dokku-compose 0.11.1 → 0.12.0

package/README.md

@@ -104,6 +104,17 @@ Running `up` again produces no changes — every step checks current state befor
 | `--remove-orphans` | Destroy services and networks not in config |
 | `--verbose` | Show git-style +/- diff (diff command only) |
 
+### Errors
+
+A failing Dokku command (mutation) is never reported as a success. On `up` and `down`, a
+global-phase failure (plugins, docker auth, global config, networks, services) aborts the whole
+run immediately. A per-app failure is printed with the command and Dokku's error output, and by
+default the run continues to the next app, exiting non-zero at the end with a summary of which
+apps failed; pass `--fail-fast` to stop at the first failure instead. `diff` never reports a
+resource as missing when it could not actually read server state — it falls back to a per-app
+read and, if that's unreadable too, marks the resource `unknown` and exits non-zero with a
+warning naming what it couldn't read.
+
 ## Features
 
 All features are idempotent — running `up` twice produces no changes.

package/dist/index.js

@@ -149,6 +149,95 @@ import { execa } from "execa";
 import { createHash } from "crypto";
 import * as os from "os";
 import * as path from "path";
+
+// src/core/mask.ts
+var SENSITIVE_RE = /(?:TOKEN|SECRET|PASSWORD|KEY|AUTH|CREDENTIAL)/i;
+function maskValue(value) {
+  if (value.length <= 4) return "****";
+  return `****${value.slice(-4)}`;
+}
+function maskSensitiveArgs(cmd) {
+  let masked = cmd.replace(/([^\s=]*(?:TOKEN|SECRET|PASSWORD|KEY|AUTH|CREDENTIAL)[^\s=]*)=(\S+)/gi, (_, key, value) => {
+    return `${key}=${maskValue(value)}`;
+  });
+  masked = masked.replace(
+    /^(registry:login\s+(?:--global\s+)?\S+\s+\S+\s+)(\S+)/,
+    (_, prefix, password) => `${prefix}${maskValue(password)}`
+  );
+  masked = masked.replace(
+    /^(\S+:backup-auth\s+\S+\s+)(\S+)(\s+)(\S+)/,
+    (_, prefix, accessKeyId, sep, secretAccessKey) => `${prefix}${maskValue(accessKeyId)}${sep}${maskValue(secretAccessKey)}`
+  );
+  return masked;
+}
+function maskSensitiveArgsList(args) {
+  const secrets = [];
+  const masked = [...args];
+  const mark = (index) => {
+    const value = masked[index];
+    if (value === void 0 || value === "") return;
+    secrets.push(value);
+    masked[index] = maskValue(value);
+  };
+  for (let i = 0; i < masked.length; i++) {
+    const m = masked[i].match(/^([^\s=]*(?:TOKEN|SECRET|PASSWORD|KEY|AUTH|CREDENTIAL)[^\s=]*)=(.+)$/i);
+    if (m) {
+      secrets.push(m[2]);
+      masked[i] = `${m[1]}=${maskValue(m[2])}`;
+    }
+  }
+  if (masked[0] === "registry:login") {
+    mark(masked.length - 1);
+  }
+  if (/^\S+:backup-auth$/.test(masked[0] ?? "")) {
+    mark(2);
+    mark(3);
+  }
+  return { masked, secrets };
+}
+function maskSecretsInText(text, secrets) {
+  let masked = text;
+  for (const secret of secrets) {
+    if (!secret) continue;
+    masked = masked.split(secret).join(maskValue(secret));
+  }
+  return masked;
+}
+function maskSensitiveData(data) {
+  if (data === null || data === void 0) return data;
+  if (typeof data === "string") return data;
+  if (Array.isArray(data)) return data.map(maskSensitiveData);
+  if (typeof data === "object") {
+    const result = {};
+    for (const [key, value] of Object.entries(data)) {
+      if (typeof value === "string" && SENSITIVE_RE.test(key)) {
+        result[key] = maskValue(value);
+      } else if (typeof value === "object" && value !== null) {
+        result[key] = maskSensitiveData(value);
+      } else {
+        result[key] = value;
+      }
+    }
+    return result;
+  }
+  return data;
+}
+
+// src/core/dokku.ts
+var DokkuCommandError = class extends Error {
+  constructor(args, exitCode, stderr) {
+    const { masked, secrets } = maskSensitiveArgsList(args);
+    const maskedCmd = masked.join(" ");
+    const stderrTail = maskSecretsInText(stderr.trim(), secrets);
+    super(
+      `dokku ${maskedCmd} failed (exit ${exitCode})` + (stderrTail ? `: ${stderrTail}` : "")
+    );
+    this.args = args;
+    this.exitCode = exitCode;
+    this.stderr = stderr;
+    this.name = "DokkuCommandError";
+  }
+};
 function createRunner(opts = {}) {
   const log = [];
