> ## Documentation Index > Fetch the complete documentation index at: https://iii.dev/docs/llms.txt > Use this file to discover all available pages before exploring further. # Compose > The compose daemon and its worker surface: the compose::* functions, the worker-compose.yaml schema, and the environment every container is started with. Compose runs a group of workers as one project. The daemon reads a `worker-compose.yaml`, starts each container in dependency order, waits for the engine to register it, and supervises it afterwards. The daemon is itself a worker. It registers under the name `compose` in a namespace of its own and exposes the `compose::*` functions there, so every project operation is a normal [trigger](./triggers), addressed to one daemon with `--namespace`. ## The daemon ```text theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} iii compose [OPTIONS] ``` | Option | Description | | ---------------------- | --------------------------------------------------------------------------------- | | `-n, --namespace ` | Namespace this daemon answers `compose::*` in. Generated and printed when absent. | | `--engine ` | Engine WebSocket address. Falls back to `III_URL`, then `ws://127.0.0.1:49134`. | A daemon holds any number of projects, and any number of daemons share one engine. What tells them apart is the namespace: the worker name is always `compose`, so the engine leases `(namespace, compose)` to one connection. Two daemons with different namespaces coexist; a second claiming one that is taken is refused at registration with `DAEMON_ALREADY_SERVING`. Without `--namespace` the daemon generates one and prints it: two words, so it can be read once and typed from memory. There is no well-known default, because a shared name is the collision the namespace exists to prevent. A generated name never reuses one that already holds state on this machine, and the engine refuses a second daemon claiming a namespace that is already served. ```text theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} $ iii compose compose serving engine: ws://127.0.0.1:49134 namespace: cobalt-meadow start a project: iii trigger compose::up --namespace cobalt-meadow file=./worker-compose.yaml ``` A generated namespace is new on every start, and a project's durable state is stored under it. A daemon that has to find its own children again after a restart passes `--namespace` and keeps it. `SIGINT` and `SIGTERM` both stop the daemon and take every project down with it. `compose::stop` does the same over the engine. ### Starting a project with the daemon `iii compose up` serves and brings one project up, without waiting for a call to name it. ```text theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} iii compose up [-f, --file ] ``` `--file` defaults to `./worker-compose.yaml`, the same fallback a `compose::*` call gets when it names no file. The daemon then stays in the foreground and serves, so every other operation is a `compose::*` call as usual. ```text theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} $ iii compose up -n orders compose serving engine: ws://127.0.0.1:49134 namespace: orders → api starting ✓ api ready (250ms) up: 1 of 1 changed in 250ms ``` A project that does not start ends the command with `PROJECT_DID_NOT_START`. Rollback has already stopped whatever came up, so there is nothing left to supervise. ### Running it in the background Compose never backgrounds itself. It serves in the foreground and writes to stdout, which is the shape every process supervisor already expects, and it leaves log rotation and restart-on-failure to something that already does both. For a quick session, a shell redirect is enough: ```bash theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} iii compose --namespace dev >> ~/iii-compose.log 2>&1 & ``` On a server, a unit file gives restart-on-failure and hands the output to the journal. Name the namespace there: a unit that restarts under a generated one loses track of its own children. ```ini theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} [Unit] Description=iii compose After=network.target [Service] Type=simple ExecStart=/usr/local/bin/iii compose --namespace prod Restart=always [Install] WantedBy=multi-user.target ``` Use `Type=simple`. `Type=notify` waits for an `sd_notify` readiness message, which compose does not send, so systemd kills it at `TimeoutStartSec`. ## The `compose::*` functions All eight functions accept the same payload. | Field | Type | Description | | ----------- | ------ | -------------------------------------------------------------------------- | | `file` | string | Which project: the path to its compose