries the apps-config mkdir this reboot
+      # paid a round trip for anyway, so the bridge costs none here either
+      # (zoolutions/dash#168, see Dash::Cli::Proxy::LegacyRename).
+      execute *proxy.prepare_boot
       sync_proxy_secrets
 
       if proxy.port_holder?

data/lib/dash/cli/proxy.rb

@@ -22,7 +22,9 @@ class Dash::Cli::Proxy < Dash::Cli::Base
         execute *DASH.registry.login
 
         # Before anything reads the new container, volume or network: bring a
-        # host still on pre-rename identity across. A no-op once it has been.
+        # host still on pre-rename identity across, and make the apps-config
+        # directory in the same round trip. Nothing but a `test -f` once it has
+        # been - see Dash::Cli::Proxy::LegacyRename.
         Dash::Cli::Proxy::LegacyRename.new(host, self).run
 
         proxy = DASH.proxy(host)
@@ -34,7 +36,8 @@ class Dash::Cli::Proxy < Dash::Cli::Base
         else
           stale_hosts << host.to_s if drift.drifted?
 
-          version = capture_with_info(*proxy.version).strip.presence
+          # The tag off the inspect the drift check already made, not a read of its own.
+          version = drift.version
 
           if version && Dash::Utils.older_version?(version, Dash::Configuration::Proxy::Run::MINIMUM_VERSION)
             raise "dash-proxy version #{version} is too old, run `dash proxy reboot` in order to update to at least #{Dash::Configuration::Proxy::Run::MINIMUM_VERSION}"
@@ -48,7 +51,6 @@ class Dash::Cli::Proxy < Dash::Cli::Base
             execute *proxy.remove_proxy_secrets_file, raise_on_non_zero_exit: false
           end
 
-          execute *proxy.ensure_apps_config_directory
           execute *proxy.start_holder_or_run if proxy.port_holder?
           execute *proxy.start_or_run(digest: drift.expected_digest)
         end
@@ -77,10 +79,10 @@ class Dash::Cli::Proxy < Dash::Cli::Base
           execute *DASH.registry.login
 
           # Bring a pre-rename host across before the container can be created
-          # against an empty volume or a network nothing else joined. A no-op
-          # once it has been.
-          execute *DASH.docker.connect_legacy_network_containers
-          execute *DASH.loadbalancer.copy_legacy_config_volume
+          # against an empty volume or a network nothing else joined, and make
+          # the apps-config directory in the same round trip. Nothing but a
+          # `test -f` once it has been.
+          execute *DASH.loadbalancer.prepare_boot
 
           # The load balancer terminates TLS and owns the cache, so its host
           # needs the proxy secrets (acme credentials, cache store) just like
@@ -92,8 +94,6 @@ class Dash::Cli::Proxy < Dash::Cli::Base
             execute *DASH.loadbalancer.remove_proxy_secrets_file, raise_on_non_zero_exit: false
           end
 
-          execute *DASH.loadbalancer.ensure_apps_config_directory
-
           # TLS terminates at the load balancer, so the TLS material the app
           # hosts get - custom certificates and the mTLS client CA - must
           # reach this host too; the LB container reads it through the same
@@ -105,10 +105,11 @@ class Dash::Cli::Proxy < Dash::Cli::Base
           # The same drift detection the proxy hosts get: a loadbalancer booted
           # with a different config digest reboots below (or warns, when
           # automatic reboot is off) instead of serving a stale config forever.
-          container_id = capture_with_info(*DASH.loadbalancer.container_id, raise_on_non_zero_exit: false).strip
-          current_digest = capture_with_info(*DASH.loadbalancer.config_digest, raise_on_non_zero_exit: false).strip
+          state = Dash::Commands::Proxy::State.parse(
+            capture_with_info(*DASH.loadbalancer.inspect_state, raise_on_non_zero_exit: false)
+          )
 
-          if container_id.present? && current_digest != DASH.loadbalancer_config.run_config_digest
+          if state.exists? && state.digest.to_s != DASH.loadbalancer_config.run_config_digest
             if auto_reboot
               # Leave the old loadbalancer serving until its reboot below.
               lb_drifted << host.to_s
@@ -413,6 +414,12 @@ class Dash::Cli::Proxy < Dash::Cli::Base
       if DASH.config.proxy.load_balancing?
         on(DASH.config.proxy.effective_loadbalancer) do |host|
           execute *DASH.registry.login
+          # start_or_run falls through to `docker run` on a host with no
+          # container, so this is a volume-creating path too and gets the same
+          # bridge boot and reboot do (zoolutions/dash#168). It also makes the
+          # apps-config directory the bind mount would otherwise have docker
+          # create root-owned.
+          execute *DASH.loadbalancer.prepare_boot
           execute *DASH.loadbalancer.start_or_run
         end
       else

data/lib/dash/cli/prune.rb

@@ -11,9 +11,7 @@ class Dash::Cli::Prune < Dash::Cli::Base
   def images
     modify(lock: true, server_lock: true) do
       on(DASH.hosts) do
-        execute *DASH.auditor.record("Pruned images"), verbosity: :debug
-        execute *DASH.prune.dangling_images
-        execute *DASH.prune.tagged_images
+        execute *DASH.auditor.record_then("Pruned images", DASH.prune.dangling_images, DASH.prune.tagged_images)
       end
     end
   end
@@ -26,11 +24,10 @@ class Dash::Cli::Prune < Dash::Cli::Base
 
     modify(lock: true, server_lock: true) do
       on(DASH.hosts) do |host|
-        execute *DASH.auditor.record("Pruned containers"), verbosity: :debug
-
-        DASH.roles_on(host).each do |role|
-          execute *DASH.prune.app_containers(retain: retain, role: role)
-        end
+        # One round trip per host, whatever it runs: a host with no app roles still
+        # records that the sweep reached it.
+        execute *DASH.auditor.record_then("Pruned containers",
+          *DASH.roles_on(host).map { |role| DASH.prune.app_containers(retain: retain, role: role) })
       end
     end
   end