Compose

Compose runs a group of workers as one project. The daemon reads a worker-compose.yaml, starts each container in dependency order, waits for the engine to register it, and supervises it afterwards. The daemon is itself a worker. It registers under the name compose in a namespace of its own and exposes the compose::* functions there, so every project operation is a normal trigger, addressed to one daemon with --namespace.

The daemon

iii compose [OPTIONS]

Option	Description
`-n, --namespace <NS>`	Namespace this daemon answers `compose::*` in. Generated and printed when absent.
`--engine <URL>`	Engine WebSocket address. Falls back to `III_URL`, then `ws://127.0.0.1:49134`.

A daemon holds any number of projects, and any number of daemons share one engine. What tells them apart is the namespace: the worker name is always compose, so the engine leases (namespace, compose) to one connection. Two daemons with different namespaces coexist; a second claiming one that is taken is refused at registration with DAEMON_ALREADY_SERVING. Without --namespace the daemon generates one and prints it: two words, so it can be read once and typed from memory. There is no well-known default, because a shared name is the collision the namespace exists to prevent. A generated name never reuses one that already holds state on this machine, and the engine refuses a second daemon claiming a namespace that is already served.

$ iii compose
compose serving
  engine: ws://127.0.0.1:49134
  namespace: cobalt-meadow
  start a project: iii trigger compose::up --namespace cobalt-meadow file=./worker-compose.yaml

A generated namespace is new on every start, and a project’s durable state is stored under it. A daemon that has to find its own children again after a restart passes --namespace and keeps it.

SIGINT and SIGTERM both stop the daemon and take every project down with it. compose::stop does the same over the engine.

Starting a project with the daemon

iii compose up serves and brings one project up, without waiting for a call to name it.

iii compose up [-f, --file <PATH>]

--file defaults to ./worker-compose.yaml, the same fallback a compose::* call gets when it names no file. The daemon then stays in the foreground and serves, so every other operation is a compose::* call as usual.

$ iii compose up -n orders
compose serving
  engine: ws://127.0.0.1:49134
  namespace: orders

→ api starting
✓ api ready (250ms)
up: 1 of 1 changed in 250ms

A project that does not start ends the command with PROJECT_DID_NOT_START. Rollback has already stopped whatever came up, so there is nothing left to supervise.

Running it in the background

Compose never backgrounds itself. It serves in the foreground and writes to stdout, which is the shape every process supervisor already expects, and it leaves log rotation and restart-on-failure to something that already does both. For a quick session, a shell redirect is enough:

iii compose --namespace dev >> ~/iii-compose.log 2>&1 &

On a server, a unit file gives restart-on-failure and hands the output to the journal. Name the namespace there: a unit that restarts under a generated one loses track of its own children.

[Unit]
Description=iii compose
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/iii compose --namespace prod
Restart=always

[Install]
WantedBy=multi-user.target

Use Type=simple. Type=notify waits for an sd_notify readiness message, which compose does not send, so systemd kills it at TimeoutStartSec.

The `compose::*` functions

All eight functions accept the same payload.

Field	Type	Description
`file`	string	Which project: the path to its compose file.
`container`	string	Restricts the operation to one container and the containers it depends on.
`namespace`	string	Which daemon the caller believed they were reaching. A guard, see below.
`worker`	string	`compose::add` only: the worker to declare. Ignored by the rest.

A project is its compose file, and nothing else names one. The same file reached twice is the same project however it was spelled, so there is no second identity to keep in sync and no way to point one at the wrong file.

namespace in the payload does not select a daemon. The engine resolves a call by the --namespace flag and never reads the body, so this can only catch having reached the wrong daemon: a mismatch fails with WRONG_DAEMON. Sent alone, the call still lands wherever the flag pointed.

