diff --git a/.idea/watcherTasks.xml b/.idea/watcherTasks.xml
index 5d92fce..058100f 100644
--- a/.idea/watcherTasks.xml
+++ b/.idea/watcherTasks.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project version="4">
   <component name="ProjectTasksOptions">
-    <TaskOptions isEnabled="true">
+    <TaskOptions isEnabled="false">
       <option name="arguments" value="run --disable=typecheck $FileDir$" />
       <option name="checkSyntaxErrors" value="true" />
       <option name="description" />
@@ -25,7 +25,7 @@
         <env name="PATH" value="$GoBinDirs$" />
       </envs>
     </TaskOptions>
-    <TaskOptions isEnabled="true">
+    <TaskOptions isEnabled="false">
       <option name="arguments" value="fmt $FilePath$" />
       <option name="checkSyntaxErrors" value="true" />
       <option name="description" />
diff --git a/README.md b/README.md
index 9450c42..a310bba 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ Bifröst (spoken as "Bee-frest"), is an advanced SSH server. It can be used as a
 
 * [Use-cases](https://bifroest.engity.org/latest/usecases/)
 * [Features](#features)
-* [Getting started](#getting-started)
+* [Getting started](https://bifroest.engity.org/latest/setup/)
 * [Configuration](https://bifroest.engity.org/latest/reference/configuration/)
 * [Status](#status)
 * [License](LICENSE)
@@ -20,8 +20,9 @@ Bifröst (spoken as "Bee-frest"), is an advanced SSH server. It can be used as a
 
 1. [SSH protocol compliant](#ssh-protocol-compliant)
 2. [OpenID Connect](#openid-connect)
-3. [Remember me](#remember-me)
-4. [Automatic user provisioning](#automatic-user-provisioning)
+3. [Docker environments](#docker-environments)
+4. [Remember me](#remember-me)
+5. [Automatic user provisioning](#automatic-user-provisioning)
 
 #### SSH protocol compliant
 
@@ -32,6 +33,10 @@ You can connect via your **SSH keys**, as usually. And so on...
 
 ...but you can also use **[OpenID Connect](https://openid.net/)** (or OAuth2) identity provider. The best thing about this is: In contrast to the other SSH servers with OpenID Connect, you don't need any other client locally installed, than your regular SSH Client ([OpenSSH](https://www.openssh.com/), [PuTTy](https://www.putty.org/), ...).
 
+#### Docker environments
+
+You can execute your users into individual Docker containers, with custom images, network settings, ...
+
 #### Remember me
 
 If authorized via another authentication token then a Public Key, it can store (temporally) your provided Public Key, for faster reconnect, while the session is still alive.
@@ -44,50 +49,9 @@ It can also automatically clean up these users as they're no longer needed, for
 
 #### More to come...
 
-## Getting started
-
-1. Download the latest version of Bifröst (see [releases page](https://github.com/engity-com/bifroest/releases)):
-   ```shell
-   # Syntax
-   curl -sSLf https://github.com/engity-com/bifroest/releases/download/<version>/bifroest-<os>-<arch>-<edition>.tgz | sudo tar -zxv -C /usr/bin bifroest
-
-   # Example
-   curl -sSLf https://github.com/engity-com/bifroest/releases/download/v1.2.3/bifroest-linux-amd64-extended.tgz | sudo tar -zxv -C /usr/bin bifroest
-   ```
-2. Configure Bifröst. For example, download the demo configuration and adjust it to your needs (see [documentation of configuration](doc/configuration.md) for more details):
-   ```shell
-   sudo mkdir -p /etc/engity/bifroest/
-   sudo curl -sSLf https://raw.githubusercontent.com/engity-com/bifroest/main/contrib/configurations/sshd-dropin-replacement.yaml -o /etc/engity/bifroest/configuration.yaml
-   # Adjust it to your needs
-   sudo vi /etc/engity/bifroest/configuration.yaml
-   ```
-3. Run Bifröst:
-   ```shell
-   sudo bifroest run
-   ```
-
-### Let it run automatically
-
-#### systemd
-
-To enable Bifröst to run at every server start where [systemd](https://wiki.archlinux.org/title/Systemd) is available, simply:
-1. Download [our example service configuration](contrib/systemd/bifroest.service):
-   ```shell
-   sudo curl -sSLf https://raw.githubusercontent.com/engity-com/bifroest/main/contrib/systemd/bifroest.service -o /etc/systemd/system/bifroest.service
-   ```
-2. Reload the systemd daemon:
-   ```shell
-   sudo systemctl daemon-reload
-   ```
-3. Enable and start Bifröst:
-   ```shell
-   sudo systemctl enable bifroest.service
-   sudo systemctl start bifroest.service
-   ```
-
-### What's next?
-
-Read [Use-Cases](https://bifroest.engity.org/latest/usecases/) and [the configuration documentation](https://bifroest.engity.org/latest/reference/configuration/) to see what else you can do with Bifröst.
+## What's next?
+
+Read [Use-Cases](https://bifroest.engity.org/latest/usecases/), our [Getting starting guide](https://bifroest.engity.org/latest/setup/) and [the configuration documentation](https://bifroest.engity.org/latest/reference/configuration/) to see what else you can do with Bifröst.
 
 ## Status
 
@@ -95,6 +59,7 @@ This project is currently under development. The application is stable ([file a
 
 ## More topics
 * [Use-Cases](https://bifroest.engity.org/latest/usecases/)
+* [Getting started](https://bifroest.engity.org/latest/setup/)
 * [Configuration](https://bifroest.engity.org/latest/reference/configuration/)
 * [License](LICENSE)
 * [Code of Conduct](CODE_OF_CONDUCT.md)
diff --git a/cmd/bifroest/dummy-server.go b/cmd/bifroest/dummy-server.go
index 09e0adb..9d61e62 100644
--- a/cmd/bifroest/dummy-server.go
+++ b/cmd/bifroest/dummy-server.go
@@ -10,29 +10,27 @@ import (
 	"strings"
 	"syscall"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	log "github.com/echocat/slf4g"
 
 	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/errors"
 )
 
-var (
-	addr = ":8783"
-)
-
 var _ = registerCommand(func(app *kingpin.Application) {
+	addr := ":8783"
 	cmd := app.Command("dummy-server", "This is a supporting command which simply runs forever until it receives a interrupt signal.").
 		Hidden().
 		Action(func(*kingpin.ParseContext) error {
-			return doDummyServer()
+			return doDummyServer(addr)
 		})
-	cmd.Flag("addr", "Address to bind to. Default: "+addr).
+	cmd.Flag("addr", "Address to bind to.").
+		Default(addr).
 		PlaceHolder("[<host>]:<port>").
 		StringVar(&addr)
 })
 
-func doDummyServer() (rErr error) {
+func doDummyServer(addr string) (rErr error) {
 	ln, err := net.Listen("tcp", addr)
 	if err != nil {
 		return fmt.Errorf("failed to listen to address %q: %w", addr, err)
diff --git a/cmd/bifroest/forever.go b/cmd/bifroest/forever.go
index 6e12670..0376c58 100644
--- a/cmd/bifroest/forever.go
+++ b/cmd/bifroest/forever.go
@@ -1,10 +1,11 @@
 package main
 
 import (
-	"github.com/alecthomas/kingpin"
 	"os"
 	"os/signal"
 	"syscall"
+
+	"github.com/alecthomas/kingpin/v2"
 )
 
 var _ = registerCommand(func(app *kingpin.Application) {
diff --git a/cmd/bifroest/imp.go b/cmd/bifroest/imp.go
new file mode 100644
index 0000000..fa84b8c
--- /dev/null
+++ b/cmd/bifroest/imp.go
@@ -0,0 +1,74 @@
+package main
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/alecthomas/kingpin/v2"
+	log "github.com/echocat/slf4g"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/crypto"
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/imp"
+)
+
+var _ = registerCommand(func(app *kingpin.Application) {
+	addr := fmt.Sprintf(":%d", imp.ServicePort)
+	var encodecMasterPublicKey string
+
+	cmd := app.Command("imp", "Runs the imp service.").
+		Hidden().
+		Action(func(*kingpin.ParseContext) error {
+			return doImp(encodecMasterPublicKey, addr)
+		})
+	cmd.Flag("addr", "Address to bind to.").
+		Default(addr).
+		PlaceHolder("[<host>]:<port>").
+		StringVar(&addr)
+	cmd.Flag("master-public-key", "Public SSH key of the master service which is accessing this imp instance.").
+		Envar("BIFROEST_MASTER_PUBLIC_KEY").
+		PlaceHolder("<base64 std raw encoded ssh public key>").
+		Required().
+		StringVar(&encodecMasterPublicKey)
+})
+
+func doImp(encodecMasterPublicKey, addr string) error {
+	service := imp.Service{
+		Version: versionV,
+		Addr:    addr,
+	}
+
+	if b, err := base64.RawStdEncoding.DecodeString(encodecMasterPublicKey); err != nil {
+		return errors.System.Newf("cannot decode imp master's public key: %w", err)
+	} else if service.MasterPublicKey, err = crypto.ParsePublicKeyBytes(b); err != nil {
+		return errors.System.Newf("cannot decode imp master's public key: %w", err)
+	}
+
+	ctx, cancelFunc := context.WithCancel(context.Background())
+	defer cancelFunc()
+
+	sigs := make(chan os.Signal, 1)
+	defer close(sigs)
+	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
+	go func() {
+		sig := <-sigs
+		log.With("signal", sig).Info("received signal")
+		cancelFunc()
+	}()
+
+	log.WithAll(common.VersionToMap(versionV)).
+		Info("Engity's Bifröst imp running...")
+
+	if err := service.Serve(ctx); err != nil {
+		log.WithError(err).Error()
+		os.Exit(1)
+	}
+
+	log.Info("bye!")
+	return nil
+}
diff --git a/cmd/bifroest/main.go b/cmd/bifroest/main.go
index c88832c..59c2785 100644
--- a/cmd/bifroest/main.go
+++ b/cmd/bifroest/main.go
@@ -1,21 +1,17 @@
 package main
 
 import (
-	log "github.com/echocat/slf4g"
-	"github.com/echocat/slf4g/level"
-	"github.com/echocat/slf4g/native/consumer"
-	"github.com/engity-com/bifroest/pkg/common"
-	"github.com/engity-com/bifroest/pkg/configuration"
 	"os"
-	"strings"
 
-	"github.com/alecthomas/kingpin"
+	log "github.com/echocat/slf4g"
+
+	"github.com/engity-com/bifroest/pkg/logging"
+
+	"github.com/alecthomas/kingpin/v2"
 	"github.com/echocat/slf4g/native"
-	"github.com/echocat/slf4g/native/facade/value"
 )
 
 var (
-	configurationRef configuration.ConfigurationRef
 	registerCommands []func(*kingpin.Application)
 )
 
@@ -33,7 +29,7 @@ func main() {
 			os.Exit(code)
 		})
 
-	configureLog(app, native.DefaultProvider)
+	logging.ConfigureLoggingForFlags(app, native.DefaultProvider)
 
 	for _, rc := range registerCommands {
 		rc(app)
@@ -44,48 +40,3 @@ func main() {
 		os.Exit(1)
 	}
 }
-
-type logProvider interface {
-	log.Provider
-	value.ProviderTarget
-	level.NamesAware
-}
-
-func configureLog(app *kingpin.Application, of logProvider) {
-	native.DefaultProvider.Consumer = consumer.NewWriter(os.Stdout)
-
-	lv := value.NewProvider(of)
-	app.Flag("log.level", "Defines the minimum level at which the log messages will be logged. Default: "+lv.Level.String()).
-		PlaceHolder("<" + strings.Join(logLevelStrings(of), "|") + ">").
-		SetValue(lv.Level)
-	app.Flag("log.format", "In which format the log output should be printed. Default: "+lv.Consumer.Formatter.String()).
-		PlaceHolder("<" + strings.Join(logFormatStrings(), "|") + ">").
-		SetValue(lv.Consumer.Formatter)
-	app.Flag("log.colorMode", "Tells if to log in color or not. Default: "+lv.Consumer.Formatter.ColorMode.String()).
-		PlaceHolder("<auto|always|never>").
-		SetValue(lv.Consumer.Formatter.ColorMode)
-}
-
-func logLevelStrings(of logProvider) []string {
-	names := of.GetLevelNames()
-
-	lvls := of.GetAllLevels()
-	all := make([]string, len(lvls))
-	for i, lvl := range lvls {
-		name, err := names.ToName(lvl)
-		common.Must(err)
-		all[i] = name
-	}
-	return all
-}
-
-func logFormatStrings() []string {
-	codecs := value.DefaultFormatterCodec.(value.MappingFormatterCodec)
-	all := make([]string, len(codecs))
-	var i int
-	for k := range codecs {
-		all[i] = k
-		i++
-	}
-	return all
-}
diff --git a/cmd/bifroest/main_unix.go b/cmd/bifroest/main_unix.go
deleted file mode 100644
index e7e4aaa..0000000
--- a/cmd/bifroest/main_unix.go
+++ /dev/null
@@ -1,7 +0,0 @@
-//go:build unix
-
-package main
-
-const (
-	defaultConfigurationRef = "/etc/engity/bifroest/configuration.yaml"
-)
diff --git a/cmd/bifroest/main_windows.go b/cmd/bifroest/main_windows.go
deleted file mode 100644
index be332f7..0000000
--- a/cmd/bifroest/main_windows.go
+++ /dev/null
@@ -1,7 +0,0 @@
-//go:build windows
-
-package main
-
-const (
-	defaultConfigurationRef = `C:\ProgramData\Engity\Bifroest\configuration.yaml`
-)
diff --git a/cmd/bifroest/run.go b/cmd/bifroest/run.go
index 50d93c5..6d9f9b7 100644
--- a/cmd/bifroest/run.go
+++ b/cmd/bifroest/run.go
@@ -6,27 +6,20 @@ import (
 	"os/signal"
 	"syscall"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	log "github.com/echocat/slf4g"
 
+	"github.com/engity-com/bifroest/pkg/configuration"
 	"github.com/engity-com/bifroest/pkg/service"
 )
 
 var _ = registerCommand(func(app *kingpin.Application) {
-	cmd := app.Command("run", "Runs the service.").
-		Action(func(*kingpin.ParseContext) error {
-			return doRun()
-		})
-	cmd.Flag("configuration", "Configuration which should be used to serve the service. Default: "+defaultConfigurationRef).
-		Short('c').
-		Default(defaultConfigurationRef).
-		PlaceHolder("<path>").
-		SetValue(&configurationRef)
+	configureRunCmd(app)
 })
 
-func doRun() error {
+func doRunDefault(conf configuration.ConfigurationRef) error {
 	svc := service.Service{
-		Configuration: *configurationRef.Get(),
+		Configuration: *conf.Get(),
 		Version:       versionV,
 	}
 
diff --git a/cmd/bifroest/run_unix.go b/cmd/bifroest/run_unix.go
new file mode 100644
index 0000000..764eac6
--- /dev/null
+++ b/cmd/bifroest/run_unix.go
@@ -0,0 +1,31 @@
+//go:build unix
+
+package main
+
+import (
+	"github.com/alecthomas/kingpin/v2"
+
+	"github.com/engity-com/bifroest/pkg/configuration"
+)
+
+const (
+	defaultConfigurationRef = "/etc/engity/bifroest/configuration.yaml"
+)
+
+func configureRunCmd(app *kingpin.Application) *kingpin.Application {
+	var conf configuration.ConfigurationRef
+	cmd := app.Command("run", "Runs the service.").
+		Action(func(*kingpin.ParseContext) error {
+			return doRun(conf)
+		})
+	cmd.Flag("configuration", "Configuration which should be used to serve the service. Default: "+defaultConfigurationRef).
+		Short('c').
+		Default(defaultConfigurationRef).
+		PlaceHolder("<path>").
+		SetValue(&conf)
+	return app
+}
+
+func doRun(conf configuration.ConfigurationRef) error {
+	return doRunDefault(conf)
+}
diff --git a/cmd/bifroest/run_windows.go b/cmd/bifroest/run_windows.go
new file mode 100644
index 0000000..5274ef1
--- /dev/null
+++ b/cmd/bifroest/run_windows.go
@@ -0,0 +1,66 @@
+//go:build windows
+
+package main
+
+import (
+	"github.com/alecthomas/kingpin/v2"
+	log "github.com/echocat/slf4g"
+	"github.com/echocat/slf4g/native"
+	"golang.org/x/sys/windows/svc"
+	"golang.org/x/sys/windows/svc/eventlog"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/logging/wel"
+)
+
+const (
+	defaultConfigurationRef = `C:\ProgramData\Engity\Bifroest\configuration.yaml`
+)
+
+func configureRunCmd(app *kingpin.Application) *kingpin.Application {
+	var ws windowsService
+	var conf configuration.ConfigurationRef
+	cmd := app.Command("run", "Runs the service.").
+		Action(func(*kingpin.ParseContext) error {
+			return doRun(conf, &ws)
+		})
+	cmd.Flag("configuration", "Configuration which should be used to serve the service. Default: "+defaultConfigurationRef).
+		Short('c').
+		Default(defaultConfigurationRef).
+		PlaceHolder("<path>").
+		SetValue(&conf)
+	ws.registerFlagsAt(cmd)
+	return app
+
+}
+
+func doRun(conf configuration.ConfigurationRef, ws *windowsService) error {
+	inService, err := svc.IsWindowsService()
+	if err != nil {
+		return errors.System.Newf("failed to determine if we are running in service: %w", err)
+	}
+	if !inService {
+		return doRunDefault(conf)
+	}
+
+	eLog, err := eventlog.Open(ws.name)
+	if err != nil {
+		return errors.System.Newf("cannot open event log for service %s: %w", ws.name, err)
+	}
+	defer common.IgnoreCloseError(eLog)
+
+	originalProvider := log.GetProvider()
+	defer log.SetProvider(originalProvider)
+
+	welProvider := wel.NewProvider("eventlog", eLog, native.DefaultProvider.GetLevel())
+	log.SetProvider(welProvider)
+
+	ws.conf = conf
+	ws.logger = eLog
+	if err := svc.Run(ws.name, ws); err != nil {
+		log.WithError(err).Error()
+	}
+	return nil
+}
diff --git a/cmd/bifroest/service_windows.go b/cmd/bifroest/service_windows.go
new file mode 100644
index 0000000..cffc757
--- /dev/null
+++ b/cmd/bifroest/service_windows.go
@@ -0,0 +1,252 @@
+//go:build windows
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/alecthomas/kingpin/v2"
+	log "github.com/echocat/slf4g"
+	"golang.org/x/sys/windows/svc"
+	"golang.org/x/sys/windows/svc/eventlog"
+	"golang.org/x/sys/windows/svc/mgr"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/service"
+)
+
+const (
+	defaultServiceName = "engity-bifroest"
+	serviceDisplayName = "Engity's Bifröst"
+)
+
+type windowsService struct {
+	name   string
+	conf   configuration.ConfigurationRef
+	logger *eventlog.Log
+}
+
+func (this *windowsService) registerFlagsAt(cmd *kingpin.CmdClause) *kingpin.CmdClause {
+	cmd.Flag("serviceName", "Name of the service. Default: "+defaultServiceName).
+		Default(defaultServiceName).
+		PlaceHolder("<name>").
+		StringVar(&this.name)
+	return cmd
+}
+
+var _ = registerCommand(func(app *kingpin.Application) {
+	svcCmd := app.Command("service", "")
+
+	var conf configuration.ConfigurationRef
+	var svc windowsService
+	common := func(cmd *kingpin.CmdClause) *kingpin.CmdClause {
+		return svc.registerFlagsAt(cmd)
+	}
+	withConfig := func(cmd *kingpin.CmdClause) *kingpin.CmdClause {
+		cmd.Flag("configuration", "Configuration which should be used to serve the service. Default: "+defaultConfigurationRef).
+			Short('c').
+			Default(defaultConfigurationRef).
+			PlaceHolder("<path>").
+			SetValue(&conf)
+		return common(cmd)
+	}
+
+	start := true
+	installCmd := withConfig(svcCmd.Command("install", "Installs the service.").
+		Action(func(*kingpin.ParseContext) error {
+			return svc.install(conf, start, true)
+		}))
+	installCmd.Flag("start", "If enabled, the service will be started afterwards, automatically. (Default=true)").
+		BoolVar(&start)
+
+	stop := true
+	stopCmd := common(svcCmd.Command("remove", "Removes the service.").
+		Action(func(*kingpin.ParseContext) error {
+			return svc.remove(stop)
+		}))
+	stopCmd.Flag("stop", "If enabled, the service will be stopped afterwards, automatically.  (Default=true)").
+		BoolVar(&stop)
+	common(svcCmd.Command("start", "Starts the service.").
+		Action(func(*kingpin.ParseContext) error {
+			return svc.start()
+		}))
+	common(svcCmd.Command("stop", "Stops the service.").
+		Action(func(*kingpin.ParseContext) error {
+			return svc.stop()
+		}))
+})
+
+func (this *windowsService) Execute(_ []string, r <-chan svc.ChangeRequest, changes chan<- svc.Status) (ssec bool, errno uint32) {
+	changes <- svc.Status{State: svc.StartPending}
+
+	s := service.Service{
+		Configuration: *this.conf.Get(),
+		Version:       versionV,
+	}
+
+	fail := func(err error) (ssec bool, errno uint32) {
+		log.Error(err)
+		return false, 1
+	}
+
+	ctx, cancelFunc := context.WithCancel(context.Background())
+	defer cancelFunc()
+
+	go func() {
+		for {
+			c := <-r
+			switch c.Cmd {
+			case svc.Interrogate:
+				changes <- c.CurrentStatus
+				// Testing deadlock from https://code.google.com/p/winsvc/issues/detail?id=4
+				time.Sleep(100 * time.Millisecond)
+				changes <- c.CurrentStatus
+			case svc.Stop, svc.Shutdown:
+				cancelFunc()
+			default:
+				_ = this.logger.Error(1, fmt.Errorf("unexpected control request #%d", c).Error())
+			}
+		}
+	}()
+
+	changes <- svc.Status{State: svc.Running, Accepts: svc.AcceptStop | svc.AcceptShutdown}
+	if err := s.Run(ctx); err != nil {
+		return fail(err)
+	}
+
+	changes <- svc.Status{State: svc.StopPending}
+	return false, 0
+}
+
+func (this *windowsService) install(conf configuration.ConfigurationRef, start, retry bool) error {
+	if err := conf.MakeAbsolute(); err != nil {
+		return err
+	}
+
+	exe, err := os.Executable()
+	if err != nil {
+		return errors.System.Newf("cannot resolve own executable: %w", err)
+	}
+
+	m, err := mgr.Connect()
+	if err != nil {
+		return err
+	}
+	defer common.IgnoreError(m.Disconnect)
+
+	if s, err := m.OpenService(this.name); err == nil {
+		_ = s.Close()
+		if !retry {
+			return errors.System.Newf("service %s already exists", this.name)
+		}
+		if err := this.remove(true); err != nil {
+			return err
+		}
+		return this.install(conf, start, false)
+	}
+
+	mgrCfg := mgr.Config{
+		StartType:        mgr.StartAutomatic,
+		DisplayName:      serviceDisplayName,
+		DelayedAutoStart: true,
+	}
+	success := false
+	s, err := m.CreateService(this.name, exe, mgrCfg, "run", "--configuration="+conf.GetFilename())
+	if err != nil {
+		return err
+	}
+	defer common.IgnoreError(s.Close)
+	defer common.IgnoreErrorIfFalse(&success, s.Delete)
+
+	if err := eventlog.InstallAsEventCreate(this.name, eventlog.Error|eventlog.Warning|eventlog.Info); err != nil {
+		if err.Error() != "SYSTEM\\CurrentControlSet\\Services\\EventLog\\Application\\"+this.name+" registry key already exists" {
+			return errors.System.Newf("SetupEventLogSource() failed: %w", err)
+		}
+	}
+	defer func() {
+		if !success {
+			_ = eventlog.Remove(this.name)
+		}
+	}()
+
+	if start {
+		if err := this.start(); err != nil {
+			return err
+		}
+	}
+
+	success = true
+	return nil
+}
+
+func (this *windowsService) remove(stop bool) error {
+	m, err := mgr.Connect()
+	if err != nil {
+		return err
+	}
+	defer common.IgnoreError(m.Disconnect)
+
+	s, err := m.OpenService(this.name)
+	if err != nil {
+		return errors.System.Newf("cannot access service %s: %w", this.name, err)
+	}
+	defer common.IgnoreError(s.Close)
+
+	if stop {
+		if _, err := s.Control(svc.Stop); err != nil {
+			return errors.System.Newf("cannot stop service %s: %w", this.name, err)
+		}
+	}
+
+	if err = s.Delete(); err != nil {
+		return err
+	}
+
+	if err := eventlog.Remove(this.name); err != nil {
+		return errors.System.Newf("RemoveEventLogSource() failed: %w", err)
+	}
+	return nil
+}
+
+func (this *windowsService) start() error {
+	m, err := mgr.Connect()
+	if err != nil {
+		return err
+	}
+	defer common.IgnoreError(m.Disconnect)
+
+	s, err := m.OpenService(this.name)
+	if err != nil {
+		return errors.System.Newf("cannot access service %s: %w", this.name, err)
+	}
+	defer common.IgnoreError(s.Close)
+
+	if err = s.Start(); err != nil {
+		return errors.System.Newf("cannot start service %s: %w", this.name, err)
+	}
+	return nil
+}
+
+func (this *windowsService) stop() error {
+	m, err := mgr.Connect()
+	if err != nil {
+		return err
+	}
+	defer common.IgnoreError(m.Disconnect)
+
+	s, err := m.OpenService(this.name)
+	if err != nil {
+		return errors.System.Newf("cannot access service %s: %w", this.name, err)
+	}
+	defer common.IgnoreError(s.Close)
+
+	if _, err := s.Control(svc.Stop); err != nil {
+		return errors.System.Newf("cannot stop service %s: %w", this.name, err)
+	}
+	return nil
+}
diff --git a/cmd/bifroest/sftp-server.go b/cmd/bifroest/sftp-server.go
index a620c6a..b935d38 100644
--- a/cmd/bifroest/sftp-server.go
+++ b/cmd/bifroest/sftp-server.go
@@ -3,7 +3,7 @@ package main
 import (
 	"os"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 
 	"github.com/engity-com/bifroest/pkg/sftp"
 )
diff --git a/cmd/bifroest/version.go b/cmd/bifroest/version.go
index 4713a48..7fbf805 100644
--- a/cmd/bifroest/version.go
+++ b/cmd/bifroest/version.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 
 	"github.com/engity-com/bifroest/pkg/common"
 )
diff --git a/cmd/build/base.go b/cmd/build/base.go
index 7bcbeff..7b69272 100644
--- a/cmd/build/base.go
+++ b/cmd/build/base.go
@@ -11,7 +11,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	"github.com/echocat/slf4g"
 )
 
diff --git a/cmd/build/build-archive.go b/cmd/build/build-archive.go
index 1fd34d1..f9a4102 100644
--- a/cmd/build/build-archive.go
+++ b/cmd/build/build-archive.go
@@ -7,7 +7,7 @@ import (
 	gos "os"
 	"time"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	"github.com/echocat/slf4g"
 	"github.com/mattn/go-zglob"
 
diff --git a/cmd/build/build-binary.go b/cmd/build/build-binary.go
index 72185d9..727ce7d 100644
--- a/cmd/build/build-binary.go
+++ b/cmd/build/build-binary.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	"github.com/echocat/slf4g"
 
 	"github.com/engity-com/bifroest/pkg/common"
diff --git a/cmd/build/build-digest.go b/cmd/build/build-digest.go
index f5d5b55..a8900df 100644
--- a/cmd/build/build-digest.go
+++ b/cmd/build/build-digest.go
@@ -8,7 +8,7 @@ import (
 	"path/filepath"
 	"time"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	"github.com/echocat/slf4g"
 
 	"github.com/engity-com/bifroest/pkg/common"
diff --git a/cmd/build/build-image.go b/cmd/build/build-image.go
index ceef5d7..58c0d9d 100644
--- a/cmd/build/build-image.go
+++ b/cmd/build/build-image.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	"github.com/echocat/slf4g"
 	"github.com/echocat/slf4g/fields"
 	"github.com/google/go-containerregistry/pkg/authn"
@@ -34,23 +34,29 @@ func newBuildImage(b *build) *buildImage {
 	return &buildImage{
 		build: b,
 
-		dummyConfiguration:   "cmd/build/contrib/dummy-for-oci-images.yaml",
-		defaultConfiguration: "contrib/configurations/sshd-dropin-replacement.yaml",
+		dummyConfigurationUnix:    "cmd/build/contrib/dummy-for-oci-images.yaml",
+		dummyConfigurationWindows: "cmd/build/contrib/dummy-for-oci-images-windows.yaml",
+		defaultConfiguration:      "contrib/configurations/sshd-dropin-replacement.yaml",
 	}
 }
 
 type buildImage struct {
 	*build
 
-	dummyConfiguration   string
-	defaultConfiguration string
+	dummyConfigurationUnix    string
+	dummyConfigurationWindows string
+	defaultConfiguration      string
 }
 
 func (this *buildImage) attach(cmd *kingpin.CmdClause) {
-	cmd.Flag("dummyConfiguration", "").
-		Default(this.dummyConfiguration).
+	cmd.Flag("dummyConfigurationUnix", "").
+		Default(this.dummyConfigurationUnix).
 		PlaceHolder("<file>").
-		StringVar(&this.dummyConfiguration)
+		StringVar(&this.dummyConfigurationUnix)
+	cmd.Flag("dummyConfigurationWindows", "").
+		Default(this.dummyConfigurationWindows).
+		PlaceHolder("<file>").
+		StringVar(&this.dummyConfigurationWindows)
 	cmd.Flag("defaultConfiguration", "").
 		Default(this.defaultConfiguration).
 		PlaceHolder("<file>").
@@ -167,13 +173,11 @@ func (this *buildImage) createPart(ctx context.Context, binary *buildArtifact) (
 		targetFile: binary.platform.os.bifroestConfigFilePath(),
 		mode:       0644,
 	}}
-
-	if !a.os.isUnix() || strings.EqualFold(from, "scratch") {
-		artifacts = []imageArtifactLayerItem{{
-			sourceFile: this.dummyConfiguration,
-			targetFile: binary.platform.os.bifroestConfigFilePath(),
-			mode:       0644,
-		}}
+	if strings.EqualFold(from, "scratch") {
+		artifacts[0].sourceFile = this.dummyConfigurationUnix
+	}
+	if !a.os.isUnix() {
+		artifacts[0].sourceFile = this.dummyConfigurationWindows
 	}
 
 	if a.os.isUnix() && strings.EqualFold(from, "scratch") {
diff --git a/cmd/build/build.go b/cmd/build/build.go
index f79b620..b1fe6be 100644
--- a/cmd/build/build.go
+++ b/cmd/build/build.go
@@ -13,7 +13,7 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	"github.com/echocat/slf4g"
 
 	"github.com/engity-com/bifroest/pkg/common"
diff --git a/cmd/build/contrib/dummy-for-oci-images-windows.yaml b/cmd/build/contrib/dummy-for-oci-images-windows.yaml
new file mode 100644
index 0000000..a52933d
--- /dev/null
+++ b/cmd/build/contrib/dummy-for-oci-images-windows.yaml
@@ -0,0 +1,38 @@
+startMessage: >
+  Welcome to Engity's Bifröst!
+  This instance runs a demo configuration that is NOT intended for
+  production use. Therefore, it will simply display a message
+  similar to this one and will close the connection immediately.
+  See https://bifroest.engity.org/latest/setup/ for more details.
+  You can log in to this instance with the username "demo" and the
+  password that should be printed the first time Bifröst was
+  started on this machine, before this message.
+
+ssh:
+  banner: |+
+    Transcend with Engity's Bifröst
+    ===============================
+
+    This instance runs a demo configuration that is NOT intended for
+    production use. Please refer the following page to complete the
+    setup: https://bifroest.engity.org/latest/setup/
+
+    You should be able to log in to this instance using the credentials
+    printed the frist time Bifröst was started on this machine.
+
+flows:
+  - name: default
+    authorization:
+      type: simple
+      entries:
+        - name: demo
+          passwordFile: "C:\\ProgramData\\Engity\\Bifroest\\passwords\\dummy"
+          createPasswordFileIfAbsentOfType: plain
+    environment:
+      type: dummy
+      banner: |+
+        Yay! You have successfully logged in to Bifröst.
+
+        Now refer https://bifroest.engity.org/latest/setup/ to continue.
+
+        Bye!
diff --git a/cmd/build/contrib/dummy-for-oci-images.yaml b/cmd/build/contrib/dummy-for-oci-images.yaml
index 904c605..aa18119 100644
--- a/cmd/build/contrib/dummy-for-oci-images.yaml
+++ b/cmd/build/contrib/dummy-for-oci-images.yaml
@@ -1,31 +1,38 @@
-## This configuration should only be used as dummy configuration within OCI/Docker images.
-## It will create (if not exists)
-## for the regular sshd.
-
 startMessage: >
   Welcome to Engity's Bifröst!
-  This instance is running a demo configuration that is NOT
-  intended for production use. Therefore, it is not possible to
-  log in to this instance until it is configured.
+  This instance runs a demo configuration that is NOT intended for
+  production use. Therefore, it will simply display a message
+  similar to this one and will close the connection immediately.
   See https://bifroest.engity.org/latest/setup/ for more details.
+  You can log in to this instance with the username "demo" and the
+  password that should be printed the first time Bifröst was
+  started on this machine, before this message.
 
 ssh:
-  addresses: [ ":22" ]
   banner: |+
     Transcend with Engity's Bifröst
     ===============================
 
-    This instance is running a demo configuration that is NOT
-    intended for production use. Therefore, it is not possible to
-    log in to this instance until it is configured.
+    This instance runs a demo configuration that is NOT intended for
+    production use. Please refer the following page to complete the
+    setup: https://bifroest.engity.org/latest/setup/
 
-    See https://bifroest.engity.org/latest/setup/ for more details.
+    You should be able to log in to this instance using the credentials
+    printed the frist time Bifröst was started on this machine.
 
 flows:
   - name: default
     authorization:
-      type: htpasswd
+      type: simple
+      entries:
+        - name: demo
+          passwordFile: "/etc/engity/bifroest/passwords/demo"
+          createPasswordFileIfAbsentOfType: plain
     environment:
-      type: local
-      # This property will not be evaluated in Windows.
-      name: "demo"
+      type: dummy
+      banner: |+
+        Yay! You have successfully logged in to Bifröst.
+
+        Now refer https://bifroest.engity.org/latest/setup/ to continue.
+
+        Bye!
diff --git a/cmd/build/dependencies-ca-certs.go b/cmd/build/dependencies-ca-certs.go
index 4710530..cb191b1 100644
--- a/cmd/build/dependencies-ca-certs.go
+++ b/cmd/build/dependencies-ca-certs.go
@@ -11,7 +11,7 @@ import (
 	"path/filepath"
 	"time"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	log "github.com/echocat/slf4g"
 	"github.com/gwatts/rootcerts/certparse"
 
diff --git a/cmd/build/dependencies-images-files.go b/cmd/build/dependencies-images-files.go
index 5a2f668..72d7c07 100644
--- a/cmd/build/dependencies-images-files.go
+++ b/cmd/build/dependencies-images-files.go
@@ -11,7 +11,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	log "github.com/echocat/slf4g"
 	"github.com/google/go-containerregistry/pkg/crane"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
diff --git a/cmd/build/dependencies.go b/cmd/build/dependencies.go
index 9a467ba..fb36974 100644
--- a/cmd/build/dependencies.go
+++ b/cmd/build/dependencies.go
@@ -3,7 +3,7 @@ package main
 import (
 	"context"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 )
 
 func newDependencies(b *base) *dependencies {
diff --git a/cmd/build/exec.go b/cmd/build/exec.go
index bb1447d..a6f035c 100644
--- a/cmd/build/exec.go
+++ b/cmd/build/exec.go
@@ -8,7 +8,7 @@ import (
 	gexec "os/exec"
 	"strings"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 
 	"github.com/engity-com/bifroest/pkg/errors"
 )
diff --git a/cmd/build/main.go b/cmd/build/main.go
index 0d913ba..a327567 100644
--- a/cmd/build/main.go
+++ b/cmd/build/main.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"syscall"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	"github.com/echocat/slf4g"
 	"github.com/echocat/slf4g/level"
 	"github.com/echocat/slf4g/native"
diff --git a/cmd/build/repo-actions.go b/cmd/build/repo-actions.go
index fa5a6d2..e79fdde 100644
--- a/cmd/build/repo-actions.go
+++ b/cmd/build/repo-actions.go
@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"iter"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	"github.com/google/go-github/v65/github"
 )
 
diff --git a/cmd/build/repo-packages.go b/cmd/build/repo-packages.go
index 0cb201d..2da3e09 100644
--- a/cmd/build/repo-packages.go
+++ b/cmd/build/repo-packages.go
@@ -6,7 +6,7 @@ import (
 	"iter"
 	"slices"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	"github.com/echocat/slf4g"
 	"github.com/google/go-github/v65/github"
 )
diff --git a/cmd/build/repo-prs.go b/cmd/build/repo-prs.go
index 22b42fa..850343f 100644
--- a/cmd/build/repo-prs.go
+++ b/cmd/build/repo-prs.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	"github.com/echocat/slf4g"
 	"github.com/google/go-github/v65/github"
 )
diff --git a/cmd/build/repo-releases.go b/cmd/build/repo-releases.go
index 9e27205..7a449cf 100644
--- a/cmd/build/repo-releases.go
+++ b/cmd/build/repo-releases.go
@@ -10,7 +10,7 @@ import (
 	"time"
 
 	"github.com/Masterminds/semver/v3"
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	log "github.com/echocat/slf4g"
 	"github.com/google/go-github/v65/github"
 
diff --git a/cmd/build/repo.go b/cmd/build/repo.go
index 92b44fc..764e7e4 100644
--- a/cmd/build/repo.go
+++ b/cmd/build/repo.go
@@ -9,7 +9,7 @@ import (
 	"strings"
 	"sync/atomic"
 
-	"github.com/alecthomas/kingpin"
+	"github.com/alecthomas/kingpin/v2"
 	"github.com/google/go-github/v65/github"
 )
 
diff --git a/contrib/configurations/dummy-windows.yaml b/contrib/configurations/dummy-windows.yaml
new file mode 100644
index 0000000..a52933d
--- /dev/null
+++ b/contrib/configurations/dummy-windows.yaml
@@ -0,0 +1,38 @@
+startMessage: >
+  Welcome to Engity's Bifröst!
+  This instance runs a demo configuration that is NOT intended for
+  production use. Therefore, it will simply display a message
+  similar to this one and will close the connection immediately.
+  See https://bifroest.engity.org/latest/setup/ for more details.
+  You can log in to this instance with the username "demo" and the
+  password that should be printed the first time Bifröst was
+  started on this machine, before this message.
+
+ssh:
+  banner: |+
+    Transcend with Engity's Bifröst
+    ===============================
+
+    This instance runs a demo configuration that is NOT intended for
+    production use. Please refer the following page to complete the
+    setup: https://bifroest.engity.org/latest/setup/
+
+    You should be able to log in to this instance using the credentials
+    printed the frist time Bifröst was started on this machine.
+
+flows:
+  - name: default
+    authorization:
+      type: simple
+      entries:
+        - name: demo
+          passwordFile: "C:\\ProgramData\\Engity\\Bifroest\\passwords\\dummy"
+          createPasswordFileIfAbsentOfType: plain
+    environment:
+      type: dummy
+      banner: |+
+        Yay! You have successfully logged in to Bifröst.
+
+        Now refer https://bifroest.engity.org/latest/setup/ to continue.
+
+        Bye!
diff --git a/contrib/configurations/simple-inside-docker-windows.yaml b/contrib/configurations/simple-inside-docker-windows.yaml
new file mode 100644
index 0000000..764e06f
--- /dev/null
+++ b/contrib/configurations/simple-inside-docker-windows.yaml
@@ -0,0 +1,33 @@
+startMessage: >
+  Welcome to Engity's Bifröst!
+  This instance runs a demo configuration that shows how to
+  operate Bifröst and its sessions inside Docker. It is NOT
+  intended for production use. This instance runs a demo
+  configuration that is NOT intended for production use.
+  Therefore, it will simply display a message similar to
+  this one and will close the connection immediately.
+  See https://bifroest.engity.org/latest/setup/in-docker/
+
+ssh:
+  banner: |+
+    Transcend with Engity's Bifröst
+    ===============================
+
+    This instance runs a demo configuration that is NOT intended for
+    production use. Please refer the following page to complete the
+    setup: https://bifroest.engity.org/latest/setup/in-docker/
+
+    You should be able to log in to this instance using the credentials
+    printed the frist time Bifröst was started on this machine.
+
+flows:
+  - name: default
+    authorization:
+      type: simple
+      entries:
+        - name: demo
+          passwordFile: "C:\\ProgramData\\Engity\\Bifroest\\passwords\\dummy"
+          createPasswordFileIfAbsentOfType: plain
+    environment:
+      type: docker
+      image: alpine
diff --git a/contrib/configurations/simple-inside-docker.yaml b/contrib/configurations/simple-inside-docker.yaml
new file mode 100644
index 0000000..154397a
--- /dev/null
+++ b/contrib/configurations/simple-inside-docker.yaml
@@ -0,0 +1,33 @@
+startMessage: >
+  Welcome to Engity's Bifröst!
+  This instance runs a demo configuration that shows how to
+  operate Bifröst and its sessions inside Docker. It is NOT
+  intended for production use. This instance runs a demo
+  configuration that is NOT intended for production use.
+  Therefore, it will simply display a message similar to
+  this one and will close the connection immediately.
+  See https://bifroest.engity.org/latest/setup/in-docker/
+
+ssh:
+  banner: |+
+    Transcend with Engity's Bifröst
+    ===============================
+
+    This instance runs a demo configuration that is NOT intended for
+    production use. Please refer the following page to complete the
+    setup: https://bifroest.engity.org/latest/setup/in-docker/
+
+    You should be able to log in to this instance using the credentials
+    printed the frist time Bifröst was started on this machine.
+
+flows:
+  - name: default
+    authorization:
+      type: simple
+      entries:
+        - name: demo
+          passwordFile: "/etc/engity/bifroest/passwords/demo"
+          createPasswordFileIfAbsentOfType: plain
+    environment:
+      type: docker
+      image: alpine
diff --git a/contrib/systemd/bifroest-in-docker.service b/contrib/systemd/bifroest-in-docker.service
new file mode 100644
index 0000000..4dc1efa
--- /dev/null
+++ b/contrib/systemd/bifroest-in-docker.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=Engity's Bifröst is an SSH server which provides authorization and authentication via OpenID Connect and classic mechanisms to access a real host.
+Requires=docker.service
+After=docker.service
+
+[Service]
+# Adjust this line to your needs which edition/version of Bifröst should be used.
+# Visit https://bifroest.engity.org/latest/setup/distribution/#image for more details.
+Environment=IMAGE=ghcr.io/engity-com/bifroest:latest
+# Comment this line out if you don't want always the latest version of Bifröst
+ExecStartPre=/usr/bin/docker pull ${IMAGE}
+ExecStartPre=mkdir -p /var/lib/engity/bifroest
+ExecStart=/usr/bin/docker run --rm --name bifroest -p 22:22 -v /var/run/docker.sock:/var/run/docker.sock -v /etc/engity/bifroest:/etc/engity/bifroest -v /var/lib/engity/bifroest:/var/lib/engity/bifroest ${IMAGE} run --log.colorMode=always
+Restart=always
+Type=simple
+
+[Install]
+WantedBy=multi-user.target
diff --git a/docs/.theme/marcos/main.py b/docs/.theme/marcos/main.py
index 9fc28f8..90d8989 100644
--- a/docs/.theme/marcos/main.py
+++ b/docs/.theme/marcos/main.py
@@ -1,3 +1,4 @@
+import html
 import json
 import os as pos
 import os.path as path
@@ -15,14 +16,17 @@
 repo_raw_url = "https://raw.githubusercontent.com/" + repo
 repo_container_uri = "ghcr.io/" + repo
 raw_version = pos.getenv('VERSION')
-release = (("v" if raw_version.__len__() > 0 and raw_version[0].isdigit() else "") + raw_version) if raw_version is not None and raw_version.__len__() > 0 else "latest"
-branch = (("v" if raw_version.__len__() > 0 and raw_version[0].isdigit() else "") + raw_version) if raw_version is not None and raw_version.__len__() > 0 else "main"
+release = (("v" if raw_version.__len__() > 0 and raw_version[
+    0].isdigit() else "") + raw_version) if raw_version is not None and raw_version.__len__() > 0 else "latest"
+branch = (("v" if raw_version.__len__() > 0 and raw_version[
+    0].isdigit() else "") + raw_version) if raw_version is not None and raw_version.__len__() > 0 else "main"
 
 
 class Packaging(str, Enum):
     archive = 'archive'
     image = 'image'
 
+
 class Os(str, Enum):
     linux = 'linux'
     windows = 'windows'
@@ -227,21 +231,29 @@ class TypeRef:
     def __init__(
             self,
             title: str,
-            ref: str | None = None,
-            args: Sequence[TypeRefT] | None = None,
+            ref: str | None,
+            *args: TypeRefT | None,
     ):
+        def filter_out_nones(candidate: TypeRefT | None) -> bool:
+            return candidate is not None
+
         self.title = title
         self.ref = ref
-        self.args = args
+        self.args = list(filter(filter_out_nones, args))
 
     @property
     def markdown(self) -> str:
-        result = self.title
-        if isinstance(self.ref, str):
-            result = f"[{result}]({self.ref})"
+        array = self.title == "Array" and self.ref is None and len(self.args) == 1
+        if array:
+            result = '<span data-hint-type="array">[]</span>'
+        else:
+            result = self.title
+            if isinstance(self.ref, str):
+                result = f"[{result}]({self.ref})"
 
-        if isinstance(self.args, Sequence) and len(self.args) > 0:
-            result += "<"
+        if len(self.args) > 0:
+            if not array:
+                result += "&lt;"
             first = True
             for arg in self.args:
                 if first:
@@ -249,7 +261,8 @@ def markdown(self) -> str:
                 else:
                     result += ","
                 result += arg.markdown
-            result += ">"
+            if not array:
+                result += "&gt;"
 
         return result
 
@@ -265,6 +278,7 @@ def property_extended(
             heading: int = 3,
             requirement: bool | str = False,
             optional: bool = False,
+            template_context: TypeRefT | TypeRef | None = None,
     ):
         if id_prefix is None:
             id_prefix = ""
@@ -276,6 +290,13 @@ def property_extended(
         result += "/// html | div.property-description\n"
         result += "<span class=\"property-assign\"></span>"
         result += data_type.markdown
+
+        if template_context is not None:
+            templating: File = env.variables.files.get_file_from_path("reference/templating/index.md")
+            templating_ref = PurePath(
+                path.relpath(templating.src_path, path.dirname(env.page.file.src_path))).as_posix()
+            result += f" [:material-file-replace-outline:{{ title=\"Templated with {template_context.title}\" data-hint-type=\"templated\" }}]({templating_ref}) {template_context.markdown}"
+
         if required:
             result += " :material-asterisk-circle-outline:{ title=\"Required\" data-hint-type=\"required\" }"
         if optional:
@@ -287,6 +308,7 @@ def property_extended(
 
         if default is not None:
             default_str = json.dumps(default, ensure_ascii=False)
+            default_str = default_str.replace("`", "\`")
             if len(default_str) > 30:
                 result += f""" = :material-keyboard-return:\n///\n
 ```{{.json .property-description-default-block linenums=0}}
@@ -294,15 +316,48 @@ def property_extended(
 ```
 """
             else:
-                result += f" = `{default_str}`" + "\n///"
+                result += f" = <code>{html.escape(default_str)}</code>" + "\n///"
         else:
             result += "\n///"
         return result
 
+    @env.macro
+    def ref(
+            title: str | None = None,
+            ref: str | None = None,
+            *args: TypeRef | TypeRefT | None,
+    ) -> TypeRef | TypeRefT | None:
+        if ref is not None:
+            if title is None:
+                if ref == "bool" or ref == "string" and ref == "number" and ref == "uint" and ref == "integer" and ref == "float":
+                    title = ref
+                else:
+                    file: File = env.variables.files.get_file_from_path(
+                        path.normpath(path.dirname(env.page.file.src_path) + "/" + ref))
+                    if file is None:
+                        title = path.basename(ref)
+                    else:
+                        title = file.page.title
+
+            return TypeRef(title, ref, *args)
+
+        if title is not None:
+            return TypeRef(title, None, *args)
+
+        return None
+
+    @env.macro
+    def array_ref(
+            title: str | None = None,
+            ref_n: str | None = None,
+            *args: TypeRef | TypeRefT | None,
+    ) -> TypeRef | TypeRefT | None:
+        return ref("Array", None, ref(title, ref_n, *args))
+
     @env.macro
     def property(
             name: str,
-            data_type_title: str,
+            data_type: str | TypeRef | TypeRefT,
             data_type_reference: str | None = None,
             default=None,
             required: bool = False,
@@ -310,45 +365,22 @@ def property(
             heading: int = 3,
             requirement: bool = False,
             optional: bool = False,
+            template_context_title: str | None = None,
+            template_context: str | None = None,
     ):
-        return property_extended(
-            name=name,
-            data_type=TypeRef(data_type_title, data_type_reference),
-            default=default,
-            required=required,
-            id_prefix=id_prefix,
-            heading=heading,
-            requirement=requirement,
-            optional=optional
-        )
+        if isinstance(data_type, str):
+            data_type = TypeRef(data_type, data_type_reference)
 
-    @env.macro
-    def property_with_holder(
-            name: str,
-            data_holder_title: str, data_holder_reference: str | None,
-            data_type_title: str, data_type_reference: str | None = None,
-            default=None,
-            required: bool = False,
-            id_prefix: str = "",
-            heading: int = 3,
-            requirement: bool = False,
-            optional: bool = False,
-    ) -> str:
-        # noinspection PyTypeChecker
         return property_extended(
             name=name,
-            data_type=TypeRef(
-                data_holder_title, data_holder_reference,
-                [
-                    TypeRef(data_type_title, data_type_reference)
-                ] if data_type_title is not None and data_type_title != "" else []
-            ),
+            data_type=data_type,
             default=default,
             required=required,
             id_prefix=id_prefix,
             heading=heading,
             requirement=requirement,
-            optional=optional
+            optional=optional,
+            template_context=ref(template_context_title, template_context)
         )
 
     @env.macro
@@ -400,7 +432,7 @@ def flag_extended(
     @env.macro
     def flag(
             name: str,
-            data_type_title: str | None = None,
+            data_type: str | TypeRef | TypeRefT | None = None,
             data_type_reference: str | None = None,
             default=None,
             required: bool = False,
@@ -408,36 +440,12 @@ def flag(
             heading: int = 3,
             aliases: Sequence[str] | None = None
     ):
-        return flag_extended(
-            name=name,
-            data_type=TypeRef(data_type_title, data_type_reference) if data_type_title is not None else None,
-            default=default,
-            required=required,
-            id_prefix=id_prefix,
-            heading=heading,
-            aliases=aliases,
-        )
+        if isinstance(data_type, str):
+            data_type = TypeRef(data_type, data_type_reference)
 
-    @env.macro
-    def flag_with_holder(
-            name: str,
-            data_holder_title: str, data_holder_reference: str | None,
-            data_type_title: str, data_type_reference: str | None = None,
-            default=None,
-            required: bool = False,
-            id_prefix: str = "",
-            heading: int = 3,
-            aliases: Sequence[str] | None = None
-    ) -> str:
-        # noinspection PyTypeChecker
         return flag_extended(
             name=name,
-            data_type=TypeRef(
-                data_holder_title, data_holder_reference,
-                [
-                    TypeRef(data_type_title, data_type_reference)
-                ] if data_type_title is not None and data_type_title != "" else []
-            ),
+            data_type=data_type,
             default=default,
             required=required,
             id_prefix=id_prefix,
@@ -461,7 +469,6 @@ def container_image_uri(
     def container_packages_url() -> str:
         return f"{repo_http_url}/pkgs/container/bifroest"
 
-
     @env.macro
     def asset_url(file: str, raw: bool = False) -> str:
         if raw:
@@ -568,16 +575,24 @@ def compatibility_matrix(
         result += '</thead><tbody markdown="span">'
 
         for arch in Arch:
-            result += f'<tr markdown="span"><td markdown="span">`{arch.name}`</td>'
 
             if os is not None:
                 generic = support_matrix.lookup(os, arch, EditionKind.generic)
                 extended = support_matrix.lookup(os, arch, EditionKind.extended)
-                if packaging == Packaging.archive or packaging is None:
-                    result += f'<td markdown="span">{compatibility_editions(True if generic and generic.binary_supported else None, True if extended and extended.binary_supported else None, os)}</td>'
-                if packaging == Packaging.image or packaging is None:
-                    result += f'<td markdown="span">{compatibility_editions(True if generic and generic.image_supported else None, True if extended and extended.image_supported else None, os)}</td>'
+
+                if (generic and (generic.binary_supported or generic.image_supported)) or (extended and (extended.binary_supported or extended.image_supported)):
+                    result += f'<tr markdown="span"><td markdown="span">`{arch.name}`</td>'
+
+                    if packaging == Packaging.archive or packaging is None:
+                        result += f'<td markdown="span">{compatibility_editions(True if generic and generic.binary_supported else None, True if extended and extended.binary_supported else None, os)}</td>'
+                    if packaging == Packaging.image or packaging is None:
+                        result += f'<td markdown="span">{compatibility_editions(True if generic and generic.image_supported else None, True if extended and extended.image_supported else None, os)}</td>'
+
+                    result += '<tr>'
+
             else:
+                result += f'<tr markdown="span"><td markdown="span">`{arch.name}`</td>'
+
                 for osv in Os:
                     generic = support_matrix.lookup(osv, arch, EditionKind.generic)
                     extended = support_matrix.lookup(osv, arch, EditionKind.extended)
@@ -586,7 +601,7 @@ def compatibility_matrix(
                     if packaging == Packaging.image or packaging is None:
                         result += f'<td markdown="span">{compatibility_editions(True if generic and generic.image_supported else None, True if extended and extended.image_supported else None, osv)}</td>'
 
-            result += '<tr>'
+                result += '<tr>'
 
         result += '</tbody>'
         result += '</table>'
diff --git a/docs/assets/extra.css b/docs/assets/extra.css
index 3ae20f5..510b6c5 100644
--- a/docs/assets/extra.css
+++ b/docs/assets/extra.css
@@ -55,6 +55,15 @@ p.bifroest-logo .switchable rect {
     color: #b69237;
 }
 
+.md-typeset [data-hint-type="templated"] {
+    color: var(--md-typeset-color);
+    vertical-align: baseline;
+    font-size: 0.8em;
+    opacity: 0.6;
+    margin-left: 0.3em;
+    margin-right: -0.3em;
+}
+
 [data-supported=true] {
     color: #309c30;
 }
@@ -65,6 +74,10 @@ p.bifroest-logo .switchable rect {
     color: #dc6a43;
 }
 
+.md-typeset .twemoji.warning {
+    color: #dc6a43;
+}
+
 .md-typeset > p:not(.subtitle),
 .md-typeset > ol:not(.subtitle),
 .md-typeset > ul:not(.subtitle),
@@ -133,6 +146,10 @@ html .md-typeset .admonition > :not(.admonition-title):first-child {
     margin-bottom: 0;
 }
 
+.md-typeset .property-title code {
+    text-transform: none;
+}
+
 .md-typeset .property-title:has(+ .property-description) {
     display: inline-block;
     margin-top: 0.5em;
diff --git a/docs/reference/alternatives.md b/docs/reference/alternatives.md
new file mode 100644
index 0000000..d2da75e
--- /dev/null
+++ b/docs/reference/alternatives.md
@@ -0,0 +1,26 @@
+---
+description: Defines how Bifröst reaches alternatives of itself.
+---
+
+# Alternatives
+
+Defines how Bifröst reaches alternatives of itself.
+
+For example if itself runs currently runs on AMD64 architecture, but needs for a target system an ARM64 instance. Or if the host is Windows, but the target is Linux.
+
+Especially if a containerized environment (like [Docker environment](environment/docker.md)) is used, some features requires a supporting process that runs directly inside the container to enable all features. Such as tcp portforward from the context of the container or SSH Agent forward.
+
+## Properties
+
+<<property("downloadUrl", "URL", "data-type.md#url", template_context="context/alternative-binary.md", default="https://github.com/engity-com/bifroest/releases/download/v{{.version}}/bifroest-{{.os}}-{{.arch}}-{{.edition}}{{.packageExt}}")>>
+URL where to download the alternative version of Bifröst. Usually we simply will get this from [the GitHub Releases of Bifröst](https://github.com/engity-com/bifroest/releases).
+
+<<property("location", "File Path", "data-type.md#file-path", template_context="context/alternative-binary.md", default="<os specific>")>>
+Location to store the downloaded alternative version of Bifröst at.
+
+A file that already exists, will not be downloaded again.
+
+The default value is different, depending on the platform Bifröst runs on:
+
+* Linux: `/var/lib/engity/bifroest/binaries/{{.version}}/{{.os}}-{{.arch}}-{{.edition}}{{.ext}}`
+* Window: `C:\ProgramData\Engity\Bifroest\binaries\{{.version}}\{{.os}}-{{.arch}}-{{.edition}}{{.ext}}`
diff --git a/docs/reference/authorization/index.md b/docs/reference/authorization/index.md
index 4e37e4b..6b5554c 100644
--- a/docs/reference/authorization/index.md
+++ b/docs/reference/authorization/index.md
@@ -12,6 +12,7 @@ Everything in Bifröst starts here. Firstly, a user must be authorized. Bifröst
 2. `oidc`: [OpenID Connect (OIDC)](oidc.md)
 3. `simple`: [Simple](simple.md)
 4. `htpasswd`: [Htpasswd](htpasswd.md)
+5. `none`: [None](none.md)
 
 ## Examples
 
diff --git a/docs/reference/authorization/local.md b/docs/reference/authorization/local.md
index ccc5418..8adbc61 100644
--- a/docs/reference/authorization/local.md
+++ b/docs/reference/authorization/local.md
@@ -6,19 +6,19 @@ description: How to authorize an user request via the local user database of the
 
 Authorizes a user request via the local user database of the host on which Bifröst is running.
 
-!!! Note
-    This authorization requires Bifröst to run with root permissions.
+!!! note
+     This authorization requires Bifröst to run with root permissions.
 
 ## Properties
 
 <<property("type", "Authorization Type", default="local", required=True)>>
 Has to be set to `local` to enable the local authorization.
 
-<<property_with_holder("authorizedKeys", "Array", None, "Authorized Keys", "../data-type.md#authorized-keys", default=["{{.user.homeDir}}/.ssh/authorized_keys"])>>
+<<property("authorizedKeys", array_ref("File Path", "../data-type.md#file-path", ref("Authorized Keys", "../data-type.md#authorized-keys")), template_context="../context/core.md", default=["{{.user.homeDir}}/.ssh/authorized_keys"])>>
 Contains files with the format of classic [authorized keys](../data-type.md#authorized-keys), in which Bifröst will look for [SSH Public Keys](../data-type.md#ssh-public-key).
 
 <<property("password", "Password", "#password")>>
-Contains files of with format of classic [authorized keys](../data-type.md#authorized-keys), in which Bifröst will look for [SSH Public Keys](../data-type.md#ssh-public-key).
+See [below](#password).
 
 <<property("pamService", "string", default="<os and edition specific>")>>
 If set to a non-empty value, this [PAM](https://wiki.archlinux.org/title/PAM) service will be directly used during the authorization process instead of `/etc/passwd` and `/etc/shadow`.
@@ -35,17 +35,17 @@ The password can either be validated via `/etc/passwd` and `/etc/shadow` (defaul
 
 ### Properties {. #password-properties}
 
-<<property_with_holder("allowed", "Bool Template", "../templating/index.md#bool", "Context Password Authorization Request", "../context/authorization-request.md#password", default=True, id_prefix="password-", heading=4)>>
+<<property("allowed", "bool", template_context="../context/authorization-request.md#password", template_context_title="Context Password Authorization Request", default=True, id_prefix="password-", heading=4)>>
 If `true`, the user is allowed to use passwords via classic password authentication
 
-<<property_with_holder("interactiveAllowed", "Bool Template", "../templating/index.md#bool", "Context Interactive Authorization Request", "../context/authorization-request.md#interactive", default=True, id_prefix="password-", heading=4)>>
+<<property("interactiveAllowed", "bool", template_context="../context/authorization-request.md#interactive", template_context_title="Context Interactive Authorization Request", default=True, id_prefix="password-", heading=4)>>
 If `true`, the user is allowed to use passwords via interactive authentication.
 
-<<property_with_holder("emptyAllowed", "Bool Template", "../templating/index.md#bool", "Context * Authorization Request", "../context/authorization-request.md", default=False, id_prefix="password-", heading=4)>>
+<<property("emptyAllowed", "bool", template_context="../context/authorization-request.md", template_context_title="Context * Authorization Request", default=False, id_prefix="password-", heading=4)>>
 If `true`, the user is allowed to use empty passwords.
 
-!!! warning
-    This is explicitly not recommend.
+!!! danger
+     This is explicitly not recommend.
 
 ## Context
 
diff --git a/docs/reference/authorization/none.md b/docs/reference/authorization/none.md
new file mode 100644
index 0000000..3e30d9b
--- /dev/null
+++ b/docs/reference/authorization/none.md
@@ -0,0 +1,33 @@
+---
+toc_depth: 4
+description: How to enable users to access Bifröst without any kind of password or SSH key.
+---
+
+# None authorization
+
+Always authorizes a user regardless of the password used, even if no password or SSH key is provided.
+
+!!! danger
+     This authorization enables a high security risk.
+
+      There are only very rare cases where this makes sense. Only in cases like creating a demo server does it make sense to use it. See [our demonstration/training use case as a ligable example](../../usecases.md#demos)
+
+## Properties
+
+_None._
+
+## Context
+
+This authorization will produce a context of type [Authorization Simple](../context/authorization.md#simple).
+
+## Examples
+
+```yaml
+type: none
+```
+
+## Compatibility
+
+| <<dist("linux")>> | <<dist("windows")>> |
+| - | - |
+| <<compatibility_editions(True,True,"linux")>> | <<compatibility_editions(True,None,"windows")>> |
diff --git a/docs/reference/authorization/oidc.md b/docs/reference/authorization/oidc.md
index 73cf815..110e2bc 100644
--- a/docs/reference/authorization/oidc.md
+++ b/docs/reference/authorization/oidc.md
@@ -21,7 +21,7 @@ Currently the following flow of OpenID Connect is supported:
 <<property("type", "Authorization Type", default="oidc", required=True, id_prefix="device-auth-", heading=4)>>
 Has to be set to `oidcDeviceAuth` to enable the OIDC DeviceAuth authorization.
 
-<<property("issuer", "URL", None, id_prefix="device-auth-", heading=4, required=True)>>
+<<property("issuer", "URL", "../data-type.md#url", template_context="../context/core.md", id_prefix="device-auth-", heading=4, required=True)>>
 The issuer is the URL identifier for the service which is issued by your identity provider.
 
 ##### Examples {: #device-auth-property-issuer-examples }
@@ -29,13 +29,13 @@ The issuer is the URL identifier for the service which is issued by your identit
 * `https://accounts.google.com`
 * `https://login.salesforce.com`
 
-<<property("clientId", "string", None, id_prefix="device-auth-", heading=4, required=True)>>
+<<property("clientId", "string", template_context="../context/core.md", id_prefix="device-auth-", heading=4, required=True)>>
 Client ID issued by your identity provider.
 
-<<property("clientSecret", "string", None, id_prefix="device-auth-", heading=4, required=True)>>
+<<property("clientSecret", "string", template_context="../context/core.md", id_prefix="device-auth-", heading=4, required=True)>>
 Secret for the corresponding [Client ID](#device-auth-property-clientId).
 
-<<property_with_holder("scopes", "Array", None, "string", None, id_prefix="device-auth-", heading=4, required=True)>>
+<<property("scopes", array_ref("string"), template_context="../context/core.md", id_prefix="device-auth-", heading=4, default=["openid","profile","email"])>>
 Scopes to request the token from the identity provider for.
 
 ##### Examples {: #device-auth-property-scopes-examples }
diff --git a/docs/reference/authorization/simple.md b/docs/reference/authorization/simple.md
index a516a67..6b13a11 100644
--- a/docs/reference/authorization/simple.md
+++ b/docs/reference/authorization/simple.md
@@ -12,7 +12,7 @@ Authorizes a user request via stored credentials.
 <<property("type", "Authorization Type", default="simple", required=True)>>
 Has to be set to `simple` to enable simple authorization.
 
-<<property_with_holder("entries", "Array", None, "Entry", "#entry")>>
+<<property("entries", array_ref("Entry", "#entry"))>>
 Each entry will be inspected to check if a remote user should be authorized.
 
 ## Entry
@@ -22,6 +22,7 @@ Always one property of the following properties has to match in combination with
 * [`authorizedKeys`](#entry-property-authorizedKeys)
 * [`authorizedKeysFile`](#entry-property-authorizedKeysFile)
 * [`password`](#entry-property-password)
+* [`passwordFile`](#entry-property-passwordFile)
 
 ### Properties {: #entry-properties }
 
@@ -33,12 +34,24 @@ Like: `ssh <name>@my-great-domain.tld` to match this entry.
 <<property("authorizedKeys", "Authorized Keys", "../data-type.md#authorized-keys", id_prefix="entry-", heading=4)>>
 Contains [SSH Public Keys](../data-type.md#ssh-public-key) in the format of classic [authorized keys](../data-type.md#authorized-keys).
 
-<<property_with_holder("authorizedKeysFile", "File Path", "../data-type.md#file-path", "Authorized Keys", "../data-type.md#authorized-keys", id_prefix="entry-", heading=4)>>
+<<property("authorizedKeysFile", ref("File Path", "../data-type.md#file-path", ref("Authorized Keys", "../data-type.md#authorized-keys")), id_prefix="entry-", heading=4)>>
 Similar to [`authorizedKeys`](#entry-property-authorizedKeys), but in a dedicated file.
 
 <<property("password", "Password", "../data-type.md#password", id_prefix="entry-", heading=4)>>
 Password (if user uses interactive or password authentication method) to be evaluated against.
 
+<<property("passwordFile", ref("File Path", "../data-type.md#file-path", ref("Password", "../data-type.md#password")), id_prefix="entry-", heading=4)>>
+Same as [`password`](#entry-property-password), but is receiving the value from this file.
+
+If both properties are defined and have values, [`password`](#entry-property-password) will be used.
+
+<<property("createPasswordFileIfAbsentOfType", "Password Type", "../data-type.md#password-type", id_prefix="entry-", heading=4)>>
+If this property is provided and [`passwordFile`](#entry-property-passwordFile) is defined, but does not exist, the file will be generated with a random password of this type.
+
+The result will be printed into the startup logs of Bifröst.
+
+This feature is usually only makes sense for cases where you want to create dummy configurations of Bifröst to demonstrate some functionality, like we're utilizing it in our demonstration configurations: [contrib/configurations/simple-inside-docker.yaml](<<asset_url("contrib/configurations/simple-inside-docker.yaml")>>).
+
 ## Context
 
 This authorization will produce a context of type [Authorization Simple](../context/authorization.md#simple).
diff --git a/docs/reference/cli.md b/docs/reference/cli.md
index 7fd1672..019bb5f 100644
--- a/docs/reference/cli.md
+++ b/docs/reference/cli.md
@@ -14,7 +14,7 @@ Syntax: `bifroest run [flags]`
 
 Includes [all general flags](#general-flags).
 
-<<flag_with_holder("configuration", "File Path", "data-type.md#file-path", "Configuration", "configuration.md", default="<os specific>", aliases=["c"],id_prefix="run-", heading=4)>>
+<<flag("configuration", ref("File Path", "data-type.md#file-path", ref("Configuration", "configuration.md")), default="<os specific>", aliases=["c"],id_prefix="run-", heading=4)>>
 
 The default value varies depending on the platform Bifröst runs on:
 
@@ -29,6 +29,72 @@ Syntax: `bifroest verion [flags]`
 
 Includes [all general flags](#general-flags).
 