file. | | `container` | string | Restricts the operation to one container and the containers it depends on. | | `namespace` | string | Which daemon the caller believed they were reaching. A guard, see below. | | `worker` | string | `compose::add` only: the worker to declare. Ignored by the rest. | A project is its compose file, and nothing else names one. The same file reached twice is the same project however it was spelled, so there is no second identity to keep in sync and no way to point one at the wrong file. `namespace` in the payload does not select a daemon. The engine resolves a call by the `--namespace` flag and never reads the body, so this can only catch having reached the wrong daemon: a mismatch fails with `WRONG_DAEMON`. Sent alone, the call still lands wherever the flag pointed. | Function | Takes | Returns | | ------------------- | ---------------- | ----------------------------------------------------------------------------- | | `compose::up` | `file` | An operation result. | | `compose::down` | `file` | An operation result. | | `compose::status` | `file` | The project's namespace, file, state directory, daemon pid, container states. | | `compose::list` | nothing | The daemon name, its namespace, its pid, and every project it holds. | | `compose::validate` | `file` | A validation report. | | `compose::add` | `file`, `worker` | What the edit did, and the `down` and `up` that followed. | | `compose::restart` | `file`, `worker` | The `down` and the `up`, or one container's restart. | | `compose::update` | `file`, `worker` | Both versions, and the restart that followed. | | `compose::stop` | nothing | The daemon name, its pid, and the projects it is about to stop. | `file` is not required. Left out, it falls back to a `worker-compose.yaml` in the daemon's own working directory. `worker` has no fallback. ### Adding a worker `compose::add` declares a worker in the compose file and restarts the project. `worker=` takes a registry name (`state`), a name with a version (`state@0.21.4`) or a directory (`./workers/api`); a leading `.` or `/` is what makes it a path, since a registry reference may carry a host of its own. An unpinned name is resolved once and written out as an exact version, so a later `up` cannot quietly get a different build. The same worker at the same version changes nothing and says so; at a different version it is replaced, which is how an upgrade or a rollback is asked for. A worker is rarely alone. Its manifest names what it calls, and the registry answers with that whole graph already pinned to versions that satisfy each other, so those are declared too, as containers with their own `depends_on`. Nothing starts behind the file: what runs is still what the file says, and an operator can read it, pin it differently, or take a container out. Two rules shape the expansion. Workers compiled into the engine are skipped, because they are already serving and have no artefact to install; an edge to one is dropped rather than written, since `depends_on` may only name a container the file declares. And a worker two others need is declared once, named by both. The file is edited, not rewritten: comments, blank lines and quoting survive, entries are appended, and the result is parsed before it is written, so a bad edit never reaches disk. What is written is `worker`, `version` and `depends_on`. It writes no `scripts`, so a `path://` worker needs `scripts.start` in its own `iii.worker.yaml` to start. A `path://` worker is added alone: its dependencies are declared in a manifest on disk rather than in the registry's answer. ```bash theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} iii trigger compose::up --namespace dev file=./worker-compose.yaml iii trigger compose::up --namespace dev file=./worker-compose.yaml container=api iii trigger compose::status --namespace dev file=./worker-compose.yaml iii trigger compose::down --namespace dev file=./worker-compose.yaml iii trigger compose::list --namespace dev iii trigger compose::add --namespace dev file=./worker-compose.yaml worker=state iii trigger compose::restart --namespace dev file=./worker-compose.yaml iii trigger compose::stop --namespace dev ``` A project-scoped call may leave `file` out when the daemon's own working directory holds a `worker-compose.yaml`; without one, it fails with `NO_COMPOSE_FILE`. A relative `file` resolves against the daemon's directory, not the caller's, so pass an absolute path when they differ. `compose::restart` is a `down` followed by an `up`, with the compose file read again between them, so an edit made by hand takes effect without restarting the daemon. It accepts `container` like the two