Function	Takes	Returns
`compose::up`	`file`	An operation result.
`compose::down`	`file`	An operation result.
`compose::status`	`file`	The project’s namespace, file, state directory, daemon pid, container states.
`compose::list`	nothing	The daemon name, its namespace, its pid, and every project it holds.
`compose::validate`	`file`	A validation report.
`compose::add`	`file`, `worker`	What the edit did, and the `down` and `up` that followed.
`compose::restart`	`file`, `worker`	The `down` and the `up`, or one container’s restart.
`compose::update`	`file`, `worker`	Both versions, and the restart that followed.
`compose::stop`	nothing	The daemon name, its pid, and the projects it is about to stop.

file is not required. Left out, it falls back to a worker-compose.yaml in the daemon’s own working directory. worker has no fallback.

Adding a worker

compose::add declares a worker in the compose file and restarts the project. worker= takes a registry name (state), a name with a version (state@0.21.4) or a directory (./workers/api); a leading . or / is what makes it a path, since a registry reference may carry a host of its own. An unpinned name is resolved once and written out as an exact version, so a later up cannot quietly get a different build. The same worker at the same version changes nothing and says so; at a different version it is replaced, which is how an upgrade or a rollback is asked for. A worker is rarely alone. Its manifest names what it calls, and the registry answers with that whole graph already pinned to versions that satisfy each other, so those are declared too, as containers with their own depends_on. Nothing starts behind the file: what runs is still what the file says, and an operator can read it, pin it differently, or take a container out. Two rules shape the expansion. Workers compiled into the engine are skipped, because they are already serving and have no artefact to install; an edge to one is dropped rather than written, since depends_on may only name a container the file declares. And a worker two others need is declared once, named by both. The file is edited, not rewritten: comments, blank lines and quoting survive, entries are appended, and the result is parsed before it is written, so a bad edit never reaches disk. What is written is worker, version and depends_on. It writes no scripts, so a path:// worker needs scripts.start in its own iii.worker.yaml to start. A path:// worker is added alone: its dependencies are declared in a manifest on disk rather than in the registry’s answer.

iii trigger compose::up     --namespace dev file=./worker-compose.yaml
iii trigger compose::up     --namespace dev file=./worker-compose.yaml container=api
iii trigger compose::status --namespace dev file=./worker-compose.yaml
iii trigger compose::down   --namespace dev file=./worker-compose.yaml
iii trigger compose::list   --namespace dev
iii trigger compose::add    --namespace dev file=./worker-compose.yaml worker=state
iii trigger compose::restart --namespace dev file=./worker-compose.yaml
iii trigger compose::stop   --namespace dev

A project-scoped call may leave file out when the daemon’s own working directory holds a worker-compose.yaml; without one, it fails with NO_COMPOSE_FILE. A relative file resolves against the daemon’s directory, not the caller’s, so pass an absolute path when they differ. compose::restart is a down followed by an up, with the compose file read again between them, so an edit made by hand takes effect without restarting the daemon. It accepts container like the two halves it is made of. Nothing cleverer yet: no rolling restart, and no keeping a container that did not change. compose::stop stops a compose project but returns before the daemon exits. compose::validate answers for a file and holds nothing: a CI job that only ever validates leaves the daemon owning nothing. Validation is offline, so package:// containers are reported under deferred_packages instead of being resolved.

Restarting one worker

compose::restart worker=state stops that container and starts it again. Nothing else moves: not what it depends on, and not what depends on it. That is a decision, not a shortcut. A dependent holding a connection to the worker sees it drop, and compose does not restart the dependents to hide it. Which of them tolerate a drop is the operator’s knowledge, not compose’s. Left out, worker restarts the whole project instead: down, then up, with the file read again between them.