+## Service management {. #service}
+
+!!! note
+     Only available on Windows.
+
+### Installation {. #service-install}
+
+Installation of Bifröst as service inside the operating system, which will let it run upon system start and with full privileges.
+
+Syntax: `bifroest service install [flags]`
+
+#### Flags {. #service-install-flags}
+
+Includes [all general flags](#general-flags).
+
+<<flag("name", "string", default="engity-bifroest", id_prefix="service-install-", heading=5)>>
+Name of the service.
+
+<<flag("configuration", ref("File Path", "data-type.md#file-path", ref("Configuration", "configuration.md")), default="C:\\ProgramData\\Engity\\Bifroest\\configuration.yaml", aliases=["c"], id_prefix="service-install-", heading=5)>>
+Configuration location to use for the installed service.
+
+<<flag("start", "bool", default=True, id_prefix="service-install-", heading=5)>>
+If installed, should it be started immediately. This calls implicitly [`bifroest service start`](#service-start).
+
+### Removal {. #service-remove}
+
+Will remove an installed service instance of Bifröst from the operating system.
+
+Syntax: `bifroest service remove [flags]`
+
+#### Flags {. #service-remove-flags}
+
+Includes [all general flags](#general-flags).
+
+<<flag("name", "string", default="engity-bifroest", id_prefix="service-remove-", heading=5)>>
+Name of the service.
+
+<<flag("stop", "bool", default=True, id_prefix="service-remove-", heading=5)>>
+Same as calling [`bifroest service stop`](#service-stop) before this command.
+
+### Start {. #service-start}
+
+Will start the installed service instance of Bifröst.
+
+Syntax: `bifroest service start [flags]`
+
+#### Flags {. #service-start-flags}
+
+Includes [all general flags](#general-flags).
+
+<<flag("name", "string", default="engity-bifroest", id_prefix="service-start-", heading=5)>>
+Name of the service.
+
+### Stop {. #service-stop}
+
+Will stop the installed service instance of Bifröst (if running).
+
+Syntax: `bifroest service stop [flags]`
+
+#### Flags {. #service-stop-flags}
+
+Includes [all general flags](#general-flags).
+
+<<flag("name", "string", default="engity-bifroest", id_prefix="service-stop-", heading=5)>>
+Name of the service.
+
 ## General
 
 ### Flags {. #general-flags}
diff --git a/docs/reference/configuration.md b/docs/reference/configuration.md
index 24791d3..823060a 100644
--- a/docs/reference/configuration.md
+++ b/docs/reference/configuration.md
@@ -29,6 +29,12 @@ Defines which flows are evaluated for user sessions.
 <<property("housekeeping", "Housekeeping", "housekeeping.md")>>
 Defines how Bifröst will clean up its sessions and connections.
 
+<<property("alternatives", "Alternatives", "alternatives.md")>>
+Defines how the imp (if needed) behaves to help to bridge context boundaries, for example to enable port-forwarding into an OCI container.
+
+<<property("startMessage", "string", template_context="context/core.md", default="")>>
+If defined this message will be displayed in the log files of Bifröst on startup.
+
 ## Examples
 
 1. Simple:
@@ -44,6 +50,9 @@ Defines how Bifröst will clean up its sessions and connections.
         # ...
     housekeeping:
       # ...
+    alternatives:
+      # ...
+    startMessage: ""
     ```
 
 2. ??? plain "Drop in replacement for OpenSSH sshd"
diff --git a/docs/reference/connection/ssh.md b/docs/reference/connection/ssh.md
index c8ca5cc..d6f4edb 100644
--- a/docs/reference/connection/ssh.md
+++ b/docs/reference/connection/ssh.md
@@ -7,7 +7,7 @@ Defines the behavior of the SSH protocol for a user who is connecting to Bifrös
 
 ## Configuration
 
-<<property_with_holder("addresses", "Array", None, "Net Address", "../data-type.md#net-address", default=[":22"])>>
+<<property("addresses", array_ref("Net Address", "../data-type.md#net-address"), default=[":22"])>>
 To which address the service will bind and listen to.
 ``
 <<property("keys", "Keys", "#keys")>>
@@ -25,7 +25,7 @@ How many different authentication methods a client can use before the connection
 <<property("maxConnections", "uint8", None, default=255)>>
 The maximum amount of parallel connections on this service. Every additional connection beyond will be rejected.
 
-<<property_with_holder("banner", "String Template", "../templating/index.md#string", "Connection", "../context/connection.md", default='{{ `/etc/ssh/sshd-banner` | file `optional` | default `Transcend with Engity\'s Bifröst\n\n` }}')>>
+<<property("banner", "string", template_context="../context/connection.md", default='{{ `/etc/ssh/sshd-banner` | file `optional` | default `Transcend with Engity\'s Bifröst\n\n` }}')>>
 Banner which will be shown when the client connects to the server even before the first validation of authorizations or similar happens.
 
 ## Examples
@@ -42,11 +42,14 @@ maxConnections: 255
 banner: "Yeah!"
 ```
 
+<<property("preparationMessages", "Preparation Messages", "#preparationMessages")>>
+See [below](#preparationMessages).
+
 ## Keys
 
-### Configuration
+### Configuration {: #keys-configuration }
 
-<<property_with_holder("hostKeys", "Array", None, "File Path", "../data-type.md#file-path", default=['<defaultLocation>'], heading=4)>>
+<<property("hostKeys", array_ref("File Path", "../data-type.md#file-path"), default=['<defaultLocation>'], heading=4, id_prefix="keys-")>>
 Where to store the host keys at. If they do not exist, they will be created as Ed25519 key.
 
 Default Locations:
@@ -54,23 +57,23 @@ Default Locations:
 * Linux: `/etc/engity/bifroest/key`
 * Windows: `C:\ProgramData\Engity\Bifroest\key`
 
-<<property("rsaRestriction", "RSA Restriction", "../data-type.md#rsa-restriction", default="at-least-4096-bits", heading=4)>>
+<<property("rsaRestriction", "RSA Restriction", "../data-type.md#rsa-restriction", default="at-least-4096-bits", heading=4, id_prefix="keys-")>>
 Restrict which RSA keys are allowed to be used.
 
-<<property("dsaRestriction", "DSA Restriction", "../data-type.md#dsa-restriction", default="none", heading=4)>>
+<<property("dsaRestriction", "DSA Restriction", "../data-type.md#dsa-restriction", default="none", heading=4, id_prefix="keys-")>>
 Restrict which DSA keys are allowed to be used.
 
-<<property("ecdsaRestriction", "ECDSA Restriction", "../data-type.md#ecdsa-restriction", default="at-least-384-bits", heading=4)>>
+<<property("ecdsaRestriction", "ECDSA Restriction", "../data-type.md#ecdsa-restriction", default="at-least-384-bits", heading=4, id_prefix="keys-")>>
 Restrict which ECDSA keys are allowed to be used.
 
-<<property("ed25519Restriction", "ED25519 Restriction", "../data-type.md#ed25519-restriction", default="all", heading= 4)>>
+<<property("ed25519Restriction", "ED25519 Restriction", "../data-type.md#ed25519-restriction", default="all", heading= 4, id_prefix="keys-")>>
 Restrict which ED25519 keys are allowed to be used.
 
-<<property_with_holder("rememberMeNotification", "String Template", "../templating/index.md#string", "Authorization", "../context/authorization.md", default="If you return until {{.session.validUntil | format `dateTimeT`}} with the same public key ({{.key | fingerprint}}), you can seamlessly log in again.\n\n", heading=4)>>
+<<property("rememberMeNotification", "string", template_context="../context/authorization.md", default="If you return until {{.session.validUntil | format `dateTimeT`}} with the same public key ({{.key | fingerprint}}), you can seamlessly log in again.\n\n", heading=4, id_prefix="keys-")>>
 
 Banner which will be shown if the connection was based on an authentication method (like OIDC) which does not have its own public key authentication. At this point, the authentication was successful AND the client submitted at least one public key (as authentication try). This key will be used and this message will be shown to the client to inform that this key will be used for the session from now on. As a result, the original authentication will be skipped (like OIDC) as long as it is not expired and the client presents the same public key.
 
-### Examples
+### Examples {: #keys-examples }
 
 ```yaml
 hostKeys: [ /etc/engity/bifroest/key ]
@@ -81,6 +84,62 @@ ed25519Restriction: all
 rememberMeNotification: "If you return until {{.session.validUntil | format `dateTimeT`}} with the same public key {{.key | fingerprint}}), you can seamlessly login again.\n\n"
 ```
 
+## Preparation Messages {: #preparationMessages }
+
+In some cases the connection will not be available instantly. For example if the [docker environment](../environment/docker.md) is used and an image needs to be downloaded first, this could take some seconds. In these cases different parts of Bifröst might trigger these messages being displayed. By default, all of them are displayed as described [below](#preparationMessages-configuration).
+
+As this is an array of preparation messages, the first which matches, wins.
+
+### Configuration {: #preparationMessages-configuration }
+
+<<property("id", "Regex", "../data-type.md#regex", default=".*", heading=4, id_prefix="preparationMessages-")>>
+Each preparation proces has a unique ID (like [`pull-image`](../environment/docker.md#preparationProcess-pull-image) of the [docker environment](../environment/docker.md)).
+
+This property defines a [regular expression](../data-type.md#regex) this ID has to match together with [`flow`](#preparationMessages-property-flow).
+
+<<property("flow", "Regex", "../data-type.md#regex", default=".*", heading=4, id_prefix="preparationMessages-")>>
+Each preparation process will be produces by a [flow](../flow.md).
+
+This property defines a [regular expression](../data-type.md#regex) the [name of this flow](../flow.md#property-name) has to match together with [`id`](#preparationMessages-property-id).
+
+<<property("start", "string", template_context="../context/preparation-process.md", default="{{.title}}...", heading=4, id_prefix="preparationMessages-")>>
+This message is shown when a preparation process starts.
+
+<<property("update", "string", template_context="../context/preparation-process.md", default="\r{{.title}}... {{.percentage | printf `%.0f%%`}}", heading=4, id_prefix="preparationMessages-")>>
+This message is shown on each status change of a preparation process.
+
+<<property("end", "string", template_context="../context/preparation-process.md", default="\r{{.title}}... DONE!\n", heading=4, id_prefix="preparationMessages-")>>
+This message is shown if the preparation process finishes successful.
+
+<<property("error", "string", template_context="../context/preparation-process.md", default="\r{{.title}}... FAILED! Contact server operator for more information. Disconnecting now...\n", heading=4, id_prefix="preparationMessages-")>>
+This message is shown if the preparation process finishes with an error. The direct consequence will be that the connection will be closed by Bifröst immediately.
+
+### Examples {: #preparationMessages-examples }
+
+```yaml title="Show special message for pull-image process (all flows), but default for the rest"
+preparationMessages:
+  - id: ^pull-image$
+    # {{.image}} is NOT part of the common set of properties of
+    # a Preparation Message it is specific to this message.
+    # Please visit the details of each Preparation Message type
+    # for details.
+    start: "Going to download image {{.image}}..."
+    update: "\rGoing to download image {{.image}}... {{.percentage | printf `%.0f%%`}}"
+    end: "\rImage {{.image}} downloaded.\n"
+    error: "\rFailed to download image {{.image}}.\n"
+  - {} # Entry with all default values as mentioned above
+```
+
+```yaml title="Disable messages completely, for all preparation processes"
+preparationMessages:
+  - start: ""
+    update: ""
+    end: ""
+    error: ""
+```
+
+
+
 ## Compatibility
 
 | <<dist("linux")>> | <<dist("windows")>> |
diff --git a/docs/reference/context/alternative-binary.md b/docs/reference/context/alternative-binary.md
new file mode 100644
index 0000000..e7b2795
--- /dev/null
+++ b/docs/reference/context/alternative-binary.md
@@ -0,0 +1,29 @@
+---
+description: In cases when Bifröst needs to obtain an alternative variant of its binaries, this context provides the required information.
+---
+
+# Context Alternative Binary
+
+In cases when Bifröst needs to obtain an alternative variant of its binaries, this context provides the required information.
+
+## Properties
+
+<<property("os", "string")>>
+
+Holds the name of the operating system, such as `linux` or `windows`.
+
+<<property("arch", "string")>>
+
+Holds the name of the architecture, such as `amd64` or `arm64`.
+
+<<property("version", "string")>>
+
+Holds the actual version, such as `<<release_name()>>`.
+
+<<property("ext", "string")>>
+
+Holds the extension for the target binary, such as `<empty>` or `.exe`.
+
+<<property("packageExt", "string")>>
+
+Holds the extension for the package, such as `.tgz` or `.zip`.
diff --git a/docs/reference/context/authorization.md b/docs/reference/context/authorization.md
index c16dbb8..c63ae24 100644
--- a/docs/reference/context/authorization.md
+++ b/docs/reference/context/authorization.md
@@ -14,6 +14,7 @@ There are more specialized variants of the authorization available, based on whi
 | [Local](#local)                | [Local](../authorization/local.md)                |
 | [OpenID Connect (OIDC)](#oidc) | [OpenID Connect (OIDC)](../authorization/oidc.md) |
 | [Simple](#simple)              | [Simple](../authorization/simple.md)              |
+| [None](#none)                  | [None](../authorization/none.md)                  |
 
 ## Htpasswd
 
@@ -62,3 +63,11 @@ Is the result of a successful authorization via [Simple authorization](../author
 <<property("entry", "Simple Entry", "simple-entry.md", id_prefix="simple-", heading=4)>>
 
 Holds a representation of the authorized record of [Simple authorization entries](../authorization/simple.md#property-entries).
+
+## None
+
+Is the result of a successful authorization via [None authorization](../authorization/none.md).
+
+### Properties
+
+_None._
diff --git a/docs/reference/context/core.md b/docs/reference/context/core.md
new file mode 100644
index 0000000..c5b59f1
--- /dev/null
+++ b/docs/reference/context/core.md
@@ -0,0 +1,11 @@
+---
+description: How to access core context information within Bifröst.
+---
+
+# Context Core
+
+Represents the core of Bifröst.
+
+## Properties
+
+This context does not provide any kind of properties; but all functions can be used.
diff --git a/docs/reference/context/local-user.md b/docs/reference/context/local-user.md
index ae1dbbb..da90c04 100644
--- a/docs/reference/context/local-user.md
+++ b/docs/reference/context/local-user.md
@@ -28,11 +28,11 @@ The primary group of the user.
 
 Shortcut for [`group.gid`](#property-group).
 
-<<property_with_holder("groups", "Array", None, "Local Group", "local-group.md")>>
+<<property("groups", array_ref("Local Group", "local-group.md"))>>
 
 The groups (do not confuse with the [primary group](#property-group)) of the user.
 
-<<property_with_holder("gids", "Array", None, "uint32")>>
+<<property("gids", array_ref("uint32"))>>
 
 Shortcut for [`groups.*.gid`](#property-groups).
 
diff --git a/docs/reference/context/preparation-process.md b/docs/reference/context/preparation-process.md
new file mode 100644
index 0000000..0e0a166
--- /dev/null
+++ b/docs/reference/context/preparation-process.md
@@ -0,0 +1,42 @@
+---
+description: How to access context information of a Preparation Process of Bifröst.
+---
+
+# Context Preparation Process
+
+Holds the information about a [Preparation Process](../connection/ssh.md#preparationMessages) of Bifröst.
+
+## Properties
+
+<<property("id", "string")>>
+
+Each preparation process has its own unique ID (like [`pull-image`](../environment/docker.md#preparationProcess-pull-image) of the [docker environment](../environment/docker.md)).
+
+Please refer the documentation of the supported [environments](../environment/index.md) for their preparation process kinds.
+
+<<property("flow", "string")>>
+
+Holds the [name of flow](../flow.md#property-name) which context holds this preparation process.
+
+<<property("progress", "float32", optional=True)>>
+
+In case of update events, this holds the current progress of the whole process in `0.0` to `1.0`.
+
+<<property("percentage", "float32", optional=True)>>
+
+Same as [`progress`](#property-progress) but multiplied with `100.0` to be able to be used directly as percentage value. Therefore, the value can be `0.0` to `100.0`.
+
+<<property("error", "any", optional=True)>>
+
+In case of error events, this holds the full error information.
+
+!!! danger
+     Should usually not be displayed to end-users because it can contain sensitive system information which should only be exposed inside of log files.
+
+     This property should only be used for evaluation what should be displayed instead of displaying itself.
+
+<<property("*", "any", optional=True)>>
+
+Each preparation process can provide other information, like [`image` in case of a docker `pull-image` process](../environment/docker.md#preparationProcess-pull-image-property-image).
+
+Please refer the documentation of the supported [environments](../environment/index.md) for their process kinds.
diff --git a/docs/reference/data-type.md b/docs/reference/data-type.md
index b90674d..cbefeb3 100644
--- a/docs/reference/data-type.md
+++ b/docs/reference/data-type.md
@@ -23,6 +23,19 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC80lm5FQbbyRUut6RwZJRbxTLO3W4f08ITDi9fA3+jx
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDIGYzqJpPf3shQVGo98xMdl5S4LJmWme3i+sPcYseRrKziAWWGc8xzLUGnRwVe5X5v7J+IaHZ0dpnelylbnDwEvQTX+8gZybcL8RpS6u5dKqmKTv12SqcucpGStQ3O0Ec3MnRKEeMoJXIdqIVxuXxC8863H42KzkBvDjZn4qasF8IOVpGSC4+i93bNKScN6epQYzKcPCmZSSAnZJPgih0y1Z6+yNOJd+6PAFXmhBOh7yU0Ypne9szj/6o3YrPuNUj762CZyjg7ivQI/DvxwnUA2X8dnb2pyD4CGrr6YduWMl2xqUEDerNVaPc+I63QR8gIUYYmAs5uQwrDI4U0aWpC7erLMsNRa8C+YUdX+rV2+lJWSH8/k2NGrT1FoG5PWHmZTIe4juKIlAArzDAE6shauM3j4b4YLhly6mySXxT9m+EPtcrZjdEg76/0FylFUH70dx0Wf7lt50cLQIoXCJVovp/w95J6FVMYACl1y/sbDzmirg2PQkqkrr3MZnNY88jI/OuyZYAHNIjMkbriaFIkFBK4epGhsIIpsArPS8ZGZTQNBrrYWF+pf8JvJ1NaoLP+JKUP/A7l1KsqCKK3sWIRY7u8n8McK0VQMig4duHHtZ+aUGhZd/+m19UG1gg7QPUffZQM0RIPWWcsklrmlvzBqVcxgHXkZOoFqzc9WyewWQ== me-legacy@foo.tld
 ```
 
+## Docker Pull Credentials
+To pull from an OCI/Docker image registry there can be credentials required. In these cases usually they have to be provided in this format.
+
+Bifröst accept them in the following formats:
+
+1. Base64 URL encoded JSON of format `{"username":"<username>","password":"<password>"}` or `{"auth":"<base64 encoded auth token>"}`
+2. JSON of format `{"username":"<username>","password":"<password>"}` or `{"auth":"<base64 encoded auth token>"}` ... which will be:
+    1. base64 URL encoded by Bifröst. -> result will be as 1.
+3. A bare auth token ... which will be:
+    1. base64 URL encoded,
+    2. put into `{"auth":"<encoded bare auth token>"}` JSON and
+    3. finally base64 URL encoded by Bifröst. -> result will be as 1.
+
 ## DSA Restriction
 Can be one of:
 
@@ -92,6 +105,16 @@ Socket address in format <code>\[&lt;[Host](#host)&gt;]:&lt;port&gt;</code>.
 ## Password
 Represents an encoded or plain password that can be evaluated if it does match a requested one.
 
+## Password Type
+Can be one of:
+* `plain`
+* `bcrypt`
+
+## Pull Policy
+Can be one of:
+* `ifAbsend`
+* `always`
+
 ## Regex
 Regular expression of [Go flavor](https://pkg.go.dev/regexp). You can play around with it at [regex.com](https://regex101.com/r/fRdVOl/1).
 
@@ -109,3 +132,6 @@ Can be one of:
 The public variant of an [SSH keypair](https://wiki.archlinux.org/title/SSH_keys) of a user.
 
 Please refer to the [good documentation at GitHub how to create SSH (public) keys](https://docs.github.com/de/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent).
+
+## URL
+Represents a classical [URL](https://en.wikipedia.org/wiki/URL) to reference resources (for example) in the internet, like [https://bifroest.engity.org](https://bifroest.engity.org).
diff --git a/docs/reference/environment/docker.md b/docs/reference/environment/docker.md
new file mode 100644
index 0000000..0065e48
--- /dev/null
+++ b/docs/reference/environment/docker.md
@@ -0,0 +1,209 @@
+---
+description: When using Docker environments, each user session runs in a separate Docker container.
+toc_depth: 5
+---
+
+# Docker environment
+
+When using Docker environments, each user session runs in a separate Docker container. This is in contrast to the [local environment](local.md), where each user session runs on the same host as Bifröst.
+
+This is useful if you explicitly do not want to give users access to the host itself, but to environments where they can work with defined toolsets. Especially if you want to create demo or training environments.
+
+But also if you want to set up a [Bastion/Jump host](../../usecases.md#bastion), where a user can jump from this server to another network, this can be very helpful. In this case, using different [networks](#property-networks) can be beneficial.
+
+## Configuration {: #configuration}
+
+<<property("type", "Environment Type", default="docker", required=True)>>
+Has to be set to `docker` to enable the docker environment.
+
+<<property("loginAllowed", "bool", template_context="../context/authorization.md", default=True)>>
+Has to be true (after being evaluated) that the user is allowed to use this environment.
+
+<h4 id="property-loginAllowed-examples">Examples</h4>
+
+1. Require that the existing [local user](../authorization/local.md) has the group `ssh`:
+   ```yaml
+   loginAllowed: |
+      {{ or
+          (.authorization.user.group.name | eq "ssh" )
+          (.authorization.user.groups     | firstMatching `{{.name | eq "ssh"}}`)
+      }}
+   ```
+
+<<property("host", "string", template_context="../context/authorization.md", default="{{ env `DOCKER_HOST` }}")>>
+URL how to connect to the [API endpoint of the docker compatible daemon](https://docs.docker.com/reference/api/engine/latest/).
+
+Accepted protocols are:
+
+1. `http`
+2. `https`
+3. `tcp`
+4. `unix` (only supported on unix based systems)
+5. `npipe` (only supported on Windows)
+
+If this variable is empty (which can be also the case if <code>{{ env \`DOCKER_HOST\` }}</code> evaluates to empty, because the environment variable is not set), the system specific connection will be chosen:
+
+* Unix (such as Linux): `unix:///var/run/docker.sock`
+* Windows: `npipe:////./pipe/docker_engine`
+
+<<property("apiVersion", "string", template_context="../context/authorization.md", default="{{ env `DOCKER_API_VERSION` }}")>>
+Defines which version of Docker API should be chosen for communication. In doubt leave this blank.
+
+<<property("certPath", "File path", "../data-type.md#file-path", template_context="../context/authorization.md", default="{{ env `DOCKER_CERT_PATH` }}")>>
+Is a directory which should contain the following files:
+
+* `key.pem`: Private key Bifröst should connect to the Docker API with.
+* `cert.pem` Certificate Bifröst should present when connect to the Docker API.
+* `ca.pem`: Certificate authorities to check the certificate of the Docker API Host against.
+
+If this variable is empty (which can be also the case if <code>{{ env \`DOCKER_CERT_PATH\` }}</code> evaluates to empty) and [`tlsVerify`](#property-tlsVerify) is set to `false`, all Docker API Hosts are accepted.
+
+<<property("tlsVerify", "bool", template_context="../context/authorization.md", default="{{ env `DOCKER_TLS_VERIFY` | ne `` }}")>>
+If this variable is `false` (which can be also the case if <code>{{ env \`DOCKER_TLS_VERIFY\` }}</code> evaluates to empty), all Docker API Hosts are accepted.
+
+!!! danger
+     Setting this to `false` is only recommend, if connecting to the local socket connection (on the same machine - see [`host`'s default behavior](#property-host)).
+
+<<property("image", "string", template_context="../context/authorization.md", default="alpine")>>
+Which OCI/Docker image should be used for this environment.
+
+Everything available within this image will be also available to the user who is connecting to the container using this image. Therefore, you should consider to creating your custom images if you need additional features like [`kubectl`](https://kubernetes.io/docs/reference/kubectl/), [`skopeo`](https://github.com/containers/skopeo), ... and use this one here.
+
+This image needs to contain a valid [shell executable](#property-shellCommand).
+
+[`ENTRYPOINT`](https://docs.docker.com/reference/dockerfile/#entrypoint) and [`CMD`](https://docs.docker.com/reference/dockerfile/#cmd) settings of the image will be ignored.
+
+<<property("imagePullPolicy", "Pull Policy", "../data-type.md#pull-policy", template_context="../context/authorization.md", default="ifAbsent")>>
+Defines what should happen if the container starts with the required image of the container.
+
+If the image needs to be pulled, it will trigger the [`image-pull` preparation process](#preparationProcess-pull-image).
+
+<<property("imagePullCredentials", "Docker Pull Credentials", "../data-type.md#docker-pull-credentials", template_context="../context/authorization.md")>>
+Defines credentials which should be used to pull the defined [`image`](#property-image).
+
+<<property("networks", array_ref("string"), template_context="../context/authorization.md", default=["default"])>>
+Defines the container networks this container should be connected to.
+
+Empty always defaults to `["default"]`.
+
+!!! note
+     As long [`impPublishHost`](#property-impPublishHost) isn't set, the **first** network should be always reachable by Bifröst itself. This can be either the case if Bifröst itself runs inside of Docker (Bifröst in Docker) or it runs on the host machine and there is a valid route (which is the default Linux native, but not on Docker/Podman for Desktop).
+
+<<property("volumes", array_ref("string"), template_context="../context/authorization.md")>>
+Defines which volumes should be mounted into the container. Each entry is an individual mount statement.
+
+This is the equivalent of `-v`/`--volume` flag of Docker. See [Bind mounts documentation of Docker](https://docs.docker.com/engine/storage/volumes/) about the syntax of these entries.
+
+We recommend to use [`mounts`](#property-mounts) instead, because it is easier to understand. `volumes` is the older version of the notation and known by experienced users.
+
+<<property("mounts", array_ref("string"), template_context="../context/authorization.md")>>
+Defines which volumes should be mounted into the container. Each entry is an individual mount statement.
+
+This is the equivalent of `--mount` flag of Docker. See [Bind mounts documentation of Docker](https://docs.docker.com/engine/storage/volumes/) about the syntax of these entries.
+
+<<property("capabilities", array_ref("string"), template_context="../context/authorization.md")>>
+List of Unix kernel capabilities to be added to the container. This enables a more fine grained version in contrast to give all capabilities to the container with [`privileged`](#property-privileged) = `true`.
+
+Does only work on Unix based systems.
+
+<<property("privileged", "bool", template_context="../context/authorization.md", default=False)>>
+If this is set to `true` this container will have all capabilities of the system.
+
+!!! danger
+     Only enable this feature if you really need this, and you know what you're doing.
+
+<<property("dnsServers", array_ref("string"), template_context="../context/authorization.md")>>
+Defines a list of external DNS server the container should use.
+
+<<property("dnsSearch", array_ref("string"), template_context="../context/authorization.md")>>
+Defines custom DNS search domains for the container.
+
+<<property("shellCommand", array_ref("string"), template_context="../context/authorization.md", default="<os specific>")>>
+The shell which should be used to execute the user into.
+
+If not defined, the following command will be used:
+
+* Linux: `["/bin/sh"]`
+* Windows: `["C:\WINDOWS\system32\cmd.exe"]`
+
+<<property("execCommand", array_ref("string"), template_context="../context/authorization.md", default="<os specific>")>>
+If execute is used, this is the command prefix which will used for the command.
+
+If not defined, the following command will be used:
+
+* Linux: `["/bin/sh", "-c"]`
+* Windows: `["C:\WINDOWS\system32\cmd.exe", "/C"]`
+
+<<property("sftpCommand", array_ref("string"), template_context="../context/authorization.md", default="<bifroest sftp-server>")>>
+Defines the sftp server command which should be used. Usually you should not be required to modify this, because by default Bifröst is handling this by itself.
+
+<<property("directory", "File Path", "../data-type.md#file-path", template_context="../context/authorization.md")>>
+Defines the working directory of the initial process inside the container for each execution.
+
+If not defined the value [`WORKDIR`](https://docs.docker.com/reference/dockerfile/#workdir) will be used. If this is absent, too: `/`.
+
+<<property("user", "string", template_context="../context/authorization.md")>>
+Defines the user will run with inside the container.
+
+If not defined the value [`USER`](https://docs.docker.com/reference/dockerfile/#user) will be used. If this is absent, too: `root`.
+
+<<property("banner", "string", template_context="../context/authorization.md", default="")>>
+Will be displayed to the user upon connection to its environment.
+
+<h4 id="property-banner-examples">Examples</h4>
+
+1. If [local user](../authorization/local.md) is used, show its name in a message:
+   ```yaml
+   banner: "Hello, {{.authorization.user.name}}!\n"
+   ```
+2. If [users authorized via OIDC](../authorization/oidc.md) is used, show its name in a message:
+   ```yaml
+   banner: "Hello, {{.authorization.idToken.name}}!\n"
+   ```
+
+<<property("portForwardingAllowed", "bool", template_context="../context/authorization.md", default=True)>>
+If `true`, users are allowed to use SSH's port forwarding mechanism.
+
+<<property("impPublishHost", "string", template_context="../context/authorization.md")>>
+If this property is set, the port of the IMP process will be not just exposed on the container network, but also on this host.
+
+At this address Bifröst will then connect to the IMP process inside the container.
+
+!!! warning
+     To set this property makes only sense as long you have a firewall in place, which prevents external attackers to connect to the host ports, and you have no other choice. Usually Bifröst can connect via the container networks to IMP directly (see [`networks`](#property-networks)).
+
+This is usually required, if you run Bifröst on a Docker/Podman for Desktop installation (such as on Windows or macOS) where the Docker daemon does not run on the host directly, but inside virtual machine.
+
+## Preparation Processes {: #preparationProcesses }
+
+If events about preparation processes are emitted by this environment, they are picked up by connections (like [SSH](../connection/ssh.md#preparationMessages)) and handled.
+
+The docker environment emits the following processes:
+
+### `pull-image` {: #preparationProcess-pull-image }
+
+In cases if an [image](#property-image) needs to be pulled, either it does not exist or [`imagePullPolicy`](#property-imagePullPolicy) is to [`always`](../data-type.md#pull-policy), the image pull process starts. As this will block the user interaction with its session, this process event is emitted. It makes it possible to show the progress of download to the user.
+
+#### Properties
+
+<<property("image", "string", id_prefix="preparationProcess-pull-image-", heading=5)>>
+Holds the tag of the image to be downloaded.
+
+
+### Examples {: #examples}
+
+1. Simple:
+   ```yaml
+   type: docker
+   ```
+2. With ubuntu image:
+   ```yaml
+   type: docker
+   image: ubuntu
+   ```
+
+## Compatibility
+
+| <<dist("linux")>> | <<dist("windows")>> |
+| - | - |
+| <<compatibility_editions(True,True,"linux")>> | <<compatibility_editions(True,None,"windows")>> |
diff --git a/docs/reference/environment/dummy.md b/docs/reference/environment/dummy.md
new file mode 100644
index 0000000..ae026b5
--- /dev/null
+++ b/docs/reference/environment/dummy.md
@@ -0,0 +1,51 @@
+---
+description: An environment created for demonstration purposes, it simply prints a message and exists immediately.
+toc_depth: 5
+---
+
+# Dummy environment
+
+An environment created for demonstration purposes, it simply prints a message and exists immediately.
+
+This feature is usually only makes sense for cases where you want to create dummy configurations of Bifröst to demonstrate some functionality, like we're utilizing it in our demonstration configurations: [contrib/configurations/dummy-windows.yaml](<<asset_url("contrib/configurations/dummy-windows.yaml")>>).
+
+
+## Configuration {: #configuration}
+
+<<property("type", "Environment Type", default="dummy", required=True)>>
+Has to be set to `dummy` to enable the dummy environment.
+
+<<property("banner", "string", template_context="../context/authorization.md", default="")>>
+Will be displayed to the user upon connection to its environment.
+
+<h4 id="property-banner-examples">Examples</h4>
+
+1. If [simple user](../authorization/simple.md) is used, show its name in a message:
+   ```yaml
+   banner: "Hello, {{.authorization.entry.name}}!\n"
+   ```
+2. If [users authorized via OIDC](../authorization/oidc.md) is used, show its name in a message:
+   ```yaml
+   banner: "Hello, {{.authorization.idToken.name}}!\n"
+   ```
+
+<<property("exitCode", "int64", template_context="../context/authorization.md", default=0)>>
+After [`banner`](#property-banner) was printed to the user, the environment will exit with this code.
+
+### Examples {: #examples}
+
+1. Simple:
+   ```yaml
+   type: simple
+   ```
+2. With message:
+   ```yaml
+   type: simple
+   banner: "Hello, {{.authorization.idToken.name}}!\n"
+   ```
+
+## Compatibility
+
+| <<dist("linux")>> | <<dist("windows")>> |
+| - | - |
+| <<compatibility_editions(True,True,"linux")>> | <<compatibility_editions(True,None,"windows")>> |
diff --git a/docs/reference/environment/index.md b/docs/reference/environment/index.md
index 579b044..dcf0d39 100644
--- a/docs/reference/environment/index.md
+++ b/docs/reference/environment/index.md
@@ -8,7 +8,9 @@ Bifröst executes user sessions within environments. These environments can eith
 
 ## Types
 
-1. `local`: [Local](local.md)
+1. `docker`: [Docker](docker.md)
+2. `local`: [Local](local.md)
+3. `dummy`: [Dummy](dummy.md)
 
 ## Examples
 
diff --git a/docs/reference/environment/local.md b/docs/reference/environment/local.md
index 5e5e372..2a76107 100644
--- a/docs/reference/environment/local.md
+++ b/docs/reference/environment/local.md
@@ -17,8 +17,8 @@ The Linux variant is only supported by Linux based operating systems.
 
 It can run as the Bifröst user itself, but can also [impersonate](https://en.wiktionary.org/wiki/impersonate) another user.
 
-!!! Note
-    If impersonating another user Bifröst is running at, root permissions are required.
+!!! note
+     If impersonating another user Bifröst is running at, root permissions are required.
 
 ### User requirement {: #linux-user-requirement}
 
@@ -33,7 +33,7 @@ See the evaluation matrix of [`createIfAbsent`](#linux-property-createIfAbsent-e
 <<property("type", "Environment Type", default="local", required=True, id_prefix="linux-", heading=4)>>
 Has to be set to `local` to enable the local environment.
 
-<<property_with_holder("loginAllowed", "Bool Template", "../templating/index.md#bool", "Authorization", "../context/authorization.md", default=True, id_prefix="linux-", heading=4)>>
+<<property("loginAllowed", "bool", template_context="../context/authorization.md", default=True, id_prefix="linux-", heading=4)>>
 Has to be true (after being evaluated) that the user is allowed to use this environment.
 
 ##### Examples {: #linux-property-loginAllowed-examples}
@@ -56,7 +56,7 @@ Has to be true (after being evaluated) that the user is allowed to use this envi
       }}
    ```
 
-<<property_with_holder("name", "String Template", "../templating/index.md#string", "Authorization", "../context/authorization.md", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
+<<property("name", "string", template_context="../context/authorization.md", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
 The _username_ the user should have. Empty means this requirement won't be evaluated or applied (in case of creation/modification of a user).
 
 ##### Examples {: #linux-property-name-examples}
@@ -73,7 +73,7 @@ The _username_ the user should have. Empty means this requirement won't be evalu
    name: "foobar"
    ```
 
-<<property_with_holder("displayName", "String Template", "../templating/index.md#string", "Authorization", "../context/authorization.md", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
+<<property("displayName", "string", template_context="../context/authorization.md", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
 The display name (or _title_ or [_GECOS_](https://en.wikipedia.org/wiki/Gecos_field)) the user should have.
 
 ##### Examples {: #linux-property-name-examples}
@@ -87,7 +87,7 @@ The display name (or _title_ or [_GECOS_](https://en.wikipedia.org/wiki/Gecos_fi
    displayName: "Foobar"
    ```
 
-<<property_with_holder("uid", "Uint32 Template", "../templating/index.md#uint32", "Authorization", "../context/authorization.md", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
+<<property("uid", "uint32", template_context="../context/authorization.md", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
 The [_UID_ (user identifier)](https://en.wikipedia.org/wiki/User_identifier) the user should have. Empty means this requirement won't be evaluated or applied (in case of creation/modification of a user).
 
 ##### Examples {: #linux-property-uid-examples}
@@ -112,7 +112,7 @@ The primary group the user should have. Empty means this requirement won't be ev
      name: "oidc"
    ```
 
-<<property_with_holder("groups", "Array", None, "Group", "#linux-group", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
+<<property("groups", array_ref("Group", "#linux-group"), id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
 The groups (do not confuse with the [primary group](#linux-property-group)) the user should have. Empty means this requirement won't be evaluated or applied (in case of creation/modification of a user).
 
 ##### Examples {: #linux-property-groups-examples}
@@ -123,16 +123,16 @@ The groups (do not confuse with the [primary group](#linux-property-group)) the
      - name: "oidc"
    ```
 
-<<property_with_holder("shell", "String Template", "../templating/index.md#string", "Authorization", "../context/authorization.md", default="/bin/sh", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
+<<property("shell", "File Path", "../data-type.md#file-path", template_context="../context/authorization.md", default="/bin/sh", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
 The [shell](https://en.wikipedia.org/wiki/Shell_(computing)) the user should have. Not defined means this requirement won't be evaluated or applied (in case of creation/modification of a user).
 
-<<property_with_holder("homeDir", "String Template", "../templating/index.md#string", "Authorization", "../context/authorization.md", default="/home/<user.name>", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
+<<property("homeDir", "File Path", "../data-type.md#file-path", template_context="../context/authorization.md", default="/home/<user.name>", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
 The home directory the user should have. Not defined means this requirement won't be evaluated or applied (in case of creation/modification of a user).
 
-<<property_with_holder("skel", "String Template", "../templating/index.md#string", "Authorization", "../context/authorization.md", default="/etc/skel", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
+<<property("skel", "File Path", "../data-type.md#file-path", template_context="../context/authorization.md", default="/etc/skel", id_prefix="linux-", heading=4, requirement="linux-user-requirement")>>
 If a new user needs to be created in a directory on the Bifröst hosts, it will receive its initial files of its [home directory](#linux-property-homeDir) from (= user's home skeleton/template directory).
 
-<<property_with_holder("createIfAbsent", "Bool Template", "../templating/index.md#bool", "Authorization", "../context/authorization.md", default=false, id_prefix="linux-", heading=4)>>
+<<property("createIfAbsent", "string", template_context="../context/authorization.md", default=false, id_prefix="linux-", heading=4)>>
 Will create the local user if it does not exist to match the provided requirements (see below). If this property is `false` the user has to exist, otherwise the execution will fail and the connection will be closed immediately.
 
 This property (together with [`updateIfDifferent`](#linux-property-updateIfDifferent)) has to be `true` if you're using authorizations like [OIDC](../authorization/oidc.md), where the user is not expected to exist locally, and you don't want to create each user individually.
@@ -144,7 +144,7 @@ This property (together with [`updateIfDifferent`](#linux-property-updateIfDiffe
 | Exists, but does not match | _Does not apply_ | _Does not apply_ |
 | Does not exist | :octicons-x-circle-24: Rejected | :octicons-check-circle-24: Created and accepted |
 
-<<property_with_holder("updateIfDifferent", "Bool Template", "../templating/index.md#bool", "Authorization", "../context/authorization.md", default=false, id_prefix="linux-", heading=4)>>
+<<property("updateIfDifferent", "bool", template_context="../context/authorization.md", default=false, id_prefix="linux-", heading=4)>>
 If an existing user does not match the provided requirements (see below) and the property is `true`, this user is asked to match the requirements.
 
 This property (together with [`createIfAbsent`](#linux-property-createIfAbsent)) should be `true` if you're using authorizations like [OIDC](../authorization/oidc.md), where the user is not expected to exist locally and you don't want to create each user individually.
@@ -156,7 +156,7 @@ This property (together with [`createIfAbsent`](#linux-property-createIfAbsent))
 | Exists but does not match | :octicons-x-circle-24: Rejected | :octicons-check-circle-24: Modified and accepted |
 | Does not exist | _Does not apply_ | _Does not apply_ |
 
-<<property_with_holder("banner", "String Template", "../templating/index.md#string", "Authorization", "../context/authorization.md", default="", id_prefix="linux-", heading=4)>>
+<<property("banner", "string", template_context="../context/authorization.md", default="", id_prefix="linux-", heading=4)>>
 Will be displayed to the user upon connection to its environment.
 
 ##### Examples {: #linux-property-banner-examples}
@@ -169,7 +169,7 @@ Will be displayed to the user upon connection to its environment.
    banner: "Hello, {{.authorization.idToken.name}}!\n"
    ```
 
-<<property_with_holder("portForwardingAllowed", "Bool Template", "../templating/index.md#bool", "Authorization", "../context/authorization.md", default=true, id_prefix="linux-", heading=4)>>
+<<property("portForwardingAllowed", "bool", template_context="../context/authorization.md", default=true, id_prefix="linux-", heading=4)>>
 If `true`, users are allowed to use SSH's port forwarding mechanism.
 
 <<property("dispose", "Dispose", "#linux-dispose", id_prefix="linux-", heading=4)>>
@@ -213,7 +213,7 @@ Defines what happens if an environment is disposed.
    ```
 ### Group {: #linux-group}
 
-<<property_with_holder("name", "String Template", "../templating/index.md#string", "Authorization", "../context/authorization.md", id_prefix="linux-group-", heading=4)>>
+<<property("name", "string", template_context="../context/authorization.md", id_prefix="linux-group-", heading=4)>>
 The _name_ the group should have. Empty means this requirement won't be evaluated or applied (in case of creation/modification of a user).
 
 ##### Examples {: #linux-group-property-name-examples}
@@ -224,44 +224,44 @@ The _name_ the group should have. Empty means this requirement won't be evaluate
    name: "oidc"
    ```
 
-<<property_with_holder("gid", "Uint32 Template", "../templating/index.md#uint32", "Authorization", "../context/authorization.md", id_prefix="linux-group-", heading=4)>>
+<<property("gid", "uint32", template_context="../context/authorization.md", id_prefix="linux-group-", heading=4)>>
 The _GID_ (group identifier) the group should have. Empty means this requirement won't be evaluated or applied (in case of creation/modification of a user).
 
 ##### Examples {: #linux-group-property-gid-examples}
 
 1. Always use `123`
    ```yaml
-   name: 123
+   gid: 123
    ```
 
 ### Dispose {: #linux-dispose}
 
 Defines the behavior of an environment on disposal (cleanup).
 
-<<property_with_holder("deleteManagedUser", "Bool Template", "../templating/index.md#bool", "Authorization", "../context/authorization.md", default=True, id_prefix="linux-dispose-", heading=4)>>
+<<property("deleteManagedUser", "bool", template_context="../context/authorization.md", default=True, id_prefix="linux-dispose-", heading=4)>>
 If `true` the environment will also delete users, created/managed by it. Usually, if [`createIfAbsent`](#linux-property-createIfAbsent) and [`updateIfDifferent`](#linux-property-updateIfDifferent) is both `false` this has no effect.
 
-<<property_with_holder("deleteManagedUserHomeDir", "Bool Template", "../templating/index.md#bool", "Authorization", "../context/authorization.md", default=True, id_prefix="linux-dispose-", heading=4)>>
+<<property("deleteManagedUserHomeDir", "bool", template_context="../context/authorization.md", default=True, id_prefix="linux-dispose-", heading=4)>>
 In combination with [`deleteManagedUser`](#linux-dispose-property-deleteManagedUser), if `true` the environment will **also** delete the user's home directory.
 
-<<property_with_holder("killManagedUserProcesses", "Bool Template", "../templating/index.md#bool", "Authorization", "../context/authorization.md", default=True, id_prefix="linux-dispose-", heading=4)>>
+<<property("killManagedUserProcesses", "bool", template_context="../context/authorization.md", default=True, id_prefix="linux-dispose-", heading=4)>>
 In combination with [`deleteManagedUser`](#linux-dispose-property-deleteManagedUser), if `true` the environment will **also** kill **all** user's running processes.
 
 ## Windows
 
 The Windows variant is only supported by Windows 7+ based operating systems.
 
-!!! Warning
-In contrast to the [Linux](#linux) version this variant **CANNOT** [impersonate](https://en.wiktionary.org/wiki/impersonate). As a consequence, each user session always executes as the user the Bifröst process itself runs with.
+!!! warning
+     In contrast to the [Linux](#linux) version this variant **CANNOT** [impersonate](https://en.wiktionary.org/wiki/impersonate). As a consequence, each user session always executes as the user the Bifröst process itself runs with.
 
-    Impersonating on a Windows machine requires either full credentials (password) or another running process the session tokens can be cloned from. As both conflicts how we intend Bifröst to work, both solutions leave a lot of use-cases behind. Since it is very "hacky", we decided to stick with the simple approach.
+     Impersonating on a Windows machine requires either full credentials (password) or another running process the session tokens can be cloned from. As both conflicts how we intend Bifröst to work, both solutions leave a lot of use-cases behind. Since it is very "hacky", we decided to stick with the simple approach.
 
 ### Configuration {: #windows-configuration}
 
 <<property("type", "Environment Type", default="local", required=True, id_prefix="windows-", heading=4)>>
 Has to be set to `local` to enable the local environment.
 
-<<property_with_holder("loginAllowed", "Bool Template", "../templating/index.md#bool", "Authorization", "../context/authorization.md", default=True, id_prefix="windows-", heading=4)>>
+<<property("loginAllowed", "bool", template_context="../context/authorization.md", default=True, id_prefix="windows-", heading=4)>>
 Has to be true (after being evaluated) that the user is allowed to use this environment.
 
 ##### Examples {: #windows-property-loginAllowed-examples}
@@ -274,7 +274,7 @@ Has to be true (after being evaluated) that the user is allowed to use this envi
          (.authorization.idToken.tid    | eq  "my-great-tenant-uuid")
       }}
    ```
-<<property_with_holder("banner", "String Template", "../templating/index.md#string", "Authorization", "../context/authorization.md", "", id_prefix="windows-", heading=4)>>
+<<property("banner", "string", template_context="../context/authorization.md", id_prefix="windows-", heading=4)>>
 Will be displayed to the user upon connection to its environment.
 
 ##### Examples {: #windows-property-banner-examples}
@@ -283,18 +283,18 @@ Will be displayed to the user upon connection to its environment.
    banner: "Hello, {{.authorization.idToken.name}}!\n"
    ```
 
-<<property_with_holder("shellCommand", "Strings Template", "../templating/index.md#string", "Authorization", "../context/authorization.md", ["C:\\WINDOWS\\system32\\cmd.exe"], id_prefix="windows-", heading=4)>>
+<<property("shellCommand", "string", template_context="../context/authorization.md", default=["C:\\WINDOWS\\system32\\cmd.exe"], id_prefix="windows-", heading=4)>>
 The shell which is used to execute the user's session.
 
-<<property_with_holder("execCommandPrefix", "Strings Template", "../templating/index.md#string", "Authorization", "../context/authorization.md", [ "C:\\WINDOWS\\system32\\cmd.exe", "/C" ], id_prefix="windows-", heading=4)>>
+<<property("execCommandPrefix", "string", template_context="../context/authorization.md", default=[ "C:\\WINDOWS\\system32\\cmd.exe", "/C" ], id_prefix="windows-", heading=4)>>
 The executor command prefix which is used when a user executes a command instead of executing into a shell.
 
 If the user will execute `ssh foo@bar.com echo "bar"` on the host `C:\WINDOWS\system32\cmd.exe /C 'echo "bar"'` will be executed.
 
-<<property_with_holder("directory", "Strings Template", "../templating/index.md#string", "Authorization", "../context/authorization.md", "<working directory of Bifröst>", id_prefix="windows-", heading=4)>>
+<<property("directory", "File Path", "../data-type.md#file-path", template_context="../context/authorization.md", default="<working directory of Bifröst>", id_prefix="windows-", heading=4)>>
 The working directory in which the command will be executed in.
 
-<<property_with_holder("portForwardingAllowed", "Bool Template", "../templating/index.md#bool", "Authorization", "../context/authorization.md", True, id_prefix="windows-", heading=4)>>
+<<property("portForwardingAllowed", "bool", template_context="../context/authorization.md", default=True, id_prefix="windows-", heading=4)>>
 If `true`, users are allowed to use SSH's port forwarding mechanism.
 
 ### Examples {: #windows-examples}
@@ -320,9 +320,9 @@ If `true`, users are allowed to use SSH's port forwarding mechanism.
        }}
    ```
 
-## Compatibility
+`## Compatibility
 
 | <<dist("linux")>> | <<dist("windows")>> |
 | - | - |
 | <<compatibility_editions(True,True,"linux")>> | <<compatibility_editions(True,None,"windows")>> |
-
+`
diff --git a/docs/reference/flow.md b/docs/reference/flow.md
index 239be54..9575fe7 100644
--- a/docs/reference/flow.md
+++ b/docs/reference/flow.md
@@ -20,7 +20,7 @@ For each configured flow, Bifröst will evaluate the following checks. If one of
 :   Defines the unique name of the flow. It will be used inside logs, as references for the stored [sessions](session/index.md), ...
 
     !!! warning
-        Changing this value afterward means to break all existing sessions.
+         Changing this value afterward means to break all existing sessions.
 
 <<property("requirement", "Requirement", "#requirement")>>
 :   See [Requirement](#requirement), below.
@@ -64,13 +64,13 @@ The requirement has to be fulfilled, even before the [authorization](#property-a
 If this property is set, the requesting name (`ssh <requesting name>@my-host.tld`) has to fulfill this regular expression. If empty everything will be included.
 
 !!! warning
-    Keep `^` and `$` to ensure a full match, otherwise it matches only a part of it.
+     Keep `^` and `$` to ensure a full match, otherwise it matches only a part of it.
 
 <<property("excludedRequestingName", "Regex", "data-type.md#regex", default="\"\"", id_prefix="requirement-", heading=4)>>
 If this property is set, the requesting name (`ssh <requesting name>@my-host.tld`) has to **NOT** fulfill this regular expression. If empty everything will be included.
 
 !!! warning
-    Keep `^` and `$` to ensure a full match, otherwise it matches only a part of it.
+     Keep `^` and `$` to ensure a full match, otherwise it matches only a part of it.
 
 ### Example {: id=requirement-example }
 
diff --git a/docs/reference/templating/index.md b/docs/reference/templating/index.md
index 7c1c52d..e4acbeb 100644
--- a/docs/reference/templating/index.md
+++ b/docs/reference/templating/index.md
@@ -8,14 +8,16 @@ In many places of the [configuration](../configuration.md) Bifröst can not only
 
 Bifröst uses the [template engine of Go](https://pkg.go.dev/text/template). A collection of rather good resources to learn can be found at [HashiCrop's Nomand Developer documentation](https://developer.hashicorp.com/nomad/tutorials/templates/go-template-syntax).
 
-In the documentation of each Bifröst's component you can find the type (like [String Template](#string) or [Bool Template](#bool)) and the corresponding [context object](../context/index.md) (like [Connection](../context/connection.md) or [Authorization](../context/authorization.md)). The result will be like:
+In the documentation of each Bifröst's component you may find the type the icon [:material-file-replace-outline:{ title="Templated with Foobar" }](index.md), followed by the corresponding [context object](../context/index.md) (like [Connection](../context/connection.md) or [Authorization](../context/authorization.md)). The result will be like:
 
-* [String Template](#string)&lt;[Authorization](../context/authorization.md)&gt;
-* [Bool Template](#bool)&lt;[Connection](../context/connection.md)&gt;
+* [:material-file-replace-outline:{ title="Templated with Authorization" data-hint-type="templated" }](index.md) [Authorization](../context/authorization.md)
+* [:material-file-replace-outline:{ title="Templated with Authorization" data-hint-type="templated" }](index.md) [Connection](../context/connection.md)
 
-## Variants
+## Base types
 
-### String {: #string}
+Each base type ([string](#string), [bool](#bool), [uint32](#uint32), ...) has a different handling in edge cases.
+
+### string {: #string}
 
 A template of type String is always rendered to a corresponding string - as it is.
 
@@ -24,13 +26,17 @@ Examples:
 * `Foo{{ "Xyz" }}Bar` or will result in `FooXyzBar`.
 * `Foo{{ 123 }}Bar` or will result in `Foo123Bar`.
 
-### Bool {: #bool}
+### bool {: #bool}
 
 A template of type Bool is always rendered into a boolean value (`true` or `false`). The following rules are evaluated to decide for either `true` or `false`:
 
 * `false`: If the value trimmed and converted to lower-cases is one of: `false`, `disabled`, `0`, `no`, `off`, &lt;empty&gt;, `nil` or `null`
 * `true`: Everything else
 
-### Uint32 {: #uint32}
+### uint32 {: #uint32}
+
+A template of type uint32 is always rendered into an unsigned integer with 32 bits value (`0` or more). An empty value is always assumed as `0`.
+
+### float32 {: #float32}
 
-A template of type Uint32 is always rendered into an unsigned integer with 32 bits value (`0` or more). An empty value is always assumed as `0`.
+A template of type float32 is always rendered into a floating point number with 32 bits value (`0.0` or more). An empty value is always assumed as `0`.
diff --git a/docs/setup/distribution.md b/docs/setup/distribution.md
index 9602e09..f52febd 100644
--- a/docs/setup/distribution.md
+++ b/docs/setup/distribution.md
@@ -16,6 +16,7 @@ On this page you'll find:
     1. [Archives](#archive)
     2. [OCI/Docker Images](#image)
 
+<div id="compatibility"></div>
 <<compatibility_matrix()>>
 > Cells express support in format of `<generic>`/`<extended>`.
 
@@ -95,9 +96,8 @@ See the [release page](<< release_url() >>) for all available downloads.
 * Windows Generic on AMD64:
     ```{.powershell title="Run elevated"}
     mkdir -Force 'C:\Program Files\Engity\Bifroest'
-    cd 'C:\Program Files\Engity\Bifroest'
     curl -sSLf -o "${Env:Temp}\bifroest.zip" <<release_asset_url("bifroest-windows-amd64-generic.zip")>>
-    Expand-Archive "${Env:Temp}\bifroest.zip" -DestinationPath .
+    Expand-Archive "${Env:Temp}\bifroest.zip" -DestinationPath 'C:\Program Files\Engity\Bifroest'
     ```
 
 ### OCI/Docker Images {: #image}
diff --git a/docs/setup/in-docker.md b/docs/setup/in-docker.md
new file mode 100644
index 0000000..e73f76f
--- /dev/null
+++ b/docs/setup/in-docker.md
@@ -0,0 +1,97 @@
+---
+description: How to install, configure and run Bifröst inside Docker.
+toc_depth: 2
+---
+
+# Installing in Docker
+
+!!! tip
+     This guide shows how to install Bifröst in Docker/Container. If you like to use Bifröst directly on your Host, see its documentation [here](on-host.md).
+
+## Before we start
+
+Be sure Bifröst is supporting your Docker host, by checking the following matrix:<br>
+
+!!! tip ""
+     Cells express support in format of `<generic>`/`<extended>`. See our [documentation of distributions of Bifröst](distribution.md) to learn more.
+
+<<compatibility_matrix(packaging="archive")>>
+
+In the majority of the cases you might run Linux or Windows on AMD64, which is supported.
+
+## Linux
+
+!!! note
+     This guide assumes you have a Linux distribution with [systemd](https://systemd.io/) running. This reflects the majority of all actual distributions, such as Ubuntu, Debian, Fedora, ...
+
+1. [Ensure you have a working docker instance installed.](https://docs.docker.com/engine/install/)
+
+2. Configure Bifröst. For example download the demo configuration and adjust it to your needs (see [documentation of configuration](../reference/configuration.md) for the documentation about it):
+   ```shell
+   sudo mkdir -p /etc/engity/bifroest/
+   sudo curl -sSLf <<asset_url("contrib/configurations/simple-inside-docker.yaml", True)>> -o /etc/engity/bifroest/configuration.yaml
+   # Adjust it to your needs
+   sudo vi /etc/engity/bifroest/configuration.yaml
+   ```
+
+3. Enable Bifröst to always run on your system, by downloading <<asset_link("contrib/systemd/bifroest-in-docker.service", "our example service configuration")>>:
+   ```shell
+   sudo curl -sSLf <<asset_url("contrib/systemd/bifroest-in-docker.service", True)>> -o /etc/systemd/system/bifroest.service
+   # Adjust it to your needs
+   sudo vi /etc/systemd/system/bifroest.service
+   ```
+
+4. Reload the systemd daemon:
+   ```shell
+   sudo systemctl daemon-reload
+   ```
+
+5. Enable and start Bifröst:
+   ```shell
+   sudo systemctl enable bifroest.service
+   sudo systemctl start bifroest.service
+   ```
+
+6. If you're using the [original demo configuration](<<asset_url("contrib/configurations/simple-inside-docker.yaml")>>), Bifröst will print a demo password to its log files while startup. You can receive it with the following command:
+   ```shell
+   docker logs bifroest
+   ```
+
+7. Now you can log in to Bifröst the first time:
+   ```shell
+   ssh demo@localhost
+   ```
+
+## Windows
+
+1. [Ensure you have a working docker instance installed.](https://docs.docker.com/engine/install/)
+
+    !!! note
+         This guide assumes you're running a Linux host of Docker on Docker for Windows (default).
+
+         Bifröst also supports Windows Containers (Windows native). You just have to adjust the path below accordingly.
+
+2. Open a Powershell Terminal with Administrator privileges.
+
+3. Configure Bifröst. For example download the demo configuration and adjust it to your needs (see [documentation of configuration](../reference/configuration.md) for the documentation about it):
+   ```powershell
+   mkdir -Force 'C:\ProgramData\Engity\Bifroest'
+   curl -sSLf <<asset_url("contrib/configurations/dummy-windows.yaml", True)>> -o 'C:\ProgramData\Engity\Bifroest\configuration.yaml'
+   # Adjust it to your needs
+   notepad 'C:\ProgramData\Engity\Bifroest\configuration.yaml'
+   ```
+
+4. Enable and start Bifröst:
+   ```shell
+   docker run -d --restart unless-stopped --name bifroest -p 22:22 -v //var/run/docker.sock:/var/run/docker.sock -v C:\ProgramData\Engity\Bifroest:/etc/engity/bifroest -v C:\ProgramData\Engity\Bifroest:/var/lib/engity/bifroest ghcr.io/engity-com/bifroest:latest run --log.colorMode=always
+   ```
+
+5. Now you can log in to Bifröst the first time:
+   ```shell
+   ssh demo@localhost
+   ```
+
+## What's next?
+
+* [Configuration details](../reference/configuration.md)
+* [Install on Host](on-host.md)
diff --git a/docs/setup/index.md b/docs/setup/index.md
index d9b64a9..4caef04 100644
--- a/docs/setup/index.md
+++ b/docs/setup/index.md
@@ -5,63 +5,28 @@ toc_depth: 2
 
 # Getting started
 
-!!! tip
-     This guide shows how to install Bifröst from [downloadable archive](distribution.md#archive). If you like to use Bifröst inside a container, see our documentation for [OCI/Docker Images](distribution.md#image).
+Bifröst is available as a binary for many different platforms, or even as an OCI/Docker image.
 
-## Installation
-
-1. Download Bifröst (see [release page](<< release_url() >>)):<br>
-
-    #### Syntax
-    ```shell
-    curl -sSLf <<release_asset_url("bifroest-<os>-<arch>-<edition>.tgz")>> | sudo tar -zxv -C /usr/bin bifroest
-    ```
-
-    #### Matrix
-
-    !!! tip ""
-        Cells express support in format of `<generic>`/`<extended>`.
+Before we get started, you need to choose your operating mode. Here are the main differences to help you decide:
 
-    <<compatibility_matrix(packaging="archive")>>
+| Criteria | [On Host](on-host.md) | [In Docker/Container](in-docker.md) |
+| -------- | ------ | ---------------- |
+| Available features | :fontawesome-solid-circle-plus: All ([depending on used edition](distribution.md)) | :fontawesome-solid-circle-plus: All ([depending on used edition](distribution.md)) |
+| [Compatibility (os/architecture)](distribution.md#compatibility) | :fontawesome-solid-circle-plus: Available for the most amount of different platforms. | :fontawesome-regular-circle: Available for the major platforms. |
+| Consumption (CPU/RAM/storage)| :fontawesome-solid-circle-plus: Lowest possible consumption. | :fontawesome-regular-circle: Meaningful overhead, caused virtualization and additional processes. |
+| Host integration | :fontawesome-solid-circle-plus: It runs directly on the host and has therefore direct access to everything on the host. | :fontawesome-solid-circle-plus: If running in [privileged mode](../reference/environment/docker.md#property-privileged) and all required devices are mounted, same as _On host_. |
+| Host isolation | :fontawesome-solid-circle-minus: Possible, but complicated and designed for it. | :fontawesome-solid-circle-plus: Maximum possible, by design. |
+| Interactions with containers | :fontawesome-regular-circle: Full, [except if interacting with Docker for Desktop](../reference/environment/docker.md#property-impPublishHost). | :fontawesome-solid-circle-plus: Full |
+| Installation effort | :fontawesome-solid-circle-plus: Minimal | :fontawesome-solid-circle-plus: Minimal |
 
-    #### Example
-    ```shell
-    curl -sSLf <<release_asset_url("bifroest-linux-amd64-extended.tgz")>> | sudo tar -zxv -C /usr/bin bifroest
-    ```
+If you're still not sure that to pick, maybe our [Use-Cases](../usecases.md) will help you.
 
-2. Configure Bifröst. For example download the demo configuration and adjust it to your needs (see [documentation of configuration](../reference/configuration.md) for the documentation about it):
-   ```shell
-   sudo mkdir -p /etc/engity/bifroest/
-   sudo curl -sSLf <<asset_url("contrib/configurations/sshd-dropin-replacement.yaml", True)>> -o /etc/engity/bifroest/configuration.yaml
-   # Adjust it to your needs
-   sudo vi /etc/engity/bifroest/configuration.yaml
-   ```
-
-3. Run Bifröst:
-   ```shell
-   sudo bifroest run
-   ```
-
-## Autostart
-
-...when the system starts.
+## Installation
 
-### systemd
+Different guides, for the different ways how to operate Bifröst:
 
-To enable Bifröst to run on every server, start where [systemd](https://wiki.archlinux.org/title/Systemd) is available, simply:
-1. Download <<asset_link("contrib/systemd/bifroest.service", "our example service configuration")>>:
-   ```shell
-   sudo curl -sSLf <<asset_url("contrib/systemd/bifroest.service", True)>> -o /etc/systemd/system/bifroest.service
-   ```
-2. Reload the systemd daemon:
-   ```shell
-   sudo systemctl daemon-reload
-   ```
-3. Enable and start Bifröst:
-   ```shell
-   sudo systemctl enable bifroest.service
-   sudo systemctl start bifroest.service
-   ```
+1. [On Host](on-host.md)
+2. [In Docker/Container](in-docker.md)
 
 ## What's next?
 
diff --git a/docs/setup/on-host.md b/docs/setup/on-host.md
new file mode 100644
index 0000000..4755219
--- /dev/null
+++ b/docs/setup/on-host.md
@@ -0,0 +1,112 @@
+---
+description: How to install, configure and run Bifröst directly on the host machine.
+toc_depth: 3
+---
+
+# Installing on host
+
+!!! tip
+     This guide shows how to install Bifröst from [downloadable archive](distribution.md#archive). If you like to use Bifröst inside Docker/Container, see our documentation for [OCI/Docker Images](in-docker.md).
+
+## Linux
+
+!!! note
+     This guide assumes you have a Linux distribution with [systemd](https://systemd.io/) running. This reflects the majority of all actual distributions, such as Ubuntu, Debian, Fedora, ...
+
+1. Download Bifröst (see [release page](<< release_url() >>)):<br>
+
+    #### Syntax
+    ```shell
+    curl -sSLf <<release_asset_url("bifroest-windows-<arch>-<edition>.tgz")>> | sudo tar -zxv -C /usr/bin bifroest
+    ```
+
+    #### Matrix
+
+    !!! tip ""
+         Cells express support in format of `<generic>`/`<extended>`. See our [documentation of distributions of Bifröst](distribution.md#linux) to learn more.
+
+    <<compatibility_matrix(os="linux", packaging="archive")>>
+
+    #### Example - Linux AMD64
+    ```shell
+    curl -sSLf <<release_asset_url("bifroest-linux-amd64-extended.tgz")>> | sudo tar -zxv -C /usr/bin bifroest
+    ```
+
+2. Configure Bifröst. For example download the demo configuration and adjust it to your needs (see [documentation of configuration](../reference/configuration.md) for the documentation about it):
+   ```shell
+   sudo mkdir -p /etc/engity/bifroest/
+   sudo curl -sSLf <<asset_url("contrib/configurations/sshd-dropin-replacement.yaml", True)>> -o /etc/engity/bifroest/configuration.yaml
+   # Adjust it to your needs
+   sudo vi /etc/engity/bifroest/configuration.yaml
+   ```
+
+3. Download <<asset_link("contrib/systemd/bifroest.service", "our example service configuration")>>:
+   ```shell
+   sudo curl -sSLf <<asset_url("contrib/systemd/bifroest.service", True)>> -o /etc/systemd/system/bifroest.service
+   ```
+
+4. Reload the systemd daemon:
+   ```shell
+   sudo systemctl daemon-reload
+   ```
+
+5. Enable and start Bifröst:
+   ```shell
+   sudo systemctl enable bifroest.service
+   sudo systemctl start bifroest.service
+   ```
+
+6. Now you can log in to Bifröst the first time:
+   ```shell
+   ssh demo@localhost
+   ```
+
+## Windows
+
+1. Open a Powershell Terminal with Administrator privileges.
+
+2. Download and extract Bifröst (see [release page](<< release_url() >>)):<br>
+
+    #### Syntax
+    ```powershell
+    curl -sSLf <<release_asset_url("bifroest-windows-<arch>-<edition>.zip")>> -o "${Env:Temp}\bifroest.zip"
+    mkdir -Force 'C:\Program Files\Engity\Bifroest'
+    Expand-Archive "${Env:Temp}\bifroest.zip" -DestinationPath 'C:\Program Files\Engity\Bifroest'
+    ```
+
+    #### Matrix
+
+    !!! tip ""
+         Cells express support in format of `<generic>`/`<extended>`. See our [documentation of distributions of Bifröst](distribution.md#windows) to learn more.
+
+    <<compatibility_matrix(os="windows", packaging="archive")>>
+
+    #### Example - Windows AMD64
+    ```powershell
+    curl -sSLf <<release_asset_url("bifroest-windows-amd64-generic.zip")>> -o "${Env:Temp}\bifroest.zip"
+    mkdir -Force 'C:\Program Files\Engity\Bifroest'
+    Expand-Archive "${Env:Temp}\bifroest.zip" -DestinationPath 'C:\Program Files\Engity\Bifroest'
+    ```
+
+3. Configure Bifröst. For example download the demo configuration and adjust it to your needs (see [documentation of configuration](../reference/configuration.md) for the documentation about it):
+   ```powershell
+   mkdir -Force 'C:\ProgramData\Engity\Bifroest'
+   curl -sSLf <<asset_url("contrib/configurations/dummy-windows.yaml", True)>> -o 'C:\ProgramData\Engity\Bifroest\configuration.yaml'
+   # Adjust it to your needs
+   notepad 'C:\ProgramData\Engity\Bifroest\configuration.yaml'
+   ```
+
+4. Enable and start Bifröst:
+   ```powershell
+   'C:\Program Files\Engity\Bifroest\bifroest.exe' service install
+   ```
+
+5. Now you can log in to Bifröst the first time:
+   ```powershell
+   ssh demo@localhost
+   ```
+
+## What's next?
+
+* [Configuration details](../reference/configuration.md)
+* [Install in Docker](in-docker.md)
diff --git a/docs/usecases.md b/docs/usecases.md
index 31df70b..20a0089 100644
--- a/docs/usecases.md
+++ b/docs/usecases.md
@@ -9,14 +9,15 @@ As Bifröst is very flexible on how it can be configured (see [configuration doc
 1. [**Off**-board users within the legally binding 15 minutes timeframe of the organization](#offboard)
 2. [**On**-board users within 15 minutes in the organization](#onboard)
 3. [Bastion Host / Jump Host](#bastion)
-4. [Different rules for different users per host](#multi-environment)
-5. [Drop-in-Replacement](#drop-in-replacement)
+4. [Isolated Demo/Training environments](#demos)
+5. [Different rules for different user groups per host](#multi-environment)
+6. [Drop-in-Replacement](#drop-in-replacement)
 
 !!! tip
 
-    We're planning to also implement a [Docker](https://github.com/engity-com/bifroest/issues/11) and a [Kubernetes](https://github.com/engity-com/bifroest/issues/12) environment. This will create much more use-cases, soon. 🤠
+    We're planning to also implement a [Kubernetes environment](https://github.com/engity-com/bifroest/issues/12), [SSH server chaining](https://github.com/engity-com/bifroest/issues/27) and [Session recording](https://github.com/engity-com/bifroest/issues/28). This will create much more use-cases, soon. 🤠
 
-## Off-board users within the legally binding 15 minutes timeframe of the organization {:id=offboard}
+## Off-board users within the legally binding 15 minutes timeframe of the organization {: #offboard}
 
 ### Problem
 
@@ -51,7 +52,7 @@ There is no need to access any of these services directly to remove/de-authorize
 
 If the [environments are configured accordingly](reference/environment/index.md) (default setting) all of the user's files and processes will be removed/killed automatically, too.
 