   const controlPath = opts.host ? path.join(os.tmpdir(), `dc-${createHash("sha1").update(opts.host).digest("hex").slice(0, 16)}.sock`) : null;
@@ -160,17 +249,17 @@ function createRunner(opts = {}) {
   async function execDokku(args) {
     if (opts.host) {
       try {
-        const result = await execa("ssh", [...sshControlFlags, `dokku@${opts.host}`, "--", ...args.map(shellQuote)]);
-        return { stdout: String(result.stdout ?? ""), ok: true };
+        const result = await execa("ssh", [...sshControlFlags, `dokku@${opts.host}`, "--", ...args.map(shellQuote)], { stdin: "ignore" });
+        return { stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? ""), exitCode: result.exitCode ?? 0, ok: true };
       } catch (e) {
-        return { stdout: String(e.stdout ?? ""), ok: false };
+        return { stdout: String(e.stdout ?? ""), stderr: String(e.stderr ?? ""), exitCode: e.exitCode ?? 1, ok: false };
       }
     } else {
       try {
-        const result = await execa("dokku", args);
-        return { stdout: String(result.stdout ?? ""), ok: true };
+        const result = await execa("dokku", args, { stdin: "ignore" });
+        return { stdout: String(result.stdout ?? ""), stderr: String(result.stderr ?? ""), exitCode: result.exitCode ?? 0, ok: true };
       } catch (e) {
-        return { stdout: String(e.stdout ?? ""), ok: false };
+        return { stdout: String(e.stdout ?? ""), stderr: String(e.stderr ?? ""), exitCode: e.exitCode ?? 1, ok: false };
       }
     }
   }
@@ -181,7 +270,10 @@ function createRunner(opts = {}) {
         log.push(args.map((a) => a.includes(" ") ? shellQuote(a) : a).join(" "));
         return;
       }
-      await execDokku(args);
+      const { ok, exitCode, stderr } = await execDokku(args);
+      if (!ok) {
+        throw new DokkuCommandError(args, exitCode, stderr);
+      }
     },
     async query(...args) {
       const { stdout } = await execDokku(args);
@@ -194,7 +286,7 @@ function createRunner(opts = {}) {
     async close() {
       if (!opts.host || !controlPath) return;
       try {
-        await execa("ssh", ["-O", "exit", "-o", `ControlPath=${controlPath}`, `dokku@${opts.host}`]);
+        await execa("ssh", ["-O", "exit", "-o", `ControlPath=${controlPath}`, `dokku@${opts.host}`], { stdin: "ignore" });
       } catch {
       }
     }
@@ -275,6 +367,9 @@ function logDone() {
 function logSkip() {
   console.log(`... ${chalk.yellow("already configured")}`);
 }
+function logError(context, message) {
+  console.error(chalk.red(`[${context.padEnd(12)}] ERROR: ${message}`));
+}
 function logWarn(context, message) {
   console.warn(chalk.yellow(`[${context.padEnd(12)}] WARN: ${message}`));
 }
@@ -421,6 +516,10 @@ var Storage = {
 };
 
 // src/resources/properties.ts
+async function isAppDeployed(ctx, target) {
+  const raw = await ctx.query("ps:report", target, "--deployed");
+  return raw.trim() === "true";
+}
 function propertyResource(opts) {
   return {
     key: opts.key,
@@ -438,7 +537,12 @@ function propertyResource(opts) {
       }
       if (opts.afterChange) {
         for (const cmd of opts.afterChange) {
-          await ctx.run(cmd, target);
+          try {
+            await ctx.run(cmd, target);
+          } catch (err) {
+            if (await isAppDeployed(ctx, target)) throw err;
+            logWarn(target, `${cmd} failed on an undeployed app \u2014 its proxy config will be built on first deploy`);
+          }
         }
       }
     }
@@ -546,15 +650,17 @@ var Config = {
 var Certs = {
   key: "ssl",
   read: async (ctx, target) => {
-    const raw = await ctx.query("certs:report", target, "--ssl-enabled");
-    return raw.trim() === "true";
+    const raw = (await ctx.query("certs:report", target, "--ssl-enabled")).trim();
+    if (raw === "") return void 0;
+    return raw === "true";
   },
   readAll: async (ctx) => {
     const raw = await ctx.query("certs:report");
     const bulk = parseBulkReport(raw, "ssl");
     const result = /* @__PURE__ */ new Map();
     for (const [app, report] of bulk) {
-      result.set(app, report["enabled"] === "true");
+      const enabled = report["enabled"];
+      result.set(app, enabled === void 0 ? void 0 : enabled === "true");
     }
     return result;
   },
@@ -1133,7 +1239,38 @@ async function ensureGlobalNginx(ctx, nginx) {
 }
 