halves it is made of. Nothing cleverer yet: no rolling restart, and no keeping a container that did not change. `compose::stop` stops a compose project but returns before the daemon exits. `compose::validate` answers for a file and holds nothing: a CI job that only ever validates leaves the daemon owning nothing. Validation is offline, so `package://` containers are reported under `deferred_packages` instead of being resolved. ### Restarting one worker `compose::restart worker=state` stops that container and starts it again. Nothing else moves: not what it depends on, and not what depends on it. That is a decision, not a shortcut. A dependent holding a connection to the worker sees it drop, and compose does not restart the dependents to hide it. Which of them tolerate a drop is the operator's knowledge, not compose's. Left out, `worker` restarts the whole project instead: `down`, then `up`, with the file read again between them. ### Updating a worker `compose::update worker=state` moves a declared container to another version of the same package. ```text theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} worker=state the version the registry calls latest worker=state@0.21.4 that version, which is also how a downgrade is spelled ``` The answer names both ends, because an operator who asked for "latest" does not know what it is until the call says so: ```json theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} { "container": "state", "from": "0.21.4-alpha.4", "to": "0.22.0", "detail": "state from 0.21.4-alpha.4 to 0.22.0" } ``` Already on the version asked for, nothing is written and `changed` is `false`. The container has to be declared already, and has to be a `package://` one: this edits a version line, it does not add a container, and a `path://` worker has no version to move. Use [`compose::add`](#adding-a-worker) to declare something new. Only the version line changes. A `depends_on` written by hand comes through as it was, since rewriting the graph is what `compose::add` is for. Unlike `compose::restart worker=`, an update restarts the whole project. A project is held as its file was read, so a new version is only picked up once the project is dropped and read again. Dropping it while its other containers run would leave them supervised by nothing. ### Operation results `compose::up` and `compose::down` return the same fields. | Field | Type | Description | | -------------- | ------- | ----------------------------------------------------------------------- | | `operation_id` | string | Identifier for this operation. | | `status` | string | `ok` or `failed`. | | `changed` | boolean | `false` when every requested container was already in the target state. | | `containers` | array | One entry per container the operation planned. | Each entry in `containers` contains `container`, `state`, `changed`. If a container failed it will also contain an `error` object with `code` and `message`. A failed `up` tears down any running containers, in reverse startup order, and reports those containers as `stopped` with `changed: false`. Containers that were already running before the operation are left alone. ### Container states | State | Meaning | | ---------- | ---------------------------------------------------------- | | `starting` | Spawned. The engine has not registered it yet. | | `ready` | Registered in the engine under `(namespace, container)`. | | `failed` | Exited without being asked to, or one of its hooks failed. | | `stopped` | Stopped by this daemon. | `compose::status` reports each declared container with its `state`, its `pid`, an `owned` flag, and `last_error` when there is one. `owned` is `false` for a container this daemon can see but did not start. ### Validation reports | Field | Type | Description | | ------------------- | ------ | ------------------------------------------------------------ | | `namespace` | string | Namespace the project's containers register in. | | `start_order` | array | Container keys in dependency order. | | `deferred_packages` | array | `package://` containers, which need the registry to resolve. | ## `worker-compose.yaml` This documentation reflects version 1 of a worker compose file. Unknown keys and duplicate keys are errors. Durations can specify a unit: `500ms`, `30s`, `2m`. ```yaml theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} namespace: shop startup_timeout: 60s stop_timeout: 10s containers: database: worker: path://./workers/database api: worker: path://./workers/api depends_on: [database] config_name: shop-api config_override: log_level: debug env_file: [./.env] environment: RUST_LOG: info scripts: pre_run: npm run migrate