-## On-board users within 15 minutes in the organization {:id=onboard}
+## On-board users within 15 minutes in the organization {: #onboard}
 
 This is quite similar to [Off-board users within the legally binding 15 minutes of the organization](#offboard), but obviously reverse.
 
@@ -82,7 +83,7 @@ There is no need to access any of these services directly to create/authorize th
 
 If the [environments are configured accordingly](reference/environment/index.md) (default setting), all of the user's resources (like the home directory) will be created automatically.
 
-## Bastion Host / Jump Host {:id=bastion}
+## Bastion Host / Jump Host {: #bastion}
 
 ### Problem
 
@@ -98,11 +99,30 @@ The following cases are usually used:
 ### Solution
 
 1. Set up a bastion host, either:
-   1. Inside the private network itself (in case of [AWS a dedicated EC2 instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/concepts.html) for example of [instance-type `t2.micro`](https://aws.amazon.com/ec2/instance-types/))
-   2. or outside the network with a fixed VPN connection to get inside the private network.
+    1. Inside the private network itself (in case of [AWS a dedicated EC2 instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/concepts.html) for example of [instance-type `t2.micro`](https://aws.amazon.com/ec2/instance-types/))
+    2. or outside the network with a fixed VPN connection to get inside the private network.
 2. Configure your preferred [authorization](reference/authorization/index.md) (for example [OpenID Connect](reference/authorization/oidc.md) for best [on-boarding](#onboard) and [off-boarding](#offboard) experience).
+3. Plus: If you're using the [docker environment](reference/environment/docker.md), you also gain the maximum possible security by environment isolation.
 
-## Different rules for different users per host {:id=multi-environment}
+## Isolated Demo/Training environments {: #demos }
+
+### Problem
+
+1. Assume you want to show how your software can be used (demonstration) or you want to create training sessions for users.
+2. You need an environment where your users can easily can have command interaction with.
+3. Each user needs a dedicated and isolated environment.
+4. You want to provide your own set of tools within these environments.
+
+### Solution
+
+1. Choose your favorite [authorization mechanism](reference/authorization/index.md), such as:
+    1. [OpenID Connect](reference/authorization/oidc.md) to ensure, that only users are already registered at your application are able to connect to your service or even using public social accounts like [GitHub](https://docs.github.com/v3/oauth) or [Google](https://developers.google.com/identity/openid-connect/openid-connect) to freely connect to your service.
+    2. Maybe you want to use [fixed passwords](reference/authorization/simple.md).
+    3. :material-alert-octagon:{: .warning } Also disable any kind of password request is possible, but only recommended for these kinds of purposes, nothing else. In this case, you can use the [none authorization](reference/authorization/none.md).
+2. Create an OCI/Docker image with the applications you want to show.
+3. Configure the [docker environment](reference/environment/docker.md) and [reference your image](reference/environment/docker.md#property-image).
+
+## Different rules for different user groups per host {: #multi-environment}
 
 ### Problem
 
@@ -116,7 +136,7 @@ This is almost impossible with current technologies except with different [OpenS
 
 Use Bifröst with multiple configured [flows](reference/flow.md). Each flow can handle different authorizations and environments.
 
-## Drop-in-Replacement {:id=drop-in-replacement}
+## Drop-in-Replacement {: #drop-in-replacement}
 
 You simply want to use something else than [OpenSSH sshd](https://man.openbsd.org/sshd.8), Bifröst will do this, too. 😉 Just use << asset_link("contrib/configurations/sshd-dropin-replacement.yaml", "this configuration") >>.
 
diff --git a/go.mod b/go.mod
index 5137d98..46224bb 100644
--- a/go.mod
+++ b/go.mod
@@ -6,9 +6,11 @@ require (
 	github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5
 	github.com/Masterminds/semver/v3 v3.3.0
 	github.com/Masterminds/sprig/v3 v3.3.0
-	github.com/alecthomas/kingpin v2.2.6+incompatible
+	github.com/alecthomas/kingpin/v2 v2.4.0
 	github.com/coreos/go-oidc/v3 v3.11.0
 	github.com/creack/pty v1.1.23
+	github.com/docker/docker v27.3.1+incompatible
+	github.com/docker/go-connections v0.5.0
 	github.com/echocat/slf4g v1.6.1
 	github.com/echocat/slf4g/native v1.6.1
 	github.com/fsnotify/fsnotify v1.7.0
@@ -17,7 +19,6 @@ require (
 	github.com/google/go-github/v65 v65.0.0
 	github.com/google/uuid v1.6.0
 	github.com/gwatts/rootcerts v0.0.0-20240701182254-d67b2c3ed211
-	github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0
 	github.com/mattn/go-zglob v0.0.6
 	github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a
 	github.com/mr-tron/base58 v1.2.0
@@ -26,37 +27,55 @@ require (
 	github.com/openwall/yescrypt-go v1.0.0
 	github.com/otiai10/copy v1.14.0
 	github.com/pkg/sftp v1.13.6
-	github.com/shirou/gopsutil v3.21.11+incompatible
+	github.com/shirou/gopsutil/v4 v4.24.9
 	github.com/stretchr/testify v1.9.0
 	github.com/tg123/go-htpasswd v1.2.2
+	github.com/things-go/go-socks5 v0.0.5
+	github.com/vmihailenco/msgpack/v5 v5.4.1
 	golang.org/x/crypto v0.28.0
+	golang.org/x/net v0.30.0
 	golang.org/x/oauth2 v0.23.0
+	golang.org/x/sys v0.26.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	dario.cat/mergo v1.0.1 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
+	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.15.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/cli v27.3.1+incompatible // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.8.2 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/ebitengine/purego v0.8.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-jose/go-jose/v4 v4.0.4 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
-	github.com/klauspost/compress v1.17.10 // indirect
+	github.com/klauspost/compress v1.17.11 // indirect
 	github.com/kr/fs v0.1.0 // indirect
+	github.com/lufia/plan9stats v0.0.0-20240909124753-873cd0166683 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/term v0.0.0-20221205130635-1aeaba878587 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/rogpeppe/go-internal v1.13.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
@@ -64,7 +83,14 @@ require (
 	github.com/tklauser/go-sysconf v0.3.14 // indirect
 	github.com/tklauser/numcpus v0.9.0 // indirect
 	github.com/vbatts/tar-split v0.11.6 // indirect
+	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
+	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.55.0 // indirect
+	go.opentelemetry.io/otel v1.31.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0 // indirect
+	go.opentelemetry.io/otel/metric v1.31.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.31.0 // indirect
+	go.opentelemetry.io/otel/trace v1.31.0 // indirect
 	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/sys v0.26.0 // indirect
 )
diff --git a/go.sum b/go.sum
index e7c800c..eabe97f 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,7 @@
 dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
 dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
+github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5 h1:IEjq88XO4PuBDcvmjQJcQGg+w+UaafSy8G5Kcb5tBhI=
 github.com/GehirnInc/crypt v0.0.0-20230320061759-8cc1b52080c5/go.mod h1:exZ0C/1emQJAw5tHOaUDyY1ycttqBAPcxuzf7QbY6ec=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
@@ -8,14 +10,18 @@ github.com/Masterminds/semver/v3 v3.3.0 h1:B8LGeaivUe71a5qox1ICM/JLl0NqZSW5CHyL+
 github.com/Masterminds/semver/v3 v3.3.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs=
 github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
-github.com/alecthomas/kingpin v2.2.6+incompatible h1:5svnBTFgJjZvGKyYBtMB0+m5wvrbUHiqye8wRJMlnYI=
-github.com/alecthomas/kingpin v2.2.6+incompatible/go.mod h1:59OFYbFVLKQKq+mqrL6Rw5bR0c3ACQaawgXx0QYndlE=
-github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=
-github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/alecthomas/kingpin/v2 v2.4.0 h1:f48lwail6p8zpO1bC4TxtqACaGqHYA22qkHjHpqDjYY=
+github.com/alecthomas/kingpin/v2 v2.4.0/go.mod h1:0gyi0zQnjuFk8xrkNKamJoyUo382HRL7ATRpFZCw6tE=
 github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b h1:mimo19zliBX/vSQ6PWWSL9lK8qwHozUj03+zLoEB8O0=
 github.com/alecthomas/units v0.0.0-20240927000941-0f3dac36c52b/go.mod h1:fvzegU4vN3H1qMT+8wDmzjAcDONcgo2/SZ/TyfdUOFs=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/stargz-snapshotter/estargz v0.15.1 h1:eXJjw9RbkLFgioVaTG+G/ZW/0kEe2oEKCdS/ZxIyoCU=
 github.com/containerd/stargz-snapshotter/estargz v0.15.1/go.mod h1:gr2RNwukQ/S9Nv33Lt6UC7xEx58C+LHRdoqbEKjz1Kk=
 github.com/coreos/go-oidc/v3 v3.11.0 h1:Ia3MxdwpSw702YW0xgfmP1GVCMA9aEFWu12XUZ3/OtI=
@@ -25,16 +31,28 @@ github.com/creack/pty v1.1.23/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfv
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/docker/cli v27.3.1+incompatible h1:qEGdFBF3Xu6SCvCYhc7CzaQTlBmqDuzxPDpigSyeKQQ=
 github.com/docker/cli v27.3.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v27.3.1+incompatible h1:KttF0XoteNTicmUtBO0L2tP+J7FGRFTjaEF4k6WdhfI=
+github.com/docker/docker v27.3.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
 github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/ebitengine/purego v0.8.0 h1:JbqvnEzRvPpxhCJzJJ2y0RbiZ8nyjccVUrSM3q+GvvE=
+github.com/ebitengine/purego v0.8.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/echocat/slf4g v1.6.1 h1:nQt0ZivDOsn8dyf3BJaHj1hWTF9MXsoefPUoTbVBI18=
 github.com/echocat/slf4g v1.6.1/go.mod h1:YvF/d1TcPvT+/xiHStLHPI4xPT1GGeEmPczn2MSljNA=
 github.com/echocat/slf4g/native v1.6.1 h1:g8Y8abLWwFkSQit4JQUvPO1MqpHUiPFZZINjkvPzY50=
 github.com/echocat/slf4g/native v1.6.1/go.mod h1:ijM/ey57jUdK7k0uqbhfJJYK6K8DtbEp+HfyDMBO63E=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
@@ -43,9 +61,16 @@ github.com/gliderlabs/ssh v0.3.7 h1:iV3Bqi942d9huXnzEF2Mt+CY9gLu8DNM4Obd+8bODRE=
 github.com/gliderlabs/ssh v0.3.7/go.mod h1:zpHEXBstFnQYtGnB8k8kQLol82umzn/2/snG7alWVD8=
 github.com/go-jose/go-jose/v4 v4.0.4 h1:VsjPI33J0SB9vQM6PLmNjoHqMQNGPiZ0rHL7Ni7Q6/E=
 github.com/go-jose/go-jose/v4 v4.0.4/go.mod h1:NKb5HO1EZccyMpiZNbdUw/14tiXNyUJh188dfnMCAfc=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
@@ -57,14 +82,16 @@ github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 h1:asbCHRVmodnJTuQ3qamDwqVOIjwqUPTYmYuemVOx+Ys=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0/go.mod h1:ggCgvZ2r7uOoQjOyu2Y1NhHmEPPzzuhWgcza5M1Ji1I=
 github.com/gwatts/rootcerts v0.0.0-20240701182254-d67b2c3ed211 h1:SWrkheqatqllDLJJ1VFDxwAauwXMpYyL0mhR4jjC5nU=
 github.com/gwatts/rootcerts v0.0.0-20240701182254-d67b2c3ed211/go.mod h1:5Kt9XkWvkGi2OHOq0QsGxebHmhCcqJ8KCbNg/a6+n+g=
 github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
 github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 h1:iQTw/8FWTuc7uiaSepXwyf3o52HaUYcV+Tu66S3F5GA=
-github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0/go.mod h1:1NbS8ALrpOvjt0rHPNLyCIeMtbizbir8U//inJ+zuB8=
-github.com/klauspost/compress v1.17.10 h1:oXAz+Vh0PMUvJczoi+flxpnBEPxoER1IaAnU/NMPtT0=
-github.com/klauspost/compress v1.17.10/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
+github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
@@ -74,6 +101,8 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/lufia/plan9stats v0.0.0-20240909124753-873cd0166683 h1:7UMa6KCCMjZEMDtTVdcGu0B1GmmC7QJKiCCjyTAWQy0=
+github.com/lufia/plan9stats v0.0.0-20240909124753-873cd0166683/go.mod h1:ilwx/Dta8jXAgpFYFvSWEMwxmbWXyiUHkd5FwyKhb5k=
 github.com/mattn/go-zglob v0.0.6 h1:mP8RnmCgho4oaUYDIDn6GNxYk+qJGUs8fJLn+twYj2A=
 github.com/mattn/go-zglob v0.0.6/go.mod h1:MxxjyoXXnMxfIpxTK2GAkw1w8glPsQILx3N5wrKakiY=
 github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a h1:eU8j/ClY2Ty3qdHnn0TyW3ivFoPC/0F1gQZz8yTxbbE=
@@ -84,6 +113,12 @@ github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/term v0.0.0-20221205130635-1aeaba878587 h1:HfkjXDfhgVaN5rmueG8cL8KKeFNecRCXFhaJ2qZ5SKA=
+github.com/moby/term v0.0.0-20221205130635-1aeaba878587/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
 github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
 github.com/msteinert/pam/v2 v2.0.0 h1:jnObb8MT6jvMbmrUQO5J/puTUjxy7Av+55zVJRJsCyE=
@@ -104,10 +139,12 @@ github.com/pkg/sftp v1.13.6 h1:JFZT4XbOU7l77xGSpOdW+pwIMqP044IyjXX6FGyEKFo=
 github.com/pkg/sftp v1.13.6/go.mod h1:tz1ryNURKu77RL+GuCzmoJYxQczL3wLNNpPWagdg4Qk=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
-github.com/shirou/gopsutil v3.21.11+incompatible h1:+1+c1VGhc88SSonWP6foOcLhvnKlUeu/erjjvaPEYiI=
-github.com/shirou/gopsutil v3.21.11+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
+github.com/shirou/gopsutil/v4 v4.24.9 h1:KIV+/HaHD5ka5f570RZq+2SaeFsb/pq+fp2DGNWYoOI=
+github.com/shirou/gopsutil/v4 v4.24.9/go.mod h1:3fkaHNeYsUFCGZ8+9vZVWtbyM1k2eRnlL+bWO8Bxa/Q=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
@@ -126,35 +163,76 @@ github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsT
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tg123/go-htpasswd v1.2.2 h1:tmNccDsQ+wYsoRfiONzIhDm5OkVHQzN3w4FOBAlN6BY=
 github.com/tg123/go-htpasswd v1.2.2/go.mod h1:FcIrK0J+6zptgVwK1JDlqyajW/1B4PtuJ/FLWl7nx8A=
+github.com/things-go/go-socks5 v0.0.5 h1:qvKaGcBkfDrUL33SchHN93srAmYGzb4CxSM2DPYufe8=
+github.com/things-go/go-socks5 v0.0.5/go.mod h1:mtzInf8v5xmsBpHZVbIw2YQYhc4K0jRwzfsH64Uh0IQ=
 github.com/tklauser/go-sysconf v0.3.14 h1:g5vzr9iPFFz24v2KZXs/pvpvh8/V9Fw6vQK5ZZb78yU=
 github.com/tklauser/go-sysconf v0.3.14/go.mod h1:1ym4lWMLUOhuBOPGtRcJm7tEGX4SCYNEEEtghGG/8uY=
 github.com/tklauser/numcpus v0.9.0 h1:lmyCHtANi8aRUgkckBgoDk1nHCux3n2cgkJLXdQGPDo=
 github.com/tklauser/numcpus v0.9.0/go.mod h1:SN6Nq1O3VychhC1npsWostA+oW+VOQTxZrS604NSRyI=
 github.com/vbatts/tar-split v0.11.6 h1:4SjTW5+PU11n6fZenf2IPoV8/tz3AaYHMWjf23envGs=
 github.com/vbatts/tar-split v0.11.6/go.mod h1:dqKNtesIOr2j2Qv3W/cHjnvk9I8+G7oAkFDFN6TCBEI=
+github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8=
+github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
+github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
+github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
+github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
+github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.55.0 h1:ZIg3ZT/aQ7AfKqdwp7ECpOK6vHqquXXuyTjIO8ZdmPs=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.55.0/go.mod h1:DQAwmETtZV00skUwgD6+0U89g80NKsJE3DCKeLLPQMI=
+go.opentelemetry.io/otel v1.31.0 h1:NsJcKPIW0D0H3NgzPDHmo0WW6SptzPdqg/L1zsIm2hY=
+go.opentelemetry.io/otel v1.31.0/go.mod h1:O0C14Yl9FgkjqcCZAsE053C13OaddMYr/hz6clDkEJE=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0 h1:K0XaT3DwHAcV4nKLzcQvwAgSyisUghWoY20I7huthMk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0/go.mod h1:B5Ki776z/MBnVha1Nzwp5arlzBbE3+1jk+pGmaP5HME=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0 h1:lUsI2TYsQw2r1IASwoROaCnjdj2cvC2+Jbxvk6nHnWU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0/go.mod h1:2HpZxxQurfGxJlJDblybejHB6RX6pmExPNe517hREw4=
+go.opentelemetry.io/otel/metric v1.31.0 h1:FSErL0ATQAmYHUIzSezZibnyVlft1ybhy4ozRPcF2fE=
+go.opentelemetry.io/otel/metric v1.31.0/go.mod h1:C3dEloVbLuYoX41KpmAhOqNriGbA+qqH6PQ5E5mUfnY=
+go.opentelemetry.io/otel/sdk v1.31.0 h1:xLY3abVHYZ5HSfOg3l2E5LUj2Cwva5Y7yGxnSW9H5Gk=
+go.opentelemetry.io/otel/sdk v1.31.0/go.mod h1:TfRbMdhvxIIr/B2N2LQW2S5v9m3gOQ/08KsbbO5BPT0=
+go.opentelemetry.io/otel/trace v1.31.0 h1:ffjsj1aRouKewfr85U2aGagJ46+MvodynlQ1HYdmJys=
+go.opentelemetry.io/otel/trace v1.31.0/go.mod h1:TXZkRk7SM2ZQLtR6eoAWQFIHPvzQ06FJAsO1tJg480A=
+go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
+go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw=
 golang.org/x/crypto v0.28.0 h1:GBDwsMXVQi34v5CCYUm2jkJvu4cbtru2U4TN2PSyQnw=
 golang.org/x/crypto v0.28.0/go.mod h1:rmgy+3RHxRZMyY0jjAJShp2zgEdOqj2AO7U0pYmeQ7U=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
+golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
 golang.org/x/oauth2 v0.23.0 h1:PbgcYx2W7i4LvjJWEbf0ngHV6qJYr86PkAV3bXdLEbs=
 golang.org/x/oauth2 v0.23.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
 golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -170,11 +248,27 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.19.0 h1:kTxAhCbGbxhK0IwgSKiMO5awPoDQ0RpfiVYBfK860YM=
+golang.org/x/text v0.19.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
+golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac h1:7zkz7BUtwNFFqcowJ+RIgu2MaV/MapERkDIy+mwPyjs=
+golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9 h1:T6rh4haD3GVYsgEfWExoCZA2o2FmbNyKpTuAxbEFPTg=
+google.golang.org/genproto/googleapis/api v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:wp2WsuBYj6j8wUdo3ToZsdxxixbvQNAHqVJrTgi5E5M=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9 h1:QCqS/PdaHTSWGvupk2F/ehwHtGc0/GYkT+3GAcR1CCc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:GX3210XPVPUjJbTUbvwI8f2IpZDMZuPJWDzDuebbviI=
+google.golang.org/grpc v1.67.1 h1:zWnc1Vrcno+lHZCOofnIMvycFcc0QRGIzm9dhnDX68E=
+google.golang.org/grpc v1.67.1/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
+google.golang.org/protobuf v1.35.1 h1:m3LfL6/Ca+fqnjnlqQXNpFPABW1UD7mjh8KO2mKFytA=
+google.golang.org/protobuf v1.35.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/internal/imp/protocol/bufcon.go b/internal/imp/protocol/bufcon.go
new file mode 100644
index 0000000..ffdea44
--- /dev/null
+++ b/internal/imp/protocol/bufcon.go
@@ -0,0 +1,117 @@
+package protocol
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"net"
+	"sync"
+	"sync/atomic"
+)
+
+const (
+	bufConnSize = 4096
+)
+
+var bufConnPool = sync.Pool{
+	New: func() any {
+		return &bufConn{
+			buf: make([]byte, bufConnSize),
+		}
+	},
+}
+
+func NewBufConn(in net.Conn) BufConn {
+	result := bufConnPool.Get().(*bufConn)
+	result.Conn = in
+	return result
+}
+
+type bufConn struct {
+	net.Conn
+
+	buf    []byte
+	bufLen int
+	bufPos int
+	closed atomic.Bool
+}
+
+func (this *bufConn) Read(p []byte) (n int, err error) {
+	if this.closed.Load() {
+		return 0, io.ErrClosedPipe
+	}
+
+	leftInBuf := this.bufLen - this.bufPos
+	if leftInBuf <= 0 {
+		return this.Conn.Read(p)
+	}
+
+	pLen := len(p)
+	if pLen <= leftInBuf {
+		copy(p, this.buf[this.bufPos:this.bufPos+pLen])
+		this.bufPos += pLen
+		return pLen, nil
+	}
+
+	copy(p, this.buf[this.bufPos:this.bufPos+leftInBuf])
+	n += leftInBuf
+	this.bufPos += leftInBuf
+
+	nr, err := this.Conn.Read(p[leftInBuf:])
+	n += nr
+
+	return n, err
+}
+
+func (this *bufConn) Peek(n int) ([]byte, error) {
+	if this.closed.Load() {
+		return nil, io.ErrClosedPipe
+	}
+	if this.bufPos > 0 {
+		return nil, fmt.Errorf("there was already regular read activity on this connection; Peek(..) is not longer possible")
+	}
+	if n < 0 {
+		return nil, bufio.ErrNegativeCount
+	}
+	if n == 0 {
+		return nil, nil
+	}
+	if n > len(this.buf) {
+		return nil, bufio.ErrBufferFull
+	}
+
+	if this.bufLen < n {
+		nr, err := this.Conn.Read(this.buf[this.bufLen:n])
+		if err != nil {
+			return this.buf[:this.bufLen+nr], err
+		}
+		if n-this.bufLen > nr {
+			return this.buf[:this.bufLen+nr], io.EOF
+		}
+		this.bufLen += nr
+	}
+
+	return this.buf[:n], nil
+}
+
+func (this *bufConn) Close() error {
+	if !this.closed.CompareAndSwap(false, true) {
+		return nil
+	}
+	return this.Conn.Close()
+}
+
+func (this *bufConn) Release() {
+	this.Conn = nil
+	this.bufLen = 0
+	this.bufPos = 0
+	this.closed.Store(false)
+	bufConnPool.Put(this)
+}
+
+type BufConn interface {
+	net.Conn
+
+	Release()
+	Peek(int) ([]byte, error)
+}
diff --git a/internal/imp/protocol/bufcon_test.go b/internal/imp/protocol/bufcon_test.go
new file mode 100644
index 0000000..76c3d43
--- /dev/null
+++ b/internal/imp/protocol/bufcon_test.go
@@ -0,0 +1,201 @@
+package protocol
+
+import (
+	"bufio"
+	"io"
+	"net"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/engity-com/bifroest/pkg/common"
+)
+
+func TestBufConn(t *testing.T) {
+	givenConn := newTestConnectionOf("0123456789")
+	instance := NewBufConn(givenConn).(*bufConn)
+	defer instance.Release()
+
+	{
+		actual, actualErr := instance.Peek(-3)
+		require.Equal(t, bufio.ErrNegativeCount, actualErr)
+		require.Equal(t, []byte(nil), actual)
+	}
+	{
+		actual, actualErr := instance.Peek(bufConnSize + 1)
+		require.Equal(t, bufio.ErrBufferFull, actualErr)
+		require.Equal(t, []byte(nil), actual)
+	}
+	{
+		actual, actualErr := instance.Peek(0)
+		require.NoError(t, actualErr)
+		require.Equal(t, []byte(nil), actual)
+		assert.Equal(t, false, instance.closed.Load())
+		assert.Equal(t, 0, instance.bufPos)
+		assert.Equal(t, 0, instance.bufLen)
+	}
+	{
+		actual, actualErr := instance.Peek(3)
+		require.NoError(t, actualErr)
+		require.Equal(t, "012", string(actual))
+		assert.Equal(t, false, instance.closed.Load())
+		assert.Equal(t, 0, instance.bufPos)
+		assert.Equal(t, 3, instance.bufLen)
+	}
+	{
+		actual, actualErr := instance.Peek(4)
+		require.NoError(t, actualErr)
+		require.Equal(t, "0123", string(actual))
+		assert.Equal(t, false, instance.closed.Load())
+		assert.Equal(t, 0, instance.bufPos)
+		assert.Equal(t, 4, instance.bufLen)
+	}
+	{
+		actual, actualErr := instance.Peek(2)
+		require.NoError(t, actualErr)
+		require.Equal(t, "01", string(actual))
+		assert.Equal(t, false, instance.closed.Load())
+		assert.Equal(t, 0, instance.bufPos)
+		assert.Equal(t, 4, instance.bufLen)
+	}
+	{
+		actual := make([]byte, 3)
+		actualN, actualErr := instance.Read(actual)
+		require.NoError(t, actualErr)
+		require.Equal(t, 3, actualN)
+		require.Equal(t, "012", string(actual))
+		assert.Equal(t, false, instance.closed.Load())
+		assert.Equal(t, 3, instance.bufPos)
+		assert.Equal(t, 4, instance.bufLen)
+	}
+	{
+		actual := make([]byte, 4)
+		actualN, actualErr := instance.Read(actual)
+		require.NoError(t, actualErr)
+		require.Equal(t, 4, actualN)
+		require.Equal(t, "3456", string(actual))
+		assert.Equal(t, false, instance.closed.Load())
+		assert.Equal(t, 4, instance.bufPos)
+		assert.Equal(t, 4, instance.bufLen)
+	}
+	{
+		actual, actualErr := instance.Peek(2)
+		require.ErrorContains(t, actualErr, "there was already regular read activity on this connection; Peek(..) is not longer possible")
+		require.Equal(t, []byte(nil), actual)
+	}
+	{
+		actual := make([]byte, 2)
+		actualN, actualErr := instance.Read(actual)
+		require.NoError(t, actualErr)
+		require.Equal(t, 2, actualN)
+		require.Equal(t, "78", string(actual))
+		assert.Equal(t, false, instance.closed.Load())
+		assert.Equal(t, 4, instance.bufPos)
+		assert.Equal(t, 4, instance.bufLen)
+	}
+	{
+		actual := make([]byte, 4)
+		actualN, actualErr := instance.Read(actual)
+		require.NoError(t, actualErr)
+		require.Equal(t, 1, actualN)
+		require.Equal(t, "9", string(actual[:actualN]))
+		assert.Equal(t, false, instance.closed.Load())
+		assert.Equal(t, 4, instance.bufPos)
+		assert.Equal(t, 4, instance.bufLen)
+	}
+	{
+		actualErr := instance.Close()
+		require.NoError(t, actualErr)
+		assert.Equal(t, true, instance.closed.Load())
+		assert.Equal(t, 4, instance.bufPos)
+		assert.Equal(t, 4, instance.bufLen)
+	}
+	{
+		actual := make([]byte, 4)
+		actualN, actualErr := instance.Read(actual)
+		require.Equal(t, io.ErrClosedPipe, actualErr)
+		require.Equal(t, 0, actualN)
+	}
+	{
+		actual, actualErr := instance.Peek(4)
+		require.Equal(t, io.ErrClosedPipe, actualErr)
+		require.Equal(t, []byte(nil), actual)
+	}
+	{
+		instance.Release()
+		assert.Equal(t, false, instance.closed.Load())
+		assert.Equal(t, 0, instance.bufPos)
+		assert.Equal(t, 0, instance.bufLen)
+	}
+}
+
+func TestBufConn_2(t *testing.T) {
+	givenConn := newTestConnectionOf("0123456789")
+	instance := NewBufConn(givenConn).(*bufConn)
+	defer common.IgnoreCloseError(instance)
+
+	{
+		actual, actualErr := instance.Peek(3)
+		require.NoError(t, actualErr)
+		require.Equal(t, "012", string(actual))
+		assert.Equal(t, false, instance.closed.Load())
+		assert.Equal(t, 0, instance.bufPos)
+		assert.Equal(t, 3, instance.bufLen)
+	}
+	{
+		actual := make([]byte, 5)
+		actualN, actualErr := instance.Read(actual)
+		require.NoError(t, actualErr)
+		require.Equal(t, 5, actualN)
+		require.Equal(t, "01234", string(actual))
+		assert.Equal(t, false, instance.closed.Load())
+		assert.Equal(t, 3, instance.bufPos)
+		assert.Equal(t, 3, instance.bufLen)
+	}
+}
+
+func newTestConnectionOf(what string) *testConn {
+	return &testConn{
+		Reader: strings.NewReader(what),
+	}
+}
+
+type testConn struct {
+	io.Reader
+	closed atomic.Bool
+}
+
+func (this *testConn) Write([]byte) (int, error) {
+	panic("not implemented")
+}
+
+func (this *testConn) Close() error {
+	if this.closed.CompareAndSwap(false, true) {
+		return nil
+	}
+	return io.ErrClosedPipe
+}
+
+func (this *testConn) LocalAddr() net.Addr {
+	panic("not implemented")
+}
+
+func (this *testConn) RemoteAddr() net.Addr {
+	panic("not implemented")
+}
+
+func (this *testConn) SetDeadline(time.Time) error {
+	panic("not implemented")
+}
+
+func (this *testConn) SetReadDeadline(time.Time) error {
+	panic("not implemented")
+}
+
+func (this *testConn) SetWriteDeadline(time.Time) error {
+	panic("not implemented")
+}
diff --git a/internal/imp/protocol/certificates.go b/internal/imp/protocol/certificates.go
new file mode 100644
index 0000000..fef5323
--- /dev/null
+++ b/internal/imp/protocol/certificates.go
@@ -0,0 +1,82 @@
+package protocol
+
+import (
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"fmt"
+	"math/big"
+	"time"
+
+	"github.com/engity-com/bifroest/pkg/crypto"
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+func generateCertificateForPrivateKey(name string, prv crypto.PrivateKey) (*x509.Certificate, error) {
+	fail := func(err error) (*x509.Certificate, error) {
+		return nil, err
+	}
+	failf := func(msg string, args ...any) (*x509.Certificate, error) {
+		return fail(errors.System.Newf(msg, args...))
+	}
+
+	var err error
+	template := x509.Certificate{
+		KeyUsage: x509.KeyUsageDigitalSignature,
+		Subject: pkix.Name{
+			CommonName: name,
+		},
+		NotBefore:             time.Now().Add(-24 * time.Hour),
+		NotAfter:              time.Now().Add(24 * time.Hour * 30),
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+	}
+
+	if prv.Type() == "ssh-rsa" {
+		template.KeyUsage |= x509.KeyUsageKeyEncipherment
+	}
+	if template.SerialNumber, err = rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128)); err != nil {
+		return failf("cannot generate serialNumer: %w", err)
+	}
+
+	sdk := prv.ToSdk()
+	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, sdk.Public(), sdk)
+	if err != nil {
+		return failf("cannot create certificate: %w", err)
+	}
+
+	cert, err := x509.ParseCertificate(derBytes)
+	if err != nil {
+		return failf("cannot parse just created certificate: %w", err)
+	}
+
+	return cert, nil
+}
+
+func peerVerifierForPublicKey(expected crypto.PublicKey) (func([][]byte, [][]*x509.Certificate) error, error) {
+	return func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
+		if len(rawCerts) == 0 {
+			return fmt.Errorf("no remote certificates presented: rejecting")
+		}
+		cert, err := x509.ParseCertificate(rawCerts[0])
+		if err != nil {
+			return fmt.Errorf("failed to parse remote certificate: %v: rejecting", err)
+		}
+		pKey, err := crypto.PublicKeyFromSdk(cert.PublicKey)
+		if err != nil {
+			return fmt.Errorf("illegal peer public key: %v: rejecting", err)
+		}
+		if !expected.IsEqualTo(pKey) {
+			return fmt.Errorf("remote certificate does not match expected: rejecting (%v != %v)", expected, pKey)
+		}
+		return nil
+	}, nil
+}
+
+func alwaysAcceptPeerVerifier(_ [][]byte, _ [][]*x509.Certificate) error {
+	return nil
+}
+
+func alwaysRejectPeerVerifier(_ [][]byte, _ [][]*x509.Certificate) error {
+	return fmt.Errorf("not initialized -> rejecting")
+}
diff --git a/internal/imp/protocol/common.go b/internal/imp/protocol/common.go
new file mode 100644
index 0000000..539208c
--- /dev/null
+++ b/internal/imp/protocol/common.go
@@ -0,0 +1,11 @@
+package protocol
+
+import "crypto/tls"
+
+var (
+	minTlsVersion   uint16 = tls.VersionTLS13
+	tlsCipherSuites        = []uint16{
+		tls.TLS_AES_256_GCM_SHA384,
+		tls.TLS_CHACHA20_POLY1305_SHA256,
+	}
+)
diff --git a/internal/imp/protocol/header.go b/internal/imp/protocol/header.go
new file mode 100644
index 0000000..9677236
--- /dev/null
+++ b/internal/imp/protocol/header.go
@@ -0,0 +1,90 @@
+package protocol
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/vmihailenco/msgpack/v5"
+
+	"github.com/engity-com/bifroest/pkg/codec"
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/connection"
+)
+
+const (
+	HeaderMagic = 183
+)
+
+type Header struct {
+	Method       Method
+	ConnectionId connection.Id
+}
+
+func (this *Header) DecodeMsgpack(dec *msgpack.Decoder) error {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this Header) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this Header) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	if n, err := enc.Writer().Write([]byte{HeaderMagic}); err != nil {
+		return err
+	} else if n != 1 {
+		return io.ErrShortWrite
+	}
+	if err := this.Method.EncodeMsgPack(enc); err != nil {
+		return err
+	}
+	if err := this.ConnectionId.EncodeMsgPack(enc); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *Header) DecodeMsgPack(dec codec.MsgPackDecoder) (err error) {
+	hmb := make([]byte, 1)
+
+	if n, err := dec.Buffered().Read(hmb); err != nil {
+		return err
+	} else if n != 1 {
+		return io.ErrUnexpectedEOF
+	} else if hmb[0] != HeaderMagic {
+		return fmt.Errorf("header magic number is invalid - expected %d, got %d", HeaderMagic, hmb[0])
+	}
+	if err := this.Method.DecodeMsgPack(dec); err != nil {
+		return err
+	}
+	if err := this.ConnectionId.DecodeMsgPack(dec); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *Master) do(ctx context.Context, ref Ref, connectionId connection.Id, method Method, action func(*Header, codec.MsgPackConn) error) (rErr error) {
+	fail := func(err error) error {
+		return err
+	}
+
+	conn, err := this.DialContextWithMsgPack(ctx, ref)
+	if err != nil {
+		return fail(err)
+	}
+	defer common.KeepCloseError(&rErr, conn)
+
+	header := Header{
+		Method:       method,
+		ConnectionId: connectionId,
+	}
+	if err := header.EncodeMsgPack(conn); err != nil {
+		return fail(err)
+	}
+
+	if err := action(&header, conn); err != nil {
+		return fail(err)
+	}
+
+	return nil
+}
diff --git a/internal/imp/protocol/imp.go b/internal/imp/protocol/imp.go
new file mode 100644
index 0000000..e1bd93a
--- /dev/null
+++ b/internal/imp/protocol/imp.go
@@ -0,0 +1,214 @@
+package protocol
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"net"
+	"net/http"
+	"strconv"
+	"sync"
+	"sync/atomic"
+
+	log "github.com/echocat/slf4g"
+	"github.com/things-go/go-socks5"
+
+	"github.com/engity-com/bifroest/pkg/codec"
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/crypto"
+	"github.com/engity-com/bifroest/pkg/errors"
+	bnet "github.com/engity-com/bifroest/pkg/net"
+)
+
+const (
+	DefaultPort = 9687
+)
+
+type Imp struct {
+	MasterPublicKey crypto.PublicKey
+	Addr            string
+	Logger          log.Logger
+}
+
+func (this *Imp) Serve(ctx context.Context) error {
+	fail := func(err error) error {
+		return err
+	}
+	failf := func(msg string, args ...any) error {
+		return fail(errors.Network.Newf(msg, args...))
+	}
+
+	tlsConfig, err := this.createTlsConfig()
+	if err != nil {
+		return fail(err)
+	}
+
+	addr := this.getAddr()
+	ln, err := net.Listen("tcp", addr)
+	if err != nil {
+		return failf("cannot listen to %s: %v", addr, err)
+	}
+
+	tlsLn := tls.NewListener(ln, tlsConfig)
+
+	instance := &imp{
+		Imp:      this,
+		listener: NewMuxListener(tlsLn),
+		socks5:   socks5.NewServer(socks5.WithLogger(log.GetLogger("socks5"))),
+	}
+
+	var wg sync.WaitGroup
+
+	var rpcErr atomic.Pointer[error]
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		if err := instance.serveRpc(instance.listener.Rpc()); err != nil {
+			if !bnet.IsClosedError(err) && !errors.Is(err, http.ErrServerClosed) {
+				rpcErr.Store(&err)
+			}
+		}
+	}()
+
+	var socksErr atomic.Pointer[error]
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		if err := instance.serveSocks5(instance.listener.Socks5()); err != nil {
+			if !bnet.IsClosedError(err) {
+				socksErr.Store(&err)
+			}
+		}
+	}()
+
+	<-ctx.Done()
+	if err := instance.listener.Close(); err != nil {
+		return failf("cannot close listener: %v", err)
+	}
+
+	wg.Wait()
+	if err := rpcErr.Load(); err != nil {
+		return failf("problems while listening to rpc: %w", *err)
+	}
+	if err := socksErr.Load(); err != nil {
+		return failf("problems while listening to socks5: %w", *err)
+	}
+
+	return nil
+}
+
+type imp struct {
+	*Imp
+	listener MuxListener
+	socks5   *socks5.Server
+}
+
+func (this *imp) serveSocks5(ln net.Listener) error {
+	defer common.IgnoreCloseError(ln)
+	for {
+		conn, err := ln.Accept()
+		if err != nil {
+			return err
+		}
+		if err := this.socks5.ServeConn(conn); err != nil {
+			log.GetLogger("socks5").WithError(err).Warn()
+		}
+	}
+}
+
+func (this *imp) serveRpc(ln net.Listener) error {
+	ctx := context.Background()
+	defer common.IgnoreCloseError(ln)
+	for {
+		conn, err := ln.Accept()
+		if err != nil {
+			return err
+		}
+		if err := this.serveRpcConn(ctx, conn); err != nil {
+			log.GetLogger("rpc").WithError(err).Warn()
+		}
+	}
+}
+
+func (this *imp) serveRpcConn(ctx context.Context, plainConn net.Conn) (rErr error) {
+	fail := func(err error) error {
+		return err
+	}
+	done := func(err error) error {
+		return err
+	}
+	conn := codec.GetPooledMsgPackConn(plainConn)
+	defer common.KeepCloseError(&rErr, conn)
+
+	var header Header
+	if err := header.DecodeMsgPack(conn); err != nil {
+		return fail(err)
+	}
+
+	switch header.Method {
+	case MethodEcho:
+		return done(this.handleMethodEcho(ctx, &header, conn))
+	case MethodKill:
+		return done(this.handleMethodKill(ctx, &header, conn))
+	case MethodExit:
+		return done(this.handleMethodExit(ctx, &header, conn))
+	default:
+		return fail(errors.Network.Newf("unsupported method %v", header.Method))
+	}
+}
+
+func (this *Imp) createTlsConfig() (*tls.Config, error) {
+	fail := func(err error) (*tls.Config, error) {
+		return nil, err
+	}
+
+	prv, err := this.generatePrivateKey()
+	if err != nil {
+		return fail(err)
+	}
+	cert, err := this.getOwnCertificate(prv)
+	if err != nil {
+		return fail(err)
+	}
+
+	verifier, err := peerVerifierForPublicKey(this.MasterPublicKey)
+	if err != nil {
+		return nil, err
+	}
+	return &tls.Config{
+		Certificates: []tls.Certificate{{
+			Certificate: [][]byte{cert.Raw},
+			PrivateKey:  prv.ToSdk(),
+		}},
+		VerifyPeerCertificate: verifier,
+		MinVersion:            minTlsVersion,
+		CipherSuites:          tlsCipherSuites,
+		ClientAuth:            tls.RequireAnyClientCert,
+	}, nil
+}
+
+func (this *Imp) generatePrivateKey() (crypto.PrivateKey, error) {
+	req := crypto.KeyRequirement{
+		Type: crypto.KeyTypeEd25519,
+	}
+	result, err := req.GenerateKey(nil)
+	if err != nil {
+		return nil, errors.System.Newf("cannot generate private key for imp: %w", err)
+	}
+	return result, nil
+}
+
+func (this *Imp) getOwnCertificate(prv crypto.PrivateKey) (*x509.Certificate, error) {
+	cert, err := generateCertificateForPrivateKey("bifroest-imp", prv)
+	if err != nil {
+		return nil, errors.System.Newf("cannot generate certificate for imp: %w", err)
+	}
+	return cert, nil
+}
+
+func (this *Imp) getAddr() string {
+	if v := this.Addr; v != "" {
+		return v
+	}
+	return ":" + strconv.Itoa(DefaultPort)
+}
diff --git a/internal/imp/protocol/master-session.go b/internal/imp/protocol/master-session.go
new file mode 100644
index 0000000..0aa9b68
--- /dev/null
+++ b/internal/imp/protocol/master-session.go
@@ -0,0 +1,54 @@
+package protocol
+
+import (
+	"context"
+	"net"
+	"strconv"
+
+	"github.com/engity-com/bifroest/pkg/connection"
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/sys"
+)
+
+type MasterSession struct {
+	parent *Master
+	ref    Ref
+}
+
+func (this *MasterSession) Close() error {
+	return nil
+}
+
+func (this *MasterSession) InitiateDirectTcp(ctx context.Context, connectionId connection.Id, host string, port uint32) (net.Conn, error) {
+	fail := func(err error) (net.Conn, error) {
+		return nil, errors.Network.Newf("cannot initiate direct tcp connection for %v to %s:%d: %w", connectionId, host, port, err)
+	}
+
+	dialer, releaser := this.parent.socks5DialerFor(this.ref)
+	defer releaser()
+
+	dest := net.JoinHostPort(host, strconv.FormatInt(int64(port), 10))
+
+	conn, err := dialer.DialContext(ctx, "tcp", dest)
+	if err != nil {
+		return fail(err)
+	}
+	return conn, nil
+}
+
+func (this *MasterSession) InitiateAgentForward(ctx context.Context, connectionId connection.Id) (_ net.Conn, socketPath string, _ error) {
+	// TODO implement me
+	panic("implement me")
+}
+
+func (this *MasterSession) Echo(ctx context.Context, connectionId connection.Id, in string) (string, error) {
+	return this.parent.methodEcho(ctx, this.ref, connectionId, in)
+}
+
+func (this *MasterSession) Kill(ctx context.Context, connectionId connection.Id, pid int, signal sys.Signal) error {
+	return this.parent.methodKill(ctx, this.ref, connectionId, pid, signal)
+}
+
+func (this *MasterSession) Exit(ctx context.Context, connectionId connection.Id, exitCode int) error {
+	return this.parent.methodExit(ctx, this.ref, connectionId, exitCode)
+}
diff --git a/internal/imp/protocol/master.go b/internal/imp/protocol/master.go
new file mode 100644
index 0000000..ec93096
--- /dev/null
+++ b/internal/imp/protocol/master.go
@@ -0,0 +1,162 @@
+package protocol
+
+import (
+	"context"
+	crypto2 "crypto"
+	"crypto/tls"
+	"crypto/x509"
+	gonet "net"
+	"sync"
+
+	"golang.org/x/net/proxy"
+
+	"github.com/engity-com/bifroest/pkg/codec"
+	"github.com/engity-com/bifroest/pkg/crypto"
+	"github.com/engity-com/bifroest/pkg/net"
+)
+
+func NewMaster(_ context.Context, masterPrivateKey crypto.PrivateKey) (*Master, error) {
+	fail := func(err error) (*Master, error) {
+		return nil, err
+	}
+
+	result := &Master{
+		PrivateKey: masterPrivateKey,
+	}
+
+	cert, err := generateCertificateForPrivateKey("bifroest-master", masterPrivateKey)
+	if err != nil {
+		return fail(err)
+	}
+	result.tlsDialers.New = func() any {
+		return &tls.Dialer{
+			Config: result.basicTlsConfigFor(cert, masterPrivateKey.ToSdk()),
+		}
+	}
+
+	result.socks5Dialers.New = func() any {
+		s5d := &socks5Dialer{
+			master: result,
+			ref:    nil,
+		}
+		s5d.dialerDialer.parent = s5d
+
+		if d, err := proxy.SOCKS5("<later>", "<later>", nil, &s5d.dialerDialer); err != nil {
+			panic(err)
+		} else {
+			s5d.Dialer = d.(Dialer)
+		}
+
+		return s5d
+	}
+
+	return result, nil
+}
+
+type Master struct {
+	PrivateKey crypto.PrivateKey
+
+	tlsDialers    sync.Pool
+	socks5Dialers sync.Pool
+}
+
+type Ref interface {
+	PublicKey() crypto.PublicKey
+	EndpointAddr() net.HostPort
+}
+
+func (this *Master) Open(_ context.Context, ref Ref) (*MasterSession, error) {
+	return &MasterSession{
+		parent: this,
+		ref:    ref,
+	}, nil
+}
+
+func (this *Master) DialContext(ctx context.Context, ref Ref) (gonet.Conn, error) {
+	dialer, releaser, err := this.tlsDialerFor(ref)
+	if err != nil {
+		return nil, err
+	}
+	defer releaser()
+
+	return dialer.DialContext(ctx, "tcp", ref.EndpointAddr().String())
+}
+
+func (this *Master) DialContextWithMsgPack(ctx context.Context, ref Ref) (codec.MsgPackConn, error) {
+	fail := func(err error) (codec.MsgPackConn, error) {
+		return nil, err
+	}
+
+	conn, err := this.DialContext(ctx, ref)
+	if err != nil {
+		return fail(err)
+	}
+	return codec.GetPooledMsgPackConn(conn), nil
+}
+
+func (this *Master) tlsDialerFor(ref Ref) (_ *tls.Dialer, releaser func(), _ error) {
+	result := this.tlsDialers.Get().(*tls.Dialer)
+
+	if pub := ref.PublicKey(); pub != nil {
+		verifier, err := peerVerifierForPublicKey(pub)
+		if err != nil {
+			return nil, nil, err
+		}
+		result.Config.VerifyPeerCertificate = verifier
+	} else {
+		result.Config.VerifyPeerCertificate = alwaysAcceptPeerVerifier
+	}
+	return result, func() {
+		result.Config.VerifyPeerCertificate = alwaysRejectPeerVerifier
+		this.tlsDialers.Put(result)
+	}, nil
+}
+
+func (this *Master) socks5DialerFor(ref Ref) (_ *socks5Dialer, releaser func()) {
+	result := this.socks5Dialers.Get().(*socks5Dialer)
+	result.ref = ref
+	return result, func() {
+		result.ref = nil
+		this.socks5Dialers.Put(result)
+	}
+}
+
+func (this *Master) basicTlsConfigFor(ownCertificate *x509.Certificate, sdk crypto2.Signer) *tls.Config {
+	return &tls.Config{
+		Certificates: []tls.Certificate{{
+			Certificate: [][]byte{ownCertificate.Raw},
+			PrivateKey:  sdk,
+		}},
+		MinVersion:         minTlsVersion,
+		CipherSuites:       tlsCipherSuites,
+		InsecureSkipVerify: true,
+	}
+}
+
+type Dialer interface {
+	proxy.ContextDialer
+	proxy.Dialer
+}
+
+type socks5Dialer struct {
+	Dialer
+
+	master       *Master
+	dialerDialer socks5DialerDialer
+	ref          Ref
+}
+
+type socks5DialerDialer struct {
+	parent *socks5Dialer
+}
+
+func (this *socks5DialerDialer) DialContext(ctx context.Context, network string, addr string) (gonet.Conn, error) {
+	if network != "<later>" || addr != "<later>" {
+		panic("called from illegal stack position")
+	}
+	return this.parent.master.DialContext(ctx, this.parent.ref)
+}
+
+func (this *socks5DialerDialer) Dial(network string, addr string) (gonet.Conn, error) {
+	return this.DialContext(context.Background(), network, addr)
+}
diff --git a/internal/imp/protocol/method-echo.go b/internal/imp/protocol/method-echo.go
new file mode 100644
index 0000000..6620f50
--- /dev/null
+++ b/internal/imp/protocol/method-echo.go
@@ -0,0 +1,88 @@
+package protocol
+
+import (
+	"context"
+
+	"github.com/vmihailenco/msgpack/v5"
+
+	"github.com/engity-com/bifroest/pkg/codec"
+	"github.com/engity-com/bifroest/pkg/connection"
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+type methodEchoRequest struct {
+	msg string
+}
+
+func (this methodEchoRequest) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this *methodEchoRequest) DecodeMsgpack(dec *msgpack.Decoder) (err error) {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this methodEchoRequest) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	if err := enc.EncodeString(this.msg); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *methodEchoRequest) DecodeMsgPack(dec codec.MsgPackDecoder) (err error) {
+	if this.msg, err = dec.DecodeString(); err != nil {
+		return err
+	}
+	return nil
+}
+
+type methodEchoResponse struct {
+	msg   string
+	error error
+}
+
+func (this methodEchoResponse) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this *methodEchoResponse) DecodeMsgpack(dec *msgpack.Decoder) (err error) {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this methodEchoResponse) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	if err := enc.EncodeString(this.msg); err != nil {
+		return err
+	}
+	if err := errors.EncodeMsgPack(this.error, enc); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *methodEchoResponse) DecodeMsgPack(dec codec.MsgPackDecoder) (err error) {
+	if this.msg, err = dec.DecodeString(); err != nil {
+		return err
+	}
+	if this.error, err = errors.DecodeMsgPack(dec); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *imp) handleMethodEcho(ctx context.Context, header *Header, conn codec.MsgPackConn) error {
+	return handleFromServerSide(ctx, header, conn, func(req *methodEchoRequest) methodEchoResponse {
+		return methodEchoResponse{msg: "thanks for: " + req.msg}
+	})
+}
+
+func (this *Master) methodEcho(ctx context.Context, ref Ref, connectionId connection.Id, msg string) (rsp string, err error) {
+	err = this.do(ctx, ref, connectionId, MethodEcho, func(header *Header, conn codec.MsgPackConn) error {
+		return handleFromClientSide(ctx, header, conn, methodEchoRequest{
+			msg: msg,
+		}, func(v *methodEchoResponse) error {
+			rsp = v.msg
+			return v.error
+		})
+	})
+	return rsp, err
+}
diff --git a/internal/imp/protocol/method-exit.go b/internal/imp/protocol/method-exit.go
new file mode 100644
index 0000000..b2191de
--- /dev/null
+++ b/internal/imp/protocol/method-exit.go
@@ -0,0 +1,81 @@
+package protocol
+
+import (
+	"context"
+	"os"
+
+	"github.com/vmihailenco/msgpack/v5"
+
+	"github.com/engity-com/bifroest/pkg/codec"
+	"github.com/engity-com/bifroest/pkg/connection"
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+type methodExitRequest struct {
+	exitCode int
+}
+
+func (this methodExitRequest) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this *methodExitRequest) DecodeMsgpack(dec *msgpack.Decoder) (err error) {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this methodExitRequest) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	if err := enc.EncodeInt(int64(this.exitCode)); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *methodExitRequest) DecodeMsgPack(dec codec.MsgPackDecoder) (err error) {
+	if this.exitCode, err = dec.DecodeInt(); err != nil {
+		return err
+	}
+	return nil
+}
+
+type methodExitResponse struct {
+	error error
+}
+
+func (this methodExitResponse) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this *methodExitResponse) DecodeMsgpack(dec *msgpack.Decoder) (err error) {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this methodExitResponse) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	if err := errors.EncodeMsgPack(this.error, enc); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *methodExitResponse) DecodeMsgPack(dec codec.MsgPackDecoder) (err error) {
+	if this.error, err = errors.DecodeMsgPack(dec); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *imp) handleMethodExit(ctx context.Context, header *Header, conn codec.MsgPackConn) error {
+	return handleFromServerSide(ctx, header, conn, func(req *methodExitRequest) methodExitResponse {
+		os.Exit(req.exitCode)
+		return methodExitResponse{}
+	})
+}
+
+func (this *Master) methodExit(ctx context.Context, ref Ref, connectionId connection.Id, exitCode int) error {
+	return this.do(ctx, ref, connectionId, MethodExit, func(header *Header, conn codec.MsgPackConn) error {
+		return handleFromClientSide(ctx, header, conn, methodExitRequest{
+			exitCode: exitCode,
+		}, func(v *methodExitResponse) error {
+			return v.error
+		})
+	})
+}
diff --git a/internal/imp/protocol/method-kill.go b/internal/imp/protocol/method-kill.go
new file mode 100644
index 0000000..526d260
--- /dev/null
+++ b/internal/imp/protocol/method-kill.go
@@ -0,0 +1,96 @@
+package protocol
+
+import (
+	"context"
+
+	"github.com/vmihailenco/msgpack/v5"
+
+	"github.com/engity-com/bifroest/pkg/codec"
+	"github.com/engity-com/bifroest/pkg/connection"
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/sys"
+)
+
+var (
+	ErrNoSuchProcess = errors.System.Newf("no such process")
+)
+
+type methodKillRequest struct {
+	pid    int
+	signal sys.Signal
+}
+
+func (this methodKillRequest) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this *methodKillRequest) DecodeMsgpack(dec *msgpack.Decoder) (err error) {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this methodKillRequest) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	if err := enc.EncodeInt(int64(this.pid)); err != nil {
+		return err
+	}
+	if err := this.signal.EncodeMsgPack(enc); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *methodKillRequest) DecodeMsgPack(dec codec.MsgPackDecoder) (err error) {
+	if this.pid, err = dec.DecodeInt(); err != nil {
+		return err
+	}
+	if err = this.signal.DecodeMsgPack(dec); err != nil {
+		return err
+	}
+	return nil
+}
+
+type methodKillResponse struct {
+	error error
+}
+
+func (this methodKillResponse) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this *methodKillResponse) DecodeMsgpack(dec *msgpack.Decoder) (err error) {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this methodKillResponse) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	if err := errors.EncodeMsgPack(this.error, enc); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *methodKillResponse) DecodeMsgPack(dec codec.MsgPackDecoder) (err error) {
+	if this.error, err = errors.DecodeMsgPack(dec); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *imp) handleMethodKill(ctx context.Context, header *Header, conn codec.MsgPackConn) error {
+	return handleFromServerSide(ctx, header, conn, func(req *methodKillRequest) methodKillResponse {
+		var rsp methodKillResponse
+		if err := this.kill(req.pid, req.signal); err != nil {
+			rsp.error = err
+		}
+		return rsp
+	})
+}
+
+func (this *Master) methodKill(ctx context.Context, ref Ref, connectionId connection.Id, pid int, signal sys.Signal) error {
+	return this.do(ctx, ref, connectionId, MethodKill, func(header *Header, conn codec.MsgPackConn) error {
+		return handleFromClientSide(ctx, header, conn, methodKillRequest{
+			pid:    pid,
+			signal: signal,
+		}, func(v *methodKillResponse) error {
+			return v.error
+		})
+	})
+}
diff --git a/internal/imp/protocol/method-kill_unix.go b/internal/imp/protocol/method-kill_unix.go
new file mode 100644
index 0000000..85eb3bb
--- /dev/null
+++ b/internal/imp/protocol/method-kill_unix.go
@@ -0,0 +1,23 @@
+//go:build unix
+
+package protocol
+
+import (
+	"os"
+
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/sys"
+)
+
+func (this *imp) kill(pid int, signal sys.Signal) error {
+	p, err := os.FindProcess(pid)
+	if err != nil {
+		return err
+	}
+	if err := p.Signal(signal.Native()); errors.Is(err, os.ErrProcessDone) {
+		return ErrNoSuchProcess
+	} else if err != nil {
+		return err
+	}
+	return nil
+}
diff --git a/internal/imp/protocol/method-kill_windows.go b/internal/imp/protocol/method-kill_windows.go
new file mode 100644
index 0000000..567f331
--- /dev/null
+++ b/internal/imp/protocol/method-kill_windows.go
@@ -0,0 +1,23 @@
+//go:build windows
+
+package protocol
+
+import (
+	"os"
+
+	"golang.org/x/sys/windows"
+
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/sys"
+)
+
+func (this *imp) kill(pid int, signal sys.Signal) error {
+	p, err := os.FindProcess(pid)
+	if errors.Is(err, windows.ERROR_INVALID_PARAMETER) {
+		return ErrNoSuchProcess
+	}
+	if err != nil {
+		return err
+	}
+	return p.Signal(signal.Native())
+}
diff --git a/internal/imp/protocol/method.go b/internal/imp/protocol/method.go
new file mode 100644
index 0000000..0842f74
--- /dev/null
+++ b/internal/imp/protocol/method.go
@@ -0,0 +1,121 @@
+package protocol
+
+import (
+	"context"
+
+	"github.com/vmihailenco/msgpack/v5"
+
+	"github.com/engity-com/bifroest/pkg/codec"
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+type Method uint8
+
+const (
+	MethodEcho Method = iota
+	MethodKill
+	MethodExit
+)
+
+var (
+	ErrIllegalMethod = errors.System.Newf("Illegal protocol method")
+)
+
+func (this Method) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this *Method) DecodeMsgpack(dec *msgpack.Decoder) error {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this Method) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	if err := enc.EncodeUint8(uint8(this)); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *Method) DecodeMsgPack(dec codec.MsgPackDecoder) error {
+	plain, err := dec.DecodeUint8()
+	if err != nil {
+		return err
+	}
+	buf := Method(plain)
+	if err := buf.Validate(); err != nil {
+		return err
+	}
+	*this = buf
+	return nil
+}
+
+func (this Method) Validate() error {
+	_, ok := protocolMethodToString[this]
+	if !ok {
+		return errors.System.Newf("%w: %d", ErrIllegalMethod, this)
+	}
+	return nil
+}
+
+var (
+	stringToProtocolMethod = map[string]Method{
+		"echo": MethodEcho,
+		"kill": MethodKill,
+		"exit": MethodExit,
+	}
+	protocolMethodToString = func(in map[string]Method) map[Method]string {
+		result := make(map[Method]string, len(in))
+		for k, v := range in {
+			result[v] = k
+		}
+		return result
+	}(stringToProtocolMethod)
+)
+
+func handleFromServerSide[
+	REQ any, REQP interface {
+		DecodeMsgPack(dec codec.MsgPackDecoder) error
+		*REQ
+	},
+	RSP codec.MsgPackCustomEncoder,
+](_ context.Context, header *Header, conn codec.MsgPackConn, action func(REQP) RSP) error {
+	fail := func(err error) error {
+		return errors.Network.Newf("handling %v failed: %w", header.Method, err)
+	}
+
+	var req REQP = new(REQ)
+	if err := req.DecodeMsgPack(conn); err != nil {
+		return fail(err)
+	}
+
+	rsp := action(req)
+
+	if err := rsp.EncodeMsgPack(conn); err != nil {
+		return fail(err)
+	}
+
+	return nil
+}
+
+func handleFromClientSide[
+	RSP any, RSPP interface {
+		DecodeMsgPack(dec codec.MsgPackDecoder) error
+		*RSP
+	},
+	REQ codec.MsgPackCustomEncoder,
+](_ context.Context, header *Header, conn codec.MsgPackConn, req REQ, action func(RSPP) error) error {
+	fail := func(err error) error {
+		return errors.Network.Newf("handling %v failed: %w", header.Method, err)
+	}
+
+	if err := req.EncodeMsgPack(conn); err != nil {
+		return fail(err)
+	}
+
+	var rsp RSPP = new(RSP)
+	if err := rsp.DecodeMsgPack(conn); err != nil {
+		return fail(err)
+	}
+
+	return action(rsp)
+}
diff --git a/internal/imp/protocol/mux-listener.go b/internal/imp/protocol/mux-listener.go
new file mode 100644
index 0000000..65a0449
--- /dev/null
+++ b/internal/imp/protocol/mux-listener.go
@@ -0,0 +1,152 @@
+package protocol
+
+import (
+	"fmt"
+	"io"
+	gonet "net"
+	"sync/atomic"
+
+	"github.com/things-go/go-socks5/statute"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/net"
+)
+
+func NewMuxListener(of gonet.Listener) MuxListener {
+	result := &muxListener{
+		Listener: of,
+	}
+	result.rpc.muxListener = result
+	result.rpc.connChan = make(chan gonet.Conn, 1)
+	result.rpc.errChan = make(chan error, 1)
+	result.socks5.muxListener = result
+	result.socks5.connChan = make(chan gonet.Conn, 1)
+	result.socks5.errChan = make(chan error, 1)
+	go result.run()
+	return result
+}
+
+type MuxListener interface {
+	io.Closer
+	Rpc() gonet.Listener
+	Socks5() gonet.Listener
+}
+
+type muxListener struct {
+	gonet.Listener
+
+	rpc    muxListenerChild
+	socks5 muxListenerChild
+}
+
+func (this *muxListener) run() struct{} {
+	fail := func(err error) struct{} {
+		this.rpc.sendErr(err)
+		this.socks5.sendErr(err)
+		return struct{}{}
+	}
+	for {
+		conn, err := this.Accept()
+		if net.IsClosedError(err) {
+			this.closeChans()
+			return struct{}{}
+		}
+		if err != nil {
+			return fail(err)
+		}
+
+		if err := this.handleNewConn(conn); err != nil {
+			return fail(err)
+		}
+	}
+}
+
+func (this *muxListener) handleNewConn(conn gonet.Conn) error {
+	success := false
+	defer common.IgnoreCloseErrorIfFalse(&success, conn)
+
+	bc := NewBufConn(conn)
+	peek, err := bc.Peek(1)
+	if net.IsClosedError(err) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	switch peek[0] {
+	case statute.VersionSocks5:
+		this.socks5.connChan <- bc
+	case HeaderMagic:
+		this.rpc.connChan <- bc
+	default:
+		return fmt.Errorf("invalid magic; got %d (supported is socks5=%d, rpc=%d)", peek[0], statute.VersionSocks5, HeaderMagic)
+	}
+	success = true
+	return nil
+}
+
+func (this *muxListener) Rpc() gonet.Listener {
+	return &this.rpc
+}
+
+func (this *muxListener) Socks5() gonet.Listener {
+	return &this.socks5
+}
+
+func (this *muxListener) Close() error {
+	defer this.closeChans()
+	return this.Listener.Close()
+}
+
+func (this *muxListener) closeChans() {
+	defer this.rpc.close()
+	defer this.socks5.close()
+}
+
+type muxListenerChild struct {
+	*muxListener
+	connChan       chan gonet.Conn
+	connChanClosed atomic.Bool
+	errChan        chan error
+	errChanClosed  atomic.Bool
+}
+
+func (this *muxListenerChild) sendErr(err error) {
+	if this.errChanClosed.Load() {
+		return
+	}
+	defer func() {
+		if e := recover(); e != nil && e != "send on closed channel" {
+			panic(e)
+		}
+	}()
+	this.errChan <- err
+}
+
+func (this *muxListenerChild) Accept() (gonet.Conn, error) {
+	select {
+	case result, ok := <-this.connChan:
+		if !ok {
+			return nil, io.ErrClosedPipe
+		}
+		return result, nil
+	case err, ok := <-this.errChan:
+		if !ok {
+			return nil, io.ErrClosedPipe
+		}
+		return nil, err
+	}
+}
+
+func (this *muxListenerChild) close() {
+	defer func() {
+		if this.connChanClosed.CompareAndSwap(false, true) {
+			close(this.connChan)
+		}
+	}()
+	defer func() {
+		if this.errChanClosed.CompareAndSwap(false, true) {
+			close(this.errChan)
+		}
+	}()
+}
diff --git a/mkdocs.yml b/mkdocs.yml
index 84e8033..e31d4e5 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -126,6 +126,9 @@ nav:
       - Use cases: usecases.md
   - Getting started:
       - setup/index.md
+      - Installation:
+          - On Host: setup/on-host.md
+          - In Docker: setup/in-docker.md
       - setup/distribution.md
       - Security: setup/security.md
       - License: legal/license.md
@@ -142,26 +145,33 @@ nav:
           - OIDC: reference/authorization/oidc.md
           - Simple: reference/authorization/simple.md
           - Htpasswd: reference/authorization/htpasswd.md
+          - None: reference/authorization/none.md
       - Environments:
           - reference/environment/index.md
+          - Docker: reference/environment/docker.md
           - Local: reference/environment/local.md
+          - Dummy: reference/environment/dummy.md
       - Sessions:
           - reference/session/index.md
           - Filesystem: reference/session/fs.md
       - reference/housekeeping.md
+      - reference/alternatives.md
       - reference/cli.md
       - Templating:
           - reference/templating/index.md
       - Context Objects:
           - reference/context/index.md
+          - Alternative Binary: reference/context/alternative-binary.md
           - Authorization: reference/context/authorization.md
           - Authorization Request: reference/context/authorization-request.md
           - Connection: reference/context/connection.md
+          - Core: reference/context/core.md
           - Local Group: reference/context/local-group.md
           - Local User: reference/context/local-user.md
           - OIDC Token: reference/context/oidc-token.md
           - OIDC ID Token: reference/context/oidc-id-token.md
           - OIDC User Info: reference/context/oidc-user-info.md
+          - Preparation Process: reference/context/preparation-process.md
           - Remote: reference/context/remote.md
           - Simple Entry: reference/context/simple-entry.md
       - reference/data-type.md
diff --git a/pkg/alternatives/binaries.go b/pkg/alternatives/binaries.go
new file mode 100644
index 0000000..3d437dc
--- /dev/null
+++ b/pkg/alternatives/binaries.go
@@ -0,0 +1,216 @@
+package alternatives
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/url"
+	goos "os"
+	"path/filepath"
+	"runtime"
+
+	log "github.com/echocat/slf4g"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/sys"
+)
+
+type Provider interface {
+	io.Closer
+	FindBinaryFor(ctx context.Context, os, arch string) (string, error)
+}
+
+func NewProvider(_ context.Context, version common.Version, conf *configuration.Alternatives) (Provider, error) {
+	return &provider{
+		conf:    conf,
+		version: version,
+	}, nil
+}
+
+type provider struct {
+	conf    *configuration.Alternatives
+	version common.Version
+
+	Logger log.Logger
+}
+
+func (this *provider) FindBinaryFor(ctx context.Context, hostOs, hostArch string) (_ string, rErr error) {
+	fail := func(err error) (string, error) {
+		return "", err
+	}
+	failf := func(t errors.Type, msg string, args ...any) (string, error) {
+		return fail(errors.Newf(t, msg, args...))
+	}
+
+	l := this.logger().
+		With("os", hostOs).
+		With("arch", hostArch).
+		With("version", this.version.Version())
+
+	if sys.IsBinaryCompatibleWithHost(runtime.GOOS, hostOs, runtime.GOARCH, hostArch) {
+		result, err := goos.Executable()
+		if err != nil {
+			return failf(errors.System, "cannot resolve the location of the server's executable location: %w", err)
+		}
+		l.Debug("requested imp binaries does match current binary; returning itself")
+		return result, nil
+	}
+
+	fn, err := this.alternativesLocationFor(hostOs, hostArch)
+	if err != nil {
+		return fail(err)
+	}
+	if fn == "" {
+		l.Debug("imp alternatives location resolves to empty")
+		return "", nil
+	}
+	l = l.With("location", fn)
+
+	i, err := goos.Stat(fn)
+	if sys.IsNotExist(err) {
+		// Ok, lets try to download it...
+	} else if err != nil {
+		return failf(errors.System, "cannot load information of alternative location file %q: %w", fn, err)
+	} else if i.IsDir() || i.Size() == 0 {
+		if err := goos.RemoveAll(fn); err != nil {
+			return failf(errors.System, "cannot remove old alternative location file %q: %w", fn, err)
+		}
+		l.Warn("existing imp alternatives location which is broken exists and was deleted")
+	} else {
+		l.Debug("existing imp alternatives location was returned")
+		return fn, nil
+	}
+
+	du, err := this.alternativesDownloadUrlFor(hostOs, hostArch)
+	if err != nil {
+		return fail(err)
+	}
+	if du == nil {
+		l.Debug("there does no existing imp alternatives exists at location and the download url resolves to empty")
+		return "", nil
+	}
+
+	l = l.With("url", du)
+
+	l.Info("there is no existing imp alternative existing; downloading it...")
+
+	req, err := http.NewRequest(http.MethodGet, du.String(), nil)
+	if err != nil {
+		return fail(err)
+	}
+	req = req.WithContext(ctx)
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return failf(errors.System, "cannot download imp alternative from %v: %w", du, err)
+	}
+	if resp.StatusCode != http.StatusOK {
+		return failf(errors.System, "cannot download imp alternative from %v: expected status code %d; but got: %d", du, http.StatusOK, resp.StatusCode)
+	}
+	defer common.IgnoreCloseError(resp.Body)
+
+	if err := goos.MkdirAll(filepath.Dir(fn), 0755); err != nil {
+		return failf(errors.System, "cannot create directory to store imp alternative %v inside: %w", fn, err)
+	}
+
+	out, err := goos.OpenFile(fn, goos.O_CREATE|goos.O_TRUNC|goos.O_WRONLY, 0644)
+	if err != nil {
+		return failf(errors.System, "cannot create target file %q to store imp alternative inside: %w", fn, err)
+	}
+	defer common.KeepCloseError(&rErr, out)
+
+	if _, err := io.Copy(out, resp.Body); err != nil {
+		return failf(errors.System, "cannot store %q into target file %q to store imp alternative inside: %w", du, fn, err)
+	}
+
+	l.Info("there is no existing imp alternative existing; downloading it... DONE!")
+
+	return fn, nil
+}
+
+func (this *provider) alternativesLocationFor(os, arch string) (string, error) {
+	fail := func(err error) (string, error) {
+		return "", err
+	}
+	failf := func(t errors.Type, msg string, args ...any) (string, error) {
+		return fail(errors.Newf(t, msg, args...))
+	}
+
+	ctx := alternativeResolutionContext{os, arch, this.version.Version()}
+	result, err := this.conf.Location.Render(ctx)
+	if err != nil {
+		return failf(errors.Config, "cannot resolve imp alternative location: %w", err)
+	}
+	return result, nil
+}
+
+func (this *provider) alternativesDownloadUrlFor(os, arch string) (*url.URL, error) {
+	fail := func(err error) (*url.URL, error) {
+		return nil, err
+	}
+	failf := func(t errors.Type, msg string, args ...any) (*url.URL, error) {
+		return fail(errors.Newf(t, msg, args...))
+	}
+
+	ctx := alternativeResolutionContext{os, arch, this.version.Version()}
+	result, err := this.conf.DownloadUrl.Render(ctx)
+	if err != nil {
+		return failf(errors.Config, "cannot resolve imp alternative download url: %w", err)
+	}
+	return result, nil
+}
+
+func (this *provider) logger() log.Logger {
+	if v := this.Logger; v != nil {
+		return v
+	}
+	return log.GetLogger("imp.binaries")
+}
+
+func (this *provider) Close() error {
+	return nil
+}
+
+type alternativeResolutionContext struct {
+	Os           string
+	Architecture string
+	Version      string
+}
+
+func (this alternativeResolutionContext) Ext() string {
+	switch this.Os {
+	case "windows":
+		return ".exe"
+	default:
+		return ""
+	}
+}
+func (this alternativeResolutionContext) PackageExt() string {
+	switch this.Os {
+	case "windows":
+		return ".zip"
+	default:
+		return ".tgz"
+	}
+}
+
+func (this alternativeResolutionContext) GetField(name string) (any, bool, error) {
+	switch name {
+	case "os":
+		return this.Os, true, nil
+	case "architecture", "arch":
+		return this.Architecture, true, nil
+	case "version":
+		return this.Version, true, nil
+	case "edition":
+		return "generic", true, nil
+	case "ext":
+		return this.Ext(), true, nil
+	case "packageExt":
+		return this.PackageExt(), true, nil
+	default:
+		return nil, false, nil
+	}
+}
diff --git a/pkg/authorization/authorization.go b/pkg/authorization/authorization.go
index 4d3217b..da7a0ec 100644
--- a/pkg/authorization/authorization.go
+++ b/pkg/authorization/authorization.go
@@ -2,11 +2,12 @@ package authorization
 
 import (
 	"context"
+	"fmt"
 