 // src/commands/up.ts
-async function runUp(ctx, config, appFilter) {
+var UpFailedError = class extends Error {
+  constructor(failures) {
+    super(
+      `up failed for ${failures.length} app(s): ${failures.map((f) => f.app).join(", ")}`
+    );
+    this.failures = failures;
+    this.name = "UpFailedError";
+  }
+};
+async function processApp(ctx, config, app, appConfig) {
+  await reconcile(Apps, ctx, app, true);
+  await reconcile(Domains, ctx, app, appConfig.domains);
+  await reconcile(Networks, ctx, app, appConfig.networks);
+  await reconcile(NetworkProps, ctx, app, appConfig.network);
+  await reconcile(Proxy, ctx, app, appConfig.proxy?.enabled);
+  await reconcile(Ports, ctx, app, appConfig.ports);
+  if (config.postgres || config.redis) {
+    await ensureAppLinks(ctx, app, appConfig.links ?? [], config);
+  }
+  await reconcile(Certs, ctx, app, appConfig.ssl);
+  await reconcile(Storage, ctx, app, appConfig.storage);
+  await reconcile(Nginx, ctx, app, appConfig.nginx);
+  await reconcile(Checks, ctx, app, appConfig.checks);
+  await reconcile(Logs, ctx, app, appConfig.logs);
+  await reconcile(Registry, ctx, app, appConfig.registry);
+  await reconcile(Scheduler, ctx, app, appConfig.scheduler);
+  await reconcile(Config, ctx, app, appConfig.env);
+  await reconcile(Builder, ctx, app, appConfig.build);
+  await reconcile(Git, ctx, app, appConfig.git ?? config.git);
+  await reconcile(DockerOptions, ctx, app, appConfig.docker_options);
+}
+async function runUp(ctx, config, appFilter, opts = {}) {
   const apps = appFilter.length > 0 ? appFilter : Object.keys(config.apps);
   await ensureDokkuVersion(ctx, config.dokku?.version);
   if (config.plugins) await ensurePlugins(ctx, config.plugins);
@@ -1146,29 +1283,21 @@ async function runUp(ctx, config, appFilter) {
   if (config.postgres) await ensurePostgres(ctx, config.postgres);
   if (config.redis) await ensureRedis(ctx, config.redis);
   if (config.postgres) await ensurePostgresBackups(ctx, config.postgres);
+  const failures = [];
   for (const app of apps) {
     const appConfig = config.apps[app];
     if (!appConfig) continue;
-    await reconcile(Apps, ctx, app, true);
-    await reconcile(Domains, ctx, app, appConfig.domains);
-    await reconcile(Networks, ctx, app, appConfig.networks);
-    await reconcile(NetworkProps, ctx, app, appConfig.network);
-    await reconcile(Proxy, ctx, app, appConfig.proxy?.enabled);
-    await reconcile(Ports, ctx, app, appConfig.ports);
-    if (config.postgres || config.redis) {
-      await ensureAppLinks(ctx, app, appConfig.links ?? [], config);
+    try {
+      await processApp(ctx, config, app, appConfig);
+    } catch (error) {
+      if (opts.failFast) throw error;
+      const message = error instanceof Error ? error.message : String(error);
+      logError(app, message);
+      failures.push({ app, error });
     }
-    await reconcile(Certs, ctx, app, appConfig.ssl);
-    await reconcile(Storage, ctx, app, appConfig.storage);
-    await reconcile(Nginx, ctx, app, appConfig.nginx);
-    await reconcile(Checks, ctx, app, appConfig.checks);
-    await reconcile(Logs, ctx, app, appConfig.logs);
-    await reconcile(Registry, ctx, app, appConfig.registry);
-    await reconcile(Scheduler, ctx, app, appConfig.scheduler);
-    await reconcile(Config, ctx, app, appConfig.env);
-    await reconcile(Builder, ctx, app, appConfig.build);
-    await reconcile(Git, ctx, app, appConfig.git ?? config.git);
-    await reconcile(DockerOptions, ctx, app, appConfig.docker_options);
+  }
+  if (failures.length > 0) {
+    throw new UpFailedError(failures);
   }
 }
 