Updating a worker

compose::update worker=state moves a declared container to another version of the same package.

worker=state            the version the registry calls latest
worker=state@0.21.4     that version, which is also how a downgrade is spelled

The answer names both ends, because an operator who asked for “latest” does not know what it is until the call says so:

{ "container": "state", "from": "0.21.4-alpha.4", "to": "0.22.0", "detail": "state from 0.21.4-alpha.4 to 0.22.0" }

Already on the version asked for, nothing is written and changed is false. The container has to be declared already, and has to be a package:// one: this edits a version line, it does not add a container, and a path:// worker has no version to move. Use compose::add to declare something new. Only the version line changes. A depends_on written by hand comes through as it was, since rewriting the graph is what compose::add is for.

Unlike compose::restart worker=, an update restarts the whole project. A project is held as its file was read, so a new version is only picked up once the project is dropped and read again. Dropping it while its other containers run would leave them supervised by nothing.

Operation results

compose::up and compose::down return the same fields.

Field	Type	Description
`operation_id`	string	Identifier for this operation.
`status`	string	`ok` or `failed`.
`changed`	boolean	`false` when every requested container was already in the target state.
`containers`	array	One entry per container the operation planned.

Each entry in containers contains container, state, changed. If a container failed it will also contain an error object with code and message. A failed up tears down any running containers, in reverse startup order, and reports those containers as stopped with changed: false. Containers that were already running before the operation are left alone.

Container states

State	Meaning
`starting`	Spawned. The engine has not registered it yet.
`ready`	Registered in the engine under `(namespace, container)`.
`failed`	Exited without being asked to, or one of its hooks failed.
`stopped`	Stopped by this daemon.

compose::status reports each declared container with its state, its pid, an owned flag, and last_error when there is one. owned is false for a container this daemon can see but did not start.

Validation reports

Field	Type	Description
`namespace`	string	Namespace the project’s containers register in.
`start_order`	array	Container keys in dependency order.
`deferred_packages`	array	`package://` containers, which need the registry to resolve.

`worker-compose.yaml`

This documentation reflects version 1 of a worker compose file. Unknown keys and duplicate keys are errors. Durations can specify a unit: 500ms, 30s, 2m.

namespace: shop
startup_timeout: 60s
stop_timeout: 10s
containers:
  database:
    worker: path://./workers/database
  api:
    worker: path://./workers/api
    depends_on: [database]
    config_name: shop-api
    config_override:
      log_level: debug
    env_file: [./.env]
    environment:
      RUST_LOG: info
    scripts:
      pre_run: npm run migrate
      pre_run_timeout: 2m
      run: npm start
      post_run: ./scripts/cleanup.sh
  state:
    worker: package://registry.iii.dev/state
    version: "0.21.4"

Top-level fields

Field	Type	Default	Description
`namespace`	string	absent	Namespace the project’s containers register in. A project that declares none lands in `default`.
`startup_timeout`	string	`60s`	Readiness budget for every container. A container may override it.
`stop_timeout`	string	`10s`	Grace between the polite stop and the forced kill.
`containers`	map	none	At least one entry. An empty map fails with `EMPTY_CONTAINERS`.

The namespace must already be [a-z0-9_-]. A value outside that set is refused with INVALID_NAMESPACE rather than rewritten to fit, so what the file declares is what an operator types into --namespace. Nothing about the file’s path enters it, so two copies of one project collide instead of running side by side.

Container fields

Each key under containers is the worker name the container registers under.

Field	Type	Default	Description
`worker`	string	required	`path://<dir>` or `package://<registry-host>/<name>`.
`version`	string	absent	Version range. Required for `package://`.
`depends_on`	array	empty	Container keys that start first. Self-dependencies and cycles are rejected.
`config_name`	string	absent	The configuration worker entry this container owns.
`config_override`	mapping	absent	Merged on top of the fetched configuration.
`working_dir`	path	the worker directory	Resolved against the compose file’s directory.
`environment`	map	empty	Environment variables for this container.
`env_file`	array of paths	empty	Read at start time, in declaration order. A later file wins on conflicting entries.
`startup_timeout`	string	the file’s value	Readiness budget for this container.
`scripts`	mapping	absent	See below.

path:// directories resolve against the compose file’s directory. A missing directory fails with MISSING_WORKER_DIRECTORY, and a missing env_file fails with MISSING_ENV_FILE during validation.