 	"golang.org/x/crypto/ssh"
 
-	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/net"
 	"github.com/engity-com/bifroest/pkg/session"
 	"github.com/engity-com/bifroest/pkg/sys"
 )
@@ -15,21 +16,21 @@ type Authorization interface {
 	IsAuthorized() bool
 	EnvVars() sys.EnvVars
 	Flow() configuration.FlowName
-	Remote() common.Remote
+	Remote() net.Remote
 	FindSession() session.Session
 	FindSessionsPublicKey() ssh.PublicKey
 	Dispose(context.Context) (bool, error)
 }
 
-func Forbidden(remote common.Remote) Authorization {
+func Forbidden(remote net.Remote) Authorization {
 	return &forbiddenResponse{remote}
 }
 
 type forbiddenResponse struct {
-	remote common.Remote
+	remote net.Remote
 }
 
-func (this forbiddenResponse) Remote() common.Remote {
+func (this forbiddenResponse) Remote() net.Remote {
 	return this.remote
 }
 
@@ -56,3 +57,9 @@ func (this forbiddenResponse) FindSession() session.Session {
 func (this forbiddenResponse) Dispose(context.Context) (bool, error) {
 	return false, nil
 }
+
+func (this *forbiddenResponse) GetField(name string, ce ContextEnabled) (any, bool, error) {
+	return getField(name, ce, this, func() (any, bool, error) {
+		return nil, false, fmt.Errorf("unknown field %q", name)
+	})
+}
diff --git a/pkg/authorization/htpasswd.go b/pkg/authorization/htpasswd.go
index 607cfb1..6ef6442 100644
--- a/pkg/authorization/htpasswd.go
+++ b/pkg/authorization/htpasswd.go
@@ -6,21 +6,21 @@ import (
 
 	"golang.org/x/crypto/ssh"
 
-	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/net"
 	"github.com/engity-com/bifroest/pkg/session"
 	"github.com/engity-com/bifroest/pkg/sys"
 )
 
 type htpasswd struct {
-	remote            common.Remote
+	remote            net.Remote
 	envVars           sys.EnvVars
 	flow              configuration.FlowName
 	session           session.Session
 	sessionsPublicKey ssh.PublicKey
 }
 
-func (this *htpasswd) Remote() common.Remote {
+func (this *htpasswd) Remote() net.Remote {
 	return this.remote
 }
 
@@ -48,7 +48,7 @@ func (this *htpasswd) GetField(name string, ce ContextEnabled) (any, bool, error
 	return getField(name, ce, this, func() (any, bool, error) {
 		switch name {
 		case "user":
-			return this.Remote(), true, nil
+			return this.Remote().User(), true, nil
 		default:
 			return nil, false, fmt.Errorf("unknown field %q", name)
 		}
diff --git a/pkg/authorization/local.go b/pkg/authorization/local.go
index de957b6..b2172d3 100644
--- a/pkg/authorization/local.go
+++ b/pkg/authorization/local.go
@@ -8,8 +8,8 @@ import (
 
 	"golang.org/x/crypto/ssh"
 
-	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/net"
 	"github.com/engity-com/bifroest/pkg/session"
 	"github.com/engity-com/bifroest/pkg/sys"
 	"github.com/engity-com/bifroest/pkg/user"
@@ -17,14 +17,14 @@ import (
 
 type local struct {
 	user              *user.User
-	remote            common.Remote
+	remote            net.Remote
 	envVars           sys.EnvVars
 	flow              configuration.FlowName
 	session           session.Session
 	sessionsPublicKey ssh.PublicKey
 }
 
-func (this *local) Remote() common.Remote {
+func (this *local) Remote() net.Remote {
 	return this.remote
 }
 
diff --git a/pkg/authorization/none-authorizer.go b/pkg/authorization/none-authorizer.go
new file mode 100644
index 0000000..6436c08
--- /dev/null
+++ b/pkg/authorization/none-authorizer.go
@@ -0,0 +1,150 @@
+package authorization
+
+import (
+	"context"
+	"fmt"
+
+	log "github.com/echocat/slf4g"
+
+	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/session"
+)
+
+var (
+	_ = RegisterAuthorizer(NewNone)
+)
+
+type NoneAuthorizer struct {
+	flow configuration.FlowName
+	conf *configuration.AuthorizationNone
+
+	Logger log.Logger
+}
+
+func NewNone(_ context.Context, flow configuration.FlowName, conf *configuration.AuthorizationNone) (*NoneAuthorizer, error) {
+	fail := func(err error) (*NoneAuthorizer, error) {
+		return nil, err
+	}
+	failf := func(msg string, args ...any) (*NoneAuthorizer, error) {
+		return fail(errors.Newf(errors.Config, msg, args...))
+	}
+
+	if conf == nil {
+		return failf("nil configuration")
+	}
+
+	result := NoneAuthorizer{
+		flow: flow,
+		conf: conf,
+	}
+
+	return &result, nil
+}
+
+func (this *NoneAuthorizer) AuthorizePublicKey(req PublicKeyRequest) (Authorization, error) {
+	fail := func(err error) (Authorization, error) {
+		return nil, fmt.Errorf("cannot authorize none %q via authorized keys: %w", req.Remote().User(), err)
+	}
+	failf := func(message string, args ...any) (Authorization, error) {
+		return fail(fmt.Errorf(message, args...))
+	}
+
+	auth := &none{
+		req.Remote(),
+		nil,
+		this.flow,
+		nil,
+		nil,
+	}
+
+	sess, err := req.Sessions().FindByPublicKey(req.Context(), req.RemotePublicKey(), (&session.FindOpts{}).WithPredicate(
+		session.IsFlow(this.flow),
+		session.IsStillValid,
+		session.IsRemoteName(req.Remote().User()),
+	))
+	if errors.Is(err, session.ErrNoSuchSession) {
+		sess, err = req.Sessions().Create(req.Context(), this.flow, req.Remote(), nil)
+		if err != nil {
+			return fail(err)
+		}
+
+		auth.session = sess
+	} else if err != nil {
+		return failf("cannot find session: %w", err)
+	} else {
+		auth.session = sess
+		auth.sessionsPublicKey = req.RemotePublicKey()
+	}
+
+	return auth, nil
+}
+
+func (this *NoneAuthorizer) AuthorizePassword(req PasswordRequest) (Authorization, error) {
+	fail := func(err error) (Authorization, error) {
+		return nil, fmt.Errorf("cannot authorize none %q via password: %w", req.Remote().User(), err)
+	}
+
+	sess, err := req.Sessions().Create(req.Context(), this.flow, req.Remote(), nil)
+	if err != nil {
+		return fail(err)
+	}
+
+	return &none{
+		req.Remote(),
+		nil,
+		this.flow,
+		sess,
+		nil,
+	}, nil
+}
+
+func (this *NoneAuthorizer) AuthorizeInteractive(req InteractiveRequest) (Authorization, error) {
+	fail := func(err error) (Authorization, error) {
+		return nil, fmt.Errorf("cannot authorize none %q via password: %w", req.Remote().User(), err)
+	}
+
+	sess, err := req.Sessions().Create(req.Context(), this.flow, req.Remote(), nil)
+	if err != nil {
+		return fail(err)
+	}
+
+	return &none{
+		req.Remote(),
+		nil,
+		this.flow,
+		sess,
+		nil,
+	}, nil
+}
+
+func (this *NoneAuthorizer) RestoreFromSession(ctx context.Context, sess session.Session, _ *RestoreOpts) (Authorization, error) {
+	failf := func(t errors.Type, msg string, args ...any) (Authorization, error) {
+		args = append([]any{sess}, args...)
+		return nil, errors.Newf(t, "cannot restore authorization from session %v: "+msg, args...)
+	}
+	if !sess.Flow().IsEqualTo(this.flow) {
+		return nil, ErrNoSuchAuthorization
+	}
+
+	si, err := sess.Info(ctx)
+	if err != nil {
+		return failf(errors.System, "cannot retrieve session's info: %w", err)
+	}
+	sla, err := si.LastAccessed(ctx)
+	if err != nil {
+		return failf(errors.System, "cannot retrieve session's last accessed: %w", err)
+	}
+
+	return &none{
+		sla.Remote(),
+		nil,
+		this.flow.Clone(),
+		sess,
+		nil,
+	}, nil
+}
+
+func (this *NoneAuthorizer) Close() error {
+	return nil
+}
diff --git a/pkg/authorization/none.go b/pkg/authorization/none.go
new file mode 100644
index 0000000..f758c22
--- /dev/null
+++ b/pkg/authorization/none.go
@@ -0,0 +1,59 @@
+package authorization
+
+import (
+	"context"
+	"fmt"
+
+	"golang.org/x/crypto/ssh"
+
+	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/net"
+	"github.com/engity-com/bifroest/pkg/session"
+	"github.com/engity-com/bifroest/pkg/sys"
+)
+
+type none struct {
+	remote            net.Remote
+	envVars           sys.EnvVars
+	flow              configuration.FlowName
+	session           session.Session
+	sessionsPublicKey ssh.PublicKey
+}
+
+func (this *none) Remote() net.Remote {
+	return this.remote
+}
+
+func (this *none) IsAuthorized() bool {
+	return true
+}
+
+func (this *none) EnvVars() sys.EnvVars {
+	return this.envVars
+}
+
+func (this *none) Flow() configuration.FlowName {
+	return this.flow
+}
+
+func (this *none) FindSession() session.Session {
+	return this.session
+}
+
+func (this *none) FindSessionsPublicKey() ssh.PublicKey {
+	return this.sessionsPublicKey
+}
+
+func (this *none) GetField(name string, ce ContextEnabled) (any, bool, error) {
+	return getField(name, ce, this, func() (any, bool, error) {
+		return nil, false, fmt.Errorf("unknown field %q", name)
+	})
+}
+
+func (this *none) Dispose(context.Context) (bool, error) {
+	sess := this.session
+	if sess == nil {
+		return false, nil
+	}
+	return true, nil
+}
diff --git a/pkg/authorization/oidc-device-auth-authorizer.go b/pkg/authorization/oidc-device-auth-authorizer.go
index b0f3e0c..51c08fd 100644
--- a/pkg/authorization/oidc-device-auth-authorizer.go
+++ b/pkg/authorization/oidc-device-auth-authorizer.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"strings"
 
 	coidc "github.com/coreos/go-oidc/v3/oidc"
 	log "github.com/echocat/slf4g"
@@ -45,9 +46,36 @@ func NewOidcDeviceAuth(ctx context.Context, flow configuration.FlowName, conf *c
 		return failf("nil configuration")
 	}
 
-	provider, err := coidc.NewProvider(ctx, conf.Issuer)
+	rCtx := noopContext{}
+	issuer, err := conf.Issuer.Render(rCtx)
 	if err != nil {
-		return failf("cannot evaluate OIDC issuer %q: %w", conf.Issuer, err)
+		return failf("cannot render issuer: %w", err)
+	}
+
+	provider, err := coidc.NewProvider(ctx, issuer.String())
+	if err != nil {
+		return failf("cannot evaluate OIDC issuer %q: %w", issuer, err)
+	}
+
+	clientId, err := conf.ClientId.Render(rCtx)
+	if err != nil {
+		return failf("cannot render clientId: %w", err)
+	}
+	clientSecret, err := conf.ClientSecret.Render(rCtx)
+	if err != nil {
+		return failf("cannot render clientSecret: %w", err)
+	}
+	rawScopes, err := conf.Scopes.Render(rCtx)
+	if err != nil {
+		return failf("cannot render scopes: %w", err)
+	}
+	var scopes []string
+	for _, rawScope := range rawScopes {
+		rawScope = strings.TrimSpace(rawScope)
+		if rawScope == "" {
+			continue
+		}
+		scopes = append(scopes, rawScope)
 	}
 
 	result := OidcDeviceAuthAuthorizer{
@@ -55,20 +83,22 @@ func NewOidcDeviceAuth(ctx context.Context, flow configuration.FlowName, conf *c
 		conf: conf,
 
 		oauth2Config: oauth2.Config{
-			ClientID:     conf.ClientId,
-			ClientSecret: conf.ClientSecret,
+			ClientID:     clientId,
+			ClientSecret: clientSecret,
 			Endpoint:     provider.Endpoint(),
-			Scopes:       conf.Scopes,
+			Scopes:       scopes,
 		},
 		provider: provider,
 		verifier: provider.Verifier(&coidc.Config{
-			ClientID: conf.ClientId,
+			ClientID: clientId,
 		}),
 	}
 
 	return &result, nil
 }
 
+type noopContext struct{}
+
 func (this *OidcDeviceAuthAuthorizer) RestoreFromSession(ctx context.Context, sess session.Session, opts *RestoreOpts) (Authorization, error) {
 	fail := func(err error) (Authorization, error) {
 		return nil, errors.Newf(errors.System, "cannot restore authorization from session %v: %w", sess, err)
diff --git a/pkg/authorization/oidc.go b/pkg/authorization/oidc.go
index fc7e2b8..d0a601a 100644
--- a/pkg/authorization/oidc.go
+++ b/pkg/authorization/oidc.go
@@ -9,8 +9,8 @@ import (
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/oauth2"
 
-	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/net"
 	"github.com/engity-com/bifroest/pkg/session"
 	"github.com/engity-com/bifroest/pkg/sys"
 )
@@ -19,7 +19,7 @@ type oidc struct {
 	token             OidcToken
 	idToken           OidcIdToken
 	userInfo          OidcUserInfo
-	remote            common.Remote
+	remote            net.Remote
 	flow              configuration.FlowName
 	session           session.Session
 	sessionsPublicKey ssh.PublicKey
@@ -40,7 +40,7 @@ func (this *oidc) GetField(name string, ce ContextEnabled) (any, bool, error) {
 	})
 }
 
-func (this *oidc) Remote() common.Remote {
+func (this *oidc) Remote() net.Remote {
 	return this.remote
 }
 
diff --git a/pkg/authorization/request.go b/pkg/authorization/request.go
index f60ee26..9b2dec3 100644
--- a/pkg/authorization/request.go
+++ b/pkg/authorization/request.go
@@ -5,14 +5,14 @@ import (
 	"github.com/gliderlabs/ssh"
 	gssh "golang.org/x/crypto/ssh"
 
-	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/net"
 	"github.com/engity-com/bifroest/pkg/session"
 )
 
 type Request interface {
 	Sessions() session.Repository
 	Context() ssh.Context
-	Remote() common.Remote
+	Remote() net.Remote
 	Logger() log.Logger
 	Validate(Authorization) (bool, error)
 }
diff --git a/pkg/authorization/simple-authorizer.go b/pkg/authorization/simple-authorizer.go
index 5a4a96b..52d08a3 100644
--- a/pkg/authorization/simple-authorizer.go
+++ b/pkg/authorization/simple-authorizer.go
@@ -214,7 +214,9 @@ func (this *SimpleAuthorizer) AuthorizePassword(req PasswordRequest) (Authorizat
 		return Forbidden(req.Remote()), nil
 	}
 
-	if expected := entry.Password; expected.IsZero() {
+	if expected, err := entry.GetPassword(); err != nil {
+		return failf("cannot get password of entry %q: %w", entry.Name, err)
+	} else if expected.IsZero() {
 		return Forbidden(req.Remote()), nil
 	} else if ok, err := expected.Compare([]byte(req.RemotePassword())); err != nil || !ok {
 		return Forbidden(req.Remote()), nil
@@ -251,7 +253,9 @@ func (this *SimpleAuthorizer) AuthorizeInteractive(req InteractiveRequest) (Auth
 		return fail(err)
 	}
 
-	if expected := entry.Password; expected.IsZero() {
+	if expected, err := entry.GetPassword(); err != nil {
+		return failf("cannot get password of entry %q: %w", entry.Name, err)
+	} else if expected.IsZero() {
 		return Forbidden(req.Remote()), nil
 	} else if ok, err := expected.Compare([]byte(pass)); err != nil || !ok {
 		return Forbidden(req.Remote()), nil
diff --git a/pkg/authorization/simple.go b/pkg/authorization/simple.go
index 6511432..73b76bb 100644
--- a/pkg/authorization/simple.go
+++ b/pkg/authorization/simple.go
@@ -6,22 +6,22 @@ import (
 
 	"golang.org/x/crypto/ssh"
 
-	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/net"
 	"github.com/engity-com/bifroest/pkg/session"
 	"github.com/engity-com/bifroest/pkg/sys"
 )
 
 type simple struct {
 	entry             *configuration.AuthorizationSimpleEntry
-	remote            common.Remote
+	remote            net.Remote
 	envVars           sys.EnvVars
 	flow              configuration.FlowName
 	session           session.Session
 	sessionsPublicKey ssh.PublicKey
 }
 
-func (this *simple) Remote() common.Remote {
+func (this *simple) Remote() net.Remote {
 	return this.remote
 }
 
diff --git a/pkg/codec/msgpack.go b/pkg/codec/msgpack.go
new file mode 100644
index 0000000..f022d06
--- /dev/null
+++ b/pkg/codec/msgpack.go
@@ -0,0 +1,178 @@
+package codec
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"net"
+	"reflect"
+	"sync"
+	"time"
+
+	"github.com/vmihailenco/msgpack/v5"
+)
+
+func GetPooledBufReader(r io.Reader) *bufio.Reader {
+	result := bufReaders.Get().(*bufio.Reader)
+	result.Reset(r)
+	return result
+}
+
+func ReleasePooledBufReader(v *bufio.Reader) {
+	bufReaders.Put(v)
+}
+
+func GetPooledMsgPackDecoder(r io.Reader) *msgpack.Decoder {
+	bufReader := GetPooledBufReader(r)
+	result := decoders.Get().(*msgpack.Decoder)
+	result.Reset(bufReader)
+	return result
+}
+
+func ReleasePooledMsgPackDecoder(v *msgpack.Decoder) {
+	decoders.Put(v)
+	ReleasePooledBufReader(v.Buffered().(*bufio.Reader))
+}
+
+func GetPooledMsgPackEncoder(w io.Writer) *msgpack.Encoder {
+	result := encoders.Get().(*msgpack.Encoder)
+	result.Reset(w)
+	return result
+}
+
+func ReleasePooledMsgPackEncoder(v *msgpack.Encoder) {
+	encoders.Put(v)
+}
+
+func GetPooledMsgPackConn(conn net.Conn) MsgPackConn {
+	result := msgPackConns.Get().(*msgPackConn)
+	result.Conn = conn
+	result.Encoder = GetPooledMsgPackEncoder(conn)
+	result.Decoder = GetPooledMsgPackDecoder(conn)
+	return result
+}
+
+func ReleasePooledMsgPackConn(v MsgPackConn) {
+	instance, ok := v.(*msgPackConn)
+	if !ok {
+		panic(fmt.Errorf("unsupported connection %T", v))
+	}
+	ReleasePooledMsgPackEncoder(instance.Encoder)
+	ReleasePooledMsgPackDecoder(instance.Decoder)
+	msgPackConns.Put(instance)
+}
+
+type MsgPackEncoder interface {
+	Writer() io.Writer
+	Encode(v any) error
+	EncodeMulti(v ...any) error
+	EncodeValue(v reflect.Value) error
+	EncodeNil() error
+	EncodeBool(value bool) error
+	EncodeDuration(d time.Duration) error
+	EncodeMap(m map[string]any) error
+	EncodeMapSorted(m map[string]any) error
+	EncodeMapLen(l int) error
+	EncodeUint8(n uint8) error
+	EncodeUint16(n uint16) error
+	EncodeUint32(n uint32) error
+	EncodeUint64(n uint64) error
+	EncodeInt8(n int8) error
+	EncodeInt16(n int16) error
+	EncodeInt32(n int32) error
+	EncodeInt64(n int64) error
+	EncodeUint(n uint64) error
+	EncodeInt(n int64) error
+	EncodeFloat32(n float32) error
+	EncodeFloat64(n float64) error
+	EncodeBytesLen(l int) error
+	EncodeString(v string) error
+	EncodeBytes(v []byte) error
+	EncodeArrayLen(l int) error
+}
+
+type MsgPackDecoder interface {
+	Buffered() io.Reader
+	Decode(v any) error
+	DecodeMulti(v ...any) error
+	DecodeValue(v reflect.Value) error
+	DecodeNil() error
+	DecodeBool() (bool, error)
+	DecodeDuration() (time.Duration, error)
+	DecodeInterface() (any, error)
+	DecodeInterfaceLoose() (any, error)
+	DecodeRaw() (msgpack.RawMessage, error)
+	DecodeMapLen() (int, error)
+	DecodeMap() (map[string]any, error)
+	DecodeUntypedMap() (map[any]any, error)
+	DecodeTypedMap() (any, error)
+	DecodeFloat32() (float32, error)
+	DecodeFloat64() (float64, error)
+	DecodeUint() (uint, error)
+	DecodeUint8() (uint8, error)
+	DecodeUint16() (uint16, error)
+	DecodeUint32() (uint32, error)
+	DecodeUint64() (uint64, error)
+	DecodeInt() (int, error)
+	DecodeInt8() (int8, error)
+	DecodeInt16() (int16, error)
+	DecodeInt32() (int32, error)
+	DecodeInt64() (int64, error)
+	Query(query string) ([]any, error)
+	DecodeArrayLen() (int, error)
+	DecodeSlice() ([]any, error)
+	DecodeBytes() ([]byte, error)
+	DecodeString() (string, error)
+}
+
+type MsgPackConn interface {
+	net.Conn
+	MsgPackEncoder
+	MsgPackDecoder
+}
+
+type MsgPackCustomDecoder interface {
+	DecodeMsgPack(dec MsgPackDecoder) error
+}
+
+type MsgPackCustomEncoder interface {
+	EncodeMsgPack(enc MsgPackEncoder) error
+}
+
+type msgPackConn struct {
+	net.Conn
+	*msgpack.Encoder
+	*msgpack.Decoder
+}
+
+func (this *msgPackConn) Close() error {
+	defer ReleasePooledMsgPackConn(this)
+	return this.Conn.Close()
+}
+
+var (
+	bufReaders = sync.Pool{
+		New: func() any {
+			return bufio.NewReader(nil)
+		},
+	}
+	decoders = sync.Pool{
+		New: func() any {
+			dec := msgpack.NewDecoder(nil)
+			return dec
+		},
+	}
+	encoders = sync.Pool{
+		New: func() any {
+			enc := msgpack.NewEncoder(nil)
+			enc.SetOmitEmpty(true)
+			enc.SetSortMapKeys(true)
+			return enc
+		},
+	}
+	msgPackConns = sync.Pool{
+		New: func() any {
+			return &msgPackConn{}
+		},
+	}
+)
diff --git a/pkg/common/duration.go b/pkg/common/duration.go
index 959b1fc..ecdf9e5 100644
--- a/pkg/common/duration.go
+++ b/pkg/common/duration.go
@@ -71,6 +71,10 @@ func (this *Duration) SetNative(v time.Duration) {
 	this.v = v
 }
 
+func (this *Duration) Validate() error {
+	return nil
+}
+
 func (this Duration) IsEqualTo(other any) bool {
 	if other == nil {
 		return false
diff --git a/pkg/common/filemode.go b/pkg/common/filemode.go
deleted file mode 100644
index 938b1fa..0000000
--- a/pkg/common/filemode.go
+++ /dev/null
@@ -1,87 +0,0 @@
-package common
-
-import (
-	"fmt"
-	"os"
-	"strconv"
-)
-
-func NewFileMode(plain string) (FileMode, error) {
-	var buf FileMode
-	if err := buf.Set(plain); err != nil {
-		return FileMode{}, nil
-	}
-	return buf, nil
-}
-
-func MustNewFileMode(plain string) FileMode {
-	buf, err := NewFileMode(plain)
-	if err != nil {
-		panic(err)
-	}
-	return buf
-}
-
-type FileMode struct {
-	v os.FileMode
-}
-
-func (this FileMode) IsZero() bool {
-	return this.v == 0
-}
-
-func (this FileMode) MarshalText() (text []byte, err error) {
-	return []byte(this.String()), nil
-}
-
-func (this FileMode) String() string {
-	if v := this.v; v != 0 {
-		return fmt.Sprintf("%04d", v)
-	}
-	return ""
-}
-
-func (this *FileMode) UnmarshalText(text []byte) error {
-	if len(text) == 0 {
-		this.v = 0
-		return nil
-	}
-
-	if len(text) != 4 {
-		return fmt.Errorf("illegal perm: %q", string(text))
-	}
-
-	plain, err := strconv.ParseUint(string(text), 10, 32)
-	if err != nil {
-		return fmt.Errorf("illegal perm: %q", string(text))
-	}
-
-	this.v = os.FileMode(plain)
-	return nil
-}
-
-func (this *FileMode) Set(text string) error {
-	return this.UnmarshalText([]byte(text))
-}
-
-func (this FileMode) Get() os.FileMode {
-	return this.v
-}
-
-func (this FileMode) IsEqualTo(other any) bool {
-	if other == nil {
-		return false
-	}
-	switch v := other.(type) {
-	case FileMode:
-		return this.isEqualTo(&v)
-	case *FileMode:
-		return this.isEqualTo(v)
-	default:
-		return false
-	}
-}
-
-func (this FileMode) isEqualTo(other *FileMode) bool {
-	return this.v == other.v
-}
diff --git a/pkg/common/iterators.go b/pkg/common/iterators.go
index dcd9fbe..a2e77fe 100644
--- a/pkg/common/iterators.go
+++ b/pkg/common/iterators.go
@@ -1,6 +1,9 @@
 package common
 
-import "iter"
+import (
+	"iter"
+	"slices"
+)
 
 func JoinSeq[T any](seqs ...iter.Seq[T]) iter.Seq[T] {
 	return func(yield func(T) bool) {
@@ -72,3 +75,41 @@ func SingleSeq2Of[K any, V any](k K, v V) iter.Seq2[K, V] {
 		yield(k, v)
 	}
 }
+
+func Collect[T any](in iter.Seq[T]) []T {
+	return slices.Collect(in)
+}
+
+func CollectOrFail[T any](in iter.Seq2[T, error]) ([]T, error) {
+	var vs []T
+	for v, err := range in {
+		if err != nil {
+			return nil, err
+		}
+		vs = append(vs, v)
+	}
+	return vs, nil
+}
+
+func BatchOrFail[T any](size uint32, in iter.Seq2[T, error]) iter.Seq2[[]T, error] {
+	return func(yield func([]T, error) bool) {
+		batch := make([]T, size)
+		i := uint32(0)
+		for v, err := range in {
+			if err != nil {
+				if !yield(nil, err) {
+					return
+				}
+				continue
+			}
+			batch[i] = v
+			i++
+			if i == size {
+				if !yield(batch, nil) {
+					return
+				}
+			}
+			i = 0
+		}
+	}
+}
diff --git a/pkg/common/keyed-mutex.go b/pkg/common/keyed-mutex.go
new file mode 100644
index 0000000..6e7854e
--- /dev/null
+++ b/pkg/common/keyed-mutex.go
@@ -0,0 +1,101 @@
+package common
+
+import (
+	"sync"
+	"sync/atomic"
+
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+type KeyedMutex[K comparable] struct {
+	keyToMutex map[K]*keyMutex[K]
+	uberMutex  sync.RWMutex
+	init       sync.Once
+}
+
+type Unlocker func()
+
+func (this *KeyedMutex[K]) Lock(key K) Unlocker {
+	return this.lockBy(key, func(instance *keyMutex[K]) Unlocker {
+		instance.numberOfHoldes.Add(1)
+		instance.mutex.Lock()
+		return instance.unlock
+	})
+}
+
+func (this *KeyedMutex[K]) RLock(key K) Unlocker {
+	return this.lockBy(key, func(instance *keyMutex[K]) Unlocker {
+		instance.numberOfHoldes.Add(1)
+		instance.mutex.RLock()
+		return instance.rUnlock
+	})
+}
+
+func (this *KeyedMutex[K]) lockBy(key K, instanceLocker func(*keyMutex[K]) Unlocker) Unlocker {
+	this.init.Do(func() {
+		this.keyToMutex = make(map[K]*keyMutex[K])
+	})
+	rLockActive := true
+	this.uberMutex.RLock()
+	uberRUnlock := func() {
+		if rLockActive {
+			this.uberMutex.RUnlock()
+		}
+		rLockActive = false
+	}
+	defer uberRUnlock()
+
+	instance, ok := this.keyToMutex[key]
+	if ok {
+		uberRUnlock()
+		return instanceLocker(instance)
+	}
+	uberRUnlock()
+
+	this.uberMutex.Lock()
+	defer this.uberMutex.Unlock()
+
+	instance, ok = this.keyToMutex[key]
+	if ok {
+		return instanceLocker(instance)
+	}
+
+	instance = &keyMutex[K]{
+		key:    key,
+		parent: this,
+	}
+	this.keyToMutex[key] = instance
+
+	return instanceLocker(instance)
+}
+
+type keyMutex[K comparable] struct {
+	key            K
+	parent         *KeyedMutex[K]
+	mutex          sync.RWMutex
+	numberOfHoldes atomic.Int32
+}
+
+func (this *keyMutex[K]) unlock() {
+	this.mutex.Unlock()
+	this.afterUnlock()
+}
+
+func (this *keyMutex[K]) rUnlock() {
+	this.mutex.RUnlock()
+	this.afterUnlock()
+}
+
+func (this *keyMutex[K]) afterUnlock() {
+	left := this.numberOfHoldes.Add(-1)
+	if left < 0 {
+		panic(errors.System.Newf("possible mutex leak detected: number of active holder after unlock now at a negative value: %d", left))
+	}
+	if left > 0 {
+		return
+	}
+	this.parent.uberMutex.Lock()
+	defer this.parent.uberMutex.Unlock()
+
+	delete(this.parent.keyToMutex, this.key)
+}
diff --git a/pkg/common/regexp.go b/pkg/common/regexp.go
index 9205588..8c8be9c 100644
--- a/pkg/common/regexp.go
+++ b/pkg/common/regexp.go
@@ -66,6 +66,10 @@ func (this *Regexp) MatchString(s string) bool {
 	return false
 }
 
+func (this Regexp) Validate() error {
+	return nil
+}
+
 func (this Regexp) IsEqualTo(other any) bool {
 	if other == nil {
 		return false
diff --git a/pkg/common/remote.go b/pkg/common/remote.go
deleted file mode 100644
index a91cd00..0000000
--- a/pkg/common/remote.go
+++ /dev/null
@@ -1,9 +0,0 @@
-package common
-
-import "github.com/engity-com/bifroest/pkg/net"
-
-type Remote interface {
-	User() string
-	Host() net.Host
-	String() string
-}
diff --git a/pkg/common/version.go b/pkg/common/version.go
index 355f660..fa9c08a 100644
--- a/pkg/common/version.go
+++ b/pkg/common/version.go
@@ -29,24 +29,28 @@ Revision: ` + v.Revision() + `
 Edition:  ` + v.Edition().String() + `
 Build:    ` + v.BuildAt().Format(time.RFC3339) + ` by ` + v.Vendor() + `
 Go:       ` + v.GoVersion() + `
-Platform: ` + v.Platform() + `
-Features: `
+Platform: ` + v.Platform()
 
 		csnl := 0
+		hasFeatures := false
 		v.Features().ForEach(func(category VersionFeatureCategory) {
+			hasFeatures = true
 			cnl := len(category.Name()) + 1
 			if cnl > csnl {
 				csnl = cnl
 			}
 		})
 
-		v.Features().ForEach(func(category VersionFeatureCategory) {
-			var fts []string
-			category.ForEach(func(feature VersionFeature) {
-				fts = append(fts, feature.Name())
+		if hasFeatures {
+			result += "\nFeatures:"
+			v.Features().ForEach(func(category VersionFeatureCategory) {
+				var fts []string
+				category.ForEach(func(feature VersionFeature) {
+					fts = append(fts, feature.Name())
+				})
+				result += fmt.Sprintf("\n\t%-"+strconv.Itoa(csnl)+"s %s", category.Name()+":", strings.Join(fts, " "))
 			})
-			result += fmt.Sprintf("\n\t%-"+strconv.Itoa(csnl)+"s %s", category.Name()+":", strings.Join(fts, " "))
-		})
+		}
 
 		return result
 	default:
diff --git a/pkg/configuration/alternatives.go b/pkg/configuration/alternatives.go
new file mode 100644
index 0000000..cbe7360
--- /dev/null
+++ b/pkg/configuration/alternatives.go
@@ -0,0 +1,64 @@
+package configuration
+
+import (
+	"gopkg.in/yaml.v3"
+
+	"github.com/engity-com/bifroest/pkg/template"
+)
+
+var (
+	DefaultAlternativesDownloadUrl = template.MustNewUrl("https://github.com/engity-com/bifroest/releases/download/v{{.version}}/bifroest-{{.os}}-{{.arch}}-{{.edition}}{{.packageExt}}")
+	DefaultAlternativesLocation    = template.MustNewString(defaultAlternativesLocation)
+)
+
+type Alternatives struct {
+	DownloadUrl template.Url    `yaml:"downloadUrl,omitempty"`
+	Location    template.String `yaml:"location,omitempty"`
+}
+
+func (this *Alternatives) SetDefaults() error {
+	return setDefaults(this,
+		fixedDefault("downloadUrl", func(v *Alternatives) *template.Url { return &v.DownloadUrl }, DefaultAlternativesDownloadUrl),
+		fixedDefault("location", func(v *Alternatives) *template.String { return &v.Location }, DefaultAlternativesLocation),
+	)
+}
+
+func (this *Alternatives) Trim() error {
+	return trim(this,
+		noopTrim[Alternatives]("downloadUrl"),
+		noopTrim[Alternatives]("location"),
+	)
+}
+
+func (this *Alternatives) Validate() error {
+	return validate(this,
+		func(v *Alternatives) (string, validator) { return "downloadUrl", &v.DownloadUrl },
+		func(v *Alternatives) (string, validator) { return "location", &v.Location },
+	)
+}
+
+func (this *Alternatives) UnmarshalYAML(node *yaml.Node) error {
+	return unmarshalYAML(this, node, func(target *Alternatives, node *yaml.Node) error {
+		type raw Alternatives
+		return node.Decode((*raw)(target))
+	})
+}
+
+func (this Alternatives) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case Alternatives:
+		return this.isEqualTo(&v)
+	case *Alternatives:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this Alternatives) isEqualTo(other *Alternatives) bool {
+	return isEqual(&this.DownloadUrl, &other.DownloadUrl) &&
+		isEqual(&this.Location, &other.Location)
+}
diff --git a/pkg/configuration/alternatives_unix.go b/pkg/configuration/alternatives_unix.go
new file mode 100644
index 0000000..1eec694
--- /dev/null
+++ b/pkg/configuration/alternatives_unix.go
@@ -0,0 +1,7 @@
+//go:build unix
+
+package configuration
+
+var (
+	defaultAlternativesLocation = `/var/lib/engity/bifroest/binaries/{{.version}}/{{.os}}-{{.arch}}-{{.edition}}{{.ext}}`
+)
diff --git a/pkg/configuration/alternatives_windows.go b/pkg/configuration/alternatives_windows.go
new file mode 100644
index 0000000..944eacf
--- /dev/null
+++ b/pkg/configuration/alternatives_windows.go
@@ -0,0 +1,7 @@
+//go:build windows
+
+package configuration
+
+var (
+	defaultAlternativesLocation = `C:\ProgramData\Engity\Bifroest\binaries\{{.version}}\{{.os}}-{{.arch}}-{{.edition}}{{.ext}}`
+)
diff --git a/pkg/configuration/authorization-local.go b/pkg/configuration/authorization-local.go
index 6b6b23d..bbd7db2 100644
--- a/pkg/configuration/authorization-local.go
+++ b/pkg/configuration/authorization-local.go
@@ -10,7 +10,7 @@ import (
 
 var (
 	DefaultAuthorizationLocalPamService     = defaultAuthorizationLocalPamService
-	DefaultAuthorizationLocalAuthorizedKeys = []template.String{template.MustNewString("{{.user.homeDir}}/.ssh/authorized_keys")}
+	DefaultAuthorizationLocalAuthorizedKeys = template.MustNewStrings("{{.user.homeDir}}/.ssh/authorized_keys")
 
 	_ = RegisterAuthorizationV(func() AuthorizationV {
 		return &AuthorizationLocal{}
@@ -18,14 +18,14 @@ var (
 )
 
 type AuthorizationLocal struct {
-	AuthorizedKeys []template.String  `yaml:"authorizedKeys,omitempty"`
+	AuthorizedKeys template.Strings   `yaml:"authorizedKeys,omitempty"`
 	Password       PasswordProperties `yaml:"password,omitempty"`
 	PamService     string             `yaml:"pamService,omitempty"`
 }
 
 func (this *AuthorizationLocal) SetDefaults() error {
 	return setDefaults(this,
-		fixedDefault("authorizedKeys", func(v *AuthorizationLocal) *[]template.String { return &v.AuthorizedKeys }, DefaultAuthorizationLocalAuthorizedKeys),
+		fixedDefault("authorizedKeys", func(v *AuthorizationLocal) *template.Strings { return &v.AuthorizedKeys }, DefaultAuthorizationLocalAuthorizedKeys),
 		func(v *AuthorizationLocal) (string, defaulter) { return "password", &v.Password },
 		fixedDefault("pamService", func(v *AuthorizationLocal) *string { return &v.PamService }, DefaultAuthorizationLocalPamService),
 	)
@@ -41,7 +41,7 @@ func (this *AuthorizationLocal) Trim() error {
 
 func (this *AuthorizationLocal) Validate() error {
 	return validate(this,
-		noopValidate[AuthorizationLocal]("authorizedKeys"),
+		func(v *AuthorizationLocal) (string, validator) { return "authorizedKeys", &v.AuthorizedKeys },
 		func(v *AuthorizationLocal) (string, validator) { return "password", &v.Password },
 		noopValidate[AuthorizationLocal]("pamService"),
 	)
@@ -69,7 +69,7 @@ func (this AuthorizationLocal) IsEqualTo(other any) bool {
 }
 
 func (this AuthorizationLocal) isEqualTo(other *AuthorizationLocal) bool {
-	return isEqualSlice(&this.AuthorizedKeys, &other.AuthorizedKeys) &&
+	return isEqual(&this.AuthorizedKeys, &other.AuthorizedKeys) &&
 		isEqual(&this.Password, &other.Password) &&
 		this.PamService == other.PamService
 }
diff --git a/pkg/configuration/authorization-none.go b/pkg/configuration/authorization-none.go
new file mode 100644
index 0000000..f707957
--- /dev/null
+++ b/pkg/configuration/authorization-none.go
@@ -0,0 +1,58 @@
+package configuration
+
+import (
+	"gopkg.in/yaml.v3"
+)
+
+var (
+	_ = RegisterAuthorizationV(func() AuthorizationV {
+		return &AuthorizationNone{}
+	})
+)
+
+type AuthorizationNone struct{}
+
+func (this *AuthorizationNone) SetDefaults() error {
+	return setDefaults(this)
+}
+
+func (this *AuthorizationNone) Trim() error {
+	return trim(this)
+}
+
+func (this *AuthorizationNone) Validate() error {
+	return validate(this)
+}
+
+func (this *AuthorizationNone) UnmarshalYAML(node *yaml.Node) error {
+	return unmarshalYAML(this, node, func(target *AuthorizationNone, node *yaml.Node) error {
+		type raw AuthorizationNone
+		return node.Decode((*raw)(target))
+	})
+}
+
+func (this AuthorizationNone) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case AuthorizationNone:
+		return this.isEqualTo(&v)
+	case *AuthorizationNone:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this AuthorizationNone) isEqualTo(_ *AuthorizationNone) bool {
+	return true
+}
+
+func (this AuthorizationNone) Types() []string {
+	return []string{"none"}
+}
+
+func (this AuthorizationNone) FeatureFlags() []string {
+	return []string{"none"}
+}
diff --git a/pkg/configuration/authorization-oidc-auth.go b/pkg/configuration/authorization-oidc-auth.go
index e3a4c33..7dadaed 100644
--- a/pkg/configuration/authorization-oidc-auth.go
+++ b/pkg/configuration/authorization-oidc-auth.go
@@ -1,16 +1,19 @@
 package configuration
 
 import (
-	"slices"
-
 	"github.com/coreos/go-oidc/v3/oidc"
 	"gopkg.in/yaml.v3"
+
+	"github.com/engity-com/bifroest/pkg/template"
 )
 
 var (
-	DefaultAuthorizationOidcScopes           = []string{oidc.ScopeOpenID, "profile", "email"}
-	DefaultAuthorizationOidcRetrieveIdToken  = true
-	DefaultAuthorizationOidcRetrieveUserInfo = false
+	DefaultAuthorizationOidcDefaultIssuer       = template.MustNewUrl("")
+	DefaultAuthorizationOidcDefaultClientId     = template.MustNewString("")
+	DefaultAuthorizationOidcDefaultClientSecret = template.MustNewString("")
+	DefaultAuthorizationOidcScopes              = template.MustNewStrings(oidc.ScopeOpenID, "profile", "email")
+	DefaultAuthorizationOidcRetrieveIdToken     = true
+	DefaultAuthorizationOidcRetrieveUserInfo    = false
 
 	_ = RegisterAuthorizationV(func() AuthorizationV {
 		return &AuthorizationOidcDeviceAuth{}
@@ -18,10 +21,10 @@ var (
 )
 
 type AuthorizationOidcDeviceAuth struct {
-	Issuer       string   `yaml:"issuer"`
-	ClientId     string   `yaml:"clientId"`
-	ClientSecret string   `yaml:"clientSecret"`
-	Scopes       []string `yaml:"scopes"`
+	Issuer       template.Url     `yaml:"issuer"`
+	ClientId     template.String  `yaml:"clientId"`
+	ClientSecret template.String  `yaml:"clientSecret"`
+	Scopes       template.Strings `yaml:"scopes"`
 
 	RetrieveIdToken  bool `yaml:"retrieveIdToken,omitempty"`
 	RetrieveUserInfo bool `yaml:"retrieveUserInfo,omitempty"`
@@ -29,10 +32,10 @@ type AuthorizationOidcDeviceAuth struct {
 
 func (this *AuthorizationOidcDeviceAuth) SetDefaults() error {
 	return setDefaults(this,
-		noopSetDefault[AuthorizationOidcDeviceAuth]("issuer"),
-		noopSetDefault[AuthorizationOidcDeviceAuth]("clientId"),
-		noopSetDefault[AuthorizationOidcDeviceAuth]("clientSecret"),
-		fixedDefault("scopes", func(v *AuthorizationOidcDeviceAuth) *[]string { return &v.Scopes }, DefaultAuthorizationOidcScopes),
+		fixedDefault("issuer", func(v *AuthorizationOidcDeviceAuth) *template.Url { return &v.Issuer }, DefaultAuthorizationOidcDefaultIssuer),
+		fixedDefault("clientId", func(v *AuthorizationOidcDeviceAuth) *template.String { return &v.ClientId }, DefaultAuthorizationOidcDefaultClientId),
+		fixedDefault("clientSecret", func(v *AuthorizationOidcDeviceAuth) *template.String { return &v.ClientSecret }, DefaultAuthorizationOidcDefaultClientSecret),
+		fixedDefault("scopes", func(v *AuthorizationOidcDeviceAuth) *template.Strings { return &v.Scopes }, DefaultAuthorizationOidcScopes),
 
 		fixedDefault("retrieveIdToken", func(v *AuthorizationOidcDeviceAuth) *bool { return &v.RetrieveIdToken }, DefaultAuthorizationOidcRetrieveIdToken),
 		fixedDefault("retrieveUserInfo", func(v *AuthorizationOidcDeviceAuth) *bool { return &v.RetrieveUserInfo }, DefaultAuthorizationOidcRetrieveUserInfo),
@@ -44,7 +47,7 @@ func (this *AuthorizationOidcDeviceAuth) Trim() error {
 		noopTrim[AuthorizationOidcDeviceAuth]("issuer"),
 		noopTrim[AuthorizationOidcDeviceAuth]("clientId"),
 		noopTrim[AuthorizationOidcDeviceAuth]("clientSecret"),
-		trimSliceBy("scopes", func(v *AuthorizationOidcDeviceAuth) *[]string { return &v.Scopes }, func(v string) bool { return v == "" }),
+		noopTrim[AuthorizationOidcDeviceAuth]("scopes"),
 
 		noopTrim[AuthorizationOidcDeviceAuth]("retrieveIdToken"),
 		noopTrim[AuthorizationOidcDeviceAuth]("retrieveUserInfo"),
@@ -53,10 +56,14 @@ func (this *AuthorizationOidcDeviceAuth) Trim() error {
 
 func (this *AuthorizationOidcDeviceAuth) Validate() error {
 	return validate(this,
-		notEmptyStringValidate("issuer", func(v *AuthorizationOidcDeviceAuth) *string { return &v.Issuer }),
-		notEmptyStringValidate("clientId", func(v *AuthorizationOidcDeviceAuth) *string { return &v.ClientId }),
-		notEmptyStringValidate("clientSecret", func(v *AuthorizationOidcDeviceAuth) *string { return &v.ClientSecret }),
-		notEmptySliceValidate("scopes", func(v *AuthorizationOidcDeviceAuth) *[]string { return &v.Scopes }),
+		func(v *AuthorizationOidcDeviceAuth) (string, validator) { return "issuer", &v.Issuer },
+		notZeroValidate("issuer", func(v *AuthorizationOidcDeviceAuth) *template.Url { return &v.Issuer }),
+		func(v *AuthorizationOidcDeviceAuth) (string, validator) { return "clientId", &v.ClientId },
+		notZeroValidate("clientId", func(v *AuthorizationOidcDeviceAuth) *template.String { return &v.ClientId }),
+		func(v *AuthorizationOidcDeviceAuth) (string, validator) { return "clientSecret", &v.ClientSecret },
+		notZeroValidate("clientSecret", func(v *AuthorizationOidcDeviceAuth) *template.String { return &v.ClientSecret }),
+		func(v *AuthorizationOidcDeviceAuth) (string, validator) { return "scopes", &v.Scopes },
+		notZeroValidate("scopes", func(v *AuthorizationOidcDeviceAuth) *template.Strings { return &v.Scopes }),
 
 		noopValidate[AuthorizationOidcDeviceAuth]("retrieveIdToken"),
 		noopValidate[AuthorizationOidcDeviceAuth]("retrieveUserInfo"),
@@ -85,9 +92,10 @@ func (this AuthorizationOidcDeviceAuth) IsEqualTo(other any) bool {
 }
 
 func (this AuthorizationOidcDeviceAuth) isEqualTo(other *AuthorizationOidcDeviceAuth) bool {
-	return this.Issuer == other.Issuer &&
-		this.ClientId == other.ClientId &&
-		slices.EqualFunc(this.Scopes, other.Scopes, func(l, r string) bool { return l == r }) &&
+	return isEqual(&this.Issuer, &other.Issuer) &&
+		isEqual(&this.ClientId, &other.ClientId) &&
+		isEqual(&this.ClientSecret, &other.ClientSecret) &&
+		isEqual(&this.Scopes, &other.Scopes) &&
 		this.RetrieveIdToken == other.RetrieveIdToken &&
 		this.RetrieveUserInfo == other.RetrieveUserInfo
 }
diff --git a/pkg/configuration/authorization-oidc-auth_test.go b/pkg/configuration/authorization-oidc-auth_test.go
index 973090b..6ab28ce 100644
--- a/pkg/configuration/authorization-oidc-auth_test.go
+++ b/pkg/configuration/authorization-oidc-auth_test.go
@@ -1,8 +1,11 @@
 package configuration
 
 import (
-	"github.com/echocat/slf4g/sdk/testlog"
 	"testing"
+
+	"github.com/echocat/slf4g/sdk/testlog"
+
+	"github.com/engity-com/bifroest/pkg/template"
 )
 
 func TestAuthorizationOidc_UnmarshalYAML(t *testing.T) {
@@ -36,9 +39,9 @@ clientId: abc`,
 clientId: anId
 clientSecret: aSecret`,
 			expected: AuthorizationOidcDeviceAuth{
-				Issuer:           "https://foo-bar",
-				ClientId:         "anId",
-				ClientSecret:     "aSecret",
+				Issuer:           template.MustNewUrl("https://foo-bar"),
+				ClientId:         template.MustNewString("anId"),
+				ClientSecret:     template.MustNewString("aSecret"),
 				Scopes:           DefaultAuthorizationOidcScopes,
 				RetrieveIdToken:  true,
 				RetrieveUserInfo: false,
@@ -53,10 +56,10 @@ scopes: [a,b,c]
 retrieveIdToken: false
 retrieveUserInfo: true`,
 			expected: AuthorizationOidcDeviceAuth{
-				Issuer:           "https://foo-bar",
-				ClientId:         "anId",
-				ClientSecret:     "aSecret",
-				Scopes:           []string{"a", "b", "c"},
+				Issuer:           template.MustNewUrl("https://foo-bar"),
+				ClientId:         template.MustNewString("anId"),
+				ClientSecret:     template.MustNewString("aSecret"),
+				Scopes:           template.MustNewStrings("a", "b", "c"),
 				RetrieveIdToken:  false,
 				RetrieveUserInfo: true,
 			},
diff --git a/pkg/configuration/authorization-simple-entry.go b/pkg/configuration/authorization-simple-entry.go
index 3db4e47..815b312 100644
--- a/pkg/configuration/authorization-simple-entry.go
+++ b/pkg/configuration/authorization-simple-entry.go
@@ -2,8 +2,12 @@ package configuration
 
 import (
 	"fmt"
-	"github.com/engity-com/bifroest/pkg/crypto"
+
+	log "github.com/echocat/slf4g"
 	"gopkg.in/yaml.v3"
+
+	"github.com/engity-com/bifroest/pkg/crypto"
+	"github.com/engity-com/bifroest/pkg/errors"
 )
 
 type AuthorizationSimpleEntry struct {
@@ -11,6 +15,9 @@ type AuthorizationSimpleEntry struct {
 	AuthorizedKeys     crypto.AuthorizedKeys     `yaml:"authorizedKeys,omitempty"`
 	AuthorizedKeysFile crypto.AuthorizedKeysFile `yaml:"authorizedKeysFile,omitempty"`
 	Password           crypto.Password           `yaml:"password,omitempty"`
+	PasswordFile       crypto.PasswordFile       `yaml:"passwordFile,omitempty"`
+
+	CreatePasswordFileIfAbsentOfType *crypto.PasswordType `yaml:"createPasswordFileIfAbsentOfType,omitempty"`
 }
 
 func (this *AuthorizationSimpleEntry) GetField(name string) (any, bool, error) {
@@ -28,6 +35,9 @@ func (this *AuthorizationSimpleEntry) SetDefaults() error {
 		noopSetDefault[AuthorizationSimpleEntry]("authorizedKeys"),
 		noopSetDefault[AuthorizationSimpleEntry]("authorizedKeysFile"),
 		noopSetDefault[AuthorizationSimpleEntry]("password"),
+		noopSetDefault[AuthorizationSimpleEntry]("passwordFile"),
+
+		noopSetDefault[AuthorizationSimpleEntry]("createPasswordFileIfAbsentOfType"),
 	)
 }
 
@@ -37,10 +47,36 @@ func (this *AuthorizationSimpleEntry) Trim() error {
 		func(v *AuthorizationSimpleEntry) (string, trimmer) { return "authorizedKeys", &v.AuthorizedKeys },
 		noopTrim[AuthorizationSimpleEntry]("authorizedKeysFile"),
 		noopTrim[AuthorizationSimpleEntry]("password"),
+		noopTrim[AuthorizationSimpleEntry]("passwordFile"),
+
+		noopTrim[AuthorizationSimpleEntry]("createPasswordFileIfAbsentOfType"),
 	)
 }
 
 func (this *AuthorizationSimpleEntry) Validate() error {
+	if t := this.CreatePasswordFileIfAbsentOfType; t != nil && this.Name != "" {
+		if err := this.CreatePasswordFileIfAbsentOfType.Validate(); err != nil {
+			return err
+		}
+		if f := this.PasswordFile; !f.IsZero() {
+			if pw, err := this.PasswordFile.GetPassword(); pw.IsZero() {
+				decoded, encoded, err := t.Generate(nil)
+				if err != nil {
+					return errors.System.Newf("cannot generate new password for file %v: %w", f, err)
+				}
+				if err := f.SetPassword(encoded); err != nil {
+					return errors.System.Newf("cannot generate new password for file %v: %w", f, err)
+				}
+
+				log.With("name", this.Name).
+					With("password", string(decoded)).
+					Warn("new password created and saved for user")
+
+			} else if err != nil {
+				return err
+			}
+		}
+	}
 	return validate(this,
 		notEmptyStringValidate[AuthorizationSimpleEntry]("name", func(v *AuthorizationSimpleEntry) *string { return &v.Name }),
 		func(v *AuthorizationSimpleEntry) (string, validator) { return "authorizedKeys", &v.AuthorizedKeys },
@@ -48,6 +84,11 @@ func (this *AuthorizationSimpleEntry) Validate() error {
 			return "authorizedKeysFile", &v.AuthorizedKeysFile
 		},
 		func(v *AuthorizationSimpleEntry) (string, validator) { return "password", &v.Password },
+		func(v *AuthorizationSimpleEntry) (string, validator) { return "passwordFile", &v.PasswordFile },
+
+		func(v *AuthorizationSimpleEntry) (string, validator) {
+			return "createPasswordFileIfAbsentOfType", v.CreatePasswordFileIfAbsentOfType
+		},
 	)
 }
 
@@ -76,13 +117,25 @@ func (this AuthorizationSimpleEntry) isEqualTo(other *AuthorizationSimpleEntry)
 	return this.Name == other.Name &&
 		isEqual(&this.AuthorizedKeys, &other.AuthorizedKeys) &&
 		isEqual(&this.AuthorizedKeysFile, &other.AuthorizedKeysFile) &&
-		isEqual(&this.Password, &other.Password)
+		isEqual(&this.Password, &other.Password) &&
+		isEqual(&this.PasswordFile, &other.PasswordFile) &&
+		isEqual(this.CreatePasswordFileIfAbsentOfType, other.CreatePasswordFileIfAbsentOfType)
+}
+
+func (this AuthorizationSimpleEntry) GetPassword() (crypto.Password, error) {
+	if v := this.Password; !v.IsZero() {
+		return v, nil
+	}
+	if v := this.PasswordFile; !v.IsZero() {
+		return v.GetPassword()
+	}
+	return nil, nil
 }
 
 type AuthorizationSimpleEntries []AuthorizationSimpleEntry
 
 func (this *AuthorizationSimpleEntries) SetDefaults() error {
-	return setSliceDefaults(this)
+	return setSliceDefaults(this) // Empty, be default.
 }
 
 func (this *AuthorizationSimpleEntries) Trim() error {
@@ -93,6 +146,15 @@ func (this AuthorizationSimpleEntries) Validate() error {
 	return validateSlice(this)
 }
 
+func (this *AuthorizationSimpleEntries) UnmarshalYAML(node *yaml.Node) error {
+	// Clear the entries before...
+	*this = AuthorizationSimpleEntries{}
+	return unmarshalYAML(this, node, func(target *AuthorizationSimpleEntries, node *yaml.Node) error {
+		type raw AuthorizationSimpleEntries
+		return node.Decode((*raw)(target))
+	})
+}
+
 func (this AuthorizationSimpleEntries) IsEqualTo(other any) bool {
 	if other == nil {
 		return false
diff --git a/pkg/configuration/authorization_test.go b/pkg/configuration/authorization_test.go
index 7cb3bf7..033a373 100644
--- a/pkg/configuration/authorization_test.go
+++ b/pkg/configuration/authorization_test.go
@@ -4,6 +4,8 @@ import (
 	"testing"
 
 	"github.com/echocat/slf4g/sdk/testlog"
+
+	"github.com/engity-com/bifroest/pkg/template"
 )
 
 func TestAuthorization_UnmarshalYAML(t *testing.T) {
@@ -45,9 +47,9 @@ issuer: https://foo-bar
 clientId: anId
 clientSecret: aSecret`,
 			expected: Authorization{&AuthorizationOidcDeviceAuth{
-				Issuer:           "https://foo-bar",
-				ClientId:         "anId",
-				ClientSecret:     "aSecret",
+				Issuer:           template.MustNewUrl("https://foo-bar"),
+				ClientId:         template.MustNewString("anId"),
+				ClientSecret:     template.MustNewString("aSecret"),
 				Scopes:           DefaultAuthorizationOidcScopes,
 				RetrieveIdToken:  true,
 				RetrieveUserInfo: false,
diff --git a/pkg/configuration/configuration-ref.go b/pkg/configuration/configuration-ref.go
index 97b959a..0b18036 100644
--- a/pkg/configuration/configuration-ref.go
+++ b/pkg/configuration/configuration-ref.go
@@ -1,5 +1,11 @@
 package configuration
 
+import (
+	"path/filepath"
+
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
 type ConfigurationRef struct {
 	v  Configuration
 	fn string
@@ -44,6 +50,14 @@ func (this *ConfigurationRef) GetFilename() string {
 	return this.fn
 }
 
+func (this *ConfigurationRef) MakeAbsolute() error {
+	abs, err := filepath.Abs(this.fn)
+	if err != nil {
+		return errors.Config.Newf("canont make this configuration file reference absolute: %w", err)
+	}
+	return this.Set(abs)
+}
+
 func (this ConfigurationRef) IsEqualTo(other any) bool {
 	if other == nil {
 		return false
diff --git a/pkg/configuration/configuration.go b/pkg/configuration/configuration.go
index b114432..2c4b344 100644
--- a/pkg/configuration/configuration.go
+++ b/pkg/configuration/configuration.go
@@ -9,10 +9,11 @@ import (
 	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/errors"
 	"github.com/engity-com/bifroest/pkg/sys"
+	"github.com/engity-com/bifroest/pkg/template"
 )
 
 var (
-	DefaultStartMessage = ""
+	DefaultStartMessage = template.MustNewString("")
 )
 
 type Configuration struct {
@@ -28,7 +29,9 @@ type Configuration struct {
 
 	HouseKeeping HouseKeeping `yaml:"housekeeping"`
 
-	StartMessage string `yaml:"startMessage,omitempty"`
+	Alternatives Alternatives `yaml:"alternatives"`
+
+	StartMessage template.String `yaml:"startMessage,omitempty"`
 }
 
 func (this *Configuration) SetDefaults() error {
@@ -37,7 +40,8 @@ func (this *Configuration) SetDefaults() error {
 		func(v *Configuration) (string, defaulter) { return "session", &v.Session },
 		func(v *Configuration) (string, defaulter) { return "flows", &v.Flows },
 		func(v *Configuration) (string, defaulter) { return "houseKeeping", &v.HouseKeeping },
-		fixedDefault("startMessage", func(v *Configuration) *string { return &v.StartMessage }, DefaultStartMessage),
+		func(v *Configuration) (string, defaulter) { return "alternatives", &v.Alternatives },
+		fixedDefault("startMessage", func(v *Configuration) *template.String { return &v.StartMessage }, DefaultStartMessage),
 	)
 }
 
@@ -47,6 +51,7 @@ func (this *Configuration) Trim() error {
 		func(v *Configuration) (string, trimmer) { return "session", &v.Session },
 		func(v *Configuration) (string, trimmer) { return "flows", &v.Flows },
 		func(v *Configuration) (string, trimmer) { return "houseKeeping", &v.HouseKeeping },
+		func(v *Configuration) (string, trimmer) { return "alternatives", &v.Alternatives },
 		noopTrim[Configuration]("startMessage"),
 	)
 }
@@ -56,9 +61,10 @@ func (this *Configuration) Validate() error {
 		func(v *Configuration) (string, validator) { return "ssh", &v.Ssh },
 		func(v *Configuration) (string, validator) { return "session", &v.Session },
 		func(v *Configuration) (string, validator) { return "flows", &v.Flows },
-		notEmptySliceValidate("flows", func(v *Configuration) *[]Flow { return (*[]Flow)(&v.Flows) }),
+		notZeroValidate("flows", func(v *Configuration) *Flows { return &v.Flows }),
 		func(v *Configuration) (string, validator) { return "houseKeeping", &v.HouseKeeping },
-		noopValidate[Configuration]("startMessage"),
+		func(v *Configuration) (string, validator) { return "alternatives", &v.Alternatives },
+		func(v *Configuration) (string, validator) { return "startMessage", &v.StartMessage },
 	)
 }
 