pre_run_timeout: 2m run: npm start post_run: ./scripts/cleanup.sh state: worker: package://registry.iii.dev/state version: "0.21.4" ``` ### Top-level fields | Field | Type | Default | Description | | ----------------- | ------ | ------- | ------------------------------------------------------------------------------------------------ | | `namespace` | string | absent | Namespace the project's containers register in. A project that declares none lands in `default`. | | `startup_timeout` | string | `60s` | Readiness budget for every container. A container may override it. | | `stop_timeout` | string | `10s` | Grace between the polite stop and the forced kill. | | `containers` | map | none | At least one entry. An empty map fails with `EMPTY_CONTAINERS`. | The namespace must already be `[a-z0-9_-]`. A value outside that set is refused with `INVALID_NAMESPACE` rather than rewritten to fit, so what the file declares is what an operator types into `--namespace`. Nothing about the file's path enters it, so two copies of one project collide instead of running side by side. ### Container fields Each key under `containers` is the worker name the container registers under. | Field | Type | Default | Description | | ----------------- | -------------- | -------------------- | ----------------------------------------------------------------------------------- | | `worker` | string | required | `path://` or `package:///`. | | `version` | string | absent | Version range. Required for `package://`. | | `depends_on` | array | empty | Container keys that start first. Self-dependencies and cycles are rejected. | | `config_name` | string | absent | The [configuration worker](./configuration) entry this container owns. | | `config_override` | mapping | absent | Merged on top of the fetched configuration. | | `working_dir` | path | the worker directory | Resolved against the compose file's directory. | | `environment` | map | empty | Environment variables for this container. | | `env_file` | array of paths | empty | Read at start time, in declaration order. A later file wins on conflicting entries. | | `startup_timeout` | string | the file's value | Readiness budget for this container. | | `scripts` | mapping | absent | See below. | `path://` directories resolve against the compose file's directory. A missing directory fails with `MISSING_WORKER_DIRECTORY`, and a missing `env_file` fails with `MISSING_ENV_FILE` during validation. ### Worker kinds The registry answers with a kind, and it decides how the container runs. A kind compose cannot run fails with `UNSUPPORTED_PACKAGE_KIND`. | Kind | How it runs | | -------- | ------------------------------------------------------------------------------------- | | `binary` | A child process on the host. | | `bundle` | A VM. The start command is the bundle's own `scripts.start`, read in the guest. | | `engine` | Not installable: the registry publishes no artefact, so compose has nothing to start. | | `image` | Not supported: it needs the OCI runtime. | A bundle is published code that compose did not build, so it is started behind the same boundary `iii add` puts it behind, rather than as a host process. Its configuration is published into the guest, so `III_CONFIG` names a path inside the VM; a worker reads it the same way either way. Bundle support can be refused machine-wide with `III_BUNDLE_WORKERS_DISABLED=1`, which compose honours. A bundle's VM is booted by `iii-worker`, which the installer ships beside `iii` and which needs glibc on Linux. Compose runs it as a process rather than linking it, so the engine stays portable; a bundle container on a machine without `iii-worker` fails saying so, and every other worker kind is unaffected. Bundles need a VM, and windows has none: a bundle container there fails with `BUNDLE_NEEDS_A_VM` before anything is downloaded. Run compose under WSL, where the VM has KVM to run on. Every other worker kind runs on windows as it always has. ### Scripts | Field | Type | Default | Description | | ----------------- | ------ | ------- | ------------------------------------------------------------ | | `pre_run` | string | absent | Runs to completion before the container is spawned. | | `pre_run_timeout` | string | `60s` | Budget for `pre_run`. Rejected without a `pre_run`. | | `run` | string | absent | Start command. Rejected for `package://` containers. | | `post_run` | string | absent | Runs after the container's exit is confirmed. Never awaited. | Both hooks run with the container's environment, working directory, and their own process group. The start command for a `path://` container is `run`, then `scripts.start` from the worker's `iii.worker.yaml`. A