Worker kinds

The registry answers with a kind, and it decides how the container runs. A kind compose cannot run fails with UNSUPPORTED_PACKAGE_KIND.

Kind	How it runs
`binary`	A child process on the host.
`bundle`	A VM. The start command is the bundle’s own `scripts.start`, read in the guest.
`engine`	Not installable: the registry publishes no artefact, so compose has nothing to start.
`image`	Not supported: it needs the OCI runtime.

A bundle is published code that compose did not build, so it is started behind the same boundary iii add puts it behind, rather than as a host process. Its configuration is published into the guest, so III_CONFIG names a path inside the VM; a worker reads it the same way either way. Bundle support can be refused machine-wide with III_BUNDLE_WORKERS_DISABLED=1, which compose honours. A bundle’s VM is booted by iii-worker, which the installer ships beside iii and which needs glibc on Linux. Compose runs it as a process rather than linking it, so the engine stays portable; a bundle container on a machine without iii-worker fails saying so, and every other worker kind is unaffected. Bundles need a VM, and windows has none: a bundle container there fails with BUNDLE_NEEDS_A_VM before anything is downloaded. Run compose under WSL, where the VM has KVM to run on. Every other worker kind runs on windows as it always has.

Scripts

Field	Type	Default	Description
`pre_run`	string	absent	Runs to completion before the container is spawned.
`pre_run_timeout`	string	`60s`	Budget for `pre_run`. Rejected without a `pre_run`.
`run`	string	absent	Start command. Rejected for `package://` containers.
`post_run`	string	absent	Runs after the container’s exit is confirmed. Never awaited.

Both hooks run with the container’s environment, working directory, and their own process group. The start command for a path:// container is run, then scripts.start from the worker’s iii.worker.yaml. A container with neither fails with MISSING_START_COMMAND. Where the two files describe the same thing, worker-compose.yaml wins and the manifest is the default. run overrides scripts.start, and the container key overrides the manifest’s name: the key is what reaches the child as III_WORKER_NAME, so a worker honouring the reserved contract registers under it whatever its manifest declares. A worker that hardcodes its name instead is caught at readiness by WORKER_NAME_MISMATCH, which reports the name it took.

Configuration precedence

Lowest to highest: the configuration a package ships, the entry the configuration worker holds, then config_override. The merged result is written to an owner-only file and its path is passed to the container as III_CONFIG. A container that declares config_name does not start when the fetch fails; the error is CONFIG_FETCH_FAILED.

The container environment

A container’s environment is built, and the daemon’s own environment is not inherited wholesale. Three layers apply, lowest to highest.

A host baseline. On Unix: PATH, HOME, USER, LOGNAME, SHELL, TERM, TMPDIR, TZ, LANG, LC_ALL. Windows adds the variables the platform needs, such as SystemRoot, COMSPEC, and PATHEXT.
The container’s env_file entries, then its environment map.
The reserved variables, which the daemon owns.

Variable	Value
`III_URL`	The engine address the daemon is connected to.
`III_NAMESPACE`	The project’s namespace.
`III_WORKER_NAME`	The container key.
`III_CONFIG`	Path to the resolved configuration file. Absent when there is none.
`III_CONFIG_NAME`	The configuration entry the container owns. Absent when it declares none.

Declaring a reserved variable in environment or an env_file fails with RESERVED_ENV_OVERRIDE, in both cases at compose::validate time.

For why the daemon owns these five rather than treating them as defaults a container can replace, see Understanding iii / Compose.

Reading a value from the host

The baseline is short on purpose, so nothing an operator exported reaches a worker by accident. A file names the values it wants instead, with ${VAR}.

containers:
  queue:
    worker: path://${WORKERS_DIR}/queue
    environment:
      RUST_LOG: ${RUST_LOG:-info}

References expand in any value, not only in environment: a worker path, a version, an env_file entry. The file on disk is never rewritten.