@@ -121,5 +127,6 @@ func (this Configuration) isEqualTo(other *Configuration) bool {
 		isEqual(&this.Session, &other.Session) &&
 		isEqual(&this.Flows, &other.Flows) &&
 		isEqual(&this.HouseKeeping, &other.HouseKeeping) &&
-		this.StartMessage == other.StartMessage
+		isEqual(&this.Alternatives, &other.Alternatives) &&
+		isEqual(&this.StartMessage, &other.StartMessage)
 }
diff --git a/pkg/configuration/configuration_unix_test.go b/pkg/configuration/configuration_unix_test.go
index 52d452a..d3a5a8c 100644
--- a/pkg/configuration/configuration_unix_test.go
+++ b/pkg/configuration/configuration_unix_test.go
@@ -59,6 +59,14 @@ func TestConfiguration_UnmarshalYAML(t *testing.T) {
 					MaxAuthTries:   DefaultSshMaxAuthTries,
 					MaxConnections: DefaultSshMaxConnections,
 					Banner:         DefaultSshBanner,
+					PreparationMessages: PreparationMessages{{
+						Id:     DefaultPreparationMessageId,
+						Flow:   DefaultPreparationMessageFlow,
+						Start:  DefaultPreparationMessageStart,
+						Update: DefaultPreparationMessageUpdate,
+						End:    DefaultPreparationMessageEnd,
+						Error:  DefaultPreparationMessageError,
+					}},
 				},
 				Session: Session{&SessionFs{
 					IdleTimeout:    DefaultSessionIdleTimeout,
@@ -74,9 +82,9 @@ func TestConfiguration_UnmarshalYAML(t *testing.T) {
 						ExcludedRequestingName: common.MustNewRegexp(""),
 					},
 					Authorization: Authorization{&AuthorizationOidcDeviceAuth{
-						Issuer:           "https://foo-bar",
-						ClientId:         "anId",
-						ClientSecret:     "aSecret",
+						Issuer:           template.MustNewUrl("https://foo-bar"),
+						ClientId:         template.MustNewString("anId"),
+						ClientSecret:     template.MustNewString("aSecret"),
 						Scopes:           DefaultAuthorizationOidcScopes,
 						RetrieveIdToken:  DefaultAuthorizationOidcRetrieveIdToken,
 						RetrieveUserInfo: DefaultAuthorizationOidcRetrieveUserInfo,
@@ -103,12 +111,17 @@ func TestConfiguration_UnmarshalYAML(t *testing.T) {
 						PortForwardingAllowed: DefaultEnvironmentLocalPortForwardingAllowed,
 					}},
 				}},
+				Alternatives: Alternatives{
+					DownloadUrl: DefaultAlternativesDownloadUrl,
+					Location:    DefaultAlternativesLocation,
+				},
 				HouseKeeping: HouseKeeping{
 					Every:          DefaultHouseKeepingEvery,
 					InitialDelay:   DefaultHouseKeepingInitialDelay,
 					AutoRepair:     DefaultHouseKeepingAutoRepair,
 					KeepExpiredFor: DefaultHouseKeepingKeepExpiredFor,
 				},
+				StartMessage: DefaultStartMessage,
 			},
 		},
 	)
diff --git a/pkg/configuration/configuration_windows_test.go b/pkg/configuration/configuration_windows_test.go
index 0cb0664..e921f4a 100644
--- a/pkg/configuration/configuration_windows_test.go
+++ b/pkg/configuration/configuration_windows_test.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/crypto"
+	"github.com/engity-com/bifroest/pkg/template"
 )
 
 func TestConfiguration_UnmarshalYAML(t *testing.T) {
@@ -57,6 +58,14 @@ func TestConfiguration_UnmarshalYAML(t *testing.T) {
 					MaxAuthTries:   DefaultSshMaxAuthTries,
 					MaxConnections: DefaultSshMaxConnections,
 					Banner:         DefaultSshBanner,
+					PreparationMessages: PreparationMessages{{
+						Id:     DefaultPreparationMessageId,
+						Flow:   DefaultPreparationMessageFlow,
+						Start:  DefaultPreparationMessageStart,
+						Update: DefaultPreparationMessageUpdate,
+						End:    DefaultPreparationMessageEnd,
+						Error:  DefaultPreparationMessageError,
+					}},
 				},
 				Session: Session{&SessionFs{
 					IdleTimeout:    DefaultSessionIdleTimeout,
@@ -72,9 +81,9 @@ func TestConfiguration_UnmarshalYAML(t *testing.T) {
 						ExcludedRequestingName: common.MustNewRegexp(""),
 					},
 					Authorization: Authorization{&AuthorizationOidcDeviceAuth{
-						Issuer:           "https://foo-bar",
-						ClientId:         "anId",
-						ClientSecret:     "aSecret",
+						Issuer:           template.MustNewUrl("https://foo-bar"),
+						ClientId:         template.MustNewString("anId"),
+						ClientSecret:     template.MustNewString("aSecret"),
 						Scopes:           DefaultAuthorizationOidcScopes,
 						RetrieveIdToken:  DefaultAuthorizationOidcRetrieveIdToken,
 						RetrieveUserInfo: DefaultAuthorizationOidcRetrieveUserInfo,
@@ -88,12 +97,17 @@ func TestConfiguration_UnmarshalYAML(t *testing.T) {
 						PortForwardingAllowed: DefaultEnvironmentLocalPortForwardingAllowed,
 					}},
 				}},
+				Alternatives: Alternatives{
+					DownloadUrl: DefaultAlternativesDownloadUrl,
+					Location:    DefaultAlternativesLocation,
+				},
 				HouseKeeping: HouseKeeping{
 					Every:          DefaultHouseKeepingEvery,
 					InitialDelay:   DefaultHouseKeepingInitialDelay,
 					AutoRepair:     DefaultHouseKeepingAutoRepair,
 					KeepExpiredFor: DefaultHouseKeepingKeepExpiredFor,
 				},
+				StartMessage: DefaultStartMessage,
 			},
 		},
 	)
diff --git a/pkg/configuration/environment-docker.go b/pkg/configuration/environment-docker.go
new file mode 100644
index 0000000..4b89227
--- /dev/null
+++ b/pkg/configuration/environment-docker.go
@@ -0,0 +1,232 @@
+package configuration
+
+import (
+	"github.com/docker/docker/api/types/network"
+	"gopkg.in/yaml.v3"
+
+	"github.com/engity-com/bifroest/pkg/net"
+	"github.com/engity-com/bifroest/pkg/template"
+)
+
+var (
+	DefaultEnvironmentDockerLoginAllowed = template.BoolOf(true)
+
+	DefaultEnvironmentDockerHost       = template.MustNewString("{{ env `DOCKER_HOST` }}")
+	DefaultEnvironmentDockerApiVersion = template.MustNewString("{{ env `DOCKER_API_VERSION` }}")
+	DefaultEnvironmentDockerCertPath   = template.MustNewString("{{ env `DOCKER_CERT_PATH` }}")
+	DefaultEnvironmentDockerTlsVerify  = template.MustNewBool("{{ env `DOCKER_TLS_VERIFY` | ne `` }}")
+
+	DefaultEnvironmentDockerImage                = template.MustNewString("alpine")
+	DefaultEnvironmentDockerImagePullPolicy      = PullPolicyIfAbsent
+	DefaultEnvironmentDockerImagePullCredentials = template.MustNewString("")
+	DefaultEnvironmentDockerNetworks             = template.MustNewStrings(network.NetworkDefault)
+	DefaultEnvironmentDockerVolumes              = template.MustNewStrings()
+	DefaultEnvironmentDockerMounts               = template.MustNewStrings()
+	DefaultEnvironmentDockerCapabilities         = template.MustNewStrings()
+	DefaultEnvironmentDockerPrivileged           = template.BoolOf(false)
+	DefaultEnvironmentDockerDnsServers           = template.MustNewStrings()
+	DefaultEnvironmentDockerDnsSearch            = template.MustNewStrings()
+	DefaultEnvironmentDockerShellCommand         = template.MustNewStrings()
+	DefaultEnvironmentDockerExecCommand          = template.MustNewStrings()
+	DefaultEnvironmentDockerSftpCommand          = template.MustNewStrings()
+	DefaultEnvironmentDockerDirectory            = template.MustNewString("")
+	DefaultEnvironmentDockerUser                 = template.MustNewString("")
+
+	DefaultEnvironmentDockerBanner                = template.MustNewString("")
+	DefaultEnvironmentDockerPortForwardingAllowed = template.BoolOf(true)
+	DefaultEnvironmentDockerImpPublishHost        = net.MustNewHost("")
+
+	_ = RegisterEnvironmentV(func() EnvironmentV {
+		return &EnvironmentDocker{}
+	})
+)
+
+type EnvironmentDocker struct {
+	LoginAllowed template.Bool `yaml:"loginAllowed,omitempty"`
+
+	Host       template.String `yaml:"host,omitempty"`
+	ApiVersion template.String `yaml:"apiVersion,omitempty"`
+	CertPath   template.String `yaml:"certPath,omitempty"`
+	TlsVerify  template.Bool   `yaml:"tlsVerify,omitempty"`
+
+	Image                template.String  `yaml:"image"`
+	ImagePullPolicy      PullPolicy       `yaml:"imagePullPolicy,omitempty"`
+	ImagePullCredentials template.String  `yaml:"imagePullCredentials,omitempty"`
+	Networks             template.Strings `yaml:"networks"`
+	Volumes              template.Strings `yaml:"volumes,omitempty"`
+	Mounts               template.Strings `yaml:"mounts,omitempty"`
+	Capabilities         template.Strings `yaml:"capabilities,omitempty"`
+	Privileged           template.Bool    `yaml:"privileged,omitempty"`
+	DnsServers           template.Strings `yaml:"dnsServers,omitempty"`
+	DnsSearch            template.Strings `yaml:"dnsSearch,omitempty"`
+
+	ShellCommand template.Strings `yaml:"shellCommand,omitempty"`
+	ExecCommand  template.Strings `yaml:"execCommand,omitempty"`
+	SftpCommand  template.Strings `yaml:"sftpCommand,omitempty"`
+	Directory    template.String  `yaml:"directory"`
+	User         template.String  `yaml:"user,omitempty"`
+
+	Banner template.String `yaml:"banner,omitempty"`
+
+	PortForwardingAllowed template.Bool `yaml:"portForwardingAllowed,omitempty"`
+	ImpPublishHost        net.Host      `yaml:"impPublishHost"`
+}
+
+func (this *EnvironmentDocker) SetDefaults() error {
+	return setDefaults(this,
+		fixedDefault("loginAllowed", func(v *EnvironmentDocker) *template.Bool { return &v.LoginAllowed }, DefaultEnvironmentDockerLoginAllowed),
+
+		fixedDefault("host", func(v *EnvironmentDocker) *template.String { return &v.Host }, DefaultEnvironmentDockerHost),
+		fixedDefault("apiVersion", func(v *EnvironmentDocker) *template.String { return &v.ApiVersion }, DefaultEnvironmentDockerApiVersion),
+		fixedDefault("certPath", func(v *EnvironmentDocker) *template.String { return &v.CertPath }, DefaultEnvironmentDockerCertPath),
+		fixedDefault("tlsVerify", func(v *EnvironmentDocker) *template.Bool { return &v.TlsVerify }, DefaultEnvironmentDockerTlsVerify),
+
+		fixedDefault("image", func(v *EnvironmentDocker) *template.String { return &v.Image }, DefaultEnvironmentDockerImage),
+		fixedDefault("imagePullPolicy", func(v *EnvironmentDocker) *PullPolicy { return &v.ImagePullPolicy }, DefaultEnvironmentDockerImagePullPolicy),
+		fixedDefault("imagePullCredentials", func(v *EnvironmentDocker) *template.String { return &v.ImagePullCredentials }, DefaultEnvironmentDockerImagePullCredentials),
+		fixedDefault("network", func(v *EnvironmentDocker) *template.Strings { return &v.Networks }, DefaultEnvironmentDockerNetworks),
+		fixedDefault("volumes", func(v *EnvironmentDocker) *template.Strings { return &v.Volumes }, DefaultEnvironmentDockerVolumes),
+		fixedDefault("mounts", func(v *EnvironmentDocker) *template.Strings { return &v.Mounts }, DefaultEnvironmentDockerMounts),
+		fixedDefault("capabilities", func(v *EnvironmentDocker) *template.Strings { return &v.Capabilities }, DefaultEnvironmentDockerCapabilities),
+		fixedDefault("privileged", func(v *EnvironmentDocker) *template.Bool { return &v.Privileged }, DefaultEnvironmentDockerPrivileged),
+		fixedDefault("dnsServers", func(v *EnvironmentDocker) *template.Strings { return &v.DnsServers }, DefaultEnvironmentDockerDnsServers),
+		fixedDefault("dnsSearch", func(v *EnvironmentDocker) *template.Strings { return &v.DnsSearch }, DefaultEnvironmentDockerDnsSearch),
+
+		fixedDefault("shellCommand", func(v *EnvironmentDocker) *template.Strings { return &v.ShellCommand }, DefaultEnvironmentDockerShellCommand),
+		fixedDefault("execCommand", func(v *EnvironmentDocker) *template.Strings { return &v.ExecCommand }, DefaultEnvironmentDockerExecCommand),
+		fixedDefault("sftpCommand", func(v *EnvironmentDocker) *template.Strings { return &v.SftpCommand }, DefaultEnvironmentDockerSftpCommand),
+		fixedDefault("directory", func(v *EnvironmentDocker) *template.String { return &v.Directory }, DefaultEnvironmentDockerDirectory),
+		fixedDefault("user", func(v *EnvironmentDocker) *template.String { return &v.User }, DefaultEnvironmentDockerUser),
+
+		fixedDefault("banner", func(v *EnvironmentDocker) *template.String { return &v.Banner }, DefaultEnvironmentDockerBanner),
+
+		fixedDefault("portForwardingAllowed", func(v *EnvironmentDocker) *template.Bool { return &v.PortForwardingAllowed }, DefaultEnvironmentDockerPortForwardingAllowed),
+		fixedDefault("impPublishHost", func(v *EnvironmentDocker) *net.Host { return &v.ImpPublishHost }, DefaultEnvironmentDockerImpPublishHost),
+	)
+}
+
+func (this *EnvironmentDocker) Trim() error {
+	return trim(this,
+		noopTrim[EnvironmentDocker]("loginAllowed"),
+
+		noopTrim[EnvironmentDocker]("host"),
+		noopTrim[EnvironmentDocker]("apiVersion"),
+		noopTrim[EnvironmentDocker]("certPath"),
+		noopTrim[EnvironmentDocker]("tlsVerify"),
+
+		noopTrim[EnvironmentDocker]("name"),
+		noopTrim[EnvironmentDocker]("image"),
+		noopTrim[EnvironmentDocker]("imagePullPolicy"),
+		noopTrim[EnvironmentDocker]("imagePullCredentials"),
+		noopTrim[EnvironmentDocker]("network"),
+		noopTrim[EnvironmentDocker]("volumes"),
+		noopTrim[EnvironmentDocker]("mounts"),
+		noopTrim[EnvironmentDocker]("capabilities"),
+		noopTrim[EnvironmentDocker]("privileged"),
+		noopTrim[EnvironmentDocker]("dnsServers"),
+		noopTrim[EnvironmentDocker]("dnsSearch"),
+		noopTrim[EnvironmentDocker]("shellCommand"),
+		noopTrim[EnvironmentDocker]("execCommand"),
+		noopTrim[EnvironmentDocker]("sftpCommand"),
+		noopTrim[EnvironmentDocker]("directory"),
+		noopTrim[EnvironmentDocker]("user"),
+
+		noopTrim[EnvironmentDocker]("banner"),
+
+		noopTrim[EnvironmentDocker]("portForwardingAllowed"),
+
+		noopTrim[EnvironmentDocker]("impPublishHost"),
+	)
+}
+
+func (this *EnvironmentDocker) Validate() error {
+	return validate(this,
+		func(v *EnvironmentDocker) (string, validator) { return "loginAllowed", &v.LoginAllowed },
+
+		func(v *EnvironmentDocker) (string, validator) { return "host", &v.Host },
+		func(v *EnvironmentDocker) (string, validator) { return "apiVersion", &v.ApiVersion },
+		func(v *EnvironmentDocker) (string, validator) { return "certPath", &v.CertPath },
+		func(v *EnvironmentDocker) (string, validator) { return "tlsVerify", &v.TlsVerify },
+
+		func(v *EnvironmentDocker) (string, validator) { return "image", &v.Image },
+		notZeroValidate("image", func(v *EnvironmentDocker) *template.String { return &v.Image }),
+		func(v *EnvironmentDocker) (string, validator) { return "imagePullPolicy", &v.ImagePullPolicy },
+		func(v *EnvironmentDocker) (string, validator) { return "imagePullCredentials", &v.ImagePullCredentials },
+		func(v *EnvironmentDocker) (string, validator) { return "network", &v.Networks },
+		notZeroValidate("network", func(v *EnvironmentDocker) *template.Strings { return &v.Networks }),
+		func(v *EnvironmentDocker) (string, validator) { return "volumes", &v.Volumes },
+		func(v *EnvironmentDocker) (string, validator) { return "mounts", &v.Mounts },
+		func(v *EnvironmentDocker) (string, validator) { return "capabilities", &v.Capabilities },
+		func(v *EnvironmentDocker) (string, validator) { return "privileged", &v.Privileged },
+		func(v *EnvironmentDocker) (string, validator) { return "dnsServers", &v.DnsServers },
+		func(v *EnvironmentDocker) (string, validator) { return "dnsSearch", &v.DnsSearch },
+		func(v *EnvironmentDocker) (string, validator) { return "shellCommand", &v.ShellCommand },
+		func(v *EnvironmentDocker) (string, validator) { return "execCommand", &v.ExecCommand },
+		func(v *EnvironmentDocker) (string, validator) { return "sftpCommand", &v.SftpCommand },
+		func(v *EnvironmentDocker) (string, validator) { return "directory", &v.Directory },
+		func(v *EnvironmentDocker) (string, validator) { return "user", &v.User },
+
+		func(v *EnvironmentDocker) (string, validator) { return "banner", &v.Banner },
+
+		func(v *EnvironmentDocker) (string, validator) {
+			return "portForwardingAllowed", &v.PortForwardingAllowed
+		},
+
+		func(v *EnvironmentDocker) (string, validator) { return "impPublishHost", &v.ImpPublishHost },
+	)
+}
+
+func (this *EnvironmentDocker) UnmarshalYAML(node *yaml.Node) error {
+	return unmarshalYAML(this, node, func(target *EnvironmentDocker, node *yaml.Node) error {
+		type raw EnvironmentDocker
+		return node.Decode((*raw)(target))
+	})
+}
+
+func (this EnvironmentDocker) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case EnvironmentDocker:
+		return this.isEqualTo(&v)
+	case *EnvironmentDocker:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this EnvironmentDocker) isEqualTo(other *EnvironmentDocker) bool {
+	return isEqual(&this.LoginAllowed, &other.LoginAllowed) &&
+		isEqual(&this.Host, &other.Host) &&
+		isEqual(&this.ApiVersion, &other.ApiVersion) &&
+		isEqual(&this.CertPath, &other.CertPath) &&
+		isEqual(&this.TlsVerify, &other.TlsVerify) &&
+		isEqual(&this.Image, &other.Image) &&
+		isEqual(&this.ImagePullPolicy, &other.ImagePullPolicy) &&
+		isEqual(&this.ImagePullCredentials, &other.ImagePullCredentials) &&
+		isEqual(&this.Networks, &other.Networks) &&
+		isEqual(&this.Volumes, &other.Volumes) &&
+		isEqual(&this.Mounts, &other.Mounts) &&
+		isEqual(&this.Capabilities, &other.Capabilities) &&
+		isEqual(&this.Privileged, &other.Privileged) &&
+		isEqual(&this.DnsServers, &other.DnsServers) &&
+		isEqual(&this.DnsSearch, &other.DnsSearch) &&
+		isEqual(&this.ShellCommand, &other.ShellCommand) &&
+		isEqual(&this.ExecCommand, &other.ExecCommand) &&
+		isEqual(&this.SftpCommand, &other.SftpCommand) &&
+		isEqual(&this.Directory, &other.Directory) &&
+		isEqual(&this.User, &other.User) &&
+		isEqual(&this.Banner, &other.Banner) &&
+		isEqual(&this.PortForwardingAllowed, &other.PortForwardingAllowed) &&
+		isEqual(&this.ImpPublishHost, &other.ImpPublishHost)
+}
+
+func (this EnvironmentDocker) Types() []string {
+	return []string{"docker"}
+}
+
+func (this EnvironmentDocker) FeatureFlags() []string {
+	return []string{"docker"}
+}
diff --git a/pkg/configuration/environment-dummy.go b/pkg/configuration/environment-dummy.go
new file mode 100644
index 0000000..435e460
--- /dev/null
+++ b/pkg/configuration/environment-dummy.go
@@ -0,0 +1,76 @@
+package configuration
+
+import (
+	"gopkg.in/yaml.v3"
+
+	"github.com/engity-com/bifroest/pkg/template"
+)
+
+var (
+	DefaultEnvironmentDummyExitCode = template.Int64Of(0)
+	DefaultEnvironmentDummyBanner   = template.MustNewString("")
+
+	_ = RegisterEnvironmentV(func() EnvironmentV {
+		return &EnvironmentDummy{}
+	})
+)
+
+type EnvironmentDummy struct {
+	ExitCode template.Int64  `yaml:"exitCode,omitempty"`
+	Banner   template.String `yaml:"banner,omitempty"`
+}
+
+func (this *EnvironmentDummy) SetDefaults() error {
+	return setDefaults(this,
+		fixedDefault("exitCode", func(v *EnvironmentDummy) *template.Int64 { return &v.ExitCode }, DefaultEnvironmentDummyExitCode),
+		fixedDefault("banner", func(v *EnvironmentDummy) *template.String { return &v.Banner }, DefaultEnvironmentDummyBanner),
+	)
+}
+
+func (this *EnvironmentDummy) Trim() error {
+	return trim(this,
+		noopTrim[EnvironmentDummy]("exitCode"),
+		noopTrim[EnvironmentDummy]("banner"),
+	)
+}
+
+func (this *EnvironmentDummy) Validate() error {
+	return validate(this,
+		func(v *EnvironmentDummy) (string, validator) { return "exitCode", &v.ExitCode },
+		func(v *EnvironmentDummy) (string, validator) { return "banner", &v.Banner },
+	)
+}
+
+func (this *EnvironmentDummy) UnmarshalYAML(node *yaml.Node) error {
+	return unmarshalYAML(this, node, func(target *EnvironmentDummy, node *yaml.Node) error {
+		type raw EnvironmentDummy
+		return node.Decode((*raw)(target))
+	})
+}
+
+func (this EnvironmentDummy) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case EnvironmentDummy:
+		return this.isEqualTo(&v)
+	case *EnvironmentDummy:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this EnvironmentDummy) isEqualTo(other *EnvironmentDummy) bool {
+	return isEqual(&this.ExitCode, &other.ExitCode) &&
+		isEqual(&this.Banner, &other.Banner)
+}
+
+func (this EnvironmentDummy) Types() []string {
+	return []string{"dummy"}
+}
+
+func (this EnvironmentDummy) FeatureFlags() []string {
+	return []string{"dummy"}
+}
diff --git a/pkg/configuration/environment-local-dispose.go b/pkg/configuration/environment-local-dispose.go
index bb5577b..d7bed57 100644
--- a/pkg/configuration/environment-local-dispose.go
+++ b/pkg/configuration/environment-local-dispose.go
@@ -38,9 +38,13 @@ func (this *EnvironmentLocalDispose) Trim() error {
 
 func (this *EnvironmentLocalDispose) Validate() error {
 	return validate(this,
-		noopValidate[EnvironmentLocalDispose]("deleteManagedUser"),
-		noopValidate[EnvironmentLocalDispose]("deleteManagedUserHomeDir"),
-		noopValidate[EnvironmentLocalDispose]("killManagedUserProcesses"),
+		func(v *EnvironmentLocalDispose) (string, validator) { return "deleteManagedUser", &v.DeleteManagedUser },
+		func(v *EnvironmentLocalDispose) (string, validator) {
+			return "deleteManagedUserHomeDir", &v.DeleteManagedUserHomeDir
+		},
+		func(v *EnvironmentLocalDispose) (string, validator) {
+			return "killManagedUserProcesses", &v.KillManagedUserProcesses
+		},
 	)
 }
 
diff --git a/pkg/configuration/environment-local_unix.go b/pkg/configuration/environment-local_unix.go
index e5c97f7..2b3b5fc 100644
--- a/pkg/configuration/environment-local_unix.go
+++ b/pkg/configuration/environment-local_unix.go
@@ -63,15 +63,17 @@ func (this *EnvironmentLocal) Validate() error {
 	return validate(this,
 		func(v *EnvironmentLocal) (string, validator) { return "", &v.User },
 
-		noopValidate[EnvironmentLocal]("loginAllowed"),
+		func(v *EnvironmentLocal) (string, validator) { return "loginAllowed", &v.LoginAllowed },
 
-		noopValidate[EnvironmentLocal]("createIfAbsent"),
-		noopValidate[EnvironmentLocal]("updateIfDifferent"),
+		func(v *EnvironmentLocal) (string, validator) { return "createIfAbsent", &v.CreateIfAbsent },
+		func(v *EnvironmentLocal) (string, validator) { return "updateIfDifferent", &v.UpdateIfDifferent },
 		func(v *EnvironmentLocal) (string, validator) { return "dispose", &v.Dispose },
 
-		noopValidate[EnvironmentLocal]("banner"),
+		func(v *EnvironmentLocal) (string, validator) { return "banner", &v.Banner },
 
-		noopValidate[EnvironmentLocal]("portForwardingAllowed"),
+		func(v *EnvironmentLocal) (string, validator) {
+			return "portForwardingAllowed", &v.PortForwardingAllowed
+		},
 	)
 }
 
diff --git a/pkg/configuration/environment-local_windows.go b/pkg/configuration/environment-local_windows.go
index cf1a607..00a4b0f 100644
--- a/pkg/configuration/environment-local_windows.go
+++ b/pkg/configuration/environment-local_windows.go
@@ -66,12 +66,14 @@ func (this *EnvironmentLocal) Trim() error {
 
 func (this *EnvironmentLocal) Validate() error {
 	return validate(this,
-		noopValidate[EnvironmentLocal]("loginAllowed"),
-		noopValidate[EnvironmentLocal]("banner"),
-		noopValidate[EnvironmentLocal]("shellCommand"),
-		noopValidate[EnvironmentLocal]("execCommandPrefix"),
-		noopValidate[EnvironmentLocal]("directory"),
-		noopValidate[EnvironmentLocal]("portForwardingAllowed"),
+		func(v *EnvironmentLocal) (string, validator) { return "loginAllowed", &v.LoginAllowed },
+		func(v *EnvironmentLocal) (string, validator) { return "banner", &v.Banner },
+		func(v *EnvironmentLocal) (string, validator) { return "shellCommand", &v.ShellCommand },
+		func(v *EnvironmentLocal) (string, validator) { return "execCommandPrefix", &v.ExecCommandPrefix },
+		func(v *EnvironmentLocal) (string, validator) { return "directory", &v.Directory },
+		func(v *EnvironmentLocal) (string, validator) {
+			return "portForwardingAllowed", &v.PortForwardingAllowed
+		},
 	)
 }
 
diff --git a/pkg/configuration/flow.go b/pkg/configuration/flow.go
index 5f73078..6aada5b 100644
--- a/pkg/configuration/flow.go
+++ b/pkg/configuration/flow.go
@@ -92,7 +92,11 @@ func (this Flow) isEqualTo(other *Flow) bool {
 type Flows []Flow
 
 func (this *Flows) SetDefaults() error {
-	return setSliceDefaults(this)
+	return setSliceDefaults(this) // Empty, be default.
+}
+
+func (this Flows) IsZero() bool {
+	return len(this) == 0
 }
 
 func (this *Flows) Trim() error {
@@ -103,6 +107,15 @@ func (this Flows) Validate() error {
 	return validateSlice(this)
 }
 
+func (this *Flows) UnmarshalYAML(node *yaml.Node) error {
+	// Clear the entries before...
+	*this = Flows{}
+	return unmarshalYAML(this, node, func(target *Flows, node *yaml.Node) error {
+		type raw Flows
+		return node.Decode((*raw)(target))
+	})
+}
+
 func (this Flows) IsEqualTo(other any) bool {
 	if other == nil {
 		return false
diff --git a/pkg/configuration/group-requirement-template.go b/pkg/configuration/group-requirement-template.go
index 8de77cd..237e155 100644
--- a/pkg/configuration/group-requirement-template.go
+++ b/pkg/configuration/group-requirement-template.go
@@ -51,8 +51,8 @@ func (this *GroupRequirementTemplate) Trim() error {
 
 func (this *GroupRequirementTemplate) Validate() error {
 	return validate(this,
-		noopValidate[GroupRequirementTemplate]("gid"),
-		noopValidate[GroupRequirementTemplate]("name"),
+		func(v *GroupRequirementTemplate) (string, validator) { return "gid", v.Gid },
+		func(v *GroupRequirementTemplate) (string, validator) { return "name", &v.Name },
 	)
 }
 
@@ -96,7 +96,7 @@ func (this GroupRequirementTemplates) Render(key common.StructuredKey, data any)
 }
 
 func (this *GroupRequirementTemplates) SetDefaults() error {
-	return setSliceDefaults(this)
+	return setSliceDefaults(this) // Empty, be default.
 }
 
 func (this *GroupRequirementTemplates) Trim() error {
@@ -107,6 +107,15 @@ func (this GroupRequirementTemplates) Validate() error {
 	return validateSlice(this)
 }
 
+func (this *GroupRequirementTemplates) UnmarshalYAML(node *yaml.Node) error {
+	// Clear the entries before...
+	*this = GroupRequirementTemplates{}
+	return unmarshalYAML(this, node, func(target *GroupRequirementTemplates, node *yaml.Node) error {
+		type raw GroupRequirementTemplates
+		return node.Decode((*raw)(target))
+	})
+}
+
 func (this GroupRequirementTemplates) IsEqualTo(other any) bool {
 	if other == nil {
 		return false
diff --git a/pkg/configuration/keys.go b/pkg/configuration/keys.go
index 7918e86..7383d5a 100644
--- a/pkg/configuration/keys.go
+++ b/pkg/configuration/keys.go
@@ -1,8 +1,6 @@
 package configuration
 
 import (
-	"slices"
-
 	"gopkg.in/yaml.v3"
 
 	"github.com/engity-com/bifroest/pkg/crypto"
@@ -10,12 +8,12 @@ import (
 )
 
 var (
-	DefaultHostKeyLocations       = []string{DefaultHostKeyLocation}
+	DefaultHostKeyLocations       = template.MustNewStrings(DefaultHostKeyLocation)
 	DefaultRememberMeNotification = template.MustNewString("\nIf you return until {{.session.validUntil | format `dateTimeT`}} with the same public key ({{.key | fingerprint}}), you can seamlessly login again.\n\n")
 )
 
 type Keys struct {
-	HostKeys               []string                  `yaml:"hostKeys"`
+	HostKeys               template.Strings          `yaml:"hostKeys"`
 	RsaRestriction         crypto.RsaRestriction     `yaml:"rsaRestriction"`
 	DsaRestriction         crypto.DsaRestriction     `yaml:"dsaRestriction"`
 	EcdsaRestriction       crypto.EcdsaRestriction   `yaml:"ecdsaRestriction"`
@@ -25,7 +23,7 @@ type Keys struct {
 
 func (this *Keys) SetDefaults() error {
 	return setDefaults(this,
-		fixedDefault("hostKeys", func(v *Keys) *[]string { return &v.HostKeys }, DefaultHostKeyLocations),
+		fixedDefault("hostKeys", func(v *Keys) *template.Strings { return &v.HostKeys }, DefaultHostKeyLocations),
 		fixedDefault("rsaRestriction", func(v *Keys) *crypto.RsaRestriction { return &v.RsaRestriction }, crypto.DefaultRsaRestriction),
 		fixedDefault("dsaRestriction", func(v *Keys) *crypto.DsaRestriction { return &v.DsaRestriction }, crypto.DefaultDsaRestriction),
 		fixedDefault("ecdsaRestriction", func(v *Keys) *crypto.EcdsaRestriction { return &v.EcdsaRestriction }, crypto.DefaultEcdsaRestriction),
@@ -36,7 +34,7 @@ func (this *Keys) SetDefaults() error {
 
 func (this *Keys) Trim() error {
 	return trim(this,
-		func(v *Keys) (string, trimmer) { return "hostKeys", &stringSliceTrimmer{&v.HostKeys} },
+		noopTrim[Keys]("hostKeys"),
 		noopTrim[Keys]("rsaRestriction"),
 		noopTrim[Keys]("dsaRestriction"),
 		noopTrim[Keys]("ecdsaRestriction"),
@@ -47,12 +45,13 @@ func (this *Keys) Trim() error {
 
 func (this *Keys) Validate() error {
 	return validate(this,
-		notEmptySliceValidate("hostKeys", func(v *Keys) *[]string { return &v.HostKeys }),
+		func(v *Keys) (string, validator) { return "hostKeys", &v.HostKeys },
+		notZeroValidate("hostKeys", func(v *Keys) *template.Strings { return &v.HostKeys }),
 		func(v *Keys) (string, validator) { return "rsaRestriction", &v.RsaRestriction },
 		func(v *Keys) (string, validator) { return "dsaRestriction", &v.DsaRestriction },
 		func(v *Keys) (string, validator) { return "ecdsaRestriction", &v.EcdsaRestriction },
 		func(v *Keys) (string, validator) { return "ed25519Restriction", &v.Ed25519Restriction },
-		noopValidate[Keys]("rememberMeNotification"),
+		func(v *Keys) (string, validator) { return "rememberMeNotification", &v.RememberMeNotification },
 	)
 }
 
@@ -78,7 +77,7 @@ func (this Keys) IsEqualTo(other any) bool {
 }
 
 func (this Keys) isEqualTo(other *Keys) bool {
-	return slices.Equal(this.HostKeys, other.HostKeys) &&
+	return isEqual(&this.HostKeys, &other.HostKeys) &&
 		isEqual(&this.RsaRestriction, &other.RsaRestriction) &&
 		isEqual(&this.DsaRestriction, &other.DsaRestriction) &&
 		isEqual(&this.EcdsaRestriction, &other.EcdsaRestriction) &&
diff --git a/pkg/configuration/password-properties.go b/pkg/configuration/password-properties.go
index a71f18e..766f313 100644
--- a/pkg/configuration/password-properties.go
+++ b/pkg/configuration/password-properties.go
@@ -36,9 +36,9 @@ func (this *PasswordProperties) Trim() error {
 
 func (this *PasswordProperties) Validate() error {
 	return validate(this,
-		noopValidate[PasswordProperties]("allowed"),
-		noopValidate[PasswordProperties]("interactiveAllowed"),
-		noopValidate[PasswordProperties]("emptyAllowed"),
+		func(v *PasswordProperties) (string, validator) { return "allowed", &v.Allowed },
+		func(v *PasswordProperties) (string, validator) { return "interactiveAllowed", &v.InteractiveAllowed },
+		func(v *PasswordProperties) (string, validator) { return "emptyAllowed", &v.EmptyAllowed },
 	)
 }
 
diff --git a/pkg/configuration/preparation-message.go b/pkg/configuration/preparation-message.go
new file mode 100644
index 0000000..63cde59
--- /dev/null
+++ b/pkg/configuration/preparation-message.go
@@ -0,0 +1,143 @@
+package configuration
+
+import (
+	"gopkg.in/yaml.v3"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/template"
+)
+
+var (
+	DefaultPreparationMessageId     = common.MustNewRegexp(`.*`)
+	DefaultPreparationMessageFlow   = common.MustNewRegexp(`.*`)
+	DefaultPreparationMessageStart  = template.MustNewString("{{.title}}...")
+	DefaultPreparationMessageUpdate = template.MustNewString("\r{{.title}}... {{.percentage | printf `%.0f%%`}}")
+	DefaultPreparationMessageEnd    = template.MustNewString("\r{{.title}}... DONE!\n")
+	DefaultPreparationMessageError  = template.MustNewString("\r{{.title}}... FAILED! Contact server operator for more information. Disconnecting now...\n")
+)
+
+type PreparationMessage struct {
+	Id   common.Regexp `yaml:"id,omitempty"`
+	Flow common.Regexp `yaml:"flow,omitempty"`
+
+	Start  template.String `yaml:"start,omitempty"`
+	Update template.String `yaml:"update,omitempty"`
+	End    template.String `yaml:"end,omitempty"`
+	Error  template.String `yaml:"error,omitempty"`
+}
+
+func (this *PreparationMessage) SetDefaults() error {
+	return setDefaults(this,
+		fixedDefault("id", func(v *PreparationMessage) *common.Regexp { return &v.Id }, DefaultPreparationMessageId),
+		fixedDefault("flow", func(v *PreparationMessage) *common.Regexp { return &v.Flow }, DefaultPreparationMessageFlow),
+
+		fixedDefault("start", func(v *PreparationMessage) *template.String { return &v.Start }, DefaultPreparationMessageStart),
+		fixedDefault("update", func(v *PreparationMessage) *template.String { return &v.Update }, DefaultPreparationMessageUpdate),
+		fixedDefault("end", func(v *PreparationMessage) *template.String { return &v.End }, DefaultPreparationMessageEnd),
+		fixedDefault("error", func(v *PreparationMessage) *template.String { return &v.Error }, DefaultPreparationMessageError),
+	)
+}
+
+func (this *PreparationMessage) Trim() error {
+	return trim(this,
+		noopTrim[PreparationMessage]("id"),
+		noopTrim[PreparationMessage]("flow"),
+
+		noopTrim[PreparationMessage]("start"),
+		noopTrim[PreparationMessage]("update"),
+		noopTrim[PreparationMessage]("end"),
+		noopTrim[PreparationMessage]("error"),
+	)
+}
+
+func (this *PreparationMessage) Validate() error {
+	return validate(this,
+		func(v *PreparationMessage) (string, validator) { return "id", &v.Id },
+		func(v *PreparationMessage) (string, validator) { return "flow", &v.Flow },
+
+		func(v *PreparationMessage) (string, validator) { return "start", &v.Start },
+		func(v *PreparationMessage) (string, validator) { return "update", &v.Update },
+		func(v *PreparationMessage) (string, validator) { return "end", &v.End },
+		func(v *PreparationMessage) (string, validator) { return "error", &v.Error },
+	)
+}
+
+func (this *PreparationMessage) UnmarshalYAML(node *yaml.Node) error {
+	return unmarshalYAML(this, node, func(target *PreparationMessage, node *yaml.Node) error {
+		type raw PreparationMessage
+		return node.Decode((*raw)(target))
+	})
+}
+
+func (this PreparationMessage) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case PreparationMessage:
+		return this.isEqualTo(&v)
+	case *PreparationMessage:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this PreparationMessage) isEqualTo(other *PreparationMessage) bool {
+	return isEqual(&this.Id, &other.Id) &&
+		isEqual(&this.Flow, &other.Flow) &&
+		isEqual(&this.Start, &other.Start) &&
+		isEqual(&this.Update, &other.Update) &&
+		isEqual(&this.End, &other.End) &&
+		isEqual(&this.Error, &other.Error)
+}
+
+// PreparationMessages defines a set of PreparationMessage instances.
+type PreparationMessages []PreparationMessage
+
+func (this *PreparationMessages) SetDefaults() error {
+	return setSliceDefaults(this, PreparationMessage{}) // Has one entry, be default.
+}
+
+func (this *PreparationMessages) Trim() error {
+	return trimSlice(this)
+}
+
+func (this PreparationMessages) Validate() error {
+	return validateSlice(this)
+}
+
+func (this *PreparationMessages) UnmarshalYAML(node *yaml.Node) error {
+	// Clear the entries before...
+	*this = PreparationMessages{}
+	return unmarshalYAML(this, node, func(target *PreparationMessages, node *yaml.Node) error {
+		type raw PreparationMessages
+		return node.Decode((*raw)(target))
+	})
+}
+
+func (this PreparationMessages) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case PreparationMessages:
+		return this.isEqualTo(&v)
+	case *PreparationMessages:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this PreparationMessages) isEqualTo(other *PreparationMessages) bool {
+	if len(this) != len(*other) {
+		return false
+	}
+	for i, tv := range this {
+		if !tv.IsEqualTo((*other)[i]) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/pkg/configuration/pull-policy.go b/pkg/configuration/pull-policy.go
new file mode 100644
index 0000000..2e07a9d
--- /dev/null
+++ b/pkg/configuration/pull-policy.go
@@ -0,0 +1,90 @@
+package configuration
+
+import (
+	"fmt"
+
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+type PullPolicy uint8
+
+const (
+	PullPolicyIfAbsent PullPolicy = iota
+	PullPolicyAlways
+)
+
+var (
+	pullPolicyToName = map[PullPolicy]string{
+		PullPolicyIfAbsent: "ifAbsent",
+		PullPolicyAlways:   "always",
+	}
+	nameToPullPolicy = func(in map[PullPolicy]string) map[string]PullPolicy {
+		result := make(map[string]PullPolicy, len(in))
+		for k, v := range in {
+			result[v] = k
+		}
+		result[""] = PullPolicyIfAbsent
+		result["if-absent"] = PullPolicyIfAbsent
+		return result
+	}(pullPolicyToName)
+)
+
+func (this PullPolicy) IsZero() bool {
+	return false
+}
+
+func (this PullPolicy) MarshalText() (text []byte, err error) {
+	v, ok := pullPolicyToName[this]
+	if !ok {
+		return nil, errors.Config.Newf("illegal pull-policy: %d", this)
+	}
+	return []byte(v), nil
+}
+
+func (this PullPolicy) String() string {
+	v, ok := pullPolicyToName[this]
+	if !ok {
+		return fmt.Sprintf("illegal-pull-policy-%d", this)
+	}
+	return v
+}
+
+func (this *PullPolicy) UnmarshalText(text []byte) error {
+	v, ok := nameToPullPolicy[string(text)]
+	if !ok {
+		return errors.Config.Newf("illegal pull-policy: %s", string(text))
+	}
+	*this = v
+	return nil
+}
+
+func (this *PullPolicy) Set(text string) error {
+	return this.UnmarshalText([]byte(text))
+}
+
+func (this PullPolicy) Validate() error {
+	_, err := this.MarshalText()
+	return err
+}
+
+func (this PullPolicy) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case PullPolicy:
+		return this.isEqualTo(&v)
+	case *PullPolicy:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this PullPolicy) isEqualTo(other *PullPolicy) bool {
+	return this == *other
+}
+
+func (this PullPolicy) Clone() PullPolicy {
+	return this
+}
diff --git a/pkg/configuration/ssh.go b/pkg/configuration/ssh.go
index 4ee1ae3..02b01cd 100644
--- a/pkg/configuration/ssh.go
+++ b/pkg/configuration/ssh.go
@@ -59,6 +59,10 @@ type Ssh struct {
 
 	// Banner will be displayed if the clients connects to the server before any other action takes place.
 	Banner template.String `yaml:"banner,omitempty"`
+
+	// PreparationMessages will be displayed if any kind of preparation is required before the ssh session can
+	// finally be used.
+	PreparationMessages PreparationMessages `yaml:"preparationMessages,omitempty"`
 }
 
 func (this *Ssh) SetDefaults() error {
@@ -70,6 +74,7 @@ func (this *Ssh) SetDefaults() error {
 		fixedDefault("maxAuthTries", func(v *Ssh) *uint8 { return &v.MaxAuthTries }, DefaultSshMaxAuthTries),
 		fixedDefault("maxConnections", func(v *Ssh) *uint32 { return &v.MaxConnections }, DefaultSshMaxConnections),
 		fixedDefault("banner", func(v *Ssh) *template.String { return &v.Banner }, DefaultSshBanner),
+		func(v *Ssh) (string, defaulter) { return "preparationMessages", &v.PreparationMessages },
 	)
 }
 
@@ -82,6 +87,7 @@ func (this *Ssh) Trim() error {
 		noopTrim[Ssh]("maxAuthTries"),
 		noopTrim[Ssh]("maxConnections"),
 		noopTrim[Ssh]("banner"),
+		func(v *Ssh) (string, trimmer) { return "preparationMessages", &v.PreparationMessages },
 	)
 }
 
@@ -89,11 +95,12 @@ func (this *Ssh) Validate() error {
 	return validate(this,
 		func(v *Ssh) (string, validator) { return "addresses", &v.Addresses },
 		func(v *Ssh) (string, validator) { return "keys", &v.Keys },
-		noopValidate[Ssh]("idleTimeout"),
-		noopValidate[Ssh]("maxTimeout"),
+		func(v *Ssh) (string, validator) { return "idleTimeout", &v.IdleTimeout },
+		func(v *Ssh) (string, validator) { return "maxTimeout", &v.MaxTimeout },
 		noopValidate[Ssh]("maxAuthTries"),
 		noopValidate[Ssh]("maxConnections"),
-		noopValidate[Ssh]("banner"),
+		func(v *Ssh) (string, validator) { return "banner", &v.Banner },
+		func(v *Ssh) (string, validator) { return "preparationMessages", &v.PreparationMessages },
 	)
 }
 
@@ -125,5 +132,6 @@ func (this Ssh) isEqualTo(other *Ssh) bool {
 		isEqual(&this.MaxTimeout, &other.MaxTimeout) &&
 		this.MaxAuthTries == other.MaxAuthTries &&
 		this.MaxConnections == other.MaxConnections &&
-		isEqual(&this.Banner, &other.Banner)
+		isEqual(&this.Banner, &other.Banner) &&
+		isEqual(&this.PreparationMessages, &other.PreparationMessages)
 }
diff --git a/pkg/configuration/support.go b/pkg/configuration/support.go
index 6c40c66..faf59a8 100644
--- a/pkg/configuration/support.go
+++ b/pkg/configuration/support.go
@@ -3,7 +3,7 @@ package configuration
 import (
 	"errors"
 	"fmt"
-	"slices"
+	"reflect"
 	"strings"
 
 	"gopkg.in/yaml.v3"
@@ -32,7 +32,8 @@ func setDefaults[T any](target *T, fs ...func(*T) (string, defaulter)) error {
 	return nil
 }
 
-func setSliceDefaults[T any, S ~[]T](target *S) error {
+func setSliceDefaults[T any, S ~[]T](target *S, initialValues ...T) error {
+	*target = initialValues
 	for i, v := range *target {
 		var pv any = &v
 		if err := pv.(defaulter).SetDefaults(); err != nil {
@@ -96,36 +97,6 @@ func (this *stringTrimmer) Trim() error {
 	return nil
 }
 
-type stringSliceTrimmer struct {
-	target *[]string
-}
-
-func (this *stringSliceTrimmer) Trim() error {
-	for i, v := range *this.target {
-		(*this.target)[i] = strings.TrimSpace(v)
-	}
-	*this.target = slices.DeleteFunc(*this.target, func(v string) bool {
-		return v == ""
-	})
-	return nil
-}
-
-type sliceTrimmer[T any] struct {
-	target    *[]T
-	condition func(t T) bool
-}
-
-func (this *sliceTrimmer[T]) Trim() error {
-	*this.target = slices.DeleteFunc(*this.target, this.condition)
-	return nil
-}
-
-func trimSliceBy[T any, V any](name string, target func(*T) *[]V, condition func(v V) bool) func(*T) (string, trimmer) {
-	return func(t *T) (string, trimmer) {
-		return name, &sliceTrimmer[V]{target(t), condition}
-	}
-}
-
 type validator interface {
 	Validate() error
 }
@@ -133,6 +104,9 @@ type validator interface {
 func validate[T any](target T, fs ...func(T) (string, validator)) error {
 	for _, f := range fs {
 		n, d := f(target)
+		if reflect.ValueOf(d).IsNil() {
+			continue
+		}
 		if err := d.Validate(); err != nil {
 			if n == "" {
 				return err
@@ -153,23 +127,6 @@ func validateSlice[T any, S ~[]T](target S) error {
 	return nil
 }
 
-type notEmptySliceValidator[T any] struct {
-	target *[]T
-}
-
-func (this *notEmptySliceValidator[T]) Validate() error {
-	if len(*this.target) == 0 {
-		return fmt.Errorf("required but absent")
-	}
-	return nil
-}
-
-func notEmptySliceValidate[T any, V any](name string, target func(*T) *[]V) func(*T) (string, validator) {
-	return func(t *T) (string, validator) {
-		return name, &notEmptySliceValidator[V]{target(t)}
-	}
-}
-
 type notEmptyStringValidator struct {
 	target *string
 }
@@ -319,22 +276,3 @@ func isEqual[T equaler](left, right *T) bool {
 	}
 	return (*left).IsEqualTo(*right)
 }
-
-//nolint:golint,unused
-func isEqualSlice[T equaler](left, right *[]T) bool {
-	if left == nil && right == nil {
-		return true
-	}
-	if left == nil || right == nil {
-		return false
-	}
-	if len(*left) != len(*right) {
-		return false
-	}
-	for i, lv := range *left {
-		if !isEqual[T](&lv, &((*right)[i])) {
-			return false
-		}
-	}
-	return false
-}
diff --git a/pkg/configuration/user-requirement-template.go b/pkg/configuration/user-requirement-template.go
index 48ccdde..9d4ca8d 100644
--- a/pkg/configuration/user-requirement-template.go
+++ b/pkg/configuration/user-requirement-template.go
@@ -52,13 +52,14 @@ func (this *UserRequirementTemplate) Trim() error {
 func (this *UserRequirementTemplate) Validate() error {
 	return validate(this,
 		notZeroValidate("name", func(v *UserRequirementTemplate) *template.String { return &v.Name }),
-		noopValidate[UserRequirementTemplate]("displayName"),
-		noopValidate[UserRequirementTemplate]("uid"),
+		func(v *UserRequirementTemplate) (string, validator) { return "name", &v.Name },
+		func(v *UserRequirementTemplate) (string, validator) { return "displayName", &v.DisplayName },
+		func(v *UserRequirementTemplate) (string, validator) { return "uid", v.Uid },
 		func(v *UserRequirementTemplate) (string, validator) { return "group", &v.Group },
 		func(v *UserRequirementTemplate) (string, validator) { return "groups", &v.Groups },
-		noopValidate[UserRequirementTemplate]("shell"),
-		noopValidate[UserRequirementTemplate]("homeDir"),
-		noopValidate[UserRequirementTemplate]("skel"),
+		func(v *UserRequirementTemplate) (string, validator) { return "shell", &v.Shell },
+		func(v *UserRequirementTemplate) (string, validator) { return "homeDir", &v.HomeDir },
+		func(v *UserRequirementTemplate) (string, validator) { return "skel", &v.Skel },
 	)
 }
 
diff --git a/pkg/connection/id.go b/pkg/connection/id.go
new file mode 100644
index 0000000..8abd0c6
--- /dev/null
+++ b/pkg/connection/id.go
@@ -0,0 +1,120 @@
+package connection
+
+import (
+	"bytes"
+
+	"github.com/google/uuid"
+	"github.com/vmihailenco/msgpack/v5"
+
+	"github.com/engity-com/bifroest/pkg/codec"
+	"github.com/engity-com/bifroest/pkg/common"
+)
+
+func NewId() (Id, error) {
+	raw, err := uuid.NewRandom()
+	if err != nil {
+		return Id{}, err
+	}
+	return Id(raw), nil
+}
+
+func MustNewId() Id {
+	id, err := NewId()
+	common.Must(err)
+	return id
+}
+
+type Id uuid.UUID
+
+func (this Id) String() string {
+	return uuid.UUID(this).String()
+}
+
+func (this Id) IsZero() bool {
+	for _, v := range this {
+		if v != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+func (this Id) MarshalText() (text []byte, err error) {
+	return uuid.UUID(this).MarshalText()
+}
+
+func (this *Id) UnmarshalText(text []byte) error {
+	var buf uuid.UUID
+	if err := buf.UnmarshalText(text); err != nil {
+		return err
+	}
+	*this = Id(buf)
+	return nil
+}
+
+func (this Id) MarshalBinary() (b []byte, err error) {
+	if this.IsZero() {
+		return nil, nil
+	}
+	return uuid.UUID(this).MarshalBinary()
+}
+
+func (this *Id) UnmarshalBinary(b []byte) error {
+	if len(b) == 0 {
+		*this = Id{}
+		return nil
+	}
+
+	var buf uuid.UUID
+	if err := buf.UnmarshalBinary(b); err != nil {
+		return err
+	}
+	*this = Id(buf)
+	return nil
+}
+
+func (this Id) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this *Id) DecodeMsgpack(dec *msgpack.Decoder) error {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this Id) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	b, err := this.MarshalBinary()
+	if err != nil {
+		return err
+	}
+	return enc.EncodeBytes(b)
+}
+
+func (this *Id) DecodeMsgPack(dec codec.MsgPackDecoder) error {
+	b, err := dec.DecodeBytes()
+	if err != nil {
+		return err
+	}
+	return this.UnmarshalBinary(b)
+}
+
+func (this *Id) Set(text string) error {
+	return this.UnmarshalText([]byte(text))
+}
+
+func (this Id) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case Id:
+		return bytes.Equal(this[:], v[:])
+	case *Id:
+		return bytes.Equal(this[:], (*v)[:])
+	case uuid.UUID:
+		return bytes.Equal(this[:], v[:])
+	case *uuid.UUID:
+		return bytes.Equal(this[:], (*v)[:])
+	default:
+		return false
+	}
+}
diff --git a/pkg/crypto/dsa-restriction.go b/pkg/crypto/dsa-restriction.go
index 9e2d817..a5131d9 100644
--- a/pkg/crypto/dsa-restriction.go
+++ b/pkg/crypto/dsa-restriction.go
@@ -116,6 +116,10 @@ func (this DsaRestriction) BitsAllowed(in int) bool {
 
 func (this DsaRestriction) KeyAllowed(in any) (bool, error) {
 	switch v := in.(type) {
+	case PrivateKey:
+		return this.KeyAllowed(v.ToSdk())
+	case PublicKey:
+		return this.KeyAllowed(v.ToSdk())
 	case ssh.Signer:
 		return this.KeyAllowed(v.PublicKey())
 	case ssh.CryptoPublicKey:
diff --git a/pkg/crypto/ecdsa-restriction.go b/pkg/crypto/ecdsa-restriction.go
index bf5d92b..e7f62de 100644
--- a/pkg/crypto/ecdsa-restriction.go
+++ b/pkg/crypto/ecdsa-restriction.go
@@ -116,6 +116,10 @@ func (this EcdsaRestriction) BitsAllowed(in int) bool {
 
 func (this EcdsaRestriction) KeyAllowed(in any) (bool, error) {
 	switch v := in.(type) {
+	case PrivateKey:
+		return this.KeyAllowed(v.ToSdk())
+	case PublicKey:
+		return this.KeyAllowed(v.ToSdk())
 	case ssh.Signer:
 		return this.KeyAllowed(v.PublicKey())
 	case ssh.CryptoPublicKey:
diff --git a/pkg/crypto/ed25519-restriction.go b/pkg/crypto/ed25519-restriction.go
index 53c3ad9..0cff572 100644
--- a/pkg/crypto/ed25519-restriction.go
+++ b/pkg/crypto/ed25519-restriction.go
@@ -102,6 +102,10 @@ func (this Ed25519Restriction) BitsAllowed(in int) bool {
 
 func (this Ed25519Restriction) KeyAllowed(in any) (bool, error) {
 	switch v := in.(type) {
+	case PrivateKey:
+		return this.KeyAllowed(v.ToSdk())
+	case PublicKey:
+		return this.KeyAllowed(v.ToSdk())
 	case ssh.Signer:
 		return this.KeyAllowed(v.PublicKey())
 	case ssh.CryptoPublicKey:
diff --git a/pkg/crypto/key-requirement.go b/pkg/crypto/key-requirement.go
index f79be3c..a97f56f 100644
--- a/pkg/crypto/key-requirement.go
+++ b/pkg/crypto/key-requirement.go
@@ -1,7 +1,6 @@
 package crypto
 
 import (
-	"crypto"
 	"crypto/dsa"
 	"crypto/ecdsa"
 	"crypto/ed25519"
@@ -34,7 +33,7 @@ type KeyRequirement struct {
 	EllipticCurveType *EllipticCurveType
 }
 
-func (this KeyRequirement) CreateFile(rand io.Reader, fn string) (crypto.Signer, error) {
+func (this KeyRequirement) CreateFile(rand io.Reader, fn string) (PrivateKey, error) {
 	pk, err := this.GenerateKey(rand)
 	if err != nil {
 		return nil, err
@@ -54,8 +53,8 @@ func (this KeyRequirement) CreateFile(rand io.Reader, fn string) (crypto.Signer,
 	return pk, nil
 }
 
-func (this KeyRequirement) GenerateKey(rand io.Reader) (crypto.Signer, error) {
-	done := func(s crypto.Signer, err error) (crypto.Signer, error) {
+func (this KeyRequirement) GenerateKey(rand io.Reader) (PrivateKey, error) {
+	done := func(s PrivateKey, err error) (PrivateKey, error) {
 		if err != nil {
 			return nil, fmt.Errorf("cannot gerate %v private key: %w", this.Type, err)
 		}
@@ -78,15 +77,19 @@ func (this KeyRequirement) GenerateKey(rand io.Reader) (crypto.Signer, error) {
 	}
 }
 
-func (this KeyRequirement) generateRsa(rand io.Reader) (crypto.Signer, error) {
+func (this KeyRequirement) generateRsa(rand io.Reader) (PrivateKey, error) {
 	bitSize := DefaultKeyBitSize
 	if v := this.BitSize; v != nil {
 		bitSize = *v
 	}
-	return rsa.GenerateKey(rand, bitSize)
+	sdk, err := rsa.GenerateKey(rand, bitSize)
+	if err != nil {
+		return nil, err
+	}
+	return PrivateKeyFromSdk(sdk)
 }
 
-func (this KeyRequirement) generateDsa(rand io.Reader) (crypto.Signer, error) {
+func (this KeyRequirement) generateDsa(rand io.Reader) (PrivateKey, error) {
 	parameterSize := DefaultDsaParameterSize
 	if v := this.DsaParameterSize; v != nil {
 		parameterSize = *v
@@ -101,10 +104,10 @@ func (this KeyRequirement) generateDsa(rand io.Reader) (crypto.Signer, error) {
 		return nil, err
 	}
 
-	return &dsaPrivateKey{&pk}, nil
+	return PrivateKeyFromSdk(&dsaPrivateKey{&pk})
 }
 
-func (this KeyRequirement) generateEcdsa(rand io.Reader) (crypto.Signer, error) {
+func (this KeyRequirement) generateEcdsa(rand io.Reader) (PrivateKey, error) {
 	curveType := DefaultEllipticCurveType
 	if v := this.EllipticCurveType; v != nil {
 		curveType = *v
@@ -115,10 +118,17 @@ func (this KeyRequirement) generateEcdsa(rand io.Reader) (crypto.Signer, error)
 		return nil, err
 	}
 
-	return ecdsa.GenerateKey(curve, rand)
+	sdk, err := ecdsa.GenerateKey(curve, rand)
+	if err != nil {
+		return nil, err
+	}
+	return PrivateKeyFromSdk(sdk)
 }
 
-func (this KeyRequirement) generateEd25519(rand io.Reader) (crypto.Signer, error) {
-	_, prv, err := ed25519.GenerateKey(rand)
-	return prv, err
+func (this KeyRequirement) generateEd25519(rand io.Reader) (PrivateKey, error) {
+	_, sdk, err := ed25519.GenerateKey(rand)
+	if err != nil {
+		return nil, err
+	}
+	return PrivateKeyFromSdk(sdk)
 }
diff --git a/pkg/crypto/key.go b/pkg/crypto/key.go
index b93a867..df4687e 100644
--- a/pkg/crypto/key.go
+++ b/pkg/crypto/key.go
@@ -1,41 +1,133 @@
 package crypto
 
 import (
+	"bytes"
 	"crypto"
 	"crypto/dsa"
+	"crypto/ed25519"
+	"encoding/base64"
 	"encoding/pem"
 	"fmt"
 	"io"
 	"os"
 
 	"github.com/mikesmitty/edkey"
-	"golang.org/x/crypto/ed25519"
 	"golang.org/x/crypto/ssh"
 
 	"github.com/engity-com/bifroest/pkg/sys"
 )
 
-func EnsureKeyFile(fn string, reqOnAbsence *KeyRequirement, rand io.Reader) (crypto.Signer, error) {
-	raw, err := os.ReadFile(fn)
-	if sys.IsNotExist(err) {
-		return reqOnAbsence.CreateFile(rand, fn)
-	} else if err != nil {
-		return nil, fmt.Errorf("cannot read %q: %w", fn, err)
+func ParsePublicKeyBytes(in []byte) (PublicKey, error) {
+	v, err := ssh.ParsePublicKey(in)
+	if err != nil {
+		return nil, fmt.Errorf("%w: %v", ErrIllegalSshKey, err)
 	}
+	return PublicKeyFromSsh(v)
+}
 
-	pk, err := ssh.ParseRawPrivateKey(raw)
+func PublicKeyFromSsh(in ssh.PublicKey) (PublicKey, error) {
+	result := publicKeySshWrapper{
+		PublicKey: in,
+	}
+	if v, ok := in.(ssh.CryptoPublicKey); ok {
+		result.sdk = v.CryptoPublicKey()
+	} else {
+		return nil, fmt.Errorf("%v does not implement %T", in, (ssh.CryptoPublicKey)(nil))
+	}
+
+	return &result, nil
+}
+
+func PublicKeyFromSdk(in crypto.PublicKey) (PublicKey, error) {
+	s, err := ssh.NewPublicKey(in)
 	if err != nil {
-		return nil, fmt.Errorf("cannot parse private key %q: %w", fn, err)
+		return nil, fmt.Errorf("%w: %v", ErrIllegalSshKey, err)
 	}
+	return &publicKeySshWrapper{
+		PublicKey: s,
+		sdk:       in,
+	}, nil
+}
 
-	return pk.(crypto.Signer), nil
+type PublicKey interface {
+	Type() string
+	Marshal() []byte
+	ToSsh() ssh.PublicKey
+	ToSdk() crypto.PublicKey
+	IsEqualTo(PublicKey) bool
 }
 
-func encodePrivateKeyToPemBlock(pk crypto.Signer) (*pem.Block, error) {
-	if pk == nil {
-		return nil, fmt.Errorf("nil private key")
+type publicKeySshWrapper struct {
+	ssh.PublicKey
+	sdk crypto.PublicKey
+}
+
+func (this *publicKeySshWrapper) ToSsh() ssh.PublicKey {
+	return this.PublicKey
+}
+
+func (this *publicKeySshWrapper) ToSdk() crypto.PublicKey {
+	return this.sdk
+}
+
+func (this *publicKeySshWrapper) String() string {
+	return this.Type() + " " + base64.StdEncoding.EncodeToString(this.Marshal())
+}
+
+func (this *publicKeySshWrapper) IsEqualTo(other PublicKey) bool {
+	if other == nil {
+		return false
+	}
+	tSsh, oSsh := this.ToSsh(), other.ToSsh()
+	if tSsh.Type() != oSsh.Type() {
+		return false
+	}
+	if !bytes.Equal(tSsh.Marshal(), oSsh.Marshal()) {
+		return false
+	}
+	return true
+}
+
+func PrivateKeyFromSdk(sdk crypto.Signer) (PrivateKey, error) {
+	v, err := ssh.NewSignerFromKey(sdk)
+	if err != nil {
+		return nil, err
 	}
-	switch v := pk.(type) {
+	return &privateKeyWrapper{publicKeySshWrapper{v.PublicKey(), sdk.Public()}, v, sdk}, nil
+}
+
+type PrivateKey interface {
+	Type() string
+	PublicKey() PublicKey
+	ToSsh() ssh.Signer
+	ToSdk() crypto.Signer
+	MarshalPemBlock() (*pem.Block, error)
+}
+
+type privateKeyWrapper struct {
+	pub publicKeySshWrapper
+	ssh ssh.Signer
+	sdk crypto.Signer
+}
+
+func (this *privateKeyWrapper) Type() string {
+	return this.pub.Type()
+}
+
+func (this *privateKeyWrapper) PublicKey() PublicKey {
+	return &this.pub
+}
+
+func (this *privateKeyWrapper) ToSsh() ssh.Signer {
+	return this.ssh
+}
+
+func (this *privateKeyWrapper) ToSdk() crypto.Signer {
+	return this.sdk
+}
+
+func (this *privateKeyWrapper) MarshalPemBlock() (*pem.Block, error) {
+	switch v := this.sdk.(type) {
 	case ed25519.PrivateKey:
 		return &pem.Block{
 			Type:    "OPENSSH PRIVATE KEY",
@@ -43,12 +135,32 @@ func encodePrivateKeyToPemBlock(pk crypto.Signer) (*pem.Block, error) {
 			Bytes:   edkey.MarshalED25519PrivateKey(v),
 		}, nil
 	default:
-		return ssh.MarshalPrivateKey(pk, "")
+		return ssh.MarshalPrivateKey(this.sdk, "")
+	}
+}
+
+func (this *privateKeyWrapper) String() string {
+	return this.pub.String()
+}
+
+func EnsureKeyFile(fn string, reqOnAbsence *KeyRequirement, rand io.Reader) (PrivateKey, error) {
+	raw, err := os.ReadFile(fn)
+	if sys.IsNotExist(err) {
+		return reqOnAbsence.CreateFile(rand, fn)
+	} else if err != nil {
+		return nil, fmt.Errorf("cannot read %q: %w", fn, err)
 	}
+
+	pk, err := ssh.ParseRawPrivateKey(raw)
+	if err != nil {
+		return nil, fmt.Errorf("cannot parse private key %q: %w", fn, err)
+	}
+
+	return PrivateKeyFromSdk(pk.(crypto.Signer))
 }
 
-func WriteSshPrivateKey(pk crypto.Signer, to io.Writer) error {
-	pb, err := encodePrivateKeyToPemBlock(pk)
+func WriteSshPrivateKey(pk PrivateKey, to io.Writer) error {
+	pb, err := pk.MarshalPemBlock()
 	if err != nil {
 		return fmt.Errorf("cannot encode private key: %w", err)
 	}
@@ -68,7 +180,7 @@ func (this *dsaPrivateKey) Public() crypto.PublicKey {
 	return this.PublicKey
 }
 
-func (this *dsaPrivateKey) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
+func (this *dsaPrivateKey) Sign(rand io.Reader, digest []byte, _ crypto.SignerOpts) ([]byte, error) {
 	r, s, err := dsa.Sign(rand, this.PrivateKey, digest)
 	if err != nil {
 		return nil, err
diff --git a/pkg/crypto/password-file.go b/pkg/crypto/password-file.go
new file mode 100644
index 0000000..d0668bd
--- /dev/null
+++ b/pkg/crypto/password-file.go
@@ -0,0 +1,112 @@
+package crypto
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/sys"
+)
+
+var (
+	ErrIllegalPasswordFile = errors.Config.Newf("illegal password file")
+)
+
+type PasswordFile string
+
+func (this PasswordFile) String() string {
+	return string(this)
+}
+
+func (this PasswordFile) MarshalText() ([]byte, error) {
+	return []byte(strings.Clone(this.String())), nil
+}
+
+func (this *PasswordFile) Set(plain string) error {
+	buf := PasswordFile(plain)
+	if err := buf.Validate(); err != nil {
+		return err
+	}
+	*this = buf
+	return nil
+}
+
+func (this PasswordFile) GetPassword() (Password, error) {
+	if len(this) == 0 {
+		return Password{}, nil
+	}
+	f, err := os.Open(string(this))
+	if sys.IsNotExist(err) {
+		return Password{}, nil
+	}
+	if err != nil {
+		return Password{}, fmt.Errorf("%w: %v", ErrIllegalPasswordFile, err)
+	}
+	defer common.IgnoreCloseError(f)
+
+	b, err := io.ReadAll(f)
+	if err != nil {
+		return Password{}, fmt.Errorf("%w: %v", ErrIllegalPasswordFile, err)
+	}
+
+	result := Password(b)
+	if err := result.Validate(); err != nil {
+		return Password{}, fmt.Errorf("%w: %v", ErrIllegalPasswordFile, err)
+	}
+
+	return result, nil
+}
+
+func (this PasswordFile) SetPassword(v Password) error {
+	if this.IsZero() {
+		if !v.IsZero() {
+			return errors.System.Newf("cannot save password, because this file reference is empty")
+		}
+		return nil
+	}
+
+	b, err := v.MarshalText()
+	if err != nil {
+		return errors.System.Newf("cannot save password to %s: %w", this, err)
+	}
+	_ = os.MkdirAll(filepath.Dir(string(this)), 0700)
+	if err := os.WriteFile(string(this), b, 0600); err != nil {
+		return errors.System.Newf("cannot save password to %s: %w", this, err)
+	}
+	return nil
+}
+
+func (this *PasswordFile) UnmarshalText(b []byte) error {
+	return this.Set(string(b))
+}
+
+func (this PasswordFile) Validate() error {
+	_, err := this.GetPassword()
+	return err
+}
+
+func (this PasswordFile) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case PasswordFile:
+		return this.isEqualTo(&v)
+	case *PasswordFile:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this PasswordFile) IsZero() bool {
+	return len(this) == 0
+}
+
+func (this PasswordFile) isEqualTo(other *PasswordFile) bool {
+	return string(this) == string(*other)
+}
diff --git a/pkg/crypto/password-type.go b/pkg/crypto/password-type.go
index 626fcda..640e04f 100644
--- a/pkg/crypto/password-type.go
+++ b/pkg/crypto/password-type.go
@@ -2,8 +2,11 @@ package crypto
 
 import (
 	"bytes"
+	crand "crypto/rand"
+	"encoding/base64"
 	"errors"
 	"fmt"
+	"io"
 )
 
 var (
@@ -71,6 +74,24 @@ func (this PasswordType) Compare(encoded, password []byte) (bool, error) {
 	}
 }
 