@@ -1191,15 +1320,35 @@ async function exportApps(ctx) {
 }
 
 // src/commands/down.ts
+var DownFailedError = class extends Error {
+  constructor(failures) {
+    super(
+      `down failed for ${failures.length} app(s): ${failures.map((f) => f.app).join(", ")} \u2014 service and network teardown was skipped because app teardown failed`
+    );
+    this.failures = failures;
+    this.name = "DownFailedError";
+  }
+};
 async function runDown(ctx, config, appFilter, opts) {
   const apps = appFilter.length > 0 ? appFilter : Object.keys(config.apps);
+  const failures = [];
   for (const app of apps) {
     const appConfig = config.apps[app];
     if (!appConfig) continue;
-    if (appConfig.links && (config.postgres || config.redis)) {
-      await destroyAppLinks(ctx, app, appConfig.links, config);
+    try {
+      if (appConfig.links && (config.postgres || config.redis)) {
+        await destroyAppLinks(ctx, app, appConfig.links, config);
+      }
+      await destroyApp(ctx, app);
+    } catch (error) {
+      if (opts.failFast) throw error;
+      const message = error instanceof Error ? error.message : String(error);
+      logError(app, message);
+      failures.push({ app, error });
     }
-    await destroyApp(ctx, app);
+  }
+  if (failures.length > 0) {
+    throw new DownFailedError(failures);
   }
   if (config.postgres) await destroyPostgres(ctx, config.postgres);
   if (config.redis) await destroyRedis(ctx, config.redis);
@@ -1289,51 +1438,39 @@ async function runExport(ctx, opts) {
   return config;
 }
 