container with neither fails with `MISSING_START_COMMAND`. Where the two files describe the same thing, `worker-compose.yaml` wins and the manifest is the default. `run` overrides `scripts.start`, and the container key overrides the manifest's `name`: the key is what reaches the child as `III_WORKER_NAME`, so a worker honouring the reserved contract registers under it whatever its manifest declares. A worker that hardcodes its name instead is caught at readiness by `WORKER_NAME_MISMATCH`, which reports the name it took. ### Configuration precedence Lowest to highest: the configuration a package ships, the entry the configuration worker holds, then `config_override`. The merged result is written to an owner-only file and its path is passed to the container as `III_CONFIG`. A container that declares `config_name` does not start when the fetch fails; the error is `CONFIG_FETCH_FAILED`. ## The container environment A container's environment is built, and the daemon's own environment is not inherited wholesale. Three layers apply, lowest to highest. 1. A host baseline. On Unix: `PATH`, `HOME`, `USER`, `LOGNAME`, `SHELL`, `TERM`, `TMPDIR`, `TZ`, `LANG`, `LC_ALL`. Windows adds the variables the platform needs, such as `SystemRoot`, `COMSPEC`, and `PATHEXT`. 2. The container's `env_file` entries, then its `environment` map. 3. The reserved variables, which the daemon owns. | Variable | Value | | ----------------- | ------------------------------------------------------------------------- | | `III_URL` | The engine address the daemon is connected to. | | `III_NAMESPACE` | The project's namespace. | | `III_WORKER_NAME` | The container key. | | `III_CONFIG` | Path to the resolved configuration file. Absent when there is none. | | `III_CONFIG_NAME` | The configuration entry the container owns. Absent when it declares none. | Declaring a reserved variable in `environment` or an `env_file` fails with `RESERVED_ENV_OVERRIDE`, in both cases at `compose::validate` time. For why the daemon owns these five rather than treating them as defaults a container can replace, see [Understanding iii / Compose](../understanding-iii/compose). ### Reading a value from the host The baseline is short on purpose, so nothing an operator exported reaches a worker by accident. A file names the values it wants instead, with `${VAR}`. ```yaml theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} containers: queue: worker: path://${WORKERS_DIR}/queue environment: RUST_LOG: ${RUST_LOG:-info} ``` References expand in any value, not only in `environment`: a worker path, a version, an `env_file` entry. The file on disk is never rewritten. | Written | Means | | -------------- | ----------------------------------------------------------------------------------------------- | | `${VAR}` | The value from compose's own environment. Unset, the file is refused with `UNDEFINED_VARIABLE`. | | `${VAR:-text}` | The value, or `text` when it is unset. `${VAR:-}` makes it optional and empty. | | `$VAR` | Nothing. A bare name is left alone, so a `scripts.run` holding `$PWD` still reaches the shell. | | `$${VAR}` | A literal `${VAR}`. | #### What `config_override` keeps `config_override` is never expanded, at any depth. That block is not compose's to read: it is carried to the configuration worker, which resolves `${VAR}` references of its own at read time. That is how a secret is stored as a reference rather than as a value. ```yaml theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} config_override: # Reaches the worker as written. The value is never in the compose file, # and never in what compose stores. api_key: ${ANTHROPIC_API_KEY} ``` A name that compose's environment does not hold is therefore not an error inside this block. Nothing in it is compose's to resolve. ## Readiness A container is considered up when the engine reports a worker of that name in the project's namespace. Compose polls `engine::workers::list` every 200 ms until the container's `startup_timeout` runs out. | Outcome | Code | | -------------------------------------------------------------- | ---------------------------------- | | The container never appeared. | `STARTUP_TIMEOUT` | | The process exited while compose was waiting. | `CHILD_EXITED_BEFORE_REGISTRATION` | | It registered in `default` instead of the project's namespace. | `WORKER_IGNORED_NAMESPACE` | | It registered under a different name in the right namespace. | `WORKER_NAME_MISMATCH` | | Its functions landed outside the project's namespace. | `FUNCTIONS_IN_WRONG_NAMESPACE` | | A worker already held that name in the namespace. | `CONTAINER_NAME_TAKEN` | After a container is ready, the daemon checks it every 