+func (this PasswordType) Generate(rand io.Reader) (decoded []byte, encoded Password, _ error) {
+	if rand == nil {
+		rand = crand.Reader
+	}
+	buf := make([]byte, 16)
+	if _, err := io.ReadFull(rand, buf); err != nil {
+		return nil, nil, err
+	}
+	decoded = base64.RawStdEncoding.AppendEncode(nil, buf)
+	suffix, err := this.Encode(decoded)
+	if err != nil {
+		return nil, nil, err
+	}
+	prefix, _ := this.MarshalText()
+
+	return decoded, bytes.Join([][]byte{prefix, suffix}, []byte{':'}), nil
+}
+
 func (this *PasswordType) UnmarshalText(b []byte) error {
 	return this.Set(string(b))
 }
diff --git a/pkg/crypto/rsa-restriction.go b/pkg/crypto/rsa-restriction.go
index 224d620..a4b1c8f 100644
--- a/pkg/crypto/rsa-restriction.go
+++ b/pkg/crypto/rsa-restriction.go
@@ -123,6 +123,10 @@ func (this RsaRestriction) BitsAllowed(in int) bool {
 
 func (this RsaRestriction) KeyAllowed(in any) (bool, error) {
 	switch v := in.(type) {
+	case PrivateKey:
+		return this.KeyAllowed(v.ToSdk())
+	case PublicKey:
+		return this.KeyAllowed(v.ToSdk())
 	case ssh.Signer:
 		return this.KeyAllowed(v.PublicKey())
 	case ssh.CryptoPublicKey:
diff --git a/pkg/environment/context.go b/pkg/environment/context.go
new file mode 100644
index 0000000..24349ab
--- /dev/null
+++ b/pkg/environment/context.go
@@ -0,0 +1,16 @@
+package environment
+
+import (
+	log "github.com/echocat/slf4g"
+	"github.com/gliderlabs/ssh"
+
+	"github.com/engity-com/bifroest/pkg/authorization"
+	"github.com/engity-com/bifroest/pkg/net"
+)
+
+type Context interface {
+	Remote() net.Remote
+	Context() ssh.Context
+	Logger() log.Logger
+	Authorization() authorization.Authorization
+}
diff --git a/pkg/environment/docker-api-client.go b/pkg/environment/docker-api-client.go
new file mode 100644
index 0000000..c0f3e53
--- /dev/null
+++ b/pkg/environment/docker-api-client.go
@@ -0,0 +1,109 @@
+package environment
+
+import (
+	"net/http"
+	"path/filepath"
+
+	"github.com/docker/docker/client"
+	"github.com/docker/go-connections/sockets"
+	"github.com/docker/go-connections/tlsconfig"
+
+	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+func newDockerApiClient(conf *configuration.EnvironmentDocker) (_ client.APIClient, _ error) {
+	fail := func(err error) (client.APIClient, error) {
+		return nil, err
+	}
+
+	ref, err := newDockerConnectionReference(conf)
+	if err != nil {
+		return fail(err)
+	}
+	apiClient, err := ref.toApiClient()
+	if err != nil {
+		return fail(err)
+	}
+
+	return apiClient, nil
+}
+
+func newDockerConnectionReference(conf *configuration.EnvironmentDocker) (_ *dockerConnectionReference, err error) {
+	fail := func(err error) (*dockerConnectionReference, error) {
+		return nil, err
+	}
+	failf := func(msg string, args ...any) (*dockerConnectionReference, error) {
+		return fail(errors.Config.Newf(msg, args...))
+	}
+
+	data := struct{}{}
+
+	var result dockerConnectionReference
+
+	if result.host, err = conf.Host.Render(data); err != nil {
+		return failf("cannot evaluate host: %w", err)
+	}
+	if result.apiVersion, err = conf.ApiVersion.Render(data); err != nil {
+		return failf("cannot evaluate apiVersion: %w", err)
+	}
+	if result.certPath, err = conf.CertPath.Render(data); err != nil {
+		return failf("cannot evaluate certPath: %w", err)
+	}
+	if result.tlsVerify, err = conf.TlsVerify.Render(data); err != nil {
+		return failf("cannot evaluate tlsVerify: %w", err)
+	}
+	return &result, nil
+}
+
+type dockerConnectionReference struct {
+	host       string
+	apiVersion string
+	certPath   string
+	tlsVerify  bool
+}
+
+func (this dockerConnectionReference) toApiClient() (_ *client.Client, err error) {
+	fail := func(err error) (*client.Client, error) {
+		return nil, err
+	}
+
+	hostURL, err := client.ParseHostURL(client.DefaultDockerHost)
+	if err != nil {
+		return fail(err)
+	}
+
+	httpTransport := http.Transport{}
+	if err := sockets.ConfigureTransport(&httpTransport, hostURL.Scheme, hostURL.Host); err != nil {
+		return fail(err)
+	}
+	httpClient := http.Client{
+		Transport:     &httpTransport,
+		CheckRedirect: client.CheckRedirect,
+	}
+
+	clientOpts := []client.Opt{client.WithHTTPClient(&httpClient)}
+	if v := this.host; v != "" {
+		clientOpts = append(clientOpts, client.WithHost(v))
+	}
+	if v := this.apiVersion; v != "" {
+		clientOpts = append(clientOpts, client.WithVersion(v))
+	}
+	if v := this.certPath; v != "" {
+		if httpTransport.TLSClientConfig, err = tlsconfig.Client(tlsconfig.Options{
+			CAFile:             filepath.Join(v, "ca.pem"),
+			CertFile:           filepath.Join(v, "cert.pem"),
+			KeyFile:            filepath.Join(v, "key.pem"),
+			InsecureSkipVerify: !this.tlsVerify,
+		}); err != nil {
+			return fail(err)
+		}
+	}
+
+	apiClient, err := client.NewClientWithOpts(clientOpts...)
+	if err != nil {
+		return fail(err)
+	}
+
+	return apiClient, nil
+}
diff --git a/pkg/environment/docker-image-pull-progress.go b/pkg/environment/docker-image-pull-progress.go
new file mode 100644
index 0000000..d9eb1e4
--- /dev/null
+++ b/pkg/environment/docker-image-pull-progress.go
@@ -0,0 +1,105 @@
+package environment
+
+import (
+	"encoding/json"
+	"io"
+	"iter"
+	"strings"
+
+	"github.com/docker/docker/pkg/jsonmessage"
+	log "github.com/echocat/slf4g"
+)
+
+func toJsonMessageSeq(reader io.Reader) iter.Seq2[*jsonmessage.JSONMessage, error] {
+	return func(yield func(*jsonmessage.JSONMessage, error) bool) {
+		dec := json.NewDecoder(reader)
+		for {
+			var jm jsonmessage.JSONMessage
+			err := dec.Decode(&jm)
+			if err == io.EOF {
+				return
+			}
+			if !yield(&jm, err) {
+				return
+			}
+		}
+	}
+}
+
+func handleImagePullProgress(reader io.Reader, target PreparationProgress, logger log.Logger) error {
+	type layer struct {
+		last     int64
+		total    int64
+		complete bool
+	}
+
+	calculateProgress := func(layers map[string]layer) float32 {
+		var last, total float64
+		for _, l := range layers {
+			lTotal := l.total
+			lLast := l.last
+			if !l.complete && lTotal <= 0 {
+				return 0.0
+			}
+			if l.complete && lLast <= 0 {
+				lLast = lTotal
+			}
+			last += float64(lLast)
+			total += float64(lTotal)
+		}
+		if total < last {
+			total = last
+		}
+		if total == 0 {
+			total = 1
+		}
+		return float32(last / total)
+	}
+
+	layers := map[string]layer{}
+	var progress float32 = 0.0
+
+	for jm, err := range toJsonMessageSeq(reader) {
+		if err != nil {
+			return err
+		}
+
+		layerId := jm.ID
+		status := jm.Status
+
+		if err := jm.Error; err != nil {
+			return err
+		}
+
+		if status == "Pulling fs layer" {
+			layers[layerId] = layer{}
+		} else if status == "Downloading layer" || status == "Downloading" {
+			if p := jm.Progress; p != nil {
+				layers[layerId] = layer{p.Current, p.Total, false}
+			}
+		} else if status == "Download complete" || status == "Already exists" {
+			existing := layers[layerId]
+			existing.complete = true
+			layers[layerId] = existing
+		} else if strings.HasPrefix(status, "Pulling from ") {
+			// Ignore, usually the start
+		} else if strings.HasPrefix(status, "Digest: ") {
+			// Ignore, shortly before the end
+		} else if strings.HasPrefix(status, "Status: Downloaded newer image for ") || strings.HasPrefix(status, "Status: Image is up to date for ") {
+			// Ignore, usually the end
+		} else {
+			logger.With("payload", jm).
+				Warn("received an unknown payload from docker daemon while pulling image")
+		}
+
+		progressCandidate := calculateProgress(layers)
+		if progressCandidate > progress {
+			progress = progressCandidate
+			if err := target.Report(progress); err != nil {
+				return err
+			}
+		}
+	}
+
+	return target.Done()
+}
diff --git a/pkg/environment/docker-repository.go b/pkg/environment/docker-repository.go
new file mode 100644
index 0000000..922c5c5
--- /dev/null
+++ b/pkg/environment/docker-repository.go
@@ -0,0 +1,692 @@
+package environment
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/docker/cli/opts"
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/registry"
+	"github.com/docker/docker/api/types/strslice"
+	"github.com/docker/docker/client"
+	"github.com/docker/docker/errdefs"
+	"github.com/docker/go-connections/nat"
+	"github.com/echocat/slf4g"
+	"github.com/gliderlabs/ssh"
+
+	"github.com/engity-com/bifroest/pkg/alternatives"
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/imp"
+	"github.com/engity-com/bifroest/pkg/session"
+	"github.com/engity-com/bifroest/pkg/sys"
+)
+
+var (
+	_ = RegisterRepository(NewDockerRepository)
+)
+
+const (
+	BifroestUnixBinaryMountTarget    = `/usr/bin/bifroest`
+	BifroestWindowsBinaryMountTarget = `C:\Program Files\Engity\Bifroest\bifroest.exe`
+
+	DockerLabelPrefix            = "org.engity.bifroest/"
+	DockerLabelFlow              = DockerLabelPrefix + "flow"
+	DockerLabelSessionId         = DockerLabelPrefix + "session-id"
+	DockerLabelCreatedRemoteUser = DockerLabelPrefix + "created-remote-user"
+	DockerLabelCreatedRemoteHost = DockerLabelPrefix + "created-remote-host"
+
+	DockerLabelShellCommand          = DockerLabelPrefix + "shellCommand"
+	DockerLabelExecCommand           = DockerLabelPrefix + "execCommand"
+	DockerLabelSftpCommand           = DockerLabelPrefix + "sftpCommand"
+	DockerLabelUser                  = DockerLabelPrefix + "user"
+	DockerLabelDirectory             = DockerLabelPrefix + "directory"
+	DockerLabelPortForwardingAllowed = DockerLabelPrefix + "portForwardingAllowed"
+)
+
+type DockerRepository struct {
+	flow         configuration.FlowName
+	conf         *configuration.EnvironmentDocker
+	alternatives alternatives.Provider
+	imp          imp.Imp
+
+	apiClient   client.APIClient
+	hostVersion *types.Version
+
+	Logger log.Logger
+
+	sessionIdMutex  common.KeyedMutex[session.Id]
+	activeInstances sync.Map
+}
+
+func NewDockerRepository(ctx context.Context, flow configuration.FlowName, conf *configuration.EnvironmentDocker, ap alternatives.Provider, i imp.Imp) (*DockerRepository, error) {
+	fail := func(err error) (*DockerRepository, error) {
+		return nil, err
+	}
+	failf := func(msg string, args ...any) (*DockerRepository, error) {
+		return fail(fmt.Errorf(msg, args...))
+	}
+
+	if conf == nil {
+		return failf("nil configuration")
+	}
+
+	apiClient, err := newDockerApiClient(conf)
+	if err != nil {
+		return fail(err)
+	}
+
+	hostVersion, err := apiClient.ServerVersion(ctx)
+	if err != nil {
+		return failf("cannot retrieve docker host's version: %w", err)
+	}
+
+	return &DockerRepository{
+		flow:         flow,
+		conf:         conf,
+		alternatives: ap,
+		imp:          i,
+		apiClient:    apiClient,
+		hostVersion:  &hostVersion,
+	}, nil
+}
+
+func (this *DockerRepository) WillBeAccepted(ctx Context) (ok bool, err error) {
+	fail := func(err error) (bool, error) {
+		return false, err
+	}
+
+	if ok, err = this.conf.LoginAllowed.Render(ctx); err != nil {
+		return fail(fmt.Errorf("cannot evaluate if user is allowed to login or not: %w", err))
+	}
+
+	return ok, nil
+}
+
+func (this *DockerRepository) DoesSupportPty(Context, ssh.Pty) (bool, error) {
+	return true, nil
+}
+
+func (this *DockerRepository) Ensure(req Request) (Environment, error) {
+	fail := func(err error) (Environment, error) {
+		return nil, err
+	}
+	failf := func(t errors.Type, msg string, args ...any) (Environment, error) {
+		return fail(errors.Newf(t, msg, args...))
+	}
+
+	if ok, err := this.WillBeAccepted(req); err != nil {
+		return fail(err)
+	} else if !ok {
+		return fail(ErrNotAcceptable)
+	}
+
+	sess := req.Authorization().FindSession()
+	if sess == nil {
+		return failf(errors.System, "authorization without session")
+	}
+
+	return this.findOrEnsureBySession(req.Context(), sess, nil, req, true)
+}
+
+func (this *DockerRepository) createContainerBy(req Request, sess session.Session) (*types.Container, error) {
+	fail := func(err error) (*types.Container, error) {
+		return nil, err
+	}
+	failf := func(t errors.Type, msg string, args ...any) (*types.Container, error) {
+		return fail(errors.Newf(t, msg, args...))
+	}
+
+	config, err := this.resolveContainerConfig(req, sess)
+	if err != nil {
+		return fail(err)
+	}
+	hostConfig, err := this.resolveHostConfig(req)
+	if err != nil {
+		return fail(err)
+	}
+	networkingConfig, err := this.resolveNetworkingConfig(req)
+	if err != nil {
+		return fail(err)
+	}
+
+	if this.conf.ImagePullPolicy == configuration.PullPolicyAlways {
+		if err := this.pullImage(req, config.Image); err != nil {
+			return failf(errors.System, "cannot pull container image %s: %w", config.Image, err)
+		}
+	}
+	success := false
+	cr, err := this.apiClient.ContainerCreate(req.Context(), config, hostConfig, networkingConfig, nil, "")
+	if this.isNoSuchImageError(err) && this.conf.ImagePullPolicy != configuration.PullPolicyAlways {
+		if err := this.pullImage(req, config.Image); err != nil {
+			return failf(errors.System, "cannot pull container image %s: %w", config.Image, err)
+		}
+		cr, err = this.apiClient.ContainerCreate(req.Context(), config, hostConfig, networkingConfig, nil, "")
+	}
+	if err != nil {
+		return failf(errors.System, "cannot create container: %w", err)
+	}
+	containerId := cr.ID
+	defer func() {
+		if !success {
+			if _, err := this.removeContainer(req.Context(), containerId); err != nil {
+				req.Logger().
+					WithError(err).
+					Warn("cannot remove orphan container within emergency cleanup; container could still be there")
+			}
+		}
+	}()
+
+	if err := this.apiClient.ContainerStart(req.Context(), containerId, container.StartOptions{}); err != nil {
+		return failf(errors.System, "cannot start container #%s: %w", containerId, err)
+	}
+	c, _, err := this.findContainerById(req.Context(), containerId)
+	if err != nil {
+		return fail(err)
+	}
+
+	success = true
+	return c, nil
+
+}
+
+func (this *DockerRepository) pullImage(req Request, ref string) error {
+	var progress PreparationProgress
+	fail := func(err error) error {
+		if progress != nil {
+			_ = progress.Error(err)
+		}
+		return err
+	}
+
+	var err error
+	progress, err = req.StartPreparation(
+		"pull-image",
+		fmt.Sprintf("Pulling image %s", ref),
+		PreparationProgressAttributes{
+			"image": ref,
+		},
+	)
+	if err != nil {
+		return fail(err)
+	}
+
+	var opts image.PullOptions
+
+	if opts.RegistryAuth, err = this.resolvePullCredentials(req, ref); err != nil {
+		return fail(err)
+	}
+
+	rc, err := this.apiClient.ImagePull(req.Context(), ref, opts)
+	if err != nil {
+		return fail(err)
+	}
+	defer common.IgnoreCloseError(rc)
+
+	if progress == nil {
+		return nil
+	}
+
+	l := req.Logger().
+		With("image", ref)
+	if err := handleImagePullProgress(rc, progress, l); err != nil {
+		return fail(err)
+	}
+	return err
+}
+
+func (this *DockerRepository) resolvePullCredentials(req Request, _ string) (string, error) {
+	fail := func(err error) (string, error) {
+		return "", errors.Config.Newf("cannot resolve image pull credentials: %w", err)
+	}
+
+	plain, err := this.conf.ImagePullCredentials.Render(req)
+	if err != nil {
+		return fail(err)
+	}
+
+	if plain == "" {
+		return "", nil
+	}
+
+	if buf, err := registry.DecodeAuthConfig(plain); err == nil && (buf.Auth != "" || buf.Username != "" || buf.Password != "") {
+		// We can take it as it is, because it is in fully valid format.
+		return plain, nil
+	}
+
+	var buf registry.AuthConfig
+	if err := json.Unmarshal([]byte(plain), &buf); err == nil && (buf.Auth != "" || buf.Username != "" || buf.Password != "") {
+		// Ok, is close to be perfect, just encode it base64 url based...
+		return base64.URLEncoding.EncodeToString([]byte(plain)), nil
+	}
+
+	// Seems to be direct auth string...
+	buf.Auth = plain
+	result, err := registry.EncodeAuthConfig(buf)
+	if err != nil {
+		return fail(err)
+	}
+	return result, nil
+}
+
+func (this *DockerRepository) resolveContainerConfig(req Request, sess session.Session) (_ *container.Config, err error) {
+	fail := func(err error) (*container.Config, error) {
+		return nil, err
+	}
+	failf := func(msg string, args ...any) (_ *container.Config, err error) {
+		return fail(errors.Config.Newf(msg, args...))
+	}
+
+	var result container.Config
+
+	result.Labels = map[string]string{
+		DockerLabelFlow:      this.flow.String(),
+		DockerLabelSessionId: sess.Id().String(),
+
+		DockerLabelCreatedRemoteUser: req.Remote().User(),
+		DockerLabelCreatedRemoteHost: req.Remote().Host().String(),
+	}
+	if result.Labels[DockerLabelShellCommand], err = this.resolveEncodedShellCommand(req); err != nil {
+		return fail(err)
+	}
+	if result.Labels[DockerLabelExecCommand], err = this.resolveEncodedExecCommand(req); err != nil {
+		return fail(err)
+	}
+	if result.Labels[DockerLabelSftpCommand], err = this.resolveEncodedSftpCommand(req); err != nil {
+		return fail(err)
+	}
+	if result.Labels[DockerLabelUser], err = this.conf.User.Render(req); err != nil {
+		return failf("cannot evaluate user: %w", err)
+	}
+	if result.Labels[DockerLabelDirectory], err = this.conf.Directory.Render(req); err != nil {
+		return failf("cannot evaluate directory: %w", err)
+	}
+	if v, err := this.conf.PortForwardingAllowed.Render(req); err != nil {
+		return failf("cannot evaluate portForwardingAllowed: %w", err)
+	} else if v {
+		result.Labels[DockerLabelPortForwardingAllowed] = "true"
+	}
+
+	result.ExposedPorts = map[nat.Port]struct{}{
+		nat.Port(fmt.Sprintf("%d/tcp", imp.ServicePort)): {},
+	}
+
+	if result.Image, err = this.conf.Image.Render(req); err != nil {
+		return failf("cannot evaluate image: %w", err)
+	}
+	result.Entrypoint = strslice.StrSlice{}
+	switch this.hostVersion.Os {
+	case sys.OsWindows:
+		result.Cmd = []string{BifroestWindowsBinaryMountTarget, `imp`, `--log.colorMode=always`}
+	case sys.OsLinux:
+		result.User = "root"
+		result.Cmd = []string{BifroestUnixBinaryMountTarget, `imp`, `--log.colorMode=always`}
+	default:
+		return failf("cannot resolve target path for host %s/%s", this.hostVersion.Os, this.hostVersion.Arch)
+	}
+
+	masterPub, err := this.imp.GetMasterPublicKey()
+	if err != nil {
+		return fail(err)
+	}
+
+	result.Env = []string{
+		"BIFROEST_MASTER_PUBLIC_KEY=" + base64.RawStdEncoding.EncodeToString(masterPub.Marshal()),
+		"BIFROEST_SESSION_ID=" + sess.Id().String(),
+	}
+
+	return &result, nil
+}
+
+func (this *DockerRepository) resolveHostConfig(req Request) (_ *container.HostConfig, err error) {
+	fail := func(err error) (*container.HostConfig, error) {
+		return nil, err
+	}
+	failf := func(msg string, args ...any) (_ *container.HostConfig, err error) {
+		return fail(errors.Config.Newf(msg, args...))
+	}
+
+	var result container.HostConfig
+
+	result.AutoRemove = true
+	if !this.conf.ImpPublishHost.IsZero() {
+		result.PublishAllPorts = true
+	}
+	if result.Binds, err = this.conf.Volumes.Render(req); err != nil {
+		return failf("cannot evaluate volumes: %w", err)
+	}
+	if raws, err := this.conf.Mounts.Render(req); err != nil {
+		return failf("cannot evaluate mounts: %w", err)
+	} else {
+		var buf opts.MountOpt
+		for i, raw := range raws {
+			if err := buf.Set(raw); err != nil {
+				return failf("cannot evaluate mount %d: %w", i, err)
+			}
+		}
+		result.Mounts = buf.Value()
+	}
+	if result.CapAdd, err = this.conf.Capabilities.Render(req); err != nil {
+		return failf("cannot evaluate capabilities: %w", err)
+	}
+	if result.Privileged, err = this.conf.Privileged.Render(req); err != nil {
+		return failf("cannot evaluate capabilities: %w", err)
+	}
+	if result.DNS, err = this.conf.DnsServers.Render(req); err != nil {
+		return failf("cannot evaluate dnsServer: %w", err)
+	}
+	if result.DNSSearch, err = this.conf.DnsSearch.Render(req); err != nil {
+		return failf("cannot evaluate dnsSearch: %w", err)
+	}
+
+	// result.PortBindings = nat.PortMap{nat.Port(fmt.Sprintf("%d/tcp", imp.ServicePort)): {{
+	// 	HostIP:   impBinding.Host.String(),
+	// 	HostPort: strconv.FormatUint(uint64(impBinding.Port), 10),
+	// }}}
+
+	impBinaryPath, err := this.alternatives.FindBinaryFor(req.Context(), this.hostVersion.Os, this.hostVersion.Arch)
+	if err != nil {
+		return failf("cannot resolve imp binary path: %w", err)
+	}
+	if impBinaryPath != "" {
+		impBinaryPath, err = filepath.Abs(impBinaryPath)
+		if err != nil {
+			return failf("cannot resolve full imp binary path: %w", err)
+		}
+		var targetPath string
+		switch this.hostVersion.Os {
+		case sys.OsWindows:
+			targetPath = BifroestWindowsBinaryMountTarget
+		case sys.OsLinux:
+			targetPath = BifroestUnixBinaryMountTarget
+		default:
+			return failf("cannot resolve target path for host %s/%s", this.hostVersion.Os, this.hostVersion.Arch)
+		}
+		result.Mounts = append(result.Mounts, mount.Mount{
+			Type:     mount.TypeBind,
+			Source:   impBinaryPath,
+			Target:   targetPath,
+			ReadOnly: true,
+			BindOptions: &mount.BindOptions{
+				NonRecursive:     true,
+				CreateMountpoint: true,
+			},
+		})
+	}
+
+	return &result, nil
+}
+
+func (this *DockerRepository) resolveEncodedShellCommand(req Request) (string, error) {
+	failf := func(msg string, args ...any) (string, error) {
+		return "", errors.Config.Newf(msg, args...)
+	}
+
+	v, err := this.conf.ShellCommand.Render(req)
+	if err != nil {
+		return failf("cannot evaluate shellCommand: %w", err)
+	}
+	if len(v) == 0 {
+		switch this.hostVersion.Os {
+		case sys.OsWindows:
+			v = []string{`C:\WINDOWS\system32\cmd.exe`}
+		case sys.OsLinux:
+			v = []string{`/bin/sh`}
+		default:
+			return failf("shellCommand was not defined for docker environment and default cannot be resolved for %s/%s", this.hostVersion.Os, this.hostVersion.Arch)
+		}
+	}
+	b, err := json.Marshal(v)
+	return string(b), err
+}
+
+func (this *DockerRepository) resolveEncodedExecCommand(req Request) (string, error) {
+	failf := func(msg string, args ...any) (string, error) {
+		return "", errors.Config.Newf(msg, args...)
+	}
+
+	v, err := this.conf.ExecCommand.Render(req)
+	if err != nil {
+		return failf("cannot evaluate execCommand: %w", err)
+	}
+	if len(v) == 0 {
+		switch this.hostVersion.Os {
+		case sys.OsWindows:
+			v = []string{`C:\WINDOWS\system32\cmd.exe`, `/C`}
+		case sys.OsLinux:
+			v = []string{`/bin/sh`, `-c`}
+		default:
+			return failf("execCommand was not defined for docker environment and default cannot be resolved for %s/%s", this.hostVersion.Os, this.hostVersion.Arch)
+		}
+	}
+	b, err := json.Marshal(v)
+	return string(b), err
+}
+
+func (this *DockerRepository) resolveEncodedSftpCommand(req Request) (string, error) {
+	failf := func(msg string, args ...any) (string, error) {
+		return "", errors.Config.Newf(msg, args...)
+	}
+
+	v, err := this.conf.SftpCommand.Render(req)
+	if err != nil {
+		return failf("cannot evaluate sftpCommand: %w", err)
+	}
+	if len(v) == 0 {
+		switch this.hostVersion.Os {
+		case sys.OsWindows:
+			v = []string{BifroestWindowsBinaryMountTarget, `sftp-server`}
+		case sys.OsLinux:
+			v = []string{BifroestUnixBinaryMountTarget, `sftp-server`}
+		default:
+			return failf("sftpCommand was not defined for docker environment and default cannot be resolved for %s/%s", this.hostVersion.Os, this.hostVersion.Arch)
+		}
+	}
+	b, err := json.Marshal(v)
+	return string(b), err
+}
+
+func (this *DockerRepository) resolveNetworkingConfig(req Request) (*network.NetworkingConfig, error) {
+	fail := func(err error) (*network.NetworkingConfig, error) {
+		return nil, err
+	}
+	failf := func(msg string, args ...any) (_ *network.NetworkingConfig, err error) {
+		return fail(errors.Config.Newf(msg, args...))
+	}
+
+	var result network.NetworkingConfig
+
+	if vs, err := this.conf.Networks.Render(req); err != nil {
+		return failf("cannot evaluate network: %w", err)
+	} else {
+		result.EndpointsConfig = make(map[string]*network.EndpointSettings, len(vs))
+		for _, v := range vs {
+			result.EndpointsConfig[v] = &network.EndpointSettings{}
+		}
+	}
+
+	return &result, nil
+}
+
+func (this *DockerRepository) FindBySession(ctx context.Context, sess session.Session, opts *FindOpts) (Environment, error) {
+	return this.findOrEnsureBySession(ctx, sess, opts, nil, false)
+}
+
+func (this *DockerRepository) findOrEnsureBySession(ctx context.Context, sess session.Session, opts *FindOpts, createUsing Request, retryAllowed bool) (Environment, error) {
+	fail := func(err error) (Environment, error) {
+		return nil, err
+	}
+
+	sessId := sess.Id()
+	rUnlocker := this.sessionIdMutex.RLock(sessId)
+	rUnlock := func() {
+		if rUnlocker != nil {
+			rUnlocker()
+		}
+		rUnlocker = nil
+	}
+	defer rUnlock()
+
+	ip, ok := this.activeInstances.Load(sessId)
+	if ok {
+		instance := ip.(*docker)
+		instance.owners.Add(1)
+		return instance, nil
+	}
+
+	c, exitCode, err := this.findContainerBySession(ctx, sess)
+	if err != nil {
+		return nil, err
+	}
+	if c == nil && createUsing == nil {
+		return fail(ErrNoSuchEnvironment)
+	}
+	rUnlock()
+
+	defer this.sessionIdMutex.Lock(sessId)()
+
+	ip, ok = this.activeInstances.Load(sessId)
+	if ok {
+		instance := ip.(*docker)
+		instance.owners.Add(1)
+		return instance, nil
+	}
+
+	if c != nil && exitCode >= 0 {
+		if opts.IsAutoCleanUpAllowed() {
+			if _, err := this.removeContainer(ctx, c.ID); err != nil {
+				return fail(err)
+			}
+		}
+		if createUsing == nil {
+			return fail(ErrNoSuchEnvironment)
+		}
+	}
+
+	if c == nil {
+		c, err = this.createContainerBy(createUsing, sess)
+		if err != nil {
+			return fail(err)
+		}
+	}
+
+	removeContainerUnchecked := func() {
+		if _, err := this.removeContainer(ctx, c.ID); err != nil {
+			this.logger().
+				WithError(err).
+				With("containerId", c.ID).
+				Warnf("cannot broken container; need to be done manually")
+		}
+	}
+
+	instance, err := this.new(ctx, c)
+	if err != nil {
+		if errors.Is(err, containerContainsProblemsErr) {
+			if createUsing != nil {
+				removeContainerUnchecked()
+				if !retryAllowed {
+					return fail(err)
+				}
+				return this.findOrEnsureBySession(ctx, sess, opts, createUsing, false)
+			} else if opts.IsAutoCleanUpAllowed() {
+				removeContainerUnchecked()
+				return fail(ErrNoSuchEnvironment)
+			}
+		}
+		return fail(err)
+	}
+
+	this.activeInstances.Store(sessId, instance)
+
+	return instance, nil
+}
+
+func (this *DockerRepository) removeContainer(ctx context.Context, id string) (bool, error) {
+	if err := this.apiClient.ContainerRemove(ctx, id, container.RemoveOptions{
+		RemoveVolumes: true,
+		Force:         true,
+	}); errdefs.IsNotFound(err) {
+		return false, nil
+	} else if err != nil {
+		return false, errors.System.Newf("cannot remove container #%s: %w", id, err)
+	}
+	return true, nil
+}
+
+func (this *DockerRepository) findContainerBySession(ctx context.Context, sess session.Session) (c *types.Container, exitCode int, err error) {
+	return this.findContainerBy(ctx, filters.NewArgs(
+		filters.Arg("label", DockerLabelSessionId+"="+sess.Id().String()),
+	))
+}
+func (this *DockerRepository) findContainerById(ctx context.Context, id string) (c *types.Container, exitCode int, err error) {
+	return this.findContainerBy(ctx, filters.NewArgs(
+		filters.Arg("id", id),
+	))
+}
+
+func (this *DockerRepository) findContainerBy(ctx context.Context, filters filters.Args) (c *types.Container, exitCode int, err error) {
+	list, err := this.apiClient.ContainerList(ctx, container.ListOptions{
+		Limit:   1,
+		All:     true,
+		Filters: filters,
+	})
+	if err != nil {
+		return nil, -1, errors.System.Newf("cannot list container by %v: %w", filters, err)
+	}
+	if len(list) == 0 {
+		return nil, -1, nil
+	}
+
+	c = &list[0]
+	exitCode = -1
+	if strings.HasPrefix(c.Status, "Exited (") {
+		status := strings.TrimPrefix(c.Status, "Exited (")
+		if i := strings.IndexRune(status, ')'); i > 0 {
+			v, err := strconv.Atoi(status[:i])
+			if err == nil {
+				exitCode = v
+			}
+		}
+	}
+
+	return c, exitCode, nil
+}
+
+func (this *DockerRepository) Close() error {
+	return nil
+}
+
+func (this *DockerRepository) logger() log.Logger {
+	if v := this.Logger; v != nil {
+		return v
+	}
+	return log.GetLogger("docker-repository")
+}
+
+func (this *DockerRepository) isNoSuchImageError(err error) bool {
+	for {
+		if err == nil {
+			return false
+		}
+		if msg := err.Error(); strings.HasPrefix(msg, "No such image:") {
+			return true
+		}
+		ue, ok := err.(interface{ Unwrap() error })
+		if !ok {
+			return false
+		}
+		err = ue.Unwrap()
+	}
+}
diff --git a/pkg/environment/docker-usage-specific.go b/pkg/environment/docker-usage-specific.go
new file mode 100644
index 0000000..c02d066
--- /dev/null
+++ b/pkg/environment/docker-usage-specific.go
@@ -0,0 +1,215 @@
+package environment
+
+import (
+	"context"
+	"io"
+	"os"
+	"slices"
+	"strings"
+	"sync"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/pkg/stdcopy"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/connection"
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/sys"
+)
+
+func (this *docker) Banner(req Request) (io.ReadCloser, error) {
+	b, err := this.repository.conf.Banner.Render(req)
+	if err != nil {
+		return nil, err
+	}
+
+	return io.NopCloser(strings.NewReader(b)), nil
+}
+
+func (this *docker) Run(t Task) (exitCode int, rErr error) {
+	fail := func(err error) (int, error) {
+		return -1, err
+	}
+	failf := func(msg string, args ...any) (int, error) {
+		return fail(errors.System.Newf(msg, args...))
+	}
+
+	apiClient := this.repository.apiClient
+	defer common.IgnoreCloseError(apiClient)
+
+	auth := t.Authorization()
+	sess := auth.FindSession()
+	if sess == nil {
+		return failf("authorization without session is not supported to run docker environment")
+	}
+	sshSess := t.SshSession()
+	l := t.Logger()
+
+	opts := container.ExecOptions{
+		User:         this.user,
+		WorkingDir:   this.directory,
+		AttachStdin:  true,
+		AttachStderr: true,
+		AttachStdout: true,
+	}
+
+	ev := sys.EnvVars{}
+	if v, ok := os.LookupEnv("TZ"); ok {
+		ev.Set("TZ", v)
+	}
+	ev.AddAllOf(t.Authorization().EnvVars())
+	ev.Add(t.SshSession().Environ()...)
+	ev.Set("BIFROEST_SESSION_ID", sess.Id().String())
+
+	switch t.TaskType() {
+	case TaskTypeShell:
+		if v := sshSess.Command(); len(v) > 0 {
+			opts.Cmd = append(this.execCommand, v...)
+		} else {
+			opts.Cmd = slices.Clone(this.shellCommand)
+		}
+	case TaskTypeSftp:
+		opts.Cmd = slices.Clone(this.sftpCommand)
+	default:
+		return failf("illegal task type: %v", t.TaskType())
+	}
+
+	// TODO! Does not work because we need to forward a correct socket into the container
+	// in this case we have to mount a directory into the container to ensure this.
+	// --------
+	// if ssh.AgentRequested(sshSess) {
+	// 	al, err := ssh.NewAgentListener()
+	// 	if err != nil {
+	// 		return failf("cannot listen to agent: %w", err)
+	// 	}
+	// 	defer common.IgnoreCloseError(al)
+	// go ssh.ForwardAgentConnections(al, sshSess)
+	// 	ev.Set("SSH_AUTH_SOCK", al.Addr().String())
+	// }
+
+	var execId string
+	if ptyReq, winCh, isPty := sshSess.Pty(); isPty {
+		ev.Set("TERM", ptyReq.Term)
+		go func() {
+			for {
+				win, ok := <-winCh
+				if !ok {
+					return
+				}
+				if execId != "" {
+					if err := apiClient.ContainerExecResize(sshSess.Context(), execId, container.ResizeOptions{
+						Height: uint(win.Height),
+						Width:  uint(win.Width),
+					}); err != nil {
+						l.WithError(err).Warn("cannot set window size; ignoring")
+					}
+				}
+			}
+		}()
+		opts.Tty = true
+		opts.ConsoleSize = &[2]uint{80, 40}
+	}
+	opts.Env = ev.Strings()
+
+	if e, err := apiClient.ContainerExecCreate(t.Context(), this.containerId, opts); err != nil {
+		return failf("cannot execute command: %w", err)
+	} else {
+		execId = e.ID
+	}
+
+	ea, err := apiClient.ContainerExecAttach(t.Context(), execId, container.ExecAttachOptions{
+		Tty:         opts.Tty,
+		ConsoleSize: opts.ConsoleSize,
+	})
+	if err != nil {
+		return failf("cannot attach to execution #%v: %w", execId, err)
+	}
+
+	copyDone := make(chan error, 2)
+	var activeRoutines sync.WaitGroup
+	defer func() {
+		go func() {
+			activeRoutines.Wait()
+			defer close(copyDone)
+		}()
+	}()
+
+	activeRoutines.Add(1)
+	go func() {
+		defer activeRoutines.Done()
+		var cErr error
+		if opts.Tty {
+			_, cErr = io.Copy(sshSess, ea.Reader)
+		} else {
+			_, cErr = stdcopy.StdCopy(sshSess, sshSess.Stderr(), ea.Reader)
+		}
+		if this.isRelevantError(cErr) {
+			copyDone <- cErr
+		} else {
+			copyDone <- nil
+		}
+		l.Trace("finished copy output")
+	}()
+	activeRoutines.Add(1)
+	go func() {
+		defer activeRoutines.Done()
+		if _, err := io.Copy(ea.Conn, sshSess); this.isRelevantError(err) {
+			copyDone <- err
+		} else {
+			copyDone <- nil
+		}
+		l.Trace("finished copy input")
+	}()
+
+	finish := func() (int, error) {
+		ei, iErr := apiClient.ContainerExecInspect(sshSess.Context(), execId)
+		if iErr != nil {
+			return failf("cannot inspect execution #%s: %w", execId, iErr)
+		}
+		if ei.Running {
+			return -1, nil
+		}
+		return ei.ExitCode, nil
+	}
+
+	for {
+		select {
+		// TODO! Send kill to child command
+		case <-t.Context().Done():
+			if err := t.Context().Err(); err != nil && rErr == nil {
+				rErr = err
+			}
+			return -2, rErr
+		case err, ok := <-copyDone:
+			ea.Close()
+			_ = ea.CloseWrite()
+			if ok && err != nil && rErr == nil {
+				return -1, err
+			}
+			if rErr == nil {
+				if ec, err := finish(); err != nil {
+					return -1, err
+				} else if ec >= 0 {
+					return ec, nil
+				}
+			}
+		}
+	}
+}
+
+func (this *docker) IsPortForwardingAllowed(_ string, _ uint32) (bool, error) {
+	return this.portForwardingAllowed, nil
+}
+
+func (this *docker) NewDestinationConnection(ctx context.Context, host string, port uint32) (io.ReadWriteCloser, error) {
+	if !this.portForwardingAllowed {
+		return nil, errors.Newf(errors.Permission, "portforwarning not allowed")
+	}
+
+	connId, err := connection.NewId()
+	if err != nil {
+		return nil, err
+	}
+
+	return this.impSession.InitiateDirectTcp(ctx, connId, host, port)
+}
diff --git a/pkg/environment/docker.go b/pkg/environment/docker.go
new file mode 100644
index 0000000..d335d39
--- /dev/null
+++ b/pkg/environment/docker.go
@@ -0,0 +1,215 @@
+package environment
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"sync/atomic"
+	"syscall"
+
+	"github.com/docker/docker/api/types"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/crypto"
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/imp"
+	"github.com/engity-com/bifroest/pkg/net"
+	"github.com/engity-com/bifroest/pkg/session"
+)
+
+type docker struct {
+	repository *DockerRepository
+
+	containerId string
+	sessionId   session.Id
+
+	remoteUser string
+	remoteHost net.Host
+
+	shellCommand []string
+	execCommand  []string
+	sftpCommand  []string
+	user         string
+	directory    string
+
+	portForwardingAllowed bool
+
+	impBinding net.HostPort
+	impSession imp.Session
+
+	owners atomic.Int32
+}
+
+func (this *docker) PublicKey() crypto.PublicKey {
+	// TODO! Maybe we should also consider to extract the key information here.
+	return nil
+}
+
+func (this *docker) EndpointAddr() net.HostPort {
+	return this.impBinding
+}
+
+func (this *DockerRepository) new(ctx context.Context, container *types.Container) (*docker, error) {
+	fail := func(err error) (*docker, error) {
+		return nil, errors.System.Newf("cannot create environment from container %s of flow %v: %w", container.ID, this.flow, err)
+	}
+
+	result := &docker{
+		repository: this,
+	}
+	if err := result.parseContainer(container); err != nil {
+		return fail(err)
+	}
+	var err error
+	if result.impSession, err = this.imp.Open(ctx, result); err != nil {
+		return fail(err)
+	}
+	result.owners.Add(1)
+
+	return result, nil
+}
+
+func (this *docker) Dispose(ctx context.Context) (_ bool, rErr error) {
+	fail := func(err error) (bool, error) {
+		return false, errors.Newf(errors.System, "cannot dispose environment: %w", err)
+	}
+
+	defer this.repository.sessionIdMutex.Lock(this.sessionId)()
+	defer common.KeepError(&rErr, this.closeGuarded)
+
+	ok, err := this.repository.removeContainer(ctx, this.containerId)
+	if err != nil {
+		return fail(err)
+	}
+
+	return ok, nil
+}
+
+func (this *docker) Close() (rErr error) {
+	defer this.repository.sessionIdMutex.Lock(this.sessionId)()
+
+	return this.closeGuarded()
+}
+
+func (this *docker) closeGuarded() error {
+	if this.owners.Add(-1) > 0 {
+		return nil
+	}
+	this.repository.activeInstances.Delete(this.sessionId)
+	return nil
+}
+
+func (this *docker) isRelevantError(err error) bool {
+	return err != nil && !errors.Is(err, syscall.EIO) && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF)
+}
+
+var (
+	containerContainsProblemsErr = errors.System.Newf("container contains problems")
+)
+
+func (this *docker) parseContainer(container *types.Container) (err error) {
+	fail := func(err error) error {
+		return fmt.Errorf("%w: %v", containerContainsProblemsErr, err)
+	}
+	failf := func(msg string, args ...any) error {
+		return fail(errors.System.Newf(msg, args...))
+	}
+	decodeStrings := func(in string) (result []string, err error) {
+		err = json.Unmarshal([]byte(in), &result)
+		return result, err
+	}
+
+	this.containerId = container.ID
+
+	labels := container.Labels
+	if v := labels[DockerLabelFlow]; v == "" {
+		return failf("missing label %s", DockerLabelFlow)
+	} else if v != this.repository.flow.String() {
+		return failf("expected flow: %v; bot container had: %v", this.repository.flow, v)
+	}
+	if v := labels[DockerLabelSessionId]; v == "" {
+		return failf("missing label %s", DockerLabelSessionId)
+	} else if err = this.sessionId.UnmarshalText([]byte(v)); err != nil {
+		return failf("cannot decode label %s: %w", DockerLabelSessionId, err)
+	}
+
+	this.remoteUser = labels[DockerLabelCreatedRemoteUser]
+	if v := labels[DockerLabelCreatedRemoteHost]; v == "" {
+		return failf("missing label %s", DockerLabelCreatedRemoteHost)
+	} else if err = this.remoteHost.Set(v); err != nil {
+		return failf("cannot decode label %s: %w", DockerLabelCreatedRemoteHost, err)
+	}
+
+	if v := labels[DockerLabelShellCommand]; v == "" {
+		return failf("missing label %s", DockerLabelShellCommand)
+	} else if this.shellCommand, err = decodeStrings(v); err != nil {
+		return failf("cannot decode label %s: %w", DockerLabelShellCommand, err)
+	}
+	if v := labels[DockerLabelExecCommand]; v == "" {
+		return failf("missing label %s", DockerLabelExecCommand)
+	} else if this.execCommand, err = decodeStrings(v); err != nil {
+		return failf("cannot decode label %s: %w", DockerLabelExecCommand, err)
+	}
+	if v := labels[DockerLabelSftpCommand]; v == "" {
+		this.sftpCommand = nil
+	} else if this.sftpCommand, err = decodeStrings(v); err != nil {
+		return failf("cannot decode label %s: %w", DockerLabelSftpCommand, err)
+	}
+
+	this.user = labels[DockerLabelUser]
+	this.directory = labels[DockerLabelDirectory]
+	this.portForwardingAllowed = labels[DockerLabelPortForwardingAllowed] == "true"
+
+	if this.impBinding, err = this.resolveImpBinding(container); err != nil {
+		return fail(err)
+	}
+
+	return nil
+}
+
+func (this *docker) resolveImpBinding(container *types.Container) (net.HostPort, error) {
+	fail := func(err error) (net.HostPort, error) {
+		return net.HostPort{}, err
+	}
+	failf := func(msg string, args ...any) (net.HostPort, error) {
+		return fail(errors.System.Newf(msg, args...))
+	}
+
+	iph := this.repository.conf.ImpPublishHost
+	if iph.IsZero() {
+		ns := container.NetworkSettings
+		if ns == nil {
+			return failf("missing network settings of container %v", container.ID)
+		}
+		result := net.HostPort{Port: imp.ServicePort}
+		for n, candidate := range ns.Networks {
+			if ip := candidate.IPAddress; ip != "" {
+				if err := result.Host.Set(ip); err != nil {
+					return failf("cannot parse ip address of network %s to: %w", n, err)
+				}
+				return result, nil
+			}
+		}
+		return failf("network configuration of container does not any valid network configuration")
+	}
+
+	for _, candidate := range container.Ports {
+		if candidate.PrivatePort != imp.ServicePort {
+			continue
+		}
+		if candidate.Type != "tcp" {
+			continue
+		}
+		result := net.HostPort{Port: candidate.PublicPort}
+		if err := result.Host.Set(candidate.IP); err != nil {
+			return failf("cannot parse ip address where the host is bound to: %w", err)
+		}
+		if result.Host.IsZero() {
+			result.Host = iph.Clone()
+		}
+		return result, nil
+	}
+
+	return failf("container does not have any valid exposed port")
+}
diff --git a/pkg/environment/dummy-repository.go b/pkg/environment/dummy-repository.go
new file mode 100644
index 0000000..0e786f8
--- /dev/null
+++ b/pkg/environment/dummy-repository.go
@@ -0,0 +1,53 @@
+package environment
+
+import (
+	"context"
+
+	"github.com/gliderlabs/ssh"
+
+	"github.com/engity-com/bifroest/pkg/alternatives"
+	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/imp"
+	"github.com/engity-com/bifroest/pkg/session"
+)
+
+var (
+	_ = RegisterRepository(NewDummyRepository)
+)
+
+func NewDummyRepository(_ context.Context, flow configuration.FlowName, conf *configuration.EnvironmentDummy, _ alternatives.Provider, _ imp.Imp) (*DummyRepository, error) {
+	return &DummyRepository{
+		flow: flow,
+		conf: conf,
+	}, nil
+}
+
+type DummyRepository struct {
+	flow configuration.FlowName
+	conf *configuration.EnvironmentDummy
+}
+
+func (this *DummyRepository) WillBeAccepted(_ Context) (bool, error) {
+	return true, nil
+}
+
+func (this *DummyRepository) DoesSupportPty(_ Context, _ ssh.Pty) (bool, error) {
+	return true, nil
+}
+
+func (this *DummyRepository) Ensure(req Request) (Environment, error) {
+	sess := req.Authorization().FindSession()
+	if sess == nil {
+		return nil, errors.System.Newf("authorization without session")
+	}
+	return this.FindBySession(req.Context(), sess, nil)
+}
+
+func (this *DummyRepository) FindBySession(_ context.Context, sess session.Session, _ *FindOpts) (Environment, error) {
+	return &dummy{this, sess}, nil
+}
+
+func (this *DummyRepository) Close() error {
+	return nil
+}
diff --git a/pkg/environment/dummy.go b/pkg/environment/dummy.go
new file mode 100644
index 0000000..f9c18b7
--- /dev/null
+++ b/pkg/environment/dummy.go
@@ -0,0 +1,53 @@
+package environment
+
+import (
+	"context"
+	"io"
+	"math"
+	"strings"
+
+	"github.com/engity-com/bifroest/pkg/session"
+)
+
+type dummy struct {
+	repository *DummyRepository
+	session    session.Session
+}
+
+func (this *dummy) Banner(req Request) (io.ReadCloser, error) {
+	banner, err := this.repository.conf.Banner.Render(req)
+	if err != nil {
+		return nil, err
+	}
+	if banner == "" {
+		return nil, nil
+	}
+	return io.NopCloser(strings.NewReader(banner)), nil
+}
+
+func (this *dummy) Run(t Task) (int, error) {
+	exitCode, err := this.repository.conf.ExitCode.Render(t)
+	if err != nil {
+		return -1, err
+	}
+	if exitCode < math.MinInt || exitCode > math.MaxInt {
+		return 1, nil
+	}
+	return int(exitCode), nil
+}
+
+func (this *dummy) IsPortForwardingAllowed(string, uint32) (bool, error) {
+	return false, nil
+}
+
+func (this *dummy) NewDestinationConnection(context.Context, string, uint32) (io.ReadWriteCloser, error) {
+	return nil, nil
+}
+
+func (this *dummy) Dispose(context.Context) (bool, error) {
+	return false, nil
+}
+
+func (this *dummy) Close() error {
+	return nil
+}
diff --git a/pkg/environment/environment.go b/pkg/environment/environment.go
index 223a82c..7c62ba0 100644
--- a/pkg/environment/environment.go
+++ b/pkg/environment/environment.go
@@ -3,18 +3,20 @@ package environment
 import (
 	"context"
 	"io"
-
-	"github.com/engity-com/bifroest/pkg/session"
 )
 
 type Environment interface {
-	Session() session.Session
-
 	Banner(Request) (io.ReadCloser, error)
 	Run(Task) (int, error)
 
 	IsPortForwardingAllowed(host string, port uint32) (bool, error)
 	NewDestinationConnection(ctx context.Context, host string, port uint32) (io.ReadWriteCloser, error)
 
+	// Dispose will fully dispose this instance.
+	// It does also implicitly call Close() to ensure everything happens
+	// in the correct synchronized context.
 	Dispose(context.Context) (bool, error)
+
+	// Close can be safely called more than once.
+	Close() error
 }
diff --git a/pkg/environment/facade-repository.go b/pkg/environment/facade-repository.go
index dda9081..be7eef8 100644
--- a/pkg/environment/facade-repository.go
+++ b/pkg/environment/facade-repository.go
@@ -7,20 +7,22 @@ import (
 
 	"github.com/gliderlabs/ssh"
 
+	"github.com/engity-com/bifroest/pkg/alternatives"
 	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
 	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/imp"
 	"github.com/engity-com/bifroest/pkg/session"
 )
 
-func NewRepositoryFacade(ctx context.Context, flows *configuration.Flows) (*RepositoryFacade, error) {
+func NewRepositoryFacade(ctx context.Context, flows *configuration.Flows, ap alternatives.Provider, i imp.Imp) (*RepositoryFacade, error) {
 	if flows == nil {
 		return &RepositoryFacade{}, nil
 	}
 
 	entries := make(map[configuration.FlowName]CloseableRepository, len(*flows))
 	for _, flow := range *flows {
-		instance, err := newInstance(ctx, &flow)
+		instance, err := newInstance(ctx, &flow, ap, i)
 		if err != nil {
 			return nil, err
 		}
@@ -34,22 +36,22 @@ type RepositoryFacade struct {
 	entries map[configuration.FlowName]CloseableRepository
 }
 
-func (this *RepositoryFacade) WillBeAccepted(req Request) (bool, error) {
-	flow := req.Authorization().Flow()
+func (this *RepositoryFacade) WillBeAccepted(ctx Context) (bool, error) {
+	flow := ctx.Authorization().Flow()
 	candidate, ok := this.entries[flow]
 	if !ok {
 		return false, fmt.Errorf("does not find valid environment for flow %v", flow)
 	}
-	return candidate.WillBeAccepted(req)
+	return candidate.WillBeAccepted(ctx)
 }
 
-func (this *RepositoryFacade) DoesSupportPty(req Request, pty ssh.Pty) (bool, error) {
-	flow := req.Authorization().Flow()
+func (this *RepositoryFacade) DoesSupportPty(ctx Context, pty ssh.Pty) (bool, error) {
+	flow := ctx.Authorization().Flow()
 	candidate, ok := this.entries[flow]
 	if !ok {
 		return false, fmt.Errorf("does not find valid environment for flow %v", flow)
 	}
-	return candidate.DoesSupportPty(req, pty)
+	return candidate.DoesSupportPty(ctx, pty)
 }
 
 func (this *RepositoryFacade) Ensure(req Request) (Environment, error) {
@@ -77,7 +79,7 @@ func (this *RepositoryFacade) Close() (rErr error) {
 	return nil
 }
 
-func newInstance(ctx context.Context, flow *configuration.Flow) (env CloseableRepository, err error) {
+func newInstance(ctx context.Context, flow *configuration.Flow, ap alternatives.Provider, i imp.Imp) (env CloseableRepository, err error) {
 	fail := func(err error) (CloseableRepository, error) {
 		return nil, errors.System.Newf("cannot initizalize environment for flow %q: %w", flow.Name, err)
 	}
@@ -91,7 +93,13 @@ func newInstance(ctx context.Context, flow *configuration.Flow) (env CloseableRe
 		return fail(errors.Config.Newf("cannot handle environment type %v", reflect.TypeOf(flow.Environment.V)))
 	}
 	m := reflect.ValueOf(factory)
-	rets := m.Call([]reflect.Value{reflect.ValueOf(ctx), reflect.ValueOf(flow.Name), reflect.ValueOf(flow.Environment.V)})
+	rets := m.Call([]reflect.Value{
+		reflect.ValueOf(ctx),
+		reflect.ValueOf(flow.Name),
+		reflect.ValueOf(flow.Environment.V),
+		reflect.ValueOf(ap),
+		reflect.ValueOf(i),
+	})
 	if err, ok := rets[1].Interface().(error); ok && err != nil {
 		return fail(err)
 	}
@@ -102,7 +110,7 @@ var (
 	configurationTypeToRepositoryFactory = make(map[reflect.Type]any)
 )
 
-type RepositoryFactory[C any, R CloseableRepository] func(ctx context.Context, flow configuration.FlowName, conf C) (R, error)
+type RepositoryFactory[C any, R CloseableRepository] func(context.Context, configuration.FlowName, C, alternatives.Provider, imp.Imp) (R, error)
 
 func RegisterRepository[C any, R CloseableRepository](factory RepositoryFactory[C, R]) RepositoryFactory[C, R] {
 	ct := reflect.TypeFor[C]()
diff --git a/pkg/environment/local-repository.go b/pkg/environment/local-repository.go
index 1e13f8a..5d1e4de 100644
--- a/pkg/environment/local-repository.go
+++ b/pkg/environment/local-repository.go
@@ -8,12 +8,12 @@ var (
 	_ = RegisterRepository(NewLocalRepository)
 )
 
-func (this *LocalRepository) WillBeAccepted(req Request) (ok bool, err error) {
+func (this *LocalRepository) WillBeAccepted(ctx Context) (ok bool, err error) {
 	fail := func(err error) (bool, error) {
 		return false, err
 	}
 
-	if ok, err = this.conf.LoginAllowed.Render(req); err != nil {
+	if ok, err = this.conf.LoginAllowed.Render(ctx); err != nil {
 		return fail(fmt.Errorf("cannot evaluate if user is allowed to login or not: %w", err))
 	}
 
diff --git a/pkg/environment/local-repository_unix.go b/pkg/environment/local-repository_unix.go
index 0f28611..8874462 100644
--- a/pkg/environment/local-repository_unix.go
+++ b/pkg/environment/local-repository_unix.go
@@ -10,8 +10,10 @@ import (
 	log "github.com/echocat/slf4g"
 	"github.com/gliderlabs/ssh"
 
+	"github.com/engity-com/bifroest/pkg/alternatives"
 	"github.com/engity-com/bifroest/pkg/configuration"
 	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/imp"
 	"github.com/engity-com/bifroest/pkg/session"
 	"github.com/engity-com/bifroest/pkg/template"
 	"github.com/engity-com/bifroest/pkg/user"
@@ -30,7 +32,7 @@ type LocalRepository struct {
 	userRepository user.CloseableRepository
 }
 
-func NewLocalRepository(ctx context.Context, flow configuration.FlowName, conf *configuration.EnvironmentLocal) (*LocalRepository, error) {
+func NewLocalRepository(ctx context.Context, flow configuration.FlowName, conf *configuration.EnvironmentLocal, _ alternatives.Provider, _ imp.Imp) (*LocalRepository, error) {
 	fail := func(err error) (*LocalRepository, error) {
 		return nil, err
 	}
@@ -56,7 +58,7 @@ func NewLocalRepository(ctx context.Context, flow configuration.FlowName, conf *
 	return &result, nil
 }
 
-func (this *LocalRepository) DoesSupportPty(Request, ssh.Pty) (bool, error) {
+func (this *LocalRepository) DoesSupportPty(Context, ssh.Pty) (bool, error) {
 	return true, nil
 }
 
diff --git a/pkg/environment/local-repository_windows.go b/pkg/environment/local-repository_windows.go
index c42faba..12fd80e 100644
--- a/pkg/environment/local-repository_windows.go
+++ b/pkg/environment/local-repository_windows.go
@@ -10,8 +10,10 @@ import (
 	log "github.com/echocat/slf4g"
 	"github.com/gliderlabs/ssh"
 
+	"github.com/engity-com/bifroest/pkg/alternatives"
 	"github.com/engity-com/bifroest/pkg/configuration"
 	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/imp"
 	"github.com/engity-com/bifroest/pkg/session"
 )
 
@@ -22,7 +24,7 @@ type LocalRepository struct {
 	Logger log.Logger
 }
 
-func NewLocalRepository(_ context.Context, flow configuration.FlowName, conf *configuration.EnvironmentLocal) (*LocalRepository, error) {
+func NewLocalRepository(_ context.Context, flow configuration.FlowName, conf *configuration.EnvironmentLocal, _ alternatives.Provider, _ imp.Imp) (*LocalRepository, error) {
 	fail := func(err error) (*LocalRepository, error) {
 		return nil, err
 	}
@@ -42,7 +44,7 @@ func NewLocalRepository(_ context.Context, flow configuration.FlowName, conf *co
 	return &result, nil
 }
 
-func (this *LocalRepository) DoesSupportPty(Request, ssh.Pty) (bool, error) {
+func (this *LocalRepository) DoesSupportPty(Context, ssh.Pty) (bool, error) {
 	return false, nil
 }
 
diff --git a/pkg/environment/local.go b/pkg/environment/local.go
index bfedbef..7667721 100644
--- a/pkg/environment/local.go
+++ b/pkg/environment/local.go
@@ -2,7 +2,6 @@ package environment
 
 import (
 	"context"
-	"fmt"
 	"io"
 	"net"
 	"os"
@@ -16,17 +15,11 @@ import (
 	log "github.com/echocat/slf4g"
 	"github.com/echocat/slf4g/level"
 	"github.com/gliderlabs/ssh"
-	"github.com/kardianos/osext"
 
 	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/errors"
-	"github.com/engity-com/bifroest/pkg/session"
 )
 
-func (this *local) Session() session.Session {
-	return this.session
-}
-
 func (this *local) Banner(req Request) (io.ReadCloser, error) {
 	b, err := this.repository.conf.Banner.Render(req)
 	if err != nil {
@@ -37,38 +30,53 @@ func (this *local) Banner(req Request) (io.ReadCloser, error) {
 }
 
 func (this *local) Run(t Task) (exitCode int, rErr error) {
+	fail := func(err error) (int, error) {
+		return -1, err
+	}
+	failf := func(msg string, args ...any) (int, error) {
+		return fail(errors.System.Newf(msg, args...))
+	}
+
 	l := t.Logger()
 	sshSess := t.SshSession()
 
+	auth := t.Authorization()
+	sess := auth.FindSession()
+	if sess == nil {
+		return failf("authorization without session is not supported to run docker environment")
+	}
+
 	cmd, ev, err := this.createCmdAndEnv(t)
 	if err != nil {
-		return -1, err
+		return fail(err)
 	}
 
+	ev.Set("BIFROEST_SESSION_ID", sess.Id().String())
+
 	switch t.TaskType() {
 	case TaskTypeShell:
 		if err := this.configureShellCmd(t, cmd); err != nil {
-			return -1, err
+			return fail(err)
 		}
 	case TaskTypeSftp:
-		efn, err := osext.Executable()
+		efn, err := os.Executable()
 		if err != nil {
-			return -1, fmt.Errorf("cannot resolve the location of the server's executable location: %w", err)
+			return failf("cannot resolve the location of the server's executable location: %w", err)
 		}
 		cmd.Path = efn
 		cmd.Args = []string{efn, "sftp-server"}
 	default:
-		return -1, fmt.Errorf("illegal task type: %v", t.TaskType())
+		return failf("illegal task type: %v", t.TaskType())
 	}
 
 	if ssh.AgentRequested(sshSess) {
 		l, err := ssh.NewAgentListener()
 		if err != nil {
-			return -1, fmt.Errorf("cannot listen to agent: %w", err)
+			return failf("cannot listen to agent: %w", err)
 		}
 		defer common.IgnoreCloseError(l)
 		go ssh.ForwardAgentConnections(l, sshSess)
-		cmd.Env = append(cmd.Env, "SSH_AUTH_SOCK"+l.Addr().String())
+		ev.Set("SSH_AUTH_SOCK", l.Addr().String())
 	}
 
 	cmd.Stdin = sshSess
@@ -87,13 +95,13 @@ func (this *local) Run(t Task) (exitCode int, rErr error) {
 		var err error
 		fPty, fTty, err = pty.Open()
 		if err != nil {
-			return -1, fmt.Errorf("cannot allocate pty: %w", err)
+			return failf("cannot allocate pty: %w", err)
 		}
 		defer common.IgnoreCloseError(fPty)
 		defer common.IgnoreCloseError(fTty)
 		ev.Set("TERM", ptyReq.Term)
 		if err := this.configureCmdForPty(cmd, fPty, fTty); err != nil {
-			return -1, fmt.Errorf("cannot configure cmd for pty: %w", err)
+			return failf("cannot configure cmd for pty: %w", err)
 		}
 		cmd.Stderr = fTty
 		cmd.Stdout = fTty
@@ -115,7 +123,7 @@ func (this *local) Run(t Task) (exitCode int, rErr error) {
 	cmd.Env = ev.Strings()
 
 	if err := cmd.Start(); err != nil {
-		return -1, fmt.Errorf("cannot start process %v: %w", cmd.Args, err)
+		return failf("cannot start process %v: %w", cmd.Args, err)
 	}
 	l.With("pid", cmd.Process.Pid).
 		Debug("user's process started")
@@ -193,11 +201,13 @@ func (this *local) Run(t Task) (exitCode int, rErr error) {
 	}
 }
 
-func (this *local) Dispose(ctx context.Context) (bool, error) {
+func (this *local) Dispose(ctx context.Context) (_ bool, rErr error) {
 	fail := func(err error) (bool, error) {
 		return false, errors.Newf(errors.System, "cannot dispose environment: %w", err)
 	}
 
+	defer common.KeepCloseError(&rErr, this)
+
 	disposed, err := this.dispose(ctx)
 	if err != nil {
 		return fail(err)
@@ -213,6 +223,10 @@ func (this *local) Dispose(ctx context.Context) (bool, error) {
 	return disposed, nil
 }
 
+func (this *local) Close() error {
+	return nil
+}
+
 func (this *local) isRelevantError(err error) bool {
 	return err != nil && !errors.Is(err, syscall.EIO) && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF)
 }
diff --git a/pkg/environment/repository.go b/pkg/environment/repository.go
index 9ff5a1b..05688b5 100644
--- a/pkg/environment/repository.go
+++ b/pkg/environment/repository.go
@@ -19,11 +19,11 @@ var (
 type Repository interface {
 	// WillBeAccepted returns true if it is possible to get an Environment for the
 	// provided Request.
-	WillBeAccepted(Request) (bool, error)
+	WillBeAccepted(Context) (bool, error)
 
 	// DoesSupportPty will return true if the resulting Environment will support
 	// an PTY.
-	DoesSupportPty(Request, ssh.Pty) (bool, error)
+	DoesSupportPty(Context, ssh.Pty) (bool, error)
 
 	// Ensure will create or return an environment that matches the given Request.
 	// If it is not acceptable to do this action with the provided Request
diff --git a/pkg/environment/request.go b/pkg/environment/request.go
index a353d06..02b9ef8 100644
--- a/pkg/environment/request.go
+++ b/pkg/environment/request.go
@@ -1,16 +1,15 @@
 package environment
 
-import (
-	log "github.com/echocat/slf4g"
-	"github.com/gliderlabs/ssh"
+type Request interface {
+	Context
+
+	StartPreparation(id, title string, attrs PreparationProgressAttributes) (PreparationProgress, error)
+}
 
-	"github.com/engity-com/bifroest/pkg/authorization"
-	"github.com/engity-com/bifroest/pkg/common"
-)
+type PreparationProgressAttributes map[string]any
 
-type Request interface {
-	Remote() common.Remote
-	Context() ssh.Context
-	Logger() log.Logger
-	Authorization() authorization.Authorization
+type PreparationProgress interface {
+	Report(progress float32) error
+	Done() error
+	Error(error) error
 }
diff --git a/pkg/environment/task.go b/pkg/environment/task.go
index f2b3de1..cca2536 100644
--- a/pkg/environment/task.go
+++ b/pkg/environment/task.go
@@ -25,7 +25,7 @@ func (this TaskType) String() string {
 }
 
 type Task interface {
-	Request
+	Context
 	SshSession() ssh.Session
 	TaskType() TaskType
 }
diff --git a/pkg/errors/error.go b/pkg/errors/error.go
index c03762d..f684c94 100644
--- a/pkg/errors/error.go
+++ b/pkg/errors/error.go
@@ -3,6 +3,10 @@ package errors
 import (
 	"errors"
 	"fmt"
+
+	"github.com/vmihailenco/msgpack/v5"
+
+	"github.com/engity-com/bifroest/pkg/codec"
 )
 
 func Newf(t Type, msg string, args ...any) *Error {
@@ -53,3 +57,66 @@ func IsError(err error) (eErr *Error, ok bool) {
 	ok = As(err, &eErr)
 	return
 }
+
+func EncodeMsgPack(err error, using codec.MsgPackEncoder) error {
+	if err == nil {
+		return Unknown.EncodeMsgPack(using)
+	}
+
+	eErr, ok := IsError(err)
+	if !ok {
+		eErr = &Error{
+			Type:    System,
+			Message: err.Error(),
+		}
+	}
+	return eErr.EncodeMsgPack(using)
+}
+
+func DecodeMsgPack(using codec.MsgPackDecoder) (error, error) {
+	var buf Error
+	if err := buf.DecodeMsgPack(using); err != nil {
+		return nil, err
+	}
+	if buf.Type == 0 {
+		return nil, nil
+	}
+	return &buf, nil
+}
+
+func (this Error) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this *Error) DecodeMsgpack(dec *msgpack.Decoder) (err error) {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this Error) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	if err := this.Type.EncodeMsgPack(enc); err != nil {
+		return err
+	}
+	if this.Type == 0 {
+		return nil
+	}
+	if err := enc.EncodeString(this.Error()); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this *Error) DecodeMsgPack(dec codec.MsgPackDecoder) (err error) {
+	var buf Error
+	if err = buf.Type.DecodeMsgPack(dec); err != nil {
+		return err
+	}
+	if buf.Type == 0 {
+		*this = buf
+		return nil
+	}
+	if buf.Message, err = dec.DecodeString(); err != nil {
+		return err
+	}
+	*this = buf
+	return nil
+}
diff --git a/pkg/errors/type.go b/pkg/errors/type.go
index 640873a..c6c16d4 100644
--- a/pkg/errors/type.go
+++ b/pkg/errors/type.go
@@ -4,6 +4,10 @@ import (
 	"fmt"
 	"strconv"
 	"strings"
+
+	"github.com/vmihailenco/msgpack/v5"
+
+	"github.com/engity-com/bifroest/pkg/codec"
 )
 
 type Type uint8
@@ -76,6 +80,32 @@ func (t Type) IsEqualTo(other any) bool {
 	}
 }
 