-// src/core/mask.ts
-var SENSITIVE_RE = /(?:TOKEN|SECRET|PASSWORD|KEY|AUTH|CREDENTIAL)/i;
-function maskValue(value) {
-  if (value.length <= 4) return "****";
-  return `****${value.slice(-4)}`;
-}
-function maskSensitiveArgs(cmd) {
-  let masked = cmd.replace(/([^\s=]*(?:TOKEN|SECRET|PASSWORD|KEY|AUTH|CREDENTIAL)[^\s=]*)=(\S+)/gi, (_, key, value) => {
-    return `${key}=${maskValue(value)}`;
-  });
-  masked = masked.replace(
-    /^(registry:login\s+(?:--global\s+)?\S+\s+\S+\s+)(\S+)/,
-    (_, prefix, password) => `${prefix}${maskValue(password)}`
-  );
-  return masked;
-}
-function maskSensitiveData(data) {
-  if (data === null || data === void 0) return data;
-  if (typeof data === "string") return data;
-  if (Array.isArray(data)) return data.map(maskSensitiveData);
-  if (typeof data === "object") {
-    const result = {};
-    for (const [key, value] of Object.entries(data)) {
-      if (typeof value === "string" && SENSITIVE_RE.test(key)) {
-        result[key] = maskValue(value);
-      } else if (typeof value === "object" && value !== null) {
-        result[key] = maskSensitiveData(value);
-      } else {
-        result[key] = value;
-      }
-    }
-    return result;
-  }
-  return data;
-}
-
 // src/commands/diff.ts
 import chalk2 from "chalk";
+function diffSslStatus(desired, current) {
+  if (typeof desired !== "object" || desired === null) return void 0;
+  if (current === void 0) return void 0;
+  if (current === true) return "in-sync";
+  if (current === false || current === null) return "missing";
+  return void 0;
+}
+function isEmptyValue(value) {
+  return value === null || value === void 0 || Array.isArray(value) && value.length === 0 || typeof value === "object" && Object.keys(value).length === 0;
+}
 async function computeDiff(ctx, config) {
-  const result = { apps: {}, services: {}, inSync: true };
+  const result = { apps: {}, services: {}, inSync: true, readWarnings: [] };
+  const appNames = Object.keys(config.apps);
   await ensureDokkuVersion(ctx, config.dokku?.version);
+  const appExists = /* @__PURE__ */ new Map();
+  await Promise.all(
+    appNames.map(async (app) => {
+      appExists.set(app, await ctx.check("apps:exists", app));
+    })
+  );
+  const existingAppNames = appNames.filter((app) => appExists.get(app));
   const prefetched = /* @__PURE__ */ new Map();
   await Promise.all(
     ALL_APP_RESOURCES.filter((r) => !r.forceApply && !r.key.startsWith("_") && r.readAll).map(async (r) => {
-      prefetched.set(r.key, await r.readAll(ctx));
+      try {
+        const bulk = await r.readAll(ctx);
+        const unreadable = existingAppNames.length > 0 && bulk.size === 0;
+        prefetched.set(r.key, unreadable ? null : bulk);
+      } catch {
+        prefetched.set(r.key, null);
+      }
     })
   );
   for (const [app, appConfig] of Object.entries(config.apps)) {
@@ -1348,12 +1485,41 @@ async function computeDiff(ctx, config) {
         desired = appConfig[resource.key];
       }
       if (desired === void 0) continue;
+      if (!appExists.get(app)) {
+        appDiff[resource.key] = { status: "missing", desired, current: void 0 };
+        result.inSync = false;
+        continue;
+      }
       const bulk = prefetched.get(resource.key);
-      const current = bulk ? bulk.get(app) : await resource.read(ctx, app);
+      let current;
+      let bulkUnreadable = false;
+      if (bulk === null) {
+        bulkUnreadable = true;
+        current = await resource.read(ctx, app);
+      } else if (bulk) {
+        current = bulk.get(app);
+        if (resource.key === "ssl" && current === void 0) {
+          current = await resource.read(ctx, app);
+          if (current === void 0) bulkUnreadable = true;
+        }
+      } else {
+        current = await resource.read(ctx, app);
+      }
+      const sslStatus = resource.key === "ssl" ? diffSslStatus(desired, current) : void 0;
+      if (sslStatus) {
+        appDiff[resource.key] = { status: sslStatus, desired, current };
+        if (sslStatus !== "in-sync") result.inSync = false;
+        continue;
+      }
       const change = computeChange(current, desired);
       if (!change.changed) {
         appDiff[resource.key] = { status: "in-sync", desired, current };
-      } else if (current === null || current === void 0 || Array.isArray(current) && current.length === 0 || typeof current === "object" && Object.keys(current).length === 0) {
+      } else if (bulkUnreadable && isEmptyValue(current)) {
+        appDiff[resource.key] = { status: "unknown", desired, current };
+        result.inSync = false;
+        const msg = `could not read '${resource.key}' for app '${app}' (bulk report was empty and the per-app read returned nothing)`;
+        result.readWarnings.push(msg);
+      } else if (isEmptyValue(current)) {
         appDiff[resource.key] = { status: "missing", desired, current };
         result.inSync = false;
       } else {
@@ -1376,7 +1542,7 @@ async function computeDiff(ctx, config) {
   return result;
 }
 function maskDiffResult(diff) {
-  const masked = { apps: {}, services: diff.services, inSync: diff.inSync };
+  const masked = { apps: {}, services: diff.services, inSync: diff.inSync, readWarnings: diff.readWarnings };
   for (const [app, appDiff] of Object.entries(diff.apps)) {
     const maskedAppDiff = {};
     for (const [feature, d] of Object.entries(appDiff)) {
@@ -1400,7 +1566,7 @@ function formatSummary(diff) {
     } else {
       lines.push(`  app: ${chalk2.bold(app)}`);
       for (const [feature, d] of changes) {
-        const sym = d.status === "missing" ? chalk2.green("+") : chalk2.yellow("~");
+        const sym = d.status === "missing" ? chalk2.green("+") : d.status === "unknown" ? chalk2.red("?") : chalk2.yellow("~");
         lines.push(`    ${sym} ${feature}: ${formatFeatureSummary(d)}`);
       }
     }
@@ -1412,6 +1578,11 @@ function formatSummary(diff) {
     }
   }
   const total = Object.values(diff.apps).flatMap((a) => Object.values(a)).filter((d) => d.status !== "in-sync").length + Object.values(diff.services).filter((d) => d.status !== "in-sync").length;
+  if (diff.readWarnings.length > 0) {
+    lines.push("");
+    lines.push(chalk2.red("  Could not read some server state \u2014 treated as unknown, not missing:"));
+    for (const w of diff.readWarnings) lines.push(chalk2.red(`    - ${w}`));
+  }
   lines.push("");
   if (total === 0) {
     lines.push(chalk2.green("  Everything in sync."));
@@ -1422,6 +1593,7 @@ function formatSummary(diff) {
   return lines.join("\n");
 }
 function formatFeatureSummary(d) {
+  if (d.status === "unknown") return "(could not read server state \u2014 not reported as missing)";
   if (d.status === "missing") return "(not set on server)";
   if (Array.isArray(d.desired) && Array.isArray(d.current)) {
     return `${d.current.length} \u2192 ${d.desired.length} items`;
@@ -1435,6 +1607,10 @@ function formatVerbose(diff) {
     if (changes.length === 0) continue;
     for (const [feature, d] of changes) {
       lines.push(`@@ app: ${app} / ${feature} @@`);
+      if (d.status === "unknown") {
+        lines.push(chalk2.red(`  ? could not read server state \u2014 not reported as missing`));
+        continue;
+      }
       const currentLines = d.current !== void 0 ? JSON.stringify(d.current, null, 2).split("\n") : [];
       const desiredLines = JSON.stringify(d.desired, null, 2).split("\n");
       for (const line of currentLines) lines.push(chalk2.red(`- ${line}`));
@@ -1447,6 +1623,11 @@ function formatVerbose(diff) {
       lines.push(chalk2.green(`+ ${svc}`));
     }
   }
+  if (diff.readWarnings.length > 0) {
+    lines.push("");
+    lines.push(chalk2.red("Could not read some server state \u2014 treated as unknown, not missing:"));
+    for (const w of diff.readWarnings) lines.push(chalk2.red(`  - ${w}`));
+  }
   lines.push("");
   return lines.join("\n");
 }
@@ -1502,6 +1683,7 @@ function validate(filePath) {
 }
 
