Inspect a Linux server Kamal deploys to and harden it — automated security updates, firewall/port lockdown, auto-blocking of repeated SSH auth failures, and safe SSH configuration — while keeping the ports Kamal needs open. Use when the user says "harden my server," "lock down my VPS," "secure my Kamal server," "audit server security," "close open ports," "set up automatic updates," "is my server exposed to the internet," or before putting a new box into production. Interviews the user before changing anything, explains how to undo every change, and verifies the result afterward. For provisioning Docker itself, see setup. For the servers/roles Kamal targets, see servers. For the SSH settings Kamal itself uses to connect, see ssh. For accessory port exposure, see accessories.
Run and manage accessory services — databases, Redis, search, and other long-lived dependencies your app needs — through Kamal's `accessories:` configuration and the `kamal accessory` command. Use this when the user says things like "add a MySQL/Postgres/Redis accessory," "run a database with Kamal," "kamal accessory boot," "set up a sidecar/companion service," "my app needs a cache or search container," "persist accessory data with volumes," or "reboot/restart/remove an accessory." Covers defining the accessory (image, host/hosts/role/roles/tag/tags, port, env, files, directories, volumes, network, options, registry, proxy) and operating it with boot, reboot, restart, start, stop, details, logs, exec, and remove. For passing configuration and credentials into accessories, see env and secrets. For scheduled jobs, see cron.
Install Kamal and ship your first deploy on a new project. Use when the user is starting with Kamal for the first time and says "install Kamal," "set up Kamal on this project," "kamal init," "get started with Kamal," "deploy my app for the first time," "bootstrap my servers," or "run kamal setup." Covers `gem install kamal`, the dockerized install alias, `kamal init` (config/deploy.yml, .kamal/secrets, .kamal/hooks), writing the first config (service, image, servers, registry, builder, env), filling in .kamal/secrets, bootstrapping Docker with `kamal server bootstrap`, and the first `kamal setup`. For the full set of configuration keys, see config. For routine releases after setup, see deploy. For secrets files and vault adapters, see secrets. For registry providers, see registry.
Configure Kamal builders and build then push your app image. Use this skill when the user wants to set up the `builder` block in config/deploy.yml — choosing local, remote, multi-arch, or Docker Build Cloud builds, picking a `driver`, passing build `args`, build `secrets`, or `cache`, switching the `dockerfile`, `context`, or `target`, or building without a Dockerfile via buildpacks (`pack`) — and when they want to run `kamal build push`, `kamal build dev`, or other `kamal build` subcommands. Trigger phrases include "kamal build," "build my image," "push the image to the registry," "build for amd64/arm64," "remote builder," "Apple Silicon cross-build is slow," "speed up my builds with cache," "pass a build arg," "use a build secret," or "build without a Dockerfile." For configuring the container registry, see registry. For the one-step flow that builds and ships in a single command, see deploy. For managing the secret values that build secrets reference, see secrets.
Configure and operate kamal-proxy, the reverse proxy that gives Kamal zero-downtime deploys on ports 80 and 443. Use when the user wants to route a domain (host/hosts), enable automatic HTTPS via Let's Encrypt (ssl), point the proxy at their app's port (app_port), tune the deploy healthcheck (/up), or adjust response_timeout and buffering — and when they say things like "configure the kamal proxy," "set up SSL for my domain," "add my custom domain," "the proxy isn't routing," "reboot the proxy," "upgrade kamal-proxy," or run kamal proxy boot/reboot/start/stop/details/logs. Covers the proxy config block and the kamal proxy command. For full deploys, see deploy. For enabling the proxy per role, see servers. For starting and stopping the app container, see app. For migrating from Kamal 1.x to kamal-proxy, see upgrade.
Manage secrets for a Kamal deployment — the `.kamal/secrets` file, dotenv variable and command substitution, and the `kamal secrets` vault helpers (1Password, Bitwarden, LastPass, Bitwarden Secrets Manager, AWS Secrets Manager, Doppler, GCP Secret Manager, Passbolt). Use when the user says "kamal secrets," "where do I put my registry password," "manage secrets," "pull secrets from 1Password/Bitwarden/LastPass/Doppler," "kamal secrets fetch/extract/print," "secrets-common," "secrets.<destination>," "secrets_path," "secret vs clear env keys," "RAILS_MASTER_KEY," or "migrate from .env / kamal envify," "migrate local or file-based secrets into 1Password / a vault," or "move plaintext secret files into a password manager." Covers wiring secrets into `env.secret`/`env.clear` in deploy.yml, per-destination secrets files, and aliased secrets. For setting plain non-secret env values, see env. For registry login and KAMAL_REGISTRY_PASSWORD, see registry. For build-time secrets and args, see build.
Define custom command aliases under the top-level `aliases` key in `config/deploy.yml` so a long, repeated `kamal` invocation becomes a single `kamal <name>`. Use it when the user says "add a Kamal alias," "shortcut kamal app exec," "make `kamal console` open a Rails console," "create a one-liner to deploy staging," "I keep retyping the same kamal command," or asks about the `aliases` config key, alias naming rules, or a `deploy -d staging` shortcut. Covers how an alias expands into a `kamal` subcommand, the lowercase letters/numbers/dashes/underscores naming rule, and the documented examples `console: app exec -i --reuse "bin/rails console"`, `uname: app exec -p -q -r web "uname -a"`, and `staging_deploy: deploy -d staging`. For the rest of `config/deploy.yml` and DRYing it up with YAML anchors, see config. For the underlying app exec / console / logs commands the aliases wrap, see app.
Operate and inspect already-running Kamal apps without redeploying. Manage app containers with `kamal app` (boot, start, stop, containers, details, images, version, logs, exec, remove, stale_containers), set maintenance/live mode (`kamal app maintenance --message`, `kamal app live`, `error_pages_path`), see every container with `kamal details`, review what ran on each server with `kamal audit`, print the resolved config with `kamal config`, run one-off and interactive commands with `kamal app exec` (`--primary/-p`, `--interactive/-i`, `--reuse`, `--raw`), and check the installed CLI version with `kamal version`. Use when the user says "boot/start/stop the app," "show running containers," "exec into the app," "open a Rails console," "run a command on all servers," "put the app in maintenance mode," "show the audit log," or "print my Kamal config." For shipping releases, see deploy. For reverting a release, see rollback. For log-driver and OTel/file config, see logging. For kamal-proxy, see proxy.