+func (this Type) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this *Type) DecodeMsgpack(dec *msgpack.Decoder) (err error) {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this Type) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	return enc.EncodeUint8(uint8(this))
+}
+
+func (this *Type) DecodeMsgPack(dec codec.MsgPackDecoder) error {
+	v, err := dec.DecodeUint8()
+	if err != nil {
+		return err
+	}
+	buf := Type(v)
+	_, ok := typeToStr[buf]
+	if !ok {
+		return fmt.Errorf("unknown-type-%d", v)
+	}
+	*this = buf
+	return nil
+}
+
 var (
 	strToType = map[string]Type{
 		"unknown":    Unknown,
diff --git a/pkg/imp/imp.go b/pkg/imp/imp.go
new file mode 100644
index 0000000..4b16f79
--- /dev/null
+++ b/pkg/imp/imp.go
@@ -0,0 +1,55 @@
+package imp
+
+import (
+	"context"
+	"io"
+
+	"github.com/engity-com/bifroest/internal/imp/protocol"
+	"github.com/engity-com/bifroest/pkg/crypto"
+	"github.com/engity-com/bifroest/pkg/net"
+)
+
+var (
+	ErrNoSuchProcess = protocol.ErrNoSuchProcess
+)
+
+type Ref interface {
+	PublicKey() crypto.PublicKey
+	EndpointAddr() net.HostPort
+}
+
+func NewImp(ctx context.Context, bifroestPrivateKey crypto.PrivateKey) (Imp, error) {
+	master, err := protocol.NewMaster(ctx, bifroestPrivateKey)
+	if err != nil {
+		return nil, err
+	}
+	return &imp{
+		master: master,
+	}, nil
+}
+
+type Imp interface {
+	io.Closer
+	Open(context.Context, Ref) (Session, error)
+	GetMasterPublicKey() (crypto.PublicKey, error)
+}
+
+type imp struct {
+	master *protocol.Master
+}
+
+func (this *imp) Open(ctx context.Context, ref Ref) (Session, error) {
+	cs, err := this.master.Open(ctx, ref)
+	if err != nil {
+		return nil, err
+	}
+	return cs, nil
+}
+
+func (this *imp) GetMasterPublicKey() (crypto.PublicKey, error) {
+	return this.master.PrivateKey.PublicKey(), nil
+}
+
+func (this *imp) Close() error {
+	return nil
+}
diff --git a/pkg/imp/logger/event.go b/pkg/imp/logger/event.go
new file mode 100644
index 0000000..3dbe4db
--- /dev/null
+++ b/pkg/imp/logger/event.go
@@ -0,0 +1,67 @@
+package logger
+
+import (
+	log "github.com/echocat/slf4g"
+	"github.com/echocat/slf4g/fields"
+	"github.com/echocat/slf4g/level"
+)
+
+type event struct {
+	provider *Provider
+	fields   fields.Fields
+	level    level.Level
+}
+
+func (instance *event) ForEach(consumer func(key string, value interface{}) error) error {
+	return instance.fields.ForEach(consumer)
+}
+
+func (instance *event) Get(key string) (interface{}, bool) {
+	return instance.fields.Get(key)
+}
+
+func (instance *event) Len() int {
+	return instance.fields.Len()
+}
+
+func (instance *event) GetLevel() level.Level {
+	return instance.level
+}
+
+func (instance *event) With(key string, value interface{}) log.Event {
+	return instance.with(func(s fields.Fields) fields.Fields {
+		return s.With(key, value)
+	})
+}
+
+func (instance *event) Withf(key string, format string, args ...interface{}) log.Event {
+	return instance.with(func(s fields.Fields) fields.Fields {
+		return s.Withf(key, format, args...)
+	})
+}
+
+func (instance *event) WithError(err error) log.Event {
+	return instance.with(func(s fields.Fields) fields.Fields {
+		return s.With(instance.provider.GetFieldKeysSpec().GetError(), err)
+	})
+}
+
+func (instance *event) WithAll(of map[string]interface{}) log.Event {
+	return instance.with(func(s fields.Fields) fields.Fields {
+		return s.WithAll(of)
+	})
+}
+
+func (instance *event) Without(keys ...string) log.Event {
+	return instance.with(func(s fields.Fields) fields.Fields {
+		return s.Without(keys...)
+	})
+}
+
+func (instance *event) with(mod func(fields.Fields) fields.Fields) log.Event {
+	return &event{
+		provider: instance.provider,
+		fields:   mod(instance.fields),
+		level:    instance.level,
+	}
+}
diff --git a/pkg/imp/logger/logger-core.go b/pkg/imp/logger/logger-core.go
new file mode 100644
index 0000000..6af4c5a
--- /dev/null
+++ b/pkg/imp/logger/logger-core.go
@@ -0,0 +1,87 @@
+package logger
+
+import (
+	"time"
+
+	"github.com/echocat/slf4g/fields"
+
+	log "github.com/echocat/slf4g"
+	"github.com/echocat/slf4g/level"
+)
+
+const RootLoggerName = "ROOT"
+
+type CoreLogger struct {
+	provider *Provider
+	name     string
+	level    level.Level
+}
+
+// Log implements log.CoreLogger#Log(event).
+func (this *CoreLogger) Log(event log.Event, _ uint16) {
+	f := this.provider.Drain
+	if f == nil {
+		return
+	}
+	if !this.IsLevelEnabled(event.GetLevel()) {
+		return
+	}
+
+	if v := log.GetTimestampOf(event, this.provider); v == nil {
+		event = event.With(this.provider.GetFieldKeysSpec().GetTimestamp(), time.Now())
+	}
+	if v := log.GetLoggerOf(event, this.provider); v == nil {
+		event = event.With(this.provider.GetFieldKeysSpec().GetLogger(), this)
+	}
+
+	f(event)
+}
+
+// GetLevel returns the current level.Level where this log.CoreLogger is set to.
+func (this *CoreLogger) GetLevel() level.Level {
+	if v := this.level; v != 0 {
+		return v
+	}
+	return this.provider.GetLevel()
+}
+
+// SetLevel changes the current level.Level of this log.CoreLogger. If set to
+// 0 it will force this CoreLogger to use DefaultLevel.
+func (this *CoreLogger) SetLevel(v level.Level) {
+	this.level = v
+}
+
+// IsLevelEnabled implements log.CoreLogger#IsLevelEnabled()
+func (this *CoreLogger) IsLevelEnabled(v level.Level) bool {
+	return this.GetLevel().CompareTo(v) <= 0
+}
+
+// GetName implements log.CoreLogger#GetName()
+func (this *CoreLogger) GetName() string {
+	return this.name
+}
+
+// GetProvider implements log.CoreLogger#GetProvider()
+func (this *CoreLogger) GetProvider() log.Provider {
+	return this.provider
+}
+
+func (this *CoreLogger) NewEvent(l level.Level, values map[string]interface{}) log.Event {
+	return this.NewEventWithFields(l, fields.WithAll(values))
+}
+
+func (this *CoreLogger) NewEventWithFields(l level.Level, f fields.ForEachEnabled) log.Event {
+	asFields, err := fields.AsFields(f)
+	if err != nil {
+		panic(err)
+	}
+	return &event{
+		provider: this.provider,
+		fields:   asFields,
+		level:    l,
+	}
+}
+
+func (this *CoreLogger) Accepts(e log.Event) bool {
+	return e != nil
+}
diff --git a/pkg/imp/logger/provider-facade.go b/pkg/imp/logger/provider-facade.go
new file mode 100644
index 0000000..fe000d5
--- /dev/null
+++ b/pkg/imp/logger/provider-facade.go
@@ -0,0 +1,82 @@
+package logger
+
+import (
+	"sync/atomic"
+
+	log "github.com/echocat/slf4g"
+	"github.com/echocat/slf4g/fields"
+	"github.com/echocat/slf4g/level"
+)
+
+type ProviderFacade struct {
+	delegate atomic.Pointer[log.Provider]
+	cache    atomic.Pointer[log.LoggerCache]
+}
+
+func (this *ProviderFacade) getRootLogger() log.Logger {
+	return log.NewLoggerFacade(func() log.CoreLogger {
+		return this.getDelegate().GetRootLogger()
+	})
+}
+
+func (this *ProviderFacade) getLogger(name string) log.Logger {
+	return log.NewLoggerFacade(func() log.CoreLogger {
+		return this.getDelegate().GetLogger(name)
+	})
+}
+
+// GetRootLogger implements log.Provider#GetRootLogger()
+func (this *ProviderFacade) GetRootLogger() log.Logger {
+	return this.getCache().GetRootLogger()
+}
+
+// GetLogger implements log.Provider#GetLogger()
+func (this *ProviderFacade) GetLogger(name string) log.Logger {
+	return this.getCache().GetLogger(name)
+}
+
+// GetName implements log.Provider#GetName()
+func (this *ProviderFacade) GetName() string {
+	return this.getDelegate().GetName()
+}
+
+// GetAllLevels implements log.Provider#GetAllLevels()
+func (this *ProviderFacade) GetAllLevels() level.Levels {
+	return this.getDelegate().GetAllLevels()
+}
+
+// GetFieldKeysSpec implements log.Provider#GetFieldKeysSpec()
+func (this *ProviderFacade) GetFieldKeysSpec() fields.KeysSpec {
+	return this.getDelegate().GetFieldKeysSpec()
+}
+
+func (this *ProviderFacade) Set(delegate log.Provider) {
+	if delegate == nil {
+		delegate = log.GetProvider()
+	}
+	this.delegate.Store(&delegate)
+}
+
+func (this *ProviderFacade) getDelegate() log.Provider {
+	for {
+		if v := this.delegate.Load(); v != nil {
+			return *v
+		}
+		def := log.GetProvider()
+		if this.delegate.CompareAndSwap(nil, &def) {
+			return def
+		}
+	}
+}
+
+func (this *ProviderFacade) getCache() log.LoggerCache {
+	for {
+		if v := this.cache.Load(); v != nil {
+			return *v
+		}
+		created := log.NewLoggerCache(this.getRootLogger, this.getLogger)
+		if this.cache.CompareAndSwap(nil, &created) {
+			return created
+		}
+	}
+}
diff --git a/pkg/imp/logger/provider.go b/pkg/imp/logger/provider.go
new file mode 100644
index 0000000..af820b5
--- /dev/null
+++ b/pkg/imp/logger/provider.go
@@ -0,0 +1,86 @@
+package logger
+
+import (
+	"sync/atomic"
+
+	log "github.com/echocat/slf4g"
+	"github.com/echocat/slf4g/fields"
+	"github.com/echocat/slf4g/level"
+	"github.com/echocat/slf4g/native"
+)
+
+var (
+	DefaultLevel = level.Info
+)
+
+type Provider struct {
+	Level level.Level
+	Drain func(log.Event)
+
+	cache atomic.Pointer[log.LoggerCache]
+}
+
+func (this *Provider) rootFactory() log.Logger {
+	return this.factory(RootLoggerName)
+}
+
+func (this *Provider) factory(name string) log.Logger {
+	return log.NewLogger(&CoreLogger{
+		this,
+		name,
+		0,
+	})
+}
+
+// GetRootLogger implements log.Provider#GetRootLogger()
+func (this *Provider) GetRootLogger() log.Logger {
+	return this.getCache().GetRootLogger()
+}
+
+// GetLogger implements log.Provider#GetLogger()
+func (this *Provider) GetLogger(name string) log.Logger {
+	return this.getCache().GetLogger(name)
+}
+
+// GetName implements log.Provider#GetName()
+func (this *Provider) GetName() string {
+	return "imp"
+}
+
+// GetAllLevels implements log.Provider#GetAllLevels()
+func (this *Provider) GetAllLevels() level.Levels {
+	return level.GetProvider().GetLevels()
+}
+
+// GetFieldKeysSpec implements log.Provider#GetFieldKeysSpec()
+func (this *Provider) GetFieldKeysSpec() fields.KeysSpec {
+	return native.DefaultFieldKeysSpec
+}
+
+// GetLevel returns the current level.Level where this log.Provider is set to.
+func (this *Provider) GetLevel() level.Level {
+	if v := this.Level; v != 0 {
+		return v
+	}
+	return DefaultLevel
+}
+
+// SetLevel changes the current level.Level of this log.Provider. If set to
+// 0 it will force this Provider to use DefaultLevel.
+func (this *Provider) SetLevel(v level.Level) {
+	this.Level = v
+}
+
+func (this *Provider) getCache() log.LoggerCache {
+	for {
+		v := this.cache.Load()
+		if v != nil {
+			return *v
+		}
+
+		c := log.NewLoggerCache(this.rootFactory, this.factory)
+		if this.cache.CompareAndSwap(nil, &c) {
+			return c
+		}
+	}
+}
diff --git a/pkg/imp/roundtrip_test.go b/pkg/imp/roundtrip_test.go
new file mode 100644
index 0000000..0f5bd21
--- /dev/null
+++ b/pkg/imp/roundtrip_test.go
@@ -0,0 +1,286 @@
+package imp
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"flag"
+	"io"
+	gonet "net"
+	"net/http"
+	"os"
+	"os/exec"
+	"os/signal"
+	"path/filepath"
+	"sync"
+	"syscall"
+	"testing"
+	"time"
+
+	log "github.com/echocat/slf4g"
+	"github.com/echocat/slf4g/sdk/testlog"
+	"github.com/shirou/gopsutil/v4/process"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/connection"
+	"github.com/engity-com/bifroest/pkg/crypto"
+	"github.com/engity-com/bifroest/pkg/net"
+	"github.com/engity-com/bifroest/pkg/sys"
+)
+
+const (
+	flagRoundtripTestProcess         = "imp-roundtrip-test-process"
+	flagRoundtripTestImpAddress      = "imp-roundtrip-test-imp-addr"
+	flagRoundtripTestMasterPublicKey = "imp-roundtrip-test-master-public-key"
+)
+
+var (
+	roundtripTestImpAddress = net.HostPort{
+		Host: net.MustNewHost("localhost"),
+		Port: ServicePort,
+	}
+	roundtripTestServiceAddress = net.HostPort{
+		Host: net.MustNewHost("localhost"),
+		Port: 45321,
+	}
+
+	roundtripTestEnabled          = flag.Bool("imp-roundtrip-test-enabled", true, "")
+	roundtripTestImpProcess       = flag.Bool(flagRoundtripTestProcess, false, "")
+	roundtripTestAttachToDebugger = flag.String("imp-roundtrip-test-attach-to-debugger", "", "")
+	roundtripTestDebuggerOutput   = flag.String("imp-roundtrip-test-debugger-output", "", "")
+	roundtripTestMasterPublicKey  = flag.String(flagRoundtripTestMasterPublicKey, "", "")
+)
+
+func init() {
+	flag.Var(&roundtripTestImpAddress, flagRoundtripTestImpAddress, "")
+	flag.Var(&roundtripTestServiceAddress, "imp-roundtrip-test-service-addr", "")
+}
+
+func TestRoundtrip(t *testing.T) {
+	testlog.Hook(t)
+
+	if *roundtripTestImpProcess {
+		roundtripImp(t)
+		return
+	}
+
+	if *roundtripTestEnabled {
+		roundtrip(t)
+		return
+	}
+}
+
+func roundtrip(t *testing.T) {
+	ctx, cancelFn := context.WithCancel(context.Background())
+	defer cancelFn()
+
+	masterKey := generatePrivateKey(t)
+
+	var wg sync.WaitGroup
+	impCmd := prepareRoundtripImpCmd(t, masterKey.PublicKey())
+	wg.Add(1)
+	go runCmd(ctx, t, impCmd, wg.Done)
+	defer wg.Wait()
+	defer cancelFn()
+
+	for i := 0; i < 10000; i++ {
+		time.Sleep(1 * time.Millisecond)
+		conn, err := gonet.DialTimeout("tcp", roundtripTestImpAddress.String(), time.Millisecond*10)
+		if err != nil {
+			continue
+		}
+		_ = conn.Close()
+		break
+	}
+
+	wg.Add(1)
+	go roundtripDummyService(ctx, t, wg.Done)
+
+	master, err := NewImp(ctx, masterKey)
+	require.NoError(t, err)
+	defer func() {
+		assert.NoError(t, master.Close())
+	}()
+
+	sess, err := master.Open(ctx, refV)
+	require.NoError(t, err)
+
+	connId := connection.MustNewId()
+	t.Run("echo", func(t *testing.T) {
+		resp, err := sess.Echo(ctx, connId, "foo")
+		require.NoError(t, err)
+
+		assert.Equal(t, "thanks for: foo", resp)
+	})
+	t.Run("kill", func(t *testing.T) {
+		err := sess.Kill(ctx, connId, 66666666666, sys.SIGTRAP)
+		require.Equal(t, ErrNoSuchProcess, err)
+	})
+	t.Run("port-forward-tcp", func(t *testing.T) {
+		hc := http.Client{
+			Transport: &http.Transport{
+				DialContext: func(ctx context.Context, network, addr string) (gonet.Conn, error) {
+					assert.Equal(t, network, "tcp")
+					assert.Equal(t, addr, "foo:80")
+					conn, err := sess.InitiateDirectTcp(ctx, connId, roundtripTestServiceAddress.Host.String(), uint32(roundtripTestServiceAddress.Port))
+					assert.NoError(t, err)
+					return conn, nil
+				},
+			},
+		}
+		resp, err := hc.Get("http://foo/")
+		require.NoError(t, err)
+		defer common.IgnoreCloseError(resp.Body)
+
+		require.Equal(t, http.StatusOK, resp.StatusCode)
+
+		b, err := io.ReadAll(resp.Body)
+		require.NoError(t, err)
+		assert.Equal(t, "OK!", string(b))
+	})
+
+	// Has to be the last run!
+	t.Run("exit", func(t *testing.T) {
+		err := sess.Exit(ctx, connId, 666)
+		if net.IsClosedError(err) {
+			// Ok
+		} else if err != nil {
+			t.Fatal(err)
+		}
+	})
+}
+
+func roundtripImp(t *testing.T) {
+	ctx, cancelFn := context.WithCancel(context.Background())
+
+	sigs := make(chan os.Signal, 1)
+	defer close(sigs)
+	signal.Notify(sigs, syscall.SIGTERM)
+	go func() {
+		sig := <-sigs
+		log.With("signal", sig).
+			With("context", "imp-test").
+			Info("received signal")
+		cancelFn()
+	}()
+
+	svc := Service{
+		Addr:            roundtripTestImpAddress.String(),
+		MasterPublicKey: decodePublicKeyString(t, *roundtripTestMasterPublicKey),
+	}
+
+	err := svc.Serve(ctx)
+	assert.NoError(t, err)
+}
+
+func roundtripDummyService(ctx context.Context, t *testing.T, onDone func()) {
+	defer onDone()
+	ln, err := gonet.Listen("tcp", roundtripTestServiceAddress.String())
+	require.NoError(t, err)
+	defer common.IgnoreCloseError(ln)
+
+	srv := http.Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			_, _ = w.Write([]byte("OK!"))
+		}),
+	}
+
+	go func() {
+		err := srv.Serve(ln)
+		if !net.IsClosedError(err) && !errors.Is(err, http.ErrServerClosed) {
+			require.NoError(t, err)
+		}
+	}()
+
+	<-ctx.Done()
+}
+
+func generatePrivateKey(t *testing.T) crypto.PrivateKey {
+	req := crypto.KeyRequirement{
+		Type: crypto.KeyTypeEd25519,
+	}
+	result, err := req.GenerateKey(nil)
+	require.NoError(t, err)
+	return result
+}
+
+func prepareRoundtripImpCmd(t *testing.T, masterPublicKey crypto.PublicKey) *exec.Cmd {
+	ex, err := os.Executable()
+	require.NoError(t, err)
+
+	args := []string{"-test.run=^" + t.Name() + "$",
+		"--" + flagRoundtripTestProcess,
+		"--" + flagRoundtripTestImpAddress + "=" + roundtripTestImpAddress.String(),
+		"--" + flagRoundtripTestMasterPublicKey + "=" + base64.StdEncoding.EncodeToString(masterPublicKey.Marshal()),
+	}
+	var cmd *exec.Cmd
+	if addr := *roundtripTestAttachToDebugger; addr != "" {
+		pArgs := []string{"--listen=" + addr, "--headless=true", "--api-version=2", "--accept-multiclient"}
+		if fn := *roundtripTestDebuggerOutput; fn != "" {
+			_ = os.MkdirAll(filepath.Dir(fn), 0755)
+			pArgs = append(pArgs, "--log-dest="+fn)
+		}
+		pArgs = append(pArgs, "exec", ex, "--")
+		ex = "dlv"
+		args = append(pArgs, args...)
+	}
+	cmd = exec.Command(ex, args...)
+	cmd.Env = os.Environ()
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd
+}
+
+func runCmd(ctx context.Context, t *testing.T, cmd *exec.Cmd, onDone func()) {
+	defer onDone()
+	err := cmd.Start()
+	require.NoError(t, err)
+
+	go func() {
+		<-ctx.Done()
+		p, err := process.NewProcess(int32(cmd.Process.Pid))
+		if err != nil && !errors.Is(err, process.ErrorProcessNotRunning) {
+			t.Errorf("Cannot get IMP process %d: %v", cmd.Process.Pid, err)
+			return
+		}
+		_ = p.Terminate()
+	}()
+
+	if err := cmd.Wait(); err != nil {
+		var ecErr *exec.ExitError
+		if errors.As(err, &ecErr) {
+			exitCode := ecErr.ExitCode()
+			if exitCode == 666 || exitCode == 154 {
+				// Expected exit code.
+				return
+			}
+			t.Errorf("IMP failed with %d; see above", ecErr.ExitCode())
+			return
+		}
+		t.Errorf("IMP failed with unexpected execution error: %v", err)
+	}
+}
+
+func decodePublicKeyString(t *testing.T, in string) crypto.PublicKey {
+	b, err := base64.StdEncoding.DecodeString(in)
+	require.NoError(t, err)
+	result, err := crypto.ParsePublicKeyBytes(b)
+	require.NoError(t, err)
+	return result
+}
+
+var refV = refImpl{}
+
+type refImpl struct {
+}
+
+func (this refImpl) PublicKey() crypto.PublicKey {
+	return nil // TODO! Maybe do it better...
+}
+
+func (this refImpl) EndpointAddr() net.HostPort {
+	return roundtripTestImpAddress
+}
diff --git a/pkg/imp/service.go b/pkg/imp/service.go
new file mode 100644
index 0000000..8c02018
--- /dev/null
+++ b/pkg/imp/service.go
@@ -0,0 +1,77 @@
+package imp
+
+import (
+	"context"
+
+	log "github.com/echocat/slf4g"
+
+	"github.com/engity-com/bifroest/internal/imp/protocol"
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/crypto"
+	bnet "github.com/engity-com/bifroest/pkg/net"
+)
+
+const (
+	ServicePort = 8683
+)
+
+type Service struct {
+	Version         common.Version
+	Addr            string
+	MasterPublicKey crypto.PublicKey
+
+	Logger log.Logger
+}
+
+func (this *Service) Serve(ctx context.Context) error {
+	fail := func(err error) error {
+		return err
+	}
+
+	instance, err := this.createInstance()
+	if err != nil {
+		return fail(err)
+	}
+
+	if err := instance.serve(ctx); err != nil && !bnet.IsClosedError(err) {
+		return fail(err)
+	}
+	return nil
+}
+
+func (this *Service) createInstance() (*service, error) {
+	result := service{
+		Service: this,
+	}
+
+	result.imp.Addr = this.Addr
+	result.imp.MasterPublicKey = this.MasterPublicKey
+	result.imp.Logger = this.logger()
+
+	return &result, nil
+}
+
+func (this *Service) logger() log.Logger {
+	if v := this.Logger; v != nil {
+		return v
+	}
+	return log.GetLogger("service")
+}
+
+type service struct {
+	*Service
+
+	imp protocol.Imp
+}
+
+func (this *service) serve(ctx context.Context) error {
+	fail := func(err error) error {
+		return err
+	}
+
+	if err := this.imp.Serve(ctx); err != nil {
+		return fail(err)
+	}
+
+	return nil
+}
diff --git a/pkg/imp/session.go b/pkg/imp/session.go
new file mode 100644
index 0000000..279cb8b
--- /dev/null
+++ b/pkg/imp/session.go
@@ -0,0 +1,19 @@
+package imp
+
+import (
+	"context"
+	"io"
+	"net"
+
+	"github.com/engity-com/bifroest/pkg/connection"
+	"github.com/engity-com/bifroest/pkg/sys"
+)
+
+type Session interface {
+	io.Closer
+	Echo(ctx context.Context, connectionId connection.Id, in string) (out string, _ error)
+	InitiateDirectTcp(ctx context.Context, connectionId connection.Id, host string, port uint32) (net.Conn, error)
+	InitiateAgentForward(ctx context.Context, connectionId connection.Id) (_ net.Conn, socketPath string, _ error)
+	Kill(ctx context.Context, connectionId connection.Id, pid int, signal sys.Signal) error
+	Exit(ctx context.Context, connectionId connection.Id, exitCode int) error
+}
diff --git a/pkg/logging/eventlog_windows.go b/pkg/logging/eventlog_windows.go
new file mode 100644
index 0000000..523badf
--- /dev/null
+++ b/pkg/logging/eventlog_windows.go
@@ -0,0 +1,3 @@
+//go:build windows
+
+package logging
diff --git a/pkg/logging/flags.go b/pkg/logging/flags.go
new file mode 100644
index 0000000..74fbd11
--- /dev/null
+++ b/pkg/logging/flags.go
@@ -0,0 +1,60 @@
+package logging
+
+import (
+	"os"
+	"strings"
+
+	"github.com/alecthomas/kingpin/v2"
+	log "github.com/echocat/slf4g"
+	"github.com/echocat/slf4g/level"
+	"github.com/echocat/slf4g/native"
+	"github.com/echocat/slf4g/native/consumer"
+	"github.com/echocat/slf4g/native/facade/value"
+
+	"github.com/engity-com/bifroest/pkg/common"
+)
+
+type LogProvider interface {
+	log.Provider
+	value.ProviderTarget
+	level.NamesAware
+}
+
+func ConfigureLoggingForFlags(app *kingpin.Application, of LogProvider) {
+	native.DefaultProvider.Consumer = consumer.NewWriter(os.Stderr)
+
+	lv := value.NewProvider(of)
+	app.Flag("log.level", "Defines the minimum level at which the log messages will be logged. Default: "+lv.Level.String()).
+		PlaceHolder("<" + strings.Join(logLevelStrings(of), "|") + ">").
+		SetValue(lv.Level)
+	app.Flag("log.format", "In which format the log output should be printed. Default: "+lv.Consumer.Formatter.String()).
+		PlaceHolder("<" + strings.Join(logFormatStrings(), "|") + ">").
+		SetValue(lv.Consumer.Formatter)
+	app.Flag("log.colorMode", "Tells if to log in color or not. Default: "+lv.Consumer.Formatter.ColorMode.String()).
+		PlaceHolder("<auto|always|never>").
+		SetValue(lv.Consumer.Formatter.ColorMode)
+}
+
+func logLevelStrings(of LogProvider) []string {
+	names := of.GetLevelNames()
+
+	lvls := of.GetAllLevels()
+	all := make([]string, len(lvls))
+	for i, lvl := range lvls {
+		name, err := names.ToName(lvl)
+		common.Must(err)
+		all[i] = name
+	}
+	return all
+}
+
+func logFormatStrings() []string {
+	codecs := value.DefaultFormatterCodec.(value.MappingFormatterCodec)
+	all := make([]string, len(codecs))
+	var i int
+	for k := range codecs {
+		all[i] = k
+		i++
+	}
+	return all
+}
diff --git a/pkg/logging/wel/event.go b/pkg/logging/wel/event.go
new file mode 100644
index 0000000..38bd111
--- /dev/null
+++ b/pkg/logging/wel/event.go
@@ -0,0 +1,69 @@
+//go:build windows
+
+package wel
+
+import (
+	log "github.com/echocat/slf4g"
+	"github.com/echocat/slf4g/fields"
+	"github.com/echocat/slf4g/level"
+)
+
+type event struct {
+	provider *Provider
+	fields   fields.Fields
+	level    level.Level
+}
+
+func (instance *event) ForEach(consumer func(key string, value interface{}) error) error {
+	return instance.fields.ForEach(consumer)
+}
+
+func (instance *event) Get(key string) (interface{}, bool) {
+	return instance.fields.Get(key)
+}
+
+func (instance *event) Len() int {
+	return instance.fields.Len()
+}
+
+func (instance *event) GetLevel() level.Level {
+	return instance.level
+}
+
+func (instance *event) With(key string, value interface{}) log.Event {
+	return instance.with(func(s fields.Fields) fields.Fields {
+		return s.With(key, value)
+	})
+}
+
+func (instance *event) Withf(key string, format string, args ...interface{}) log.Event {
+	return instance.with(func(s fields.Fields) fields.Fields {
+		return s.Withf(key, format, args...)
+	})
+}
+
+func (instance *event) WithError(err error) log.Event {
+	return instance.with(func(s fields.Fields) fields.Fields {
+		return s.With(instance.provider.GetFieldKeysSpec().GetError(), err)
+	})
+}
+
+func (instance *event) WithAll(of map[string]interface{}) log.Event {
+	return instance.with(func(s fields.Fields) fields.Fields {
+		return s.WithAll(of)
+	})
+}
+
+func (instance *event) Without(keys ...string) log.Event {
+	return instance.with(func(s fields.Fields) fields.Fields {
+		return s.Without(keys...)
+	})
+}
+
+func (instance *event) with(mod func(fields.Fields) fields.Fields) log.Event {
+	return &event{
+		provider: instance.provider,
+		fields:   mod(instance.fields),
+		level:    instance.level,
+	}
+}
diff --git a/pkg/logging/wel/logger_core.go b/pkg/logging/wel/logger_core.go
new file mode 100644
index 0000000..6149fc3
--- /dev/null
+++ b/pkg/logging/wel/logger_core.go
@@ -0,0 +1,158 @@
+//go:build windows
+
+package wel
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"unicode"
+
+	"github.com/echocat/slf4g/fields"
+
+	log "github.com/echocat/slf4g"
+	"github.com/echocat/slf4g/level"
+)
+
+// RootLoggerName specifies the name of the root version of coreLogger
+// instances which are managed by Provider.
+const RootLoggerName = "ROOT"
+
+type coreLogger struct {
+	*Provider
+}
+
+// Log implements log.CoreLogger#Log(event).
+func (instance *coreLogger) Log(event log.Event, skipFrames uint16) {
+	instance.log(instance.GetName(), event, skipFrames+1)
+}
+
+func (instance *coreLogger) log(loggerName string, event log.Event, _ uint16) {
+	l := event.GetLevel()
+	if !instance.IsLevelEnabled(l) {
+		return
+	}
+
+	if v := log.GetLoggerOf(event, instance); v == nil {
+		event = event.With(instance.GetFieldKeysSpec().GetLogger(), loggerName)
+	}
+
+	if l >= level.Error {
+		_ = instance.base.Error(1, instance.format(event))
+	} else {
+		_ = instance.base.Info(0, instance.format(event))
+	}
+}
+
+// IsLevelEnabled implements log.CoreLogger#IsLevelEnabled()
+func (instance *coreLogger) IsLevelEnabled(v level.Level) bool {
+	return instance.GetLevel().CompareTo(v) <= 0
+}
+
+// GetName implements log.CoreLogger#GetName()
+func (instance *coreLogger) GetName() string {
+	return RootLoggerName
+}
+
+// GetProvider implements log.CoreLogger#GetProvider()
+func (instance *coreLogger) GetProvider() log.Provider {
+	return instance.Provider
+}
+
+func (instance *coreLogger) NewEvent(l level.Level, values map[string]interface{}) log.Event {
+	return instance.NewEventWithFields(l, fields.WithAll(values))
+}
+
+func (instance *coreLogger) NewEventWithFields(l level.Level, f fields.ForEachEnabled) log.Event {
+	asFields, err := fields.AsFields(f)
+	if err != nil {
+		panic(err)
+	}
+	return &event{
+		provider: instance.Provider,
+		fields:   asFields,
+		level:    l,
+	}
+}
+
+func (instance *coreLogger) Accepts(e log.Event) bool {
+	return e != nil
+}
+
+func (instance *coreLogger) format(event log.Event) string {
+	buf := new(bytes.Buffer)
+
+	_, _ = buf.WriteString(instance.formatLevel(event.GetLevel()))
+	_, _ = buf.WriteString(instance.formatMessage(event))
+	messageKey := instance.GetFieldKeysSpec().GetMessage()
+	loggerKey := instance.GetFieldKeysSpec().GetLogger()
+	timestampKey := instance.GetFieldKeysSpec().GetTimestamp()
+	if err := fields.SortedForEach(event, nil, func(k string, vp interface{}) error {
+		if vl, ok := vp.(fields.Filtered); ok {
+			fv, shouldBeRespected := vl.Filter(event)
+			if !shouldBeRespected {
+				return nil
+			}
+			vp = fv
+		} else if vl, ok := vp.(fields.Lazy); ok {
+			vp = vl.Get()
+		}
+		if vp == fields.Exclude {
+			return nil
+		}
+
+		if k == loggerKey && vp == RootLoggerName {
+			return nil
+		}
+		if k == messageKey || k == timestampKey {
+			return nil
+		}
+		v, err := instance.formatValue(vp)
+		if err != nil {
+			return err
+		}
+
+		_ = buf.WriteByte(' ')
+		_, _ = buf.WriteString(k)
+		_ = buf.WriteByte('=')
+		_, _ = buf.Write(v)
+		return nil
+	}); err != nil {
+		_ = instance.base.Error(1123, fmt.Sprintf("Cannot format event %v: %v", event, err))
+		return ""
+	}
+
+	return buf.String()
+}
+
+func (instance *coreLogger) formatLevel(l level.Level) string {
+	return "[" + instance.getLevelFormatter().Format(l) + "]"
+}
+
+func (instance *coreLogger) formatMessage(event log.Event) string {
+	var message string
+	if v := log.GetMessageOf(event, instance); v != nil {
+		message = *v
+
+		message = strings.TrimLeftFunc(message, func(r rune) bool {
+			return r == '\r' || r == '\n'
+		})
+		message = strings.TrimRightFunc(message, unicode.IsSpace)
+		message = strings.TrimFunc(message, func(r rune) bool {
+			return r == '\r' || !unicode.IsGraphic(r)
+		})
+		message = strings.ReplaceAll(message, "\n", "\u23CE")
+		if message != "" {
+			message = " " + message
+		}
+	}
+	return message
+}
+
+func (instance *coreLogger) formatValue(v interface{}) ([]byte, error) {
+	if ve, ok := v.(error); ok {
+		v = ve.Error()
+	}
+	return json.Marshal(v)
+}
diff --git a/pkg/logging/wel/logger_renamed.go b/pkg/logging/wel/logger_renamed.go
new file mode 100644
index 0000000..cb869d0
--- /dev/null
+++ b/pkg/logging/wel/logger_renamed.go
@@ -0,0 +1,20 @@
+//go:build windows
+
+package wel
+
+import log "github.com/echocat/slf4g"
+
+type coreLoggerRenamed struct {
+	*coreLogger
+	name string
+}
+
+// Log implements log.CoreLogger#Log(event).
+func (instance *coreLoggerRenamed) Log(event log.Event, skipFrames uint16) {
+	instance.log(instance.name, event, skipFrames+1)
+}
+
+// GetName implements log.CoreLogger#GetName().
+func (instance *coreLoggerRenamed) GetName() string {
+	return instance.name
+}
diff --git a/pkg/logging/wel/provider.go b/pkg/logging/wel/provider.go
new file mode 100644
index 0000000..326c729
--- /dev/null
+++ b/pkg/logging/wel/provider.go
@@ -0,0 +1,86 @@
+//go:build windows
+
+package wel
+
+import (
+	"sync"
+	_ "unsafe"
+
+	log "github.com/echocat/slf4g"
+	"github.com/echocat/slf4g/fields"
+	"github.com/echocat/slf4g/level"
+	tlevel "github.com/echocat/slf4g/sdk/testlog/level"
+	"golang.org/x/sys/windows/svc/eventlog"
+)
+
+// NewProvider creates a new instance of Provider which is ready to use.
+func NewProvider(name string, base *eventlog.Log, level level.Level) *Provider {
+	result := &Provider{name: name, base: base, level: level}
+
+	return result
+}
+
+// Provider is an implementation of log.Provider which ensures that everything is
+// logged using testing.TB#Log(). Use NewProvider(..) to get a new instance.
+type Provider struct {
+	base  *eventlog.Log
+	name  string
+	level level.Level
+
+	coreLogger *coreLogger
+	logger     log.Logger
+	initLogger sync.Once
+}
+
+func (instance *Provider) initIfRequired() {
+	instance.initLogger.Do(func() {
+		instance.coreLogger = &coreLogger{instance}
+		instance.logger = log.NewLogger(instance.coreLogger)
+	})
+}
+
+// GetRootLogger implements log.Provider#GetRootLogger()
+func (instance *Provider) GetRootLogger() log.Logger {
+	instance.initIfRequired()
+	return instance.logger
+}
+
+// GetLogger implements log.Provider#GetLogger()
+func (instance *Provider) GetLogger(name string) log.Logger {
+	if name == RootLoggerName {
+		return instance.GetRootLogger()
+	}
+
+	instance.initIfRequired()
+	return log.NewLogger(&coreLoggerRenamed{instance.coreLogger, name})
+}
+
+// GetName implements log.Provider#GetName()
+func (instance *Provider) GetName() string {
+	return instance.name
+}
+
+// GetAllLevels implements log.Provider#GetAllLevels()
+func (instance *Provider) GetAllLevels() level.Levels {
+	return level.GetProvider().GetLevels()
+}
+
+// GetFieldKeysSpec implements log.Provider#GetFieldKeysSpec()
+func (instance *Provider) GetFieldKeysSpec() fields.KeysSpec {
+	return &fields.KeysSpecImpl{}
+}
+
+// GetLevel returns the current level.Level where this log.Provider is set to.
+func (instance *Provider) GetLevel() level.Level {
+	return instance.level
+}
+
+// SetLevel changes the current level.Level of this log.Provider. If set to
+// 0 it will force this Provider to use DefaultLevel.
+func (instance *Provider) SetLevel(v level.Level) {
+	instance.level = v
+}
+
+func (instance *Provider) getLevelFormatter() tlevel.Formatter {
+	return tlevel.DefaultFormatter
+}
diff --git a/pkg/net/errors.go b/pkg/net/errors.go
new file mode 100644
index 0000000..8d12282
--- /dev/null
+++ b/pkg/net/errors.go
@@ -0,0 +1,32 @@
+package net
+
+import (
+	"io"
+	"net"
+
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+func IsClosedError(err error) bool {
+	if err == nil {
+		return false
+	}
+
+	if errors.Is(err, io.ErrClosedPipe) || errors.Is(err, io.EOF) {
+		return true
+	}
+
+	if isClosedError(err) {
+		return true
+	}
+
+	var noe *net.OpError
+	if errors.As(err, &noe) && noe.Err != nil {
+		switch noe.Err.Error() {
+		case "use of closed network connection":
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/pkg/net/errors_unix.go b/pkg/net/errors_unix.go
new file mode 100644
index 0000000..299d90e
--- /dev/null
+++ b/pkg/net/errors_unix.go
@@ -0,0 +1,7 @@
+//go:build unix
+
+package net
+
+func isClosedError(err error) bool {
+	return false
+}
diff --git a/pkg/net/errors_windows.go b/pkg/net/errors_windows.go
new file mode 100644
index 0000000..40c7f37
--- /dev/null
+++ b/pkg/net/errors_windows.go
@@ -0,0 +1,24 @@
+//go:build windows
+
+package net
+
+import (
+	"os"
+
+	"golang.org/x/sys/windows"
+
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+func isClosedError(err error) bool {
+	var sce *os.SyscallError
+	if errors.As(err, &sce) && sce.Err != nil {
+		switch sce.Err {
+		case windows.WSAECONNRESET, windows.WSAECONNABORTED:
+			return true
+		}
+	}
+
+	return false
+
+}
diff --git a/pkg/net/host-port.go b/pkg/net/host-port.go
new file mode 100644
index 0000000..4a91950
--- /dev/null
+++ b/pkg/net/host-port.go
@@ -0,0 +1,148 @@
+package net
+
+import (
+	"bytes"
+	"strconv"
+	"strings"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+func NewHostPort(in string) (result HostPort, err error) {
+	err = result.Set(in)
+	return
+}
+
+func MustNewHostPort(in string) HostPort {
+	result, err := NewHostPort(in)
+	common.Must(err)
+	return result
+}
+
+type HostPort struct {
+	Host Host
+	Port uint16
+}
+
+func (this HostPort) String() string {
+	host := this.Host.String()
+	if host == "" && this.Port == 0 {
+		return ""
+	}
+
+	if strings.IndexByte(host, ':') >= 0 {
+		host = "[" + host + "]"
+	}
+
+	return host + ":" + strconv.FormatUint(uint64(this.Port), 10)
+}
+
+func (this HostPort) MarshalText() ([]byte, error) {
+	if err := this.Validate(); err != nil {
+		return nil, err
+	}
+
+	host, err := this.Host.MarshalText()
+	if err != nil {
+		return nil, err
+	}
+	if len(host) == 0 && this.Port == 0 {
+		return []byte{}, nil
+	}
+	port := []byte(strconv.FormatUint(uint64(this.Port), 10))
+
+	if bytes.IndexByte(host, ':') >= 0 {
+		host = bytes.Join([][]byte{{'['}, host, {']'}}, nil)
+	}
+	return bytes.Join([][]byte{host, port}, []byte{':'}), nil
+}
+
+func (this *HostPort) UnmarshalText(in []byte) error {
+	if len(in) == 0 {
+		*this = HostPort{}
+		return nil
+	}
+
+	var buf HostPort
+
+	var hostPart, portPart []byte
+	if in[0] == '[' {
+		n := bytes.IndexByte(in, ']')
+		if n == -1 || len(in) < n+2 || in[n+1] != ':' {
+			return errors.Config.Newf("illegal host-port: %s", string(in))
+		}
+		hostPart = in[1:n]
+		portPart = in[n+2:]
+	} else {
+		n := bytes.IndexByte(in, ':')
+		if n == -1 || len(in) < n+1 {
+			return errors.Config.Newf("illegal host-port: %s", string(in))
+		}
+		hostPart = in[:n]
+		portPart = in[n+1:]
+	}
+	if bytes.IndexByte(portPart, ':') >= 0 {
+		return errors.Config.Newf("illegal host-port: %s", string(in))
+	}
+
+	if err := buf.Host.UnmarshalText(hostPart); err != nil {
+		return errors.Config.Newf("illegal host-port: %w", err)
+	}
+	port, err := strconv.ParseUint(string(portPart), 10, 16)
+	if err != nil {
+		return errors.System.Newf("illegal host-port: invalid port %s", string(portPart))
+	}
+	if port == 0 {
+		return errors.System.Newf("illegal host-port: invalid port %d", port)
+	}
+	buf.Port = uint16(port)
+
+	*this = buf
+	return nil
+}
+
+func (this *HostPort) Set(in string) error {
+	return this.UnmarshalText([]byte(in))
+}
+
+func (this HostPort) Clone() HostPort {
+	return HostPort{
+		this.Host.Clone(),
+		this.Port,
+	}
+}
+
+func (this HostPort) IsZero() bool {
+	return this.Host.IsZero() &&
+		this.Port == 0
+}
+
+func (this HostPort) Validate() error {
+	if err := this.Host.Validate(); err != nil {
+		return errors.Config.Newf("illegal host-port: %w", err)
+	}
+	if (!this.Host.IsZero() && this.Port == 0) || (this.Host.IsZero() && this.Port > 0) {
+		return errors.Config.Newf("illegal host-port: %v", this)
+	}
+	return nil
+}
+
+func (this HostPort) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case HostPort:
+		return this.isEqualTo(&v)
+	case *HostPort:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this HostPort) isEqualTo(other *HostPort) bool {
+	return this.Host.IsEqualTo(other.Host) &&
+		this.Port == other.Port
+}
diff --git a/pkg/net/host-port_test.go b/pkg/net/host-port_test.go
new file mode 100644
index 0000000..cdab5cc
--- /dev/null
+++ b/pkg/net/host-port_test.go
@@ -0,0 +1,208 @@
+package net
+
+import (
+	"fmt"
+	gonet "net"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewHostPort(t *testing.T) {
+	cases := []struct {
+		in          string
+		expected    HostPort
+		expectedErr string
+	}{{
+		in:       "127.0.0.1:8080",
+		expected: HostPort{MustNewHost("127.0.0.1"), 8080},
+	}, {
+		in:       "foo:8080",
+		expected: HostPort{MustNewHost("foo"), 8080},
+	}, {
+		in:       "[::1]:8080",
+		expected: HostPort{MustNewHost("::1"), 8080},
+	}, {
+		in:          "127.0.0::8080",
+		expectedErr: `illegal host-port: 127.0.0::8080`,
+	}, {
+		in:          "127.0.0.1:8o80",
+		expectedErr: `illegal host-port: invalid port 8o80`,
+	}, {
+		in:          "127.0.0.1:0",
+		expectedErr: `illegal host-port: invalid port 0`,
+	}, {
+		in:          "[::1:8080",
+		expectedErr: `illegal host-port: [::1:8080`,
+	}, {
+		in:          "::1:8080",
+		expectedErr: `illegal host-port: ::1:8080`,
+	}, {
+		in:          "foo",
+		expectedErr: `illegal host-port: foo`,
+	}, {
+		in:       "",
+		expected: HostPort{},
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in, func(t *testing.T) {
+			actual, actualErr := NewHostPort(c.in)
+			if expected := c.expectedErr; expected != "" {
+				require.EqualError(t, actualErr, expected)
+			} else {
+				require.NoError(t, actualErr)
+				require.Equal(t, c.expected, actual)
+			}
+		})
+	}
+}
+
+func TestHostPort_String_and_MarshalText(t *testing.T) {
+	cases := []struct {
+		in          HostPort
+		expectedS   string
+		expectedB   string
+		expectedErr string
+	}{{
+		in:        HostPort{Host{IP: gonet.IPv4(127, 0, 0, 1)}, 8080},
+		expectedS: "127.0.0.1:8080",
+		expectedB: "127.0.0.1:8080",
+	}, {
+		in:        HostPort{Host{IP: gonet.IPv6loopback}, 8080},
+		expectedS: "[::1]:8080",
+		expectedB: "[::1]:8080",
+	}, {
+		in:          HostPort{Host{IP: []byte{1, 2, 3}}, 8080},
+		expectedS:   "?010203:8080",
+		expectedErr: "illegal host-port: illegal IP address: ?010203",
+	}, {
+		in:        HostPort{Host{Dns: "foo"}, 8080},
+		expectedS: "foo:8080",
+		expectedB: "foo:8080",
+	}, {
+		in:        HostPort{},
+		expectedS: "",
+		expectedB: "",
+	}}
+
+	for i, c := range cases {
+		t.Run(fmt.Sprintf("c%d", i), func(t *testing.T) {
+			{
+				actual := c.in.String()
+				require.Equal(t, c.expectedS, actual)
+			}
+			{
+				actual, actualErr := c.in.MarshalText()
+				if expected := c.expectedErr; expected != "" {
+					require.EqualError(t, actualErr, expected)
+				} else {
+					require.NoError(t, actualErr)
+					require.Equal(t, []byte(c.expectedB), actual)
+				}
+			}
+		})
+	}
+}
+
+func TestHostPort_IsZero(t *testing.T) {
+	cases := []struct {
+		in       HostPort
+		expected bool
+	}{{
+		in:       HostPort{MustNewHost("127.0.0.1"), 8080},
+		expected: false,
+	}, {
+		in:       HostPort{Host: MustNewHost("127.0.0.1")},
+		expected: false,
+	}, {
+		in:       HostPort{Port: 8080},
+		expected: false,
+	}, {
+		in:       HostPort{},
+		expected: true,
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in.String(), func(t *testing.T) {
+			actual := c.in.IsZero()
+			require.Equal(t, c.expected, actual)
+		})
+	}
+}
+
+func TestHostPort_Validate(t *testing.T) {
+	cases := []struct {
+		in       HostPort
+		expected string
+	}{{
+		in:       HostPort{MustNewHost("127.0.0.1"), 8080},
+		expected: "",
+	}, {
+		in:       HostPort{Host: MustNewHost("127.0.0.1")},
+		expected: "illegal host-port: 127.0.0.1:0",
+	}, {
+		in:       HostPort{Port: 8080},
+		expected: "illegal host-port: :8080",
+	}, {
+		in:       HostPort{},
+		expected: "",
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in.String(), func(t *testing.T) {
+			actual := c.in.Validate()
+			if expected := c.expected; expected != "" {
+				require.EqualError(t, actual, expected)
+			} else {
+				require.NoError(t, actual)
+			}
+		})
+	}
+}
+
+func TestHostPort_Clone(t *testing.T) {
+	cases := []struct {
+		in HostPort
+	}{{
+		in: HostPort{MustNewHost("127.0.0.1"), 8080},
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in.String(), func(t *testing.T) {
+			actual := c.in.Clone()
+			require.Equal(t, c.in, actual)
+		})
+	}
+}
+
+func TestHostPort_IsEqualTo(t *testing.T) {
+	cases := []struct {
+		left     HostPort
+		right    HostPort
+		expected bool
+	}{{
+		left:     HostPort{MustNewHost("127.0.0.1"), 8080},
+		right:    HostPort{MustNewHost("127.0.0.1"), 8080},
+		expected: true,
+	}, {
+		left:     HostPort{MustNewHost("127.0.0.1"), 8080},
+		right:    HostPort{MustNewHost("127.0.0."), 8080},
+		expected: false,
+	}, {
+		left:     HostPort{MustNewHost("127.0.0.1"), 8080},
+		right:    HostPort{MustNewHost("127.0.0.1"), 808},
+		expected: false,
+	}, {
+		left:     HostPort{},
+		right:    HostPort{},
+		expected: true,
+	}}
+
+	for _, c := range cases {
+		t.Run(c.left.String()+"="+c.right.String(), func(t *testing.T) {
+			actual := c.left.IsEqualTo(c.right)
+			require.Equal(t, c.expected, actual)
+		})
+	}
+}
diff --git a/pkg/net/host.go b/pkg/net/host.go
index 0520f0f..05cdb97 100644
--- a/pkg/net/host.go
+++ b/pkg/net/host.go
@@ -2,11 +2,24 @@ package net
 
 import (
 	"bytes"
-	"errors"
 	"net"
 	"strings"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/errors"
 )
 
+func NewHost(in string) (result Host, err error) {
+	err = result.Set(in)
+	return
+}
+
+func MustNewHost(in string) Host {
+	result, err := NewHost(in)
+	common.Must(err)
+	return result
+}
+
 type Host struct {
 	IP  net.IP
 	Dns string
@@ -16,7 +29,7 @@ func (this Host) String() string {
 	if v := this.IP; len(v) != 0 {
 		return v.String()
 	}
-	return this.Dns
+	return strings.Clone(this.Dns)
 }
 
 func (this Host) MarshalText() ([]byte, error) {
@@ -48,19 +61,31 @@ func (this *Host) Set(in string) error {
 func (this *Host) SetNetAddr(in net.Addr) error {
 	switch t := in.(type) {
 	case *net.IPNet:
+		if len(t.IP) == 0 {
+			return errors.Config.Newf("invalid address with empty IP")
+		}
 		*this = Host{IP: t.IP}
 		return nil
 	case *net.IPAddr:
+		if len(t.IP) == 0 {
+			return errors.Config.Newf("invalid address with empty IP")
+		}
 		*this = Host{IP: t.IP}
 		return nil
 	case *net.TCPAddr:
+		if len(t.IP) == 0 {
+			return errors.Config.Newf("invalid address with empty IP")
+		}
 		*this = Host{IP: t.IP}
 		return nil
 	case *net.UDPAddr:
+		if len(t.IP) == 0 {
+			return errors.Config.Newf("invalid address with empty IP")
+		}
 		*this = Host{IP: t.IP}
 		return nil
 	default:
-		return errors.New("invalid address type")
+		return errors.Config.Newf("invalid address type: %v", in)
 	}
 }
 