Written	Means
`${VAR}`	The value from compose’s own environment. Unset, the file is refused with `UNDEFINED_VARIABLE`.
`${VAR:-text}`	The value, or `text` when it is unset. `${VAR:-}` makes it optional and empty.
`$VAR`	Nothing. A bare name is left alone, so a `scripts.run` holding `$PWD` still reaches the shell.
`$${VAR}`	A literal `${VAR}`.

What `config_override` keeps

config_override is never expanded, at any depth. That block is not compose’s to read: it is carried to the configuration worker, which resolves ${VAR} references of its own at read time. That is how a secret is stored as a reference rather than as a value.

    config_override:
      # Reaches the worker as written. The value is never in the compose file,
      # and never in what compose stores.
      api_key: ${ANTHROPIC_API_KEY}

A name that compose’s environment does not hold is therefore not an error inside this block. Nothing in it is compose’s to resolve.

Readiness

A container is considered up when the engine reports a worker of that name in the project’s namespace. Compose polls engine::workers::list every 200 ms until the container’s startup_timeout runs out.

Outcome	Code
The container never appeared.	`STARTUP_TIMEOUT`
The process exited while compose was waiting.	`CHILD_EXITED_BEFORE_REGISTRATION`
It registered in `default` instead of the project’s namespace.	`WORKER_IGNORED_NAMESPACE`
It registered under a different name in the right namespace.	`WORKER_NAME_MISMATCH`
Its functions landed outside the project’s namespace.	`FUNCTIONS_IN_WRONG_NAMESPACE`
A worker already held that name in the namespace.	`CONTAINER_NAME_TAKEN`

After a container is ready, the daemon checks it every 250 ms. A container that exits takes its transitive dependents down with it and is recorded as failed. Nothing is restarted: v1 has no restart policy, so a container that dies stays down until the next up. When the engine connection drops and comes back, every running container gets its startup_timeout to register again. What a failure takes with it depends on when it happens, and v1 has no way to declare otherwise.

When	What comes down
During `up`	The operation ends. Everything it started is stopped in reverse order, and containers later in the start order are never attempted.
After the container is ready	Its transitive dependents. Everything else keeps running.

So a container nothing depends on ends the whole up if it fails at start, and is contained if it fails a minute later. See Understanding iii / Compose.

Where compose keeps state

Everything sits under ~/.iii/compose, or under $III_COMPOSE_STATE_DIR when that is set.

Path	Contents
`<ns>/<project>/state.json`	One project’s child records. Owner-only.
`<ns>/<project>/config/`	Resolved configuration files.
`<ns>/<project>/logs/`	What each container printed while starting.
`<ns>/<project>/vm/`	VM state for bundle containers, one directory each, plus the config each one publishes into its guest.
`packages/`	Installed `package://` artefacts, shared by projects.

<ns> is the daemon’s namespace. <project> is derived from the compose file’s canonical path: readable enough to recognise, hashed enough that two projects in directories of the same name stay apart. Because it is derived, it cannot be guessed. compose::status reports it as state_dir, which is how a container’s startup output is located:

iii trigger compose::status --namespace dev file=./worker-compose.yaml
# ... "state_dir": "/home/you/.iii/compose/dev/shop-3f2a1b9c"
ls /home/you/.iii/compose/dev/shop-3f2a1b9c/logs/

For why this is one place per machine rather than a directory beside each compose file, see Understanding iii / Compose.

Capture stops when a container becomes ready. Up to that point a worker has no connection and its own output is the only account of itself, which is what the file keeps; once the engine can hear it, the worker’s logging is the record and compose keeps no second copy. So a container that fails at boot leaves its reason on disk, and one that runs for a month does not leave a file that grew all month. A clean shutdown clears the state file. After an unclean exit, the daemon compares each record against the live process: a match is adopted, a dead process is recorded failed, and a live pid it cannot verify is left running and reported for manual cleanup.