 // src/index.ts
+import chalk3 from "chalk";
 var require2 = createRequire(import.meta.url);
 var { version } = require2("../package.json");
 var program = new Command().name("dokku-compose").version(version);
@@ -1516,7 +1698,7 @@ program.command("up [apps...]").description("Create/update apps and services to
   const runner = makeRunner(opts);
   const ctx = createContext(runner);
   try {
-    await runUp(ctx, config, apps);
+    await runUp(ctx, config, apps, { failFast: opts.failFast ?? false });
     if (opts.dryRun) {
       console.log("\n# Commands that would run:");
       for (const cmd of runner.dryRunLog) {
@@ -1524,11 +1706,15 @@ program.command("up [apps...]").description("Create/update apps and services to
         console.log(`dokku ${line}`);
       }
     }
+  } catch (error) {
+    console.error(chalk3.red(`
+${error.message}`));
+    process.exitCode = 1;
   } finally {
     await ctx.close();
   }
 });
-program.command("down [apps...]").description("Destroy apps and services (requires --force)").option("-f, --file <path>", "Config file", "dokku-compose.yml").option("--force", "Required to destroy apps").action(async (apps, opts) => {
+program.command("down [apps...]").description("Destroy apps and services (requires --force)").option("-f, --file <path>", "Config file", "dokku-compose.yml").option("--force", "Required to destroy apps").option("--fail-fast", "Stop on first error").action(async (apps, opts) => {
   if (!opts.force) {
     console.error("--force required");
     process.exit(1);
@@ -1537,7 +1723,11 @@ program.command("down [apps...]").description("Destroy apps and services (requir
   const runner = makeRunner({});
   const ctx = createContext(runner);
   try {
-    await runDown(ctx, config, apps, { force: true });
+    await runDown(ctx, config, apps, { force: true, failFast: opts.failFast ?? false });
+  } catch (error) {
+    console.error(chalk3.red(`
+${error.message}`));
+    process.exitCode = 1;
   } finally {
     await ctx.close();
   }
@@ -1586,7 +1776,7 @@ program.command("diff").description("Show what is out of sync between config and
     const diff = opts.sensitive ? rawDiff : maskDiffResult(rawDiff);
     const output = opts.verbose ? formatVerbose(diff) : formatSummary(diff);
     process.stdout.write(output);
-    process.exit(rawDiff.inSync ? 0 : 1);
+    process.exitCode = rawDiff.inSync ? 0 : 1;
   } finally {
     await ctx.close();
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dokku-compose",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Docker Compose for Dokku — declare your entire server in a single YAML file.",
   "main": "dist/index.js",
   "exports": "./dist/index.js",