250 ms. A container that exits takes its transitive dependents down with it and is recorded as `failed`. Nothing is restarted: v1 has no restart policy, so a container that dies stays down until the next `up`. When the engine connection drops and comes back, every running container gets its `startup_timeout` to register again. What a failure takes with it depends on when it happens, and v1 has no way to declare otherwise. | When | What comes down | | ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | During `up` | The operation ends. Everything it started is stopped in reverse order, and containers later in the start order are never attempted. | | After the container is ready | Its transitive dependents. Everything else keeps running. | So a container nothing depends on ends the whole `up` if it fails at start, and is contained if it fails a minute later. See [Understanding iii / Compose](../understanding-iii/compose). ## Where compose keeps state Everything sits under `~/.iii/compose`, or under `$III_COMPOSE_STATE_DIR` when that is set. | Path | Contents | | --------------------------- | ------------------------------------------------------------------------------------------------------ | | `//state.json` | One project's child records. Owner-only. | | `//config/` | Resolved configuration files. | | `//logs/` | What each container printed while starting. | | `//vm/` | VM state for bundle containers, one directory each, plus the config each one publishes into its guest. | | `packages/` | Installed `package://` artefacts, shared by projects. | `` is the daemon's namespace. `` is derived from the compose file's canonical path: readable enough to recognise, hashed enough that two projects in directories of the same name stay apart. Because it is derived, it cannot be guessed. `compose::status` reports it as `state_dir`, which is how a container's startup output is located: ```bash theme={"theme":{"light":"catppuccin-latte","dark":"dark-plus"}} iii trigger compose::status --namespace dev file=./worker-compose.yaml # ... "state_dir": "/home/you/.iii/compose/dev/shop-3f2a1b9c" ls /home/you/.iii/compose/dev/shop-3f2a1b9c/logs/ ``` For why this is one place per machine rather than a directory beside each compose file, see [Understanding iii / Compose](../understanding-iii/compose). Capture stops when a container becomes ready. Up to that point a worker has no connection and its own output is the only account of itself, which is what the file keeps; once the engine can hear it, the worker's logging is the record and compose keeps no second copy. So a container that fails at boot leaves its reason on disk, and one that runs for a month does not leave a file that grew all month. A clean shutdown clears the state file. After an unclean exit, the daemon compares each record against the live process: a match is adopted, a dead process is recorded `failed`, and a live pid it cannot verify is left running and reported for manual cleanup. ## Error codes Compose errors cross the wire with a stable code and a message. | Area | Codes | | --------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Compose file | `COMPOSE_FILE_UNREADABLE`, `INVALID_COMPOSE_FILE`, `EMPTY_CONTAINERS`, `INVALID_DURATION`, `UNKNOWN_DEPENDENCY`, `SELF_DEPENDENCY`, `DEPENDENCY_CYCLE`, `UNSUPPORTED_WORKER_SOURCE` | | Container declaration | `MISSING_VERSION_FOR_PACKAGE`, `RUN_NOT_ALLOWED_FOR_PACKAGE`, `NOT_A_PACKAGE_CONTAINER`, `PRE_RUN_TIMEOUT_WITHOUT_PRE_RUN`, `RESERVED_ENV_OVERRIDE`, `MISSING_ENV_FILE` | | Worker resolution | `MISSING_WORKER_DIRECTORY`, `MISSING_START_COMMAND`, `INVALID_MANIFEST` | | Packages | `REGISTRY_UNREACHABLE`, `PACKAGE_NOT_RESOLVED`, `PACKAGE_NOT_INSTALLED`, `PACKAGE_DOWNLOAD_FAILED`, `PACKAGE_DIGEST_MISMATCH`, `PACKAGE_ARTIFACT_EMPTY`, `UNSUPPORTED_PACKAGE_KIND`, `UNSUPPORTED_PLATFORM` | | Start and readiness | `SPAWN_FAILED`, `HOOK_SPAWN_FAILED`, `HOOK_FAILED`, `HOOK_TIMEOUT`, `STARTUP_TIMEOUT`, `CHILD_EXITED_BEFORE_REGISTRATION`, `WORKER_IGNORED_NAMESPACE`, `WORKER_NAME_MISMATCH`, `FUNCTIONS_IN_WRONG_NAMESPACE`, `CONTAINER_NAME_TAKEN`, `CONFIG_FETCH_FAILED`, `ENGINE_CALL_FAILED` | | Daemon and project | `NO_COMPOSE_FILE`, `WRONG_DAEMON`, `INVALID_NAMESPACE`, `UNKNOWN_CONTAINER`, `INVALID_STATE_FILE`, `STATE_DIR_UNAVAILABLE`, `DAEMON_ALREADY_SERVING`, `IO_ERROR` | ## Related For why compose is a worker and why a project is its file, see [Understanding iii / Compose](../understanding-iii/compose). For the namespace dimension itself, see [Understanding iii / Namespaces](../understanding-iii/namespaces). For the `iii compose` entry in the command tree, see the [CLI reference](../cli-reference/index#iii-compose).