Error codes

Compose errors cross the wire with a stable code and a message.

Area	Codes
Compose file	`COMPOSE_FILE_UNREADABLE`, `INVALID_COMPOSE_FILE`, `EMPTY_CONTAINERS`, `INVALID_DURATION`, `UNKNOWN_DEPENDENCY`, `SELF_DEPENDENCY`, `DEPENDENCY_CYCLE`, `UNSUPPORTED_WORKER_SOURCE`
Container declaration	`MISSING_VERSION_FOR_PACKAGE`, `RUN_NOT_ALLOWED_FOR_PACKAGE`, `NOT_A_PACKAGE_CONTAINER`, `PRE_RUN_TIMEOUT_WITHOUT_PRE_RUN`, `RESERVED_ENV_OVERRIDE`, `MISSING_ENV_FILE`
Worker resolution	`MISSING_WORKER_DIRECTORY`, `MISSING_START_COMMAND`, `INVALID_MANIFEST`
Packages	`REGISTRY_UNREACHABLE`, `PACKAGE_NOT_RESOLVED`, `PACKAGE_NOT_INSTALLED`, `PACKAGE_DOWNLOAD_FAILED`, `PACKAGE_DIGEST_MISMATCH`, `PACKAGE_ARTIFACT_EMPTY`, `UNSUPPORTED_PACKAGE_KIND`, `UNSUPPORTED_PLATFORM`
Start and readiness	`SPAWN_FAILED`, `HOOK_SPAWN_FAILED`, `HOOK_FAILED`, `HOOK_TIMEOUT`, `STARTUP_TIMEOUT`, `CHILD_EXITED_BEFORE_REGISTRATION`, `WORKER_IGNORED_NAMESPACE`, `WORKER_NAME_MISMATCH`, `FUNCTIONS_IN_WRONG_NAMESPACE`, `CONTAINER_NAME_TAKEN`, `CONFIG_FETCH_FAILED`, `ENGINE_CALL_FAILED`
Daemon and project	`NO_COMPOSE_FILE`, `WRONG_DAEMON`, `INVALID_NAMESPACE`, `UNKNOWN_CONTAINER`, `INVALID_STATE_FILE`, `STATE_DIR_UNAVAILABLE`, `DAEMON_ALREADY_SERVING`, `IO_ERROR`

For why compose is a worker and why a project is its file, see Understanding iii / Compose. For the namespace dimension itself, see Understanding iii / Namespaces. For the iii compose entry in the command tree, see the CLI reference.

Getting Started

Upgrading

Using iii

Understanding iii

Creating Workers

The daemon

Starting a project with the daemon

Running it in the background

The `compose::*` functions

Adding a worker

Restarting one worker

Updating a worker

Operation results

Container states

Validation reports

`worker-compose.yaml`

Top-level fields

Container fields

Worker kinds

Scripts

Configuration precedence

The container environment

Reading a value from the host

What `config_override` keeps

Readiness

Where compose keeps state

Error codes

​The daemon

​Starting a project with the daemon

​Running it in the background

​The compose::* functions

​Adding a worker

​Restarting one worker

​Updating a worker

​Operation results

​Container states

​Validation reports

​worker-compose.yaml

​Top-level fields

​Container fields

​Worker kinds

​Scripts

​Configuration precedence

​The container environment

​Reading a value from the host

​What config_override keeps

​Readiness

​Where compose keeps state

​Error codes

​Related

The daemon

Starting a project with the daemon

Running it in the background

The `compose::*` functions

Adding a worker

Restarting one worker

Updating a worker

Operation results

Container states

Validation reports

`worker-compose.yaml`

Top-level fields

Container fields

Worker kinds

Scripts

Configuration precedence

The container environment

Reading a value from the host

What `config_override` keeps

Readiness

Where compose keeps state

Error codes

Related