@@ -71,3 +96,43 @@ func (this Host) Clone() Host {
 
 	return Host{Dns: strings.Clone(this.Dns)}
 }
+
+func (this Host) WithPort(port uint16) (HostPort, error) {
+	result := HostPort{this, port}
+	if err := result.Validate(); err != nil {
+		return HostPort{}, err
+	}
+	return result, nil
+}
+
+func (this Host) IsZero() bool {
+	return len(this.IP) == 0 && this.Dns == ""
+}
+
+func (this Host) Validate() error {
+	switch len(this.IP) {
+	case net.IPv4len, net.IPv6len, 0:
+		return nil
+	default:
+		return errors.Config.Newf("illegal IP address: %v", this.IP)
+	}
+}
+
+func (this Host) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case Host:
+		return this.isEqualTo(&v)
+	case *Host:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this Host) isEqualTo(other *Host) bool {
+	return net.IP.Equal(this.IP, other.IP) &&
+		this.Dns == other.Dns
+}
diff --git a/pkg/net/host_test.go b/pkg/net/host_test.go
new file mode 100644
index 0000000..d9446b6
--- /dev/null
+++ b/pkg/net/host_test.go
@@ -0,0 +1,284 @@
+package net
+
+import (
+	"fmt"
+	gonet "net"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewHost(t *testing.T) {
+	cases := []struct {
+		in          string
+		expected    Host
+		expectedErr string
+	}{{
+		in:       "127.0.0.1",
+		expected: Host{IP: gonet.IPv4(127, 0, 0, 1)},
+	}, {
+		in:       "foo",
+		expected: Host{Dns: "foo"},
+	}, {
+		in:       "::1",
+		expected: Host{IP: gonet.IPv6loopback},
+	}, {
+		in:       "",
+		expected: Host{},
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in, func(t *testing.T) {
+			actual, actualErr := NewHost(c.in)
+			if expected := c.expectedErr; expected != "" {
+				require.EqualError(t, actualErr, expected)
+			} else {
+				require.NoError(t, actualErr)
+				require.Equal(t, c.expected, actual)
+			}
+		})
+	}
+}
+
+func TestHost_SetNetAddr(t *testing.T) {
+	cases := []struct {
+		in          gonet.Addr
+		expected    Host
+		expectedErr string
+	}{{
+		in:       &gonet.IPNet{IP: gonet.IPv4(1, 2, 3, 4)},
+		expected: Host{IP: gonet.IPv4(1, 2, 3, 4)},
+	}, {
+		in:          &gonet.IPNet{},
+		expectedErr: "invalid address with empty IP",
+	}, {
+		in:       &gonet.IPAddr{IP: gonet.IPv4(1, 2, 3, 4)},
+		expected: Host{IP: gonet.IPv4(1, 2, 3, 4)},
+	}, {
+		in:          &gonet.IPAddr{},
+		expectedErr: "invalid address with empty IP",
+	}, {
+		in:       &gonet.TCPAddr{IP: gonet.IPv4(1, 2, 3, 4)},
+		expected: Host{IP: gonet.IPv4(1, 2, 3, 4)},
+	}, {
+		in:          &gonet.TCPAddr{},
+		expectedErr: "invalid address with empty IP",
+	}, {
+		in:       &gonet.UDPAddr{IP: gonet.IPv4(1, 2, 3, 4)},
+		expected: Host{IP: gonet.IPv4(1, 2, 3, 4)},
+	}, {
+		in:          &gonet.UDPAddr{},
+		expectedErr: "invalid address with empty IP",
+	}, {
+		in: &gonet.UnixAddr{
+			Name: "foo",
+			Net:  "bar",
+		},
+		expectedErr: "invalid address type: foo",
+	}, {
+		in:          nil,
+		expectedErr: "invalid address type: <nil>",
+	}}
+
+	for _, c := range cases {
+		t.Run(fmt.Sprint(c.in), func(t *testing.T) {
+			var instance Host
+			actualErr := instance.SetNetAddr(c.in)
+			if expected := c.expectedErr; expected != "" {
+				require.EqualError(t, actualErr, expected)
+			} else {
+				require.NoError(t, actualErr)
+				require.Equal(t, c.expected, instance)
+			}
+		})
+	}
+}
+
+func TestHost_WithPort(t *testing.T) {
+	cases := []struct {
+		host        Host
+		port        uint16
+		expected    HostPort
+		expectedErr string
+	}{{
+		host:     MustNewHost("127.0.0.1"),
+		port:     8080,
+		expected: HostPort{MustNewHost("127.0.0.1"), 8080},
+	}, {
+		host:     MustNewHost("foo"),
+		port:     8080,
+		expected: HostPort{MustNewHost("foo"), 8080},
+	}, {
+		host:        MustNewHost("foo"),
+		port:        0,
+		expectedErr: "illegal host-port: foo:0",
+	}}
+
+	for _, c := range cases {
+		t.Run(fmt.Sprintf("%v:%d", c.host, c.port), func(t *testing.T) {
+			actual, actualErr := c.host.WithPort(c.port)
+			if expected := c.expectedErr; expected != "" {
+				require.EqualError(t, actualErr, expected)
+			} else {
+				require.NoError(t, actualErr)
+				require.Equal(t, c.expected, actual)
+			}
+		})
+	}
+}
+
+func TestHost_String_and_MarshalText(t *testing.T) {
+	cases := []struct {
+		in          Host
+		expectedS   string
+		expectedB   string
+		expectedErr string
+	}{{
+		in:        Host{IP: gonet.IPv4(127, 0, 0, 1)},
+		expectedS: "127.0.0.1",
+		expectedB: "127.0.0.1",
+	}, {
+		in:        Host{IP: gonet.IPv6loopback},
+		expectedS: "::1",
+		expectedB: "::1",
+	}, {
+		in:          Host{IP: []byte{1, 2, 3}},
+		expectedS:   "?010203",
+		expectedErr: "address 010203: invalid IP address",
+	}, {
+		in:        Host{Dns: "foo"},
+		expectedS: "foo",
+		expectedB: "foo",
+	}, {
+		in:        Host{},
+		expectedS: "",
+		expectedB: "",
+	}}
+
+	for i, c := range cases {
+		t.Run(fmt.Sprintf("c%d", i), func(t *testing.T) {
+			{
+				actual := c.in.String()
+				require.Equal(t, c.expectedS, actual)
+			}
+			{
+				actual, actualErr := c.in.MarshalText()
+				if expected := c.expectedErr; expected != "" {
+					require.EqualError(t, actualErr, expected)
+				} else {
+					require.NoError(t, actualErr)
+					require.Equal(t, []byte(c.expectedB), actual)
+				}
+			}
+		})
+	}
+}
+
+func TestHost_IsZero(t *testing.T) {
+	cases := []struct {
+		in       Host
+		expected bool
+	}{{
+		in:       Host{IP: gonet.IPv4(127, 0, 0, 1)},
+		expected: false,
+	}, {
+		in:       Host{Dns: "foo"},
+		expected: false,
+	}, {
+		in:       Host{},
+		expected: true,
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in.String(), func(t *testing.T) {
+			actual := c.in.IsZero()
+			require.Equal(t, c.expected, actual)
+		})
+	}
+}
+
+func TestHost_Validate(t *testing.T) {
+	cases := []struct {
+		in       Host
+		expected string
+	}{{
+		in:       Host{IP: gonet.IPv4(127, 0, 0, 1)},
+		expected: "",
+	}, {
+		in:       Host{Dns: "foo"},
+		expected: "",
+	}, {
+		in:       Host{IP: []byte{1, 2, 3}},
+		expected: "illegal IP address: ?010203",
+	}, {
+		in:       Host{},
+		expected: "",
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in.String(), func(t *testing.T) {
+			actual := c.in.Validate()
+			if expected := c.expected; expected != "" {
+				require.EqualError(t, actual, expected)
+			} else {
+				require.NoError(t, actual)
+			}
+		})
+	}
+}
+
+func TestHost_Clone(t *testing.T) {
+	cases := []struct {
+		in Host
+	}{{
+		in: Host{IP: gonet.IPv4(127, 0, 0, 1)},
+	}, {
+		in: Host{Dns: "foo"},
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in.String(), func(t *testing.T) {
+			actual := c.in.Clone()
+			require.Equal(t, c.in, actual)
+		})
+	}
+}
+
+func TestHost_IsEqualTo(t *testing.T) {
+	cases := []struct {
+		left     Host
+		right    Host
+		expected bool
+	}{{
+		left:     Host{IP: gonet.IPv4(127, 0, 0, 1)},
+		right:    Host{IP: gonet.IPv4(127, 0, 0, 1)},
+		expected: true,
+	}, {
+		left:     Host{IP: gonet.IPv4(127, 0, 0, 1)},
+		right:    Host{IP: gonet.IPv4(127, 0, 0, 2)},
+		expected: false,
+	}, {
+		left:     Host{Dns: "foo"},
+		right:    Host{Dns: "foo"},
+		expected: true,
+	}, {
+		left:     Host{Dns: "foo"},
+		right:    Host{Dns: "foo2"},
+		expected: false,
+	}, {
+		left:     Host{IP: gonet.IPv4(127, 0, 0, 1)},
+		right:    Host{Dns: "foo"},
+		expected: false,
+	}, {
+		left:     Host{},
+		right:    Host{},
+		expected: true,
+	}}
+
+	for _, c := range cases {
+		t.Run(c.left.String()+"="+c.right.String(), func(t *testing.T) {
+			actual := c.left.IsEqualTo(c.right)
+			require.Equal(t, c.expected, actual)
+		})
+	}
+}
diff --git a/pkg/net/port-predicate.go b/pkg/net/port-predicate.go
new file mode 100644
index 0000000..117a295
--- /dev/null
+++ b/pkg/net/port-predicate.go
@@ -0,0 +1,191 @@
+package net
+
+import (
+	"bytes"
+	"iter"
+	"strings"
+
+	"github.com/engity-com/bifroest/pkg/common"
+)
+
+func NewPortPredicate(in string) (result PortPredicate, err error) {
+	err = result.Set(in)
+	return
+}
+
+func MustNewPortPredicate(in string) PortPredicate {
+	result, err := NewPortPredicate(in)
+	common.Must(err)
+	return result
+}
+
+type PortPredicate struct {
+	Includes PortRanges
+	Excludes PortRanges
+}
+
+func (this PortPredicate) Test(candidate uint16) bool {
+	if candidate == 0 {
+		return false
+	}
+	if len(this.Includes) > 0 && !this.Includes.Test(candidate) {
+		return false
+	}
+	if len(this.Excludes) > 0 && this.Excludes.Test(candidate) {
+		return false
+	}
+	return true
+}
+
+func (this PortPredicate) iterateIncludes() iter.Seq2[uint16, error] {
+	return func(yield func(uint16, error) bool) {
+		if len(this.Includes) == 0 {
+			for v := uint16(0); v < 65535; v++ {
+				if !yield(v+1, nil) {
+					return
+				}
+			}
+			return
+		}
+
+		for v, err := range this.Includes.Iterate() {
+			if !yield(v, err) {
+				return
+			}
+		}
+	}
+}
+
+func (this PortPredicate) Iterate() iter.Seq2[uint16, error] {
+	return func(yield func(uint16, error) bool) {
+		if err := this.Validate(); err != nil {
+			yield(0, err)
+			return
+		}
+		for v, err := range this.iterateIncludes() {
+			if err != nil {
+				if !yield(v, err) {
+					return
+				}
+				continue
+			}
+
+			if this.Excludes.Test(v) {
+				continue
+			}
+
+			if !yield(v, nil) {
+				return
+			}
+		}
+	}
+}
+
+func (this PortPredicate) String() string {
+	iss := this.Includes.Strings()
+	ess := this.Excludes.Strings()
+	for i, es := range ess {
+		ess[i] = "!" + es
+	}
+	return strings.Join(append(iss, ess...), ",")
+}
+
+func (this PortPredicate) MarshalText() ([]byte, error) {
+	ibs, err := this.Includes.marshalTexts()
+	if err != nil {
+		return nil, err
+	}
+	ebs, err := this.Excludes.marshalTexts()
+	if err != nil {
+		return nil, err
+	}
+	for i, eb := range ebs {
+		ebs[i] = append([]byte("!"), eb...)
+	}
+	return bytes.Join(append(ibs, ebs...), []byte(",")), nil
+}
+
+func (this *PortPredicate) UnmarshalText(in []byte) error {
+	if len(in) == 0 {
+		*this = PortPredicate{}
+		return nil
+	}
+
+	parts := bytes.Split(in, []byte(","))
+	buf := PortPredicate{
+		Includes: make(PortRanges, len(parts)),
+		Excludes: make(PortRanges, len(parts)),
+	}
+	nIncludes, nExcludes := 0, 0
+
+	for _, part := range parts {
+		including := true
+		if len(part) > 0 && part[0] == '!' {
+			part = part[1:]
+			including = false
+		}
+
+		var pr PortRange
+		if err := pr.UnmarshalText(part); err != nil {
+			return err
+		}
+
+		if including {
+			buf.Includes[nIncludes] = pr
+			nIncludes++
+		} else {
+			buf.Excludes[nExcludes] = pr
+			nExcludes++
+		}
+	}
+
+	buf.Includes = buf.Includes[:nIncludes]
+	buf.Excludes = buf.Excludes[:nExcludes]
+
+	*this = buf
+	return nil
+}
+
+func (this *PortPredicate) Set(in string) error {
+	return this.UnmarshalText([]byte(in))
+}
+
+func (this PortPredicate) Clone() PortPredicate {
+	return PortPredicate{
+		Includes: this.Includes.Clone(),
+		Excludes: this.Excludes.Clone(),
+	}
+}
+
+func (this PortPredicate) IsZero() bool {
+	return this.Includes.IsZero() && this.Excludes.IsZero()
+}
+
+func (this PortPredicate) Validate() error {
+	if err := this.Includes.Validate(); err != nil {
+		return err
+	}
+	if err := this.Excludes.Validate(); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (this PortPredicate) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case PortPredicate:
+		return this.isEqualTo(&v)
+	case *PortPredicate:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this PortPredicate) isEqualTo(other *PortPredicate) bool {
+	return this.Includes.isEqualTo(&other.Includes) &&
+		this.Excludes.isEqualTo(&other.Excludes)
+}
diff --git a/pkg/net/port-predicate_test.go b/pkg/net/port-predicate_test.go
new file mode 100644
index 0000000..8270183
--- /dev/null
+++ b/pkg/net/port-predicate_test.go
@@ -0,0 +1,333 @@
+package net
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/engity-com/bifroest/pkg/common"
+)
+
+func TestNewPortPredicate(t *testing.T) {
+	cases := []struct {
+		in          string
+		expected    PortPredicate
+		expectedErr string
+	}{{
+		in:       "",
+		expected: PortPredicate{},
+	}, {
+		in:       "8080",
+		expected: PortPredicate{MustNewPortRanges("8080"), MustNewPortRanges("")},
+	}, {
+		in:       "8080-9090",
+		expected: PortPredicate{MustNewPortRanges("8080-9090"), MustNewPortRanges("")},
+	}, {
+		in:       "!8080",
+		expected: PortPredicate{MustNewPortRanges(""), MustNewPortRanges("8080")},
+	}, {
+		in:       "!8080-9090",
+		expected: PortPredicate{MustNewPortRanges(""), MustNewPortRanges("8080-9090")},
+	}, {
+		in:       "100-199,200,!300-399,400-499,!500-599",
+		expected: PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("300-399,500-599")},
+	}, {
+		in:          "9090-8080",
+		expectedErr: "illegal port-range: 9090-8080",
+	}, {
+		in:          "abc-def",
+		expectedErr: "illegal port-range: abc-def",
+	}, {
+		in:          "8080-9090-666",
+		expectedErr: "illegal port-range: 8080-9090-666",
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in, func(t *testing.T) {
+			actual, actualErr := NewPortPredicate(c.in)
+			if expected := c.expectedErr; expected != "" {
+				require.EqualError(t, actualErr, expected)
+			} else {
+				require.NoError(t, actualErr)
+				require.Equal(t, c.expected, actual)
+			}
+		})
+	}
+}
+
+func TestPortPredicate_String_and_MarshalText(t *testing.T) {
+	cases := []struct {
+		in          PortPredicate
+		expectedS   string
+		expectedB   string
+		expectedErr string
+	}{{
+		in:        PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("300-399,500-599")},
+		expectedS: "100-199,200,400-499,!300-399,!500-599",
+		expectedB: "100-199,200,400-499,!300-399,!500-599",
+	}, {
+		in:        PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("")},
+		expectedS: "100-199,200,400-499",
+		expectedB: "100-199,200,400-499",
+	}, {
+		in:        PortPredicate{MustNewPortRanges(""), MustNewPortRanges("300-399,500-599")},
+		expectedS: "!300-399,!500-599",
+		expectedB: "!300-399,!500-599",
+	}, {
+		in:        PortPredicate{},
+		expectedS: "",
+		expectedB: "",
+	}, {
+		in:          PortPredicate{PortRanges{PortRange{9090, 8080}}, nil},
+		expectedS:   "9090-8080",
+		expectedErr: "illegal port-range: 9090-8080",
+	}, {
+		in:          PortPredicate{nil, PortRanges{PortRange{9090, 8080}}},
+		expectedS:   "!9090-8080",
+		expectedErr: "illegal port-range: 9090-8080",
+	}}
+
+	for i, c := range cases {
+		t.Run(fmt.Sprintf("c%d", i), func(t *testing.T) {
+			{
+				actual := c.in.String()
+				require.Equal(t, c.expectedS, actual)
+			}
+			{
+				actual, actualErr := c.in.MarshalText()
+				if expected := c.expectedErr; expected != "" {
+					require.EqualError(t, actualErr, expected)
+				} else {
+					require.NoError(t, actualErr)
+					require.Equal(t, []byte(c.expectedB), actual)
+				}
+			}
+		})
+	}
+}
+
+func TestPortPredicate_IsZero(t *testing.T) {
+	cases := []struct {
+		in       PortPredicate
+		expected bool
+	}{{
+		in:       PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("300-399,500-599")},
+		expected: false,
+	}, {
+		in:       PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("")},
+		expected: false,
+	}, {
+		in:       PortPredicate{MustNewPortRanges(""), MustNewPortRanges("300-399,500-599")},
+		expected: false,
+	}, {
+		in:       PortPredicate{},
+		expected: true,
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in.String(), func(t *testing.T) {
+			actual := c.in.IsZero()
+			require.Equal(t, c.expected, actual)
+		})
+	}
+}
+
+func TestPortPredicate_Validate(t *testing.T) {
+	cases := []struct {
+		in       PortPredicate
+		expected string
+	}{{
+		in:       PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("300-399,500-599")},
+		expected: "",
+	}, {
+		in:       PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("")},
+		expected: "",
+	}, {
+		in:       PortPredicate{MustNewPortRanges(""), MustNewPortRanges("300-399,500-599")},
+		expected: "",
+	}, {
+		in:       PortPredicate{PortRanges{PortRange{9090, 8080}}, nil},
+		expected: "illegal port-range: 9090-8080",
+	}, {
+		in:       PortPredicate{nil, PortRanges{PortRange{9090, 8080}}},
+		expected: "illegal port-range: 9090-8080",
+	}, {
+		in:       PortPredicate{},
+		expected: "",
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in.String(), func(t *testing.T) {
+			actual := c.in.Validate()
+			if expected := c.expected; expected != "" {
+				require.EqualError(t, actual, expected)
+			} else {
+				require.NoError(t, actual)
+			}
+		})
+	}
+}
+
+func TestPortPredicate_Clone(t *testing.T) {
+	cases := []struct {
+		in PortPredicate
+	}{{
+		in: PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("300-399,500-599")},
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in.String(), func(t *testing.T) {
+			actual := c.in.Clone()
+			require.Equal(t, c.in, actual)
+		})
+	}
+}
+
+func TestPortPredicate_IsEqualTo(t *testing.T) {
+	cases := []struct {
+		left     PortPredicate
+		right    PortPredicate
+		expected bool
+	}{{
+		left:     PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("300-399,500-599")},
+		right:    PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("300-399,500-599")},
+		expected: true,
+	}, {
+		left:     PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("300-399,500-599")},
+		right:    PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("")},
+		expected: false,
+	}, {
+		left:     PortPredicate{MustNewPortRanges("100-199,200,400-499"), MustNewPortRanges("300-399,500-599")},
+		right:    PortPredicate{MustNewPortRanges(""), MustNewPortRanges("300-399,500-599")},
+		expected: false,
+	}, {
+		left:     PortPredicate{},
+		right:    PortPredicate{},
+		expected: true,
+	}}
+
+	for _, c := range cases {
+		t.Run(c.left.String()+"="+c.right.String(), func(t *testing.T) {
+			actual := c.left.IsEqualTo(c.right)
+			require.Equal(t, c.expected, actual)
+		})
+	}
+}
+
+func TestPortPredicate_Test(t *testing.T) {
+	cases := []struct {
+		instance PortPredicate
+		port     uint16
+		expected bool
+	}{{
+		instance: MustNewPortPredicate("8080-9090"),
+		port:     8080,
+		expected: true,
+	}, {
+		instance: MustNewPortPredicate("8080-9090"),
+		port:     8081,
+		expected: true,
+	}, {
+		instance: MustNewPortPredicate("8080-9090"),
+		port:     9090,
+		expected: true,
+	}, {
+		instance: MustNewPortPredicate("8080-9090"),
+		port:     8079,
+		expected: false,
+	}, {
+		instance: MustNewPortPredicate("8080-9090"),
+		port:     9091,
+		expected: false,
+	}, {
+		instance: MustNewPortPredicate("10-20,!12-18"),
+		port:     10,
+		expected: true,
+	}, {
+		instance: MustNewPortPredicate("10-20,!12-18"),
+		port:     20,
+		expected: true,
+	}, {
+		instance: MustNewPortPredicate("10-20,!12-18"),
+		port:     12,
+		expected: false,
+	}, {
+		instance: MustNewPortPredicate("10-20,!12-18"),
+		port:     18,
+		expected: false,
+	}, {
+		instance: MustNewPortPredicate("8080"),
+		port:     8080,
+		expected: true,
+	}, {
+		instance: MustNewPortPredicate("8080"),
+		port:     8079,
+		expected: false,
+	}, {
+		instance: MustNewPortPredicate("8080"),
+		port:     8081,
+		expected: false,
+	}, {
+		instance: MustNewPortPredicate(""),
+		port:     8080,
+		expected: true,
+	}, {
+		instance: MustNewPortPredicate(""),
+		port:     0,
+		expected: false,
+	}}
+
+	for _, c := range cases {
+		t.Run(fmt.Sprintf("%v/%d", c.instance, c.port), func(t *testing.T) {
+			actual := c.instance.Test(c.port)
+			require.Equal(t, c.expected, actual)
+		})
+	}
+}
+
+func TestPortPredicate_Iterate(t *testing.T) {
+	cases := []struct {
+		instance    PortPredicate
+		expected    []uint16
+		expectedErr string
+	}{{
+		instance: MustNewPortPredicate("10"),
+		expected: []uint16{10},
+	}, {
+		instance: MustNewPortPredicate("10-20"),
+		expected: []uint16{10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20},
+	}, {
+		instance: MustNewPortPredicate("10-20,!12-18"),
+		expected: []uint16{10, 11, 19, 20},
+	}, {
+		instance: MustNewPortPredicate(""),
+		expected: allUint16Values(),
+	}, {
+		instance:    PortPredicate{PortRanges{PortRange{20, 10}}, nil},
+		expectedErr: "illegal port-range: 20-10",
+	}, {
+		instance:    PortPredicate{nil, PortRanges{PortRange{20, 10}}},
+		expectedErr: "illegal port-range: 20-10",
+	}}
+
+	for _, c := range cases {
+		t.Run(c.instance.String(), func(t *testing.T) {
+			actual, actualErr := common.CollectOrFail(c.instance.Iterate())
+			if expected := c.expectedErr; expected != "" {
+				require.EqualError(t, actualErr, expected)
+			} else {
+				require.NoError(t, actualErr)
+				require.Equal(t, c.expected, actual)
+			}
+		})
+	}
+}
+
+func allUint16Values() []uint16 {
+	result := make([]uint16, 65535)
+	for v := uint16(0); v < 65535; v++ {
+		result[v] = v + 1
+	}
+	return result
+}
diff --git a/pkg/net/port-range.go b/pkg/net/port-range.go
new file mode 100644
index 0000000..a73ac78
--- /dev/null
+++ b/pkg/net/port-range.go
@@ -0,0 +1,151 @@
+package net
+
+import (
+	"iter"
+	"strconv"
+	"strings"
+
+	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+func NewPortRange(in string) (result PortRange, err error) {
+	err = result.Set(in)
+	return
+}
+
+func MustNewPortRange(in string) PortRange {
+	result, err := NewPortRange(in)
+	common.Must(err)
+	return result
+}
+
+type PortRange struct {
+	Start uint16
+	End   uint16
+}
+
+func (this PortRange) Test(candidate uint16) bool {
+	if this.Start == 0 && this.End == 0 {
+		return false
+	}
+	if this.Start > 0 && this.End > 0 {
+		return this.Start <= candidate && candidate <= this.End
+	}
+	return this.Start == candidate
+}
+
+func (this PortRange) Iterate() iter.Seq2[uint16, error] {
+	return func(yield func(uint16, error) bool) {
+		if this.End == 0 {
+			if this.Start == 0 {
+				return
+			}
+			yield(this.Start, nil)
+			return
+		}
+		if this.Start > this.End {
+			yield(0, errors.Config.Newf("illegal port-range: %v", this))
+			return
+		}
+		for i := this.Start; i <= this.End; i++ {
+			if !yield(i, nil) {
+				return
+			}
+		}
+	}
+}
+
+func (this PortRange) String() string {
+	if this.End == 0 {
+		return strconv.FormatUint(uint64(this.Start), 10)
+	}
+	return strconv.FormatUint(uint64(this.Start), 10) + "-" + strconv.FormatUint(uint64(this.End), 10)
+}
+
+func (this PortRange) MarshalText() ([]byte, error) {
+	if err := this.Validate(); err != nil {
+		return nil, err
+	}
+	return []byte(this.String()), nil
+}
+
+func (this *PortRange) UnmarshalText(in []byte) error {
+	if len(in) == 0 {
+		*this = PortRange{}
+		return nil
+	}
+
+	parts := strings.SplitN(string(in), "-", 2)
+
+	start, err := strconv.ParseUint(parts[0], 10, 16)
+	if err != nil {
+		return errors.Config.Newf("illegal port-range: %s", string(in))
+	}
+
+	var buf PortRange
+	if len(parts) > 1 {
+		end, err := strconv.ParseUint(parts[1], 10, 16)
+		if err != nil {
+			return errors.Config.Newf("illegal port-range: %s", string(in))
+		}
+		if start == end {
+			buf = PortRange{uint16(start), 0}
+		} else {
+			buf = PortRange{uint16(start), uint16(end)}
+		}
+	} else {
+		buf = PortRange{uint16(start), 0}
+	}
+
+	if err := buf.Validate(); err != nil {
+		return err
+	}
+
+	*this = buf
+	return nil
+}
+
+func (this *PortRange) Set(in string) error {
+	return this.UnmarshalText([]byte(in))
+}
+
+func (this PortRange) Clone() PortRange {
+	return PortRange{
+		this.Start,
+		this.End,
+	}
+}
+
+func (this PortRange) IsZero() bool {
+	return this.Start == 0 && this.End == 0
+}
+
+func (this PortRange) Validate() error {
+	if this.Start == 0 && this.End == 0 {
+		return nil
+	}
+	if (this.End > 0 && this.Start > this.End) || (this.Start == 0 && this.End > 0) {
+		return errors.Config.Newf("illegal port-range: %v", this)
+	}
+	return nil
+}
+
+func (this PortRange) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case PortRange:
+		return this.isEqualTo(&v)
+	case *PortRange:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this PortRange) isEqualTo(other *PortRange) bool {
+	return this.Start == other.Start &&
+		this.End == other.End
+}
diff --git a/pkg/net/port-range_test.go b/pkg/net/port-range_test.go
new file mode 100644
index 0000000..8da2801
--- /dev/null
+++ b/pkg/net/port-range_test.go
@@ -0,0 +1,286 @@
+package net
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/engity-com/bifroest/pkg/common"
+)
+
+func TestNewPortRange(t *testing.T) {
+	cases := []struct {
+		in          string
+		expected    PortRange
+		expectedErr string
+	}{{
+		in:       "",
+		expected: PortRange{},
+	}, {
+		in:       "8080",
+		expected: PortRange{8080, 0},
+	}, {
+		in:       "8080-9090",
+		expected: PortRange{8080, 9090},
+	}, {
+		in:       "8080-8080",
+		expected: PortRange{8080, 0},
+	}, {
+		in:          "9090-8080",
+		expectedErr: "illegal port-range: 9090-8080",
+	}, {
+		in:          "abc-def",
+		expectedErr: "illegal port-range: abc-def",
+	}, {
+		in:          "8080-9090-666",
+		expectedErr: "illegal port-range: 8080-9090-666",
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in, func(t *testing.T) {
+			actual, actualErr := NewPortRange(c.in)
+			if expected := c.expectedErr; expected != "" {
+				require.EqualError(t, actualErr, expected)
+			} else {
+				require.NoError(t, actualErr)
+				require.Equal(t, c.expected, actual)
+			}
+		})
+	}
+}
+
+func TestPortRange_String_and_MarshalText(t *testing.T) {
+	cases := []struct {
+		in          PortRange
+		expectedS   string
+		expectedB   string
+		expectedErr string
+	}{{
+		in:        PortRange{8080, 9090},
+		expectedS: "8080-9090",
+		expectedB: "8080-9090",
+	}, {
+		in:        PortRange{8080, 0},
+		expectedS: "8080",
+		expectedB: "8080",
+	}, {
+		in:          PortRange{0, 9090},
+		expectedS:   "0-9090",
+		expectedErr: "illegal port-range: 0-9090",
+	}, {
+		in:          PortRange{9090, 8080},
+		expectedS:   "9090-8080",
+		expectedErr: "illegal port-range: 9090-8080",
+	}}
+
+	for i, c := range cases {
+		t.Run(fmt.Sprintf("c%d", i), func(t *testing.T) {
+			{
+				actual := c.in.String()
+				require.Equal(t, c.expectedS, actual)
+			}
+			{
+				actual, actualErr := c.in.MarshalText()
+				if expected := c.expectedErr; expected != "" {
+					require.EqualError(t, actualErr, expected)
+				} else {
+					require.NoError(t, actualErr)
+					require.Equal(t, []byte(c.expectedB), actual)
+				}
+			}
+		})
+	}
+}
+
+func TestPortRange_IsZero(t *testing.T) {
+	cases := []struct {
+		in       PortRange
+		expected bool
+	}{{
+		in:       PortRange{8080, 9090},
+		expected: false,
+	}, {
+		in:       PortRange{8080, 0},
+		expected: false,
+	}, {
+		in:       PortRange{0, 9090},
+		expected: false,
+	}, {
+		in:       PortRange{},
+		expected: true,
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in.String(), func(t *testing.T) {
+			actual := c.in.IsZero()
+			require.Equal(t, c.expected, actual)
+		})
+	}
+}
+
+func TestPortRange_Validate(t *testing.T) {
+	cases := []struct {
+		in       PortRange
+		expected string
+	}{{
+		in:       PortRange{8080, 9090},
+		expected: "",
+	}, {
+		in:       PortRange{8080, 0},
+		expected: "",
+	}, {
+		in:       PortRange{9090, 8080},
+		expected: "illegal port-range: 9090-8080",
+	}, {
+		in:       PortRange{0, 9090},
+		expected: "illegal port-range: 0-9090",
+	}, {
+		in:       PortRange{},
+		expected: "",
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in.String(), func(t *testing.T) {
+			actual := c.in.Validate()
+			if expected := c.expected; expected != "" {
+				require.EqualError(t, actual, expected)
+			} else {
+				require.NoError(t, actual)
+			}
+		})
+	}
+}
+
+func TestPortRange_Clone(t *testing.T) {
+	cases := []struct {
+		in PortRange
+	}{{
+		in: PortRange{9090, 8080},
+	}}
+
+	for _, c := range cases {
+		t.Run(c.in.String(), func(t *testing.T) {
+			actual := c.in.Clone()
+			require.Equal(t, c.in, actual)
+		})
+	}
+}
+
+func TestPortRange_IsEqualTo(t *testing.T) {
+	cases := []struct {
+		left     PortRange
+		right    PortRange
+		expected bool
+	}{{
+		left:     PortRange{8080, 9090},
+		right:    PortRange{8080, 9090},
+		expected: true,
+	}, {
+		left:     PortRange{8080, 9090},
+		right:    PortRange{8088, 9090},
+		expected: false,
+	}, {
+		left:     PortRange{8080, 9090},
+		right:    PortRange{8080, 9099},
+		expected: false,
+	}, {
+		left:     PortRange{},
+		right:    PortRange{},
+		expected: true,
+	}}
+
+	for _, c := range cases {
+		t.Run(c.left.String()+"="+c.right.String(), func(t *testing.T) {
+			actual := c.left.IsEqualTo(c.right)
+			require.Equal(t, c.expected, actual)
+		})
+	}
+}
+
+func TestPortRange_Test(t *testing.T) {
+	cases := []struct {
+		instance PortRange
+		port     uint16
+		expected bool
+	}{{
+		instance: MustNewPortRange("8080-9090"),
+		port:     8080,
+		expected: true,
+	}, {
+		instance: MustNewPortRange("8080-9090"),
+		port:     8081,
+		expected: true,
+	}, {
+		instance: MustNewPortRange("8080-9090"),
+		port:     9090,
+		expected: true,
+	}, {
+		instance: MustNewPortRange("8080-9090"),
+		port:     8079,
+		expected: false,
+	}, {
+		instance: MustNewPortRange("8080-9090"),
+		port:     9091,
+		expected: false,
+	}, {
+		instance: MustNewPortRange("8080"),
+		port:     8080,
+		expected: true,
+	}, {
+		instance: MustNewPortRange("8080"),
+		port:     8079,
+		expected: false,
+	}, {
+		instance: MustNewPortRange("8080"),
+		port:     8081,
+		expected: false,
+	}, {
+		instance: MustNewPortRange(""),
+		port:     8080,
+		expected: false,
+	}, {
+		instance: MustNewPortRange(""),
+		port:     0,
+		expected: false,
+	}}
+
+	for _, c := range cases {
+		t.Run(fmt.Sprintf("%v-%d", c.instance, c.port), func(t *testing.T) {
+			actual := c.instance.Test(c.port)
+			require.Equal(t, c.expected, actual)
+		})
+	}
+}
+
+func TestPortRange_Iterate(t *testing.T) {
+	cases := []struct {
+		instance    PortRange
+		expected    []uint16
+		expectedErr string
+	}{{
+		instance: MustNewPortRange("10"),
+		expected: []uint16{10},
+	}, {
+		instance: MustNewPortRange("10-20"),
+		expected: []uint16{10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20},
+	}, {
+		instance: MustNewPortRange(""),
+		expected: nil,
+	}, {
+		instance:    PortRange{20, 10},
+		expectedErr: "illegal port-range: 20-10",
+	}}
+
+	for _, c := range cases {
+		t.Run(c.instance.String(), func(t *testing.T) {
+			actual, actualErr := common.CollectOrFail(c.instance.Iterate())
+			if expected := c.expectedErr; expected != "" {
+				require.EqualError(t, actualErr, expected)
+			} else {
+				require.NoError(t, actualErr)
+				require.Equal(t, c.expected, actual)
+			}
+		})
+	}
+}
diff --git a/pkg/net/port-ranges.go b/pkg/net/port-ranges.go
new file mode 100644
index 0000000..2d4655d
--- /dev/null
+++ b/pkg/net/port-ranges.go
@@ -0,0 +1,147 @@
+package net
+
+import (
+	"bytes"
+	"iter"
+	"strings"
+
+	"github.com/engity-com/bifroest/pkg/common"
+)
+
+func NewPortRanges(in string) (result PortRanges, err error) {
+	err = result.Set(in)
+	return
+}
+
+func MustNewPortRanges(in string) PortRanges {
+	result, err := NewPortRanges(in)
+	common.Must(err)
+	return result
+}
+
+type PortRanges []PortRange
+
+func (this PortRanges) Test(candidate uint16) bool {
+	for _, v := range this {
+		if v.Test(candidate) {
+			return true
+		}
+	}
+	return false
+}
+
+func (this PortRanges) Iterate() iter.Seq2[uint16, error] {
+	return func(yield func(uint16, error) bool) {
+		for _, inner := range this {
+			for v, err := range inner.Iterate() {
+				if !yield(v, err) {
+					return
+				}
+			}
+		}
+	}
+}
+
+func (this PortRanges) Strings() []string {
+	strs := make([]string, len(this))
+	for i, v := range this {
+		strs[i] = v.String()
+	}
+	return strs
+}
+
+func (this PortRanges) String() string {
+	return strings.Join(this.Strings(), ",")
+}
+
+func (this PortRanges) marshalTexts() ([][]byte, error) {
+	var err error
+	bs := make([][]byte, len(this))
+	for i, v := range this {
+		if bs[i], err = v.MarshalText(); err != nil {
+			return nil, err
+		}
+	}
+	return bs, nil
+}
+
+func (this PortRanges) MarshalText() ([]byte, error) {
+	bs, err := this.marshalTexts()
+	if err != nil {
+		return nil, err
+	}
+	return bytes.Join(bs, []byte(",")), nil
+}
+
+func (this *PortRanges) UnmarshalText(in []byte) error {
+	if len(in) == 0 {
+		*this = PortRanges{}
+		return nil
+	}
+
+	parts := bytes.Split(in, []byte(","))
+	buf := make(PortRanges, len(parts))
+	for i, v := range parts {
+		if err := buf[i].UnmarshalText(v); err != nil {
+			return err
+		}
+	}
+	*this = buf
+	return nil
+}
+
+func (this *PortRanges) Set(in string) error {
+	return this.UnmarshalText([]byte(in))
+}
+
+func (this PortRanges) Clone() PortRanges {
+	result := make(PortRanges, len(this))
+	for i, v := range this {
+		result[i] = v.Clone()
+	}
+	return result
+}
+
+func (this PortRanges) IsZero() bool {
+	for _, v := range this {
+		if !v.IsZero() {
+			return false
+		}
+	}
+	return true
+}
+
+func (this PortRanges) Validate() error {
+	for _, v := range this {
+		if err := v.Validate(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (this PortRanges) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case PortRanges:
+		return this.isEqualTo(&v)
+	case *PortRanges:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this PortRanges) isEqualTo(other *PortRanges) bool {
+	if len(this) != len(*other) {
+		return false
+	}
+	for i, tv := range this {
+		if !tv.isEqualTo(&(*other)[i]) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/pkg/net/proto.go b/pkg/net/proto.go
new file mode 100644
index 0000000..68ff0ff
--- /dev/null
+++ b/pkg/net/proto.go
@@ -0,0 +1,89 @@
+package net
+
+import (
+	"fmt"
+
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+type Proto uint8
+
+const (
+	ProtoTcp Proto = iota
+)
+
+func (this Proto) String() string {
+	v, ok := protoToName[this]
+	if !ok {
+		return fmt.Sprintf("illegal-proto-%d", this)
+	}
+	return v
+}
+
+func (this Proto) MarshalText() ([]byte, error) {
+	v, ok := protoToName[this]
+	if !ok {
+		return nil, errors.Config.Newf("illegal proto: %d", this)
+	}
+	return []byte(v), nil
+}
+
+func (this *Proto) UnmarshalText(in []byte) error {
+	v, ok := nameToProto[string(in)]
+	if !ok {
+		return errors.Config.Newf("illegal proto: %s", string(in))
+	}
+	*this = v
+	return nil
+}
+
+func (this *Proto) Set(in string) error {
+	return this.UnmarshalText([]byte(in))
+}
+
+func (this Proto) Clone() Proto {
+	return this
+}
+
+func (this Proto) IsZero() bool {
+	return false
+}
+
+func (this Proto) Validate() error {
+	_, ok := protoToName[this]
+	if !ok {
+		return errors.Config.Newf("illegal proto: %d", this)
+	}
+	return nil
+}
+
+func (this Proto) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case Proto:
+		return this.isEqualTo(&v)
+	case *Proto:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this Proto) isEqualTo(other *Proto) bool {
+	return this == *other
+}
+
+var (
+	protoToName = map[Proto]string{
+		ProtoTcp: "tcp",
+	}
+	nameToProto = func(in map[Proto]string) map[string]Proto {
+		result := make(map[string]Proto, len(in))
+		for k, v := range in {
+			result[v] = k
+		}
+		return result
+	}(protoToName)
+)
diff --git a/pkg/net/remote.go b/pkg/net/remote.go
new file mode 100644
index 0000000..850310c
--- /dev/null
+++ b/pkg/net/remote.go
@@ -0,0 +1,7 @@
+package net
+
+type Remote interface {
+	User() string
+	Host() Host
+	String() string
+}
diff --git a/pkg/service/context.go b/pkg/service/context.go
index 4e25baf..cdfa660 100644
--- a/pkg/service/context.go
+++ b/pkg/service/context.go
@@ -9,10 +9,12 @@ import (
 	gssh "golang.org/x/crypto/ssh"
 
 	"github.com/engity-com/bifroest/pkg/authorization"
-	"github.com/engity-com/bifroest/pkg/common"
+	"github.com/engity-com/bifroest/pkg/configuration"
 	"github.com/engity-com/bifroest/pkg/environment"
+	"github.com/engity-com/bifroest/pkg/errors"
 	"github.com/engity-com/bifroest/pkg/net"
 	"github.com/engity-com/bifroest/pkg/session"
+	"github.com/engity-com/bifroest/pkg/template"
 )
 
 type remote struct {
@@ -58,7 +60,7 @@ func (this *authorizeRequest) Context() ssh.Context {
 	return this.remote.Context
 }
 
-func (this *authorizeRequest) Remote() common.Remote {
+func (this *authorizeRequest) Remote() net.Remote {
 	return &this.remote
 }
 
@@ -71,12 +73,12 @@ func (this *authorizeRequest) Sessions() session.Repository {
 }
 
 func (this *authorizeRequest) Validate(auth authorization.Authorization) (bool, error) {
-	req := environmentRequest{
+	ctx := environmentContext{
 		service:       this.service,
 		remote:        &this.remote,
 		authorization: auth,
 	}
-	return this.service.environments.WillBeAccepted(&req)
+	return this.service.environments.WillBeAccepted(&ctx)
 }
 
 type publicKeyAuthorizeRequest struct {
@@ -142,13 +144,13 @@ func (this *interactiveAuthorizeRequest) Prompt(message string, echo bool) (stri
 	return resp[0], err
 }
 
-type environmentRequest struct {
+type environmentContext struct {
 	service       *service
 	remote        *remote
 	authorization authorization.Authorization
 }
 
-func (this *environmentRequest) GetField(name string) (any, bool, error) {
+func (this *environmentContext) GetField(name string) (any, bool, error) {
 	switch name {
 	case "context":
 		return this.remote.Context, true, nil
@@ -161,24 +163,135 @@ func (this *environmentRequest) GetField(name string) (any, bool, error) {
 	}
 }
 
-func (this *environmentRequest) Context() ssh.Context {
+func (this *environmentContext) Context() ssh.Context {
 	return this.remote.Context
 }
 
-func (this *environmentRequest) Remote() common.Remote {
+func (this *environmentContext) Remote() net.Remote {
 	return this.remote
 }
 
-func (this *environmentRequest) Logger() log.Logger {
+func (this *environmentContext) Logger() log.Logger {
 	return this.service.logger(this.remote)
 }
 
-func (this *environmentRequest) Authorization() authorization.Authorization {
+func (this *environmentContext) Authorization() authorization.Authorization {
 	return this.authorization
 }
 
+type environmentRequest struct {
+	environmentContext
+	sshSession ssh.Session
+}
+
+func (this *environmentRequest) StartPreparation(id, title string, attrs environment.PreparationProgressAttributes) (environment.PreparationProgress, error) {
+	flowStr := this.authorization.Flow().String()
+
+	for _, candidate := range this.service.Configuration.Ssh.PreparationMessages {
+		if !candidate.Flow.MatchString(flowStr) {
+			continue
+		}
+		if !candidate.Id.MatchString(id) {
+			continue
+		}
+		result := &environmentRequestPreparationProgress{this, id, title, attrs, &candidate}
+		if err := result.printStart(); err != nil {
+			return nil, err
+		}
+		return result, nil
+	}
+
+	return nil, nil
+}
+
+type environmentRequestPreparationProgress struct {
+	*environmentRequest
+	id    string
+	title string
+	attrs environment.PreparationProgressAttributes
+	pm    *configuration.PreparationMessage
+}
+
+func (this *environmentRequestPreparationProgress) GetField(name string) (any, bool, error) {
+	switch name {
+	case "id":
+		return this.id, true, nil
+	case "title":
+		return this.title, true, nil
+	default:
+		if this.attrs != nil {
+			v, ok := this.attrs[name]
+			if ok {
+				return v, true, nil
+			}
+		}
+		return this.environmentRequest.GetField(name)
+	}
+}
+
+func (this *environmentRequestPreparationProgress) print(tmpl *template.String, data any) error {
+	v, err := tmpl.Render(data)
+	if err != nil {
+		return errors.Network.Newf("cannot render preparation progress message for client: %w", err)
+	}
+	if v == "" {
+		return nil
+	}
+	_, err = this.sshSession.Write([]byte(v))
+	if err != nil {
+		return errors.Network.Newf("cannot print preparation progress message to client: %w", err)
+	}
+	return nil
+}
+
+func (this *environmentRequestPreparationProgress) printStart() error {
+	return this.print(&this.pm.Start, this)
+}
+
+func (this *environmentRequestPreparationProgress) Report(progress float32) error {
+	return this.print(&this.pm.Update, environmentRequestPreparationProgressProgress{this, progress})
+}
+
+func (this *environmentRequestPreparationProgress) Done() error {
+	return this.print(&this.pm.End, this)
+}
+
+func (this *environmentRequestPreparationProgress) Error(err error) error {
+	return this.print(&this.pm.Error, environmentRequestPreparationProgressError{this, err})
+}
+
+type environmentRequestPreparationProgressProgress struct {
+	*environmentRequestPreparationProgress
+	progress float32
+}
+
+func (this environmentRequestPreparationProgressProgress) GetField(name string) (any, bool, error) {
+	switch name {
+	case "progress":
+		return this.progress, true, nil
+	case "percentage":
+		return this.progress * 100.0, true, nil
+	default:
+		return this.environmentRequestPreparationProgress.GetField(name)
+	}
+}
+
+type environmentRequestPreparationProgressError struct {
+	*environmentRequestPreparationProgress
+	error error
+}
+
+func (this environmentRequestPreparationProgressError) GetField(name string) (any, bool, error) {
+	switch name {
+	case "error":
+		return this.error, true, nil
+	default:
+		return this.environmentRequestPreparationProgress.GetField(name)
+	}
+}
+
 type environmentTask struct {
-	environmentRequest
+	environmentContext
 	sshSession ssh.Session
 	taskType   environment.TaskType
 }
@@ -188,7 +301,7 @@ func (this *environmentTask) GetField(name string) (any, bool, error) {
 	case "taskType":
 		return this.taskType, true, nil
 	default:
-		return this.environmentRequest.GetField(name)
+		return this.environmentContext.GetField(name)
 	}
 }
 
@@ -271,3 +384,6 @@ func (this *connectionContext) GetField(name string) (any, bool, error) {
 		return nil, false, fmt.Errorf("unknown field %q", name)
 	}
 }
+
+type noopContext struct {
+}
diff --git a/pkg/service/housekeeper.go b/pkg/service/housekeeper.go
index 9ca43c1..28ba849 100644
--- a/pkg/service/housekeeper.go
+++ b/pkg/service/housekeeper.go
@@ -166,7 +166,7 @@ func (this *houseKeeper) dispose(ctx context.Context, logger log.Logger, sess se
 	return environmentDisposed || authorizationDisposed || sessionDisposed, nil
 }
 
-func (this *houseKeeper) disposeEnvironment(ctx context.Context, logger log.Logger, sess session.Session) (bool, error) {
+func (this *houseKeeper) disposeEnvironment(ctx context.Context, logger log.Logger, sess session.Session) (_ bool, rErr error) {
 	fail := func(err error) (bool, error) {
 		return false, errors.Newf(errors.System, "cannot dispose authorization: %w", err)
 	}
@@ -182,6 +182,7 @@ func (this *houseKeeper) disposeEnvironment(ctx context.Context, logger log.Logg
 	if err != nil {
 		return fail(err)
 	}
+	defer common.KeepCloseError(&rErr, env)
 
 	disposed, err := env.Dispose(ctx)
 	if err != nil {
diff --git a/pkg/service/service-authorization.go b/pkg/service/service-authorization.go
index 4887c3c..00a8464 100644
--- a/pkg/service/service-authorization.go
+++ b/pkg/service/service-authorization.go
@@ -158,7 +158,7 @@ func (this *service) onPtyRequest(ctx ssh.Context, pty ssh.Pty) bool {
 
 	logger := this.logger(ctx)
 
-	ok, err := this.environments.DoesSupportPty(&environmentRequest{
+	ok, err := this.environments.DoesSupportPty(&environmentContext{
 		this,
 		&remote{ctx},
 		auth,
diff --git a/pkg/service/service-direct-tcp-ip.go b/pkg/service/service-direct-tcp-ip.go
index 187f463..c267bce 100644
--- a/pkg/service/service-direct-tcp-ip.go
+++ b/pkg/service/service-direct-tcp-ip.go
@@ -1,9 +1,6 @@
 package service
 
 import (
-	"io"
-	"sync"
-	"sync/atomic"
 	"syscall"
 	"time"
 
@@ -13,6 +10,7 @@ import (
 	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/environment"
 	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/sys"
 )
 
 type localForwardChannelData struct {
@@ -67,6 +65,11 @@ func (this *service) handleNewDirectTcpIp(_ *ssh.Server, _ *gssh.ServerConn, new
 		_ = newChan.Reject(gssh.ConnectionFailed, err.Error())
 		return
 	}
+	if dConn == nil {
+		l.Info("connection rejected")
+		_ = newChan.Reject(gssh.ConnectionFailed, "rejected")
+		return
+	}
 	defer common.IgnoreCloseError(dConn)
 
 	sConn, reqs, err := newChan.Accept()
@@ -77,72 +80,40 @@ func (this *service) handleNewDirectTcpIp(_ *ssh.Server, _ *gssh.ServerConn, new
 
 	go gssh.DiscardRequests(reqs)
 
-	type done struct {
-		name  string
-		error error
+	nameOf := func(isL2r bool) string {
+		if isL2r {
+			return "source -> destination"
+		}
+		return "destination -> source"
 	}
-	dones := make(chan done, 2)
-	var wg sync.WaitGroup
-	var rErr error
-	var direction string
-	var s2d, d2s atomic.Int64
-	started := time.Now()
-	go func() {
-		wg.Wait()
-		close(dones)
-
-		ld := l.
-			With("s2d", s2d.Load()).
-			With("d2s", d2s.Load()).
-			With("duration", time.Since(started).Truncate(time.Microsecond))
-
-		if rErr != nil {
-			if direction != "" {
-				ld = ld.With("direction", direction)
+
+	_ = sys.FullDuplexCopy(ctx, sConn, dConn, &sys.FullDuplexCopyOpts{
+		OnStart: func() {
+			l.Debug("port forwarding started")
+		},
+		OnEnd: func(s2d, d2s int64, duration time.Duration, err error, wasInL2r *bool) {
+			ld := l.
+				With("s2d", s2d).
+				With("d2s", d2s).
+				With("duration", duration)
+			if wasInL2r != nil {
+				ld = ld.With("direction", nameOf(*wasInL2r))
 			}
-			ld.WithError(rErr).Error("cannot successful handle port forwarding request; canceling...")
-		} else {
-			ld.Info("port forwarding finished")
-		}
-	}()
 
-	copyFull := func(from io.Reader, to io.Writer, name string) {
-		defer wg.Done()
-		n, err := io.Copy(to, from)
-		if this.isRelevantError(err) {
-			dones <- done{name, err}
-		} else {
-			dones <- done{name, nil}
-		}
-		if name == "destination -> source" {
-			d2s.Store(n)
-		} else {
-			s2d.Store(n)
-		}
-		l.WithError(err).Tracef("coping of %s done", name)
-	}
-	wg.Add(2)
-	go copyFull(dConn, sConn, "destination -> source")
-	go copyFull(sConn, dConn, "source -> destination")
-
-	l.Debug("port forwarding started")
-
-	for {
-		select {
-		case <-ctx.Done():
-			if err := ctx.Err(); this.isSilentError(err) {
-				rErr = err
-				direction = ""
+			if err != nil {
+				ld.WithError(err).Error("cannot successful handle port forwarding request; canceling...")
+			} else {
+				ld.Info("port forwarding finished")
 			}
-			return
-		case v := <-dones:
-			if this.isRelevantError(v.error) {
-				rErr = v.error
-				direction = v.name
+		},
+		OnStreamEnd: func(isL2r bool, err error) {
+			name := "source -> destination"
+			if !isL2r {
+				name = "destination -> source"
 			}
-			return
-		}
-	}
+			l.WithError(err).Tracef("coping of %s done", name)
+		},
+	})
 }
 
 func (this *service) onReversePortForwardingRequested(_ ssh.Context, _ string, _ uint32) bool {
diff --git a/pkg/service/service-session.go b/pkg/service/service-session.go
index 5b9566f..58b2b5c 100644
--- a/pkg/service/service-session.go
+++ b/pkg/service/service-session.go
@@ -88,19 +88,24 @@ func (this *service) executeSession(sshSess ssh.Session, taskType environment.Ta
 		return fail(err)
 	}
 
+	ctx := sshSess.Context()
 	req := environmentRequest{
-		service:       this,
-		remote:        &remote{sshSess.Context()},
-		authorization: auth,
+		environmentContext{
+			service:       this,
+			remote:        &remote{ctx},
+			authorization: auth,
+		},
+		sshSess,
 	}
 
 	env, err := this.environments.Ensure(&req)
 	if err != nil {
 		return fail(err)
 	}
+	defer common.KeepCloseError(&rErr, env)
 
-	sshSess.Context().SetValue(environmentKeyCtxKey, env)
-	defer sshSess.Context().SetValue(environmentKeyCtxKey, nil)
+	ctx.SetValue(environmentKeyCtxKey, env)
+	defer ctx.SetValue(environmentKeyCtxKey, nil)
 
 	if len(sshSess.RawCommand()) == 0 && taskType == environment.TaskTypeShell {
 		banner, err := env.Banner(&req)
@@ -116,7 +121,7 @@ func (this *service) executeSession(sshSess ssh.Session, taskType environment.Ta
 	}
 
 	t := environmentTask{
-		environmentRequest: req,
+		environmentContext: req.environmentContext,
 		sshSession:         sshSess,
 		taskType:           taskType,
 	}
diff --git a/pkg/service/service.go b/pkg/service/service.go
index 5a4eef1..c28cca8 100644
--- a/pkg/service/service.go
+++ b/pkg/service/service.go
@@ -15,12 +15,14 @@ import (
 	"github.com/gliderlabs/ssh"
 	gssh "golang.org/x/crypto/ssh"
 
+	"github.com/engity-com/bifroest/pkg/alternatives"
 	"github.com/engity-com/bifroest/pkg/authorization"
 	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
 	"github.com/engity-com/bifroest/pkg/crypto"
 	"github.com/engity-com/bifroest/pkg/environment"
 	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/imp"
 	bnet "github.com/engity-com/bifroest/pkg/net"
 	"github.com/engity-com/bifroest/pkg/session"
 )
@@ -57,7 +59,9 @@ func (this *Service) Run(ctx context.Context) (rErr error) {
 		ctx = context.Background()
 	}
 
-	if msg := this.Configuration.StartMessage; msg != "" {
+	if msg, err := this.Configuration.StartMessage.Render(noopContext{}); err != nil {
+		return err
+	} else if msg != "" {
 		for _, line := range strings.Split(msg, "\n") {
 			if line = strings.TrimSpace(line); line != "" {
 				log.Warn(line)
@@ -164,30 +168,37 @@ func (this *Service) prepare() (svc *service, err error) {
 	ctx := context.Background()
 	svc = &service{Service: this}
 
+	hostSigners, err := this.loadHostPrivateKeys()
+	if err != nil {
+		return fail(err)
+	}
+
+	if svc.alternatives, err = alternatives.NewProvider(ctx, this.Version, &this.Configuration.Alternatives); err != nil {
+		return fail(err)
+	}
+	if svc.imp, err = imp.NewImp(ctx, hostSigners[0]); err != nil {
+		return fail(err)
+	}
 	if svc.sessions, err = session.NewFacadeRepository(ctx, &this.Configuration.Session); err != nil {
 		return fail(err)
 	}
 	if svc.authorizer, err = authorization.NewAuthorizerFacade(ctx, &this.Configuration.Flows); err != nil {
 		return fail(err)
 	}
-	if svc.environments, err = environment.NewRepositoryFacade(ctx, &this.Configuration.Flows); err != nil {
+	if svc.environments, err = environment.NewRepositoryFacade(ctx, &this.Configuration.Flows, svc.alternatives, svc.imp); err != nil {
 		return fail(err)
 	}
 	if err = svc.houseKeeper.init(svc); err != nil {
 		return fail(err)
 	}
-	if err := this.prepareServer(ctx, svc); err != nil {
+	if err := this.prepareServer(ctx, svc, hostSigners); err != nil {
 		return fail(err)
 	}
 
 	return svc, nil
 }
 
-func (this *Service) prepareServer(_ context.Context, svc *service) (err error) {
-	fail := func(err error) error {
-		return err
-	}
-
+func (this *Service) prepareServer(_ context.Context, svc *service, hostPrivateKeys []crypto.PrivateKey) (err error) {
 	svc.server.IdleTimeout = 0 // handled by service's connection
 	svc.server.MaxTimeout = 0  // handled by service's connection
 	svc.server.ServerConfigCallback = svc.createNewServerConfig
@@ -210,17 +221,27 @@ func (this *Service) prepareServer(_ context.Context, svc *service) (err error)
 	svc.server.SubsystemHandlers = map[string]ssh.SubsystemHandler{
 		"sftp": svc.handleSshSftpSession,
 	}
-	if svc.server.HostSigners, err = this.loadHostSigners(); err != nil {
-		return fail(err)
+	svc.server.HostSigners = make([]ssh.Signer, len(hostPrivateKeys))
+	for i, v := range hostPrivateKeys {
+		svc.server.HostSigners[i] = v.ToSsh()
 	}
 
 	return nil
 }
 
-func (this *Service) loadHostSigners() ([]ssh.Signer, error) {
+func (this *Service) loadHostPrivateKeys() ([]crypto.PrivateKey, error) {
 	kc := &this.Configuration.Ssh.Keys
-	result := make([]ssh.Signer, len(kc.HostKeys))
-	for i, fn := range kc.HostKeys {
+
+	hostKeys, err := kc.HostKeys.Render(noopContext{})
+	if err != nil {
+		return nil, errors.Config.Newf("cannot render hostKeys: %w", err)
+	}
+
+	var result []crypto.PrivateKey
+	for _, fn := range hostKeys {
+		if fn == "" {
+			continue
+		}
 		pk, err := crypto.EnsureKeyFile(fn, &crypto.KeyRequirement{
 			Type: crypto.KeyTypeEd25519,
 		}, nil)
@@ -233,12 +254,7 @@ func (this *Service) loadHostSigners() ([]ssh.Signer, error) {
 		} else if !ok {
 			return nil, fmt.Errorf("cannot check if host key %q is not allowed by restrictions: %w", fn, err)
 		}
-
-		signer, err := gssh.NewSignerFromKey(pk)
-		if err != nil {
-			return nil, fmt.Errorf("cannot convert host key %q: %w", fn, err)
-		}
-		result[i] = signer
+		result = append(result, pk)
 	}
 	return result, nil
 }
@@ -250,6 +266,8 @@ type service struct {
 	authorizer     authorization.CloseableAuthorizer
 	environments   environment.CloseableRepository
 	houseKeeper    houseKeeper
+	alternatives   alternatives.Provider
+	imp            imp.Imp
 	server         ssh.Server
 	forwardHandler ssh.ForwardedTCPHandler
 
@@ -288,6 +306,8 @@ func (this *service) createNewServerConfig(ssh.Context) *gssh.ServerConfig {
 }
 
 func (this *service) Close() (rErr error) {
+	defer common.KeepCloseError(&rErr, this.alternatives)
+	defer common.KeepCloseError(&rErr, this.imp)
 	defer common.KeepCloseError(&rErr, this.sessions)
 	defer common.KeepCloseError(&rErr, this.authorizer)
 	defer common.KeepCloseError(&rErr, this.environments)
diff --git a/pkg/session/fs-connection-interceptor.go b/pkg/session/fs-connection-interceptor.go
index f6c21fb..c1a9fee 100644
--- a/pkg/session/fs-connection-interceptor.go
+++ b/pkg/session/fs-connection-interceptor.go
@@ -9,7 +9,6 @@ import (
 
 	log "github.com/echocat/slf4g"
 	"github.com/gliderlabs/ssh"
-	"github.com/google/uuid"
 
 	"github.com/engity-com/bifroest/pkg/configuration"
 )
@@ -24,7 +23,7 @@ func (this *fs) ConnectionInterceptor(context.Context) (ConnectionInterceptor, e
 
 	byFlow, hasByFlow := this.repository.connectionInterceptors[this.flow]
 	if !hasByFlow {
-		byFlow = make(map[uuid.UUID]*fsConnectionInterceptorStack)
+		byFlow = make(map[Id]*fsConnectionInterceptorStack)
 		this.repository.connectionInterceptors[this.flow] = byFlow
 	}
 
@@ -43,12 +42,12 @@ func (this *fs) ConnectionInterceptor(context.Context) (ConnectionInterceptor, e
 	return byId.create()
 }
 
-type fsConnectionInterceptors map[configuration.FlowName]map[uuid.UUID]*fsConnectionInterceptorStack
+type fsConnectionInterceptors map[configuration.FlowName]map[Id]*fsConnectionInterceptorStack
 
 type fsConnectionInterceptorStack struct {
 	repository *FsRepository
 	flow       configuration.FlowName
-	id         uuid.UUID
+	id         Id
 	created    int64
 	active     atomic.Int32
 
diff --git a/pkg/session/fs-created.go b/pkg/session/fs-created.go
index bade094..ac27bf8 100644
--- a/pkg/session/fs-created.go
+++ b/pkg/session/fs-created.go
@@ -5,7 +5,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/net"
 )
 
@@ -24,7 +23,7 @@ func (this *fsCreated) At() time.Time {
 	return this.info.createdAt
 }
 
-func (this *fsCreated) Remote() common.Remote {
+func (this *fsCreated) Remote() net.Remote {
 	return &this.remote
 }
 
diff --git a/pkg/session/fs-info.go b/pkg/session/fs-info.go
index aeababa..6205f3e 100644
--- a/pkg/session/fs-info.go
+++ b/pkg/session/fs-info.go
@@ -7,8 +7,6 @@ import (
 	"os"
 	"time"
 
-	"github.com/google/uuid"
-
 	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
 	"github.com/engity-com/bifroest/pkg/net"
@@ -63,7 +61,7 @@ func (this *fsInfo) Flow() configuration.FlowName {
 	return this.session.flow
 }
 
-func (this *fsInfo) Id() uuid.UUID {
+func (this *fsInfo) Id() Id {
 	return this.session.id
 }
 
diff --git a/pkg/session/fs-lastaccessed.go b/pkg/session/fs-lastaccessed.go
index 17bbdc3..7b5bf65 100644
--- a/pkg/session/fs-lastaccessed.go
+++ b/pkg/session/fs-lastaccessed.go
@@ -42,7 +42,7 @@ func (this *fsLastAccessed) At() time.Time {
 	return this.at
 }
 
-func (this *fsLastAccessed) Remote() common.Remote {
+func (this *fsLastAccessed) Remote() net.Remote {
 	return &this.remote
 }
 
diff --git a/pkg/session/fs-repository.go b/pkg/session/fs-repository.go
index e4e96e5..23e55bd 100644
--- a/pkg/session/fs-repository.go
+++ b/pkg/session/fs-repository.go
@@ -22,6 +22,7 @@ import (
 	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
 	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/net"
 	"github.com/engity-com/bifroest/pkg/sys"
 )
 
@@ -51,7 +52,7 @@ type FsRepository struct {
 	mutex sync.RWMutex
 }
 
-func (this *FsRepository) dir(flow configuration.FlowName, id uuid.UUID) (string, error) {
+func (this *FsRepository) dir(flow configuration.FlowName, id Id) (string, error) {
 	fs, err := flow.MarshalText()
 	if err != nil {
 		return "", err
@@ -63,7 +64,7 @@ func (this *FsRepository) dir(flow configuration.FlowName, id uuid.UUID) (string
 	return filepath.Join(this.conf.Storage, string(fs), string(is)), nil
 }
 
-func (this *FsRepository) file(flow configuration.FlowName, id uuid.UUID, kind string) (string, error) {
+func (this *FsRepository) file(flow configuration.FlowName, id Id, kind string) (string, error) {
 	dir, err := this.dir(flow, id)
 	if err != nil {
 		return "", err
@@ -71,7 +72,7 @@ func (this *FsRepository) file(flow configuration.FlowName, id uuid.UUID, kind s
 	return filepath.Join(dir, kind), nil
 }
 
-func (this *FsRepository) openRead(flow configuration.FlowName, id uuid.UUID, kind string) (*os.File, string, error) {
+func (this *FsRepository) openRead(flow configuration.FlowName, id Id, kind string) (*os.File, string, error) {
 	fn, err := this.file(flow, id, kind)
 	if err != nil {
 		return nil, "", err
@@ -83,7 +84,7 @@ func (this *FsRepository) openRead(flow configuration.FlowName, id uuid.UUID, ki
 	return f, fn, nil
 }
 
-func (this *FsRepository) openWrite(flow configuration.FlowName, id uuid.UUID, kind string, rw bool) (*os.File, string, error) {
+func (this *FsRepository) openWrite(flow configuration.FlowName, id Id, kind string, rw bool) (*os.File, string, error) {
 	fn, err := this.file(flow, id, kind)
 	if err != nil {
 		return nil, "", err
@@ -100,7 +101,7 @@ func (this *FsRepository) openWrite(flow configuration.FlowName, id uuid.UUID, k
 	return f, fn, nil
 }
 
-func (this *FsRepository) stat(flow configuration.FlowName, id uuid.UUID, kind string) (os.FileInfo, error) {
+func (this *FsRepository) stat(flow configuration.FlowName, id Id, kind string) (os.FileInfo, error) {
 	fn, err := this.file(flow, id, kind)
 	if err != nil {
 		return nil, err
@@ -126,7 +127,7 @@ func (this *FsRepository) dirFileMode() sys.FileMode {
 	return result
 }
 
-func (this *FsRepository) Create(ctx context.Context, flow configuration.FlowName, remote common.Remote, authToken []byte) (Session, error) {
+func (this *FsRepository) Create(ctx context.Context, flow configuration.FlowName, remote net.Remote, authToken []byte) (Session, error) {
 	this.mutex.Lock()
 	defer this.mutex.Unlock()
 
@@ -134,10 +135,11 @@ func (this *FsRepository) Create(ctx context.Context, flow configuration.FlowNam
 		return nil, fmt.Errorf("cannot create session for user %v at flow %v: %w", remote, flow, err)
 	}
 
-	id, err := uuid.NewUUID()
+	vid, err := uuid.NewUUID()
 	if err != nil {
 		return fail(err)
 	}
+	id := Id(vid)
 
 	var sess fs
 	sess.info.VState = StateNew
@@ -160,14 +162,14 @@ func (this *FsRepository) Create(ctx context.Context, flow configuration.FlowNam
 	return &sess, nil
 }
 
-func (this *FsRepository) FindBy(ctx context.Context, flow configuration.FlowName, id uuid.UUID, opts *FindOpts) (Session, error) {
+func (this *FsRepository) FindBy(ctx context.Context, flow configuration.FlowName, id Id, opts *FindOpts) (Session, error) {
 	this.mutex.RLock()
 	defer this.mutex.RUnlock()
 
 	return this.findBy(ctx, flow, id, opts, false)
 }
 
-func (this *FsRepository) findBy(ctx context.Context, flow configuration.FlowName, id uuid.UUID, opts *FindOpts, expectedToExist bool) (*fs, error) {
+func (this *FsRepository) findBy(ctx context.Context, flow configuration.FlowName, id Id, opts *FindOpts, expectedToExist bool) (*fs, error) {
 	cleanUpIfAllowedAndFail := func(err error) (*fs, error) {
 		this.doFindAutoCleanIfAllowed(ctx, flow, id, opts, "found broken session; it was removed entirely", err)
 		return nil, err
@@ -212,7 +214,7 @@ func (this *FsRepository) FindByPublicKey(ctx context.Context, key ssh.PublicKey
 		return nil, fmt.Errorf("cannot find session for public key: %w", err)
 	}
 
-	loadCandidate := func(flow configuration.FlowName, id uuid.UUID) (*fs, error) {
+	loadCandidate := func(flow configuration.FlowName, id Id) (*fs, error) {
 		this.mutex.RLock()
 		defer this.mutex.RUnlock()
 
@@ -233,7 +235,7 @@ func (this *FsRepository) FindByPublicKey(ctx context.Context, key ssh.PublicKey
 			return false, err
 		}
 
-		if err := this.iterateFlowDirs(ctx, flow, func(id uuid.UUID, path string) (bool, error) {
+		if err := this.iterateFlowDirs(ctx, flow, func(id Id, path string) (bool, error) {
 			if err := ctx.Err(); err != nil {
 				return false, err
 			}
@@ -268,7 +270,7 @@ func (this *FsRepository) FindByAccessToken(ctx context.Context, t []byte, opts
 		return nil, fmt.Errorf("cannot find session for public key: %w", err)
 	}
 
-	loadCandidate := func(flow configuration.FlowName, id uuid.UUID) (*fs, error) {
+	loadCandidate := func(flow configuration.FlowName, id Id) (*fs, error) {
 		this.mutex.RLock()
 		defer this.mutex.RUnlock()
 
@@ -289,7 +291,7 @@ func (this *FsRepository) FindByAccessToken(ctx context.Context, t []byte, opts
 			return false, err
 		}
 
-		if err := this.iterateFlowDirs(ctx, flow, func(id uuid.UUID, path string) (bool, error) {
+		if err := this.iterateFlowDirs(ctx, flow, func(id Id, path string) (bool, error) {
 			if err := ctx.Err(); err != nil {
 				return false, err
 			}
@@ -320,7 +322,7 @@ func (this *FsRepository) FindByAccessToken(ctx context.Context, t []byte, opts
 }
 
 func (this *FsRepository) FindAll(ctx context.Context, consumer Consumer, opts *FindOpts) error {
-	loadCandidate := func(flow configuration.FlowName, id uuid.UUID) (*fs, error) {
+	loadCandidate := func(flow configuration.FlowName, id Id) (*fs, error) {
 		this.mutex.RLock()
 		defer this.mutex.RUnlock()
 
@@ -333,7 +335,7 @@ func (this *FsRepository) FindAll(ctx context.Context, consumer Consumer, opts *
 			return false, err
 		}
 
-		err := this.iterateFlowDirs(ctx, flow, func(id uuid.UUID, path string) (bool, error) {
+		err := this.iterateFlowDirs(ctx, flow, func(id Id, path string) (bool, error) {
 			if err := ctx.Err(); err != nil {
 				return false, err
 			}
@@ -352,14 +354,14 @@ func (this *FsRepository) FindAll(ctx context.Context, consumer Consumer, opts *
 	}, opts)
 }
 
-func (this *FsRepository) DeleteBy(ctx context.Context, flow configuration.FlowName, id uuid.UUID) error {
+func (this *FsRepository) DeleteBy(ctx context.Context, flow configuration.FlowName, id Id) error {
 	this.mutex.Lock()
 	defer this.mutex.Unlock()
 
 	return this.deleteBy(ctx, flow, id)
 }
 
-func (this *FsRepository) deleteBy(ctx context.Context, flow configuration.FlowName, id uuid.UUID) error {
+func (this *FsRepository) deleteBy(ctx context.Context, flow configuration.FlowName, id Id) error {
 	dir, err := this.dir(flow, id)
 	if err != nil {
 		return err
@@ -378,7 +380,7 @@ func (this *FsRepository) deleteBy(ctx context.Context, flow configuration.FlowN
 	return nil
 }
 
-func (this *FsRepository) disposeBy(ctx context.Context, flow configuration.FlowName, id uuid.UUID) (bool, error) {
+func (this *FsRepository) disposeBy(ctx context.Context, flow configuration.FlowName, id Id) (bool, error) {
 	var disposed bool
 
 	if this.connectionInterceptors != nil {
@@ -417,7 +419,7 @@ func (this *FsRepository) disposeBy(ctx context.Context, flow configuration.Flow
 	return disposed, nil
 }
 
-func (this *FsRepository) doFindAutoCleanIfAllowed(ctx context.Context, flow configuration.FlowName, id uuid.UUID, opts *FindOpts, successMessage string, cause error) {
+func (this *FsRepository) doFindAutoCleanIfAllowed(ctx context.Context, flow configuration.FlowName, id Id, opts *FindOpts, successMessage string, cause error) {
 	if opts.IsAutoCleanUpAllowed() {
 		logger := opts.GetLogger(this.logger).
 			Withf("sesion", "%v/%v", flow, id)
@@ -606,7 +608,7 @@ func (this *FsRepository) iterateFlows(ctx context.Context, consumer func(flow c
 	return nil
 }
 
-func (this *FsRepository) iterateFlowDirs(ctx context.Context, flow configuration.FlowName, consumer func(id uuid.UUID, path string) (canContinue bool, err error), opts *FindOpts) (rErr error) {
+func (this *FsRepository) iterateFlowDirs(ctx context.Context, flow configuration.FlowName, consumer func(id Id, path string) (canContinue bool, err error), opts *FindOpts) (rErr error) {
 	fs, err := flow.MarshalText()
 	if err != nil {
 		return err
@@ -648,7 +650,7 @@ func (this *FsRepository) iterateFlowDirs(ctx context.Context, flow configuratio
 			this.doFindAutoCleanFlowContentIfAllowed(ctx, flow, filepath.Join(dirName, entry.Name()), opts, "found file inside flow directory which should not be there; it was deleted", nil)
 			continue
 		}
-		var id uuid.UUID
+		var id Id
 		if err := id.UnmarshalText([]byte(entry.Name())); err != nil {
 			this.doFindAutoCleanFlowContentIfAllowed(ctx, flow, filepath.Join(dirName, entry.Name()), opts, "found directory which isn't a UUID inside flow directory which should not be there; it was deleted entirely", nil)
 			// We ignore directories which does not match UUID in their names.
@@ -666,7 +668,7 @@ func (this *FsRepository) iterateFlowDirs(ctx context.Context, flow configuratio
 	return nil
 }
 
-func (this *FsRepository) findPublicKeyIn(ctx context.Context, flow configuration.FlowName, id uuid.UUID, f *os.File, consumer func(key ssh.PublicKey, lineN int) (canContinue bool, _ error)) (lineN int, rErr error) {
+func (this *FsRepository) findPublicKeyIn(ctx context.Context, flow configuration.FlowName, id Id, f *os.File, consumer func(key ssh.PublicKey, lineN int) (canContinue bool, _ error)) (lineN int, rErr error) {
 	failN := func(lineN int, err error) (int, error) {
 		return lineN, fmt.Errorf("cannot handle publicKeys file (%q:%d) of session %v/%v: %w", f.Name(), lineN, flow, id, err)
 	}
@@ -708,7 +710,7 @@ func (this *FsRepository) findPublicKeyIn(ctx context.Context, flow configuratio
 	return lineN, nil
 }
 
-func (this *FsRepository) hasPublicKey(ctx context.Context, flow configuration.FlowName, id uuid.UUID, pub ssh.PublicKey) (found bool, rErr error) {
+func (this *FsRepository) hasPublicKey(ctx context.Context, flow configuration.FlowName, id Id, pub ssh.PublicKey) (found bool, rErr error) {
 	kind := this.publicKeyKind(pub)
 	f, _, err := this.openRead(flow, id, kind)
 	if sys.IsNotExist(err) {
@@ -739,7 +741,7 @@ func (this *FsRepository) hasPublicKey(ctx context.Context, flow configuration.F
 	return found, nil
 }
 
-func (this *FsRepository) addPublicKey(ctx context.Context, flow configuration.FlowName, id uuid.UUID, pub ssh.PublicKey) (rErr error) {
+func (this *FsRepository) addPublicKey(ctx context.Context, flow configuration.FlowName, id Id, pub ssh.PublicKey) (rErr error) {
 	if _, err := this.stat(flow, id, FsFileSession); err != nil {
 		return fmt.Errorf("cannot session's %v/%v last access because cannot stat info: %w", flow, id, err)
 	}
@@ -787,7 +789,7 @@ func (this *FsRepository) addPublicKey(ctx context.Context, flow configuration.F
 	return nil
 }
 
-func (this *FsRepository) deletePublicKey(ctx context.Context, flow configuration.FlowName, id uuid.UUID, pub ssh.PublicKey) (rErr error) {
+func (this *FsRepository) deletePublicKey(ctx context.Context, flow configuration.FlowName, id Id, pub ssh.PublicKey) (rErr error) {
 	kind := this.publicKeyKind(pub)
 	fIn, fn, err := this.openRead(flow, id, kind)
 	if sys.IsNotExist(err) {
@@ -849,7 +851,7 @@ func (this *FsRepository) deletePublicKey(ctx context.Context, flow configuratio
 	return nil
 }
 
-func (this *FsRepository) hasAccessToken(_ context.Context, flow configuration.FlowName, id uuid.UUID, t []byte) (found bool, rErr error) {
+func (this *FsRepository) hasAccessToken(_ context.Context, flow configuration.FlowName, id Id, t []byte) (found bool, rErr error) {
 	f, _, err := this.openRead(flow, id, FsFileAccessToken)
 	if sys.IsNotExist(err) {
 		return false, nil
diff --git a/pkg/session/fs.go b/pkg/session/fs.go
index c949e03..cb367e6 100644
--- a/pkg/session/fs.go
+++ b/pkg/session/fs.go
@@ -7,11 +7,11 @@ import (
 	"os"
 	"time"
 
-	"github.com/google/uuid"
 	"golang.org/x/crypto/ssh"
 
 	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/net"
 	"github.com/engity-com/bifroest/pkg/sys"
 )
 
@@ -28,12 +28,12 @@ type fs struct {
 	repository *FsRepository
 
 	flow configuration.FlowName
-	id   uuid.UUID
+	id   Id
 
 	info fsInfo
 }
 
-func (this *fs) init(repository *FsRepository, flow configuration.FlowName, id uuid.UUID) {
+func (this *fs) init(repository *FsRepository, flow configuration.FlowName, id Id) {
 	this.repository = repository
 	this.flow = flow
 	this.id = id
@@ -48,7 +48,7 @@ func (this *fs) Flow() configuration.FlowName {
 	return this.flow
 }
 
-func (this *fs) Id() uuid.UUID {
+func (this *fs) Id() Id {
 	return this.id
 }
 
@@ -151,11 +151,11 @@ func (this *fs) DeletePublicKey(ctx context.Context, pub ssh.PublicKey) error {
 	return this.repository.deletePublicKey(ctx, this.flow, this.id, pub)
 }
 
-func (this *fs) NotifyLastAccess(ctx context.Context, remote common.Remote, newState State) (State, error) {
+func (this *fs) NotifyLastAccess(ctx context.Context, remote net.Remote, newState State) (State, error) {
 	return this.notifyLastAccess(ctx, remote, newState)
 }
 
-func (this *fs) notifyLastAccess(ctx context.Context, remote common.Remote, newState State) (State, error) {
+func (this *fs) notifyLastAccess(ctx context.Context, remote net.Remote, newState State) (State, error) {
 	var buf fsLastAccessed
 	buf.at = time.Now().Truncate(time.Millisecond)
 	buf.VRemoteUser = remote.User()
diff --git a/pkg/session/id.go b/pkg/session/id.go
new file mode 100644
index 0000000..1e94bae
--- /dev/null
+++ b/pkg/session/id.go
@@ -0,0 +1,105 @@
+package session
+
+import (
+	"bytes"
+
+	"github.com/google/uuid"
+	"github.com/vmihailenco/msgpack/v5"
+
+	"github.com/engity-com/bifroest/pkg/codec"
+)
+
+type Id uuid.UUID
+
+func (this Id) String() string {
+	return uuid.UUID(this).String()
+}
+
+func (this Id) IsZero() bool {
+	for _, v := range this {
+		if v != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+func (this Id) MarshalText() (text []byte, err error) {
+	return uuid.UUID(this).MarshalText()
+}
+
+func (this *Id) UnmarshalText(text []byte) error {
+	var buf uuid.UUID
+	if err := buf.UnmarshalText(text); err != nil {
+		return err
+	}
+	*this = Id(buf)
+	return nil
+}
+
+func (this Id) MarshalBinary() (b []byte, err error) {
+	if this.IsZero() {
+		return nil, nil
+	}
+	return uuid.UUID(this).MarshalBinary()
+}
+
+func (this *Id) UnmarshalBinary(b []byte) error {
+	if len(b) == 0 {
+		*this = Id{}
+		return nil
+	}
+
+	var buf uuid.UUID
+	if err := buf.UnmarshalBinary(b); err != nil {
+		return err
+	}
+	*this = Id(buf)
+	return nil
+}
+
+func (this Id) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this *Id) DecodeMsgpack(dec *msgpack.Decoder) error {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this Id) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	b, err := this.MarshalBinary()
+	if err != nil {
+		return err
+	}
+	return enc.EncodeBytes(b)
+}
+
+func (this *Id) DecodeMsgPack(dec codec.MsgPackDecoder) error {
+	b, err := dec.DecodeBytes()
+	if err != nil {
+		return err
+	}
+	return this.UnmarshalBinary(b)
+}
+
+func (this *Id) Set(text string) error {
+	return this.UnmarshalText([]byte(text))
+}
+
+func (this Id) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case Id:
+		return bytes.Equal(this[:], v[:])
+	case *Id:
+		return bytes.Equal(this[:], (*v)[:])
+	case uuid.UUID:
+		return bytes.Equal(this[:], v[:])
+	case *uuid.UUID:
+		return bytes.Equal(this[:], (*v)[:])
+	default:
+		return false
+	}
+}
diff --git a/pkg/session/info.go b/pkg/session/info.go
index ed3658a..9077140 100644
--- a/pkg/session/info.go
+++ b/pkg/session/info.go
@@ -4,15 +4,13 @@ import (
 	"context"
 	"time"
 
-	"github.com/google/uuid"
-
-	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/net"
 )
 
 type Info interface {
 	Flow() configuration.FlowName
-	Id() uuid.UUID
+	Id() Id
 	State() State
 	Created(context.Context) (InfoCreated, error)
 	LastAccessed(context.Context) (InfoLastAccessed, error)
@@ -24,10 +22,10 @@ type Info interface {
 
 type InfoCreated interface {
 	At() time.Time
-	Remote() common.Remote
+	Remote() net.Remote
 }
 
 type InfoLastAccessed interface {
 	At() time.Time
-	Remote() common.Remote
+	Remote() net.Remote
 }
diff --git a/pkg/session/repository.go b/pkg/session/repository.go
index f7ebcf0..5fcdf67 100644
--- a/pkg/session/repository.go
+++ b/pkg/session/repository.go
@@ -6,11 +6,10 @@ import (
 	"io"
 
 	log "github.com/echocat/slf4g"
-	"github.com/google/uuid"
 	"golang.org/x/crypto/ssh"
 
-	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
+	"github.com/engity-com/bifroest/pkg/net"
 )
 
 var (
@@ -18,14 +17,14 @@ var (
 )
 
 type Repository interface {
-	Create(ctx context.Context, flow configuration.FlowName, remote common.Remote, authToken []byte) (Session, error)
+	Create(ctx context.Context, flow configuration.FlowName, remote net.Remote, authToken []byte) (Session, error)
 
-	FindBy(context.Context, configuration.FlowName, uuid.UUID, *FindOpts) (Session, error)
+	FindBy(context.Context, configuration.FlowName, Id, *FindOpts) (Session, error)
 	FindByPublicKey(context.Context, ssh.PublicKey, *FindOpts) (Session, error)
 	FindByAccessToken(context.Context, []byte, *FindOpts) (Session, error)
 	FindAll(context.Context, Consumer, *FindOpts) error
 
-	DeleteBy(context.Context, configuration.FlowName, uuid.UUID) error
+	DeleteBy(context.Context, configuration.FlowName, Id) error
 	Delete(context.Context, Session) error
 }
 
diff --git a/pkg/session/session.go b/pkg/session/session.go
index ca989d9..23c5a26 100644
--- a/pkg/session/session.go
+++ b/pkg/session/session.go
@@ -3,12 +3,11 @@ package session
 import (
 	"context"
 
-	"github.com/google/uuid"
 	"golang.org/x/crypto/ssh"
 
-	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/configuration"
 	"github.com/engity-com/bifroest/pkg/errors"
+	"github.com/engity-com/bifroest/pkg/net"
 )
 
 var (
@@ -17,7 +16,7 @@ var (
 
 type Session interface {
 	Flow() configuration.FlowName
-	Id() uuid.UUID
+	Id() Id
 	Info(context.Context) (Info, error)
 	AuthorizationToken(context.Context) ([]byte, error)
 	EnvironmentToken(context.Context) ([]byte, error)
@@ -34,7 +33,7 @@ type Session interface {
 	SetEnvironmentToken(context.Context, []byte) error
 	AddPublicKey(context.Context, ssh.PublicKey) error
 	DeletePublicKey(context.Context, ssh.PublicKey) error
-	NotifyLastAccess(ctx context.Context, remote common.Remote, newState State) (oldState State, err error)
+	NotifyLastAccess(ctx context.Context, remote net.Remote, newState State) (oldState State, err error)
 	Dispose(ctx context.Context) (bool, error)
 
 	String() string
diff --git a/pkg/sys/binary-compatibility.go b/pkg/sys/binary-compatibility.go
new file mode 100644
index 0000000..e9e4774
--- /dev/null
+++ b/pkg/sys/binary-compatibility.go
@@ -0,0 +1,49 @@
+package sys
+
+import "runtime"
+
+var binaryCompatibilityMatrix = map[string]map[string]map[string]struct{}{
+	"linux": {
+		"amd64": {
+			"386": struct{}{},
+		},
+		"arm64": {
+			"arm": struct{}{},
+		},
+	},
+	"windows": {
+		"amd64": {
+			"386": struct{}{},
+		},
+		"arm64": {
+			"arm": struct{}{},
+		},
+	},
+}
+
+func IsBinaryCompatibleWithHost(binaryOs, binaryArch, hostOs, hostArch string) bool {
+	if binaryOs != hostOs {
+		return false
+	}
+	if binaryArch == hostArch {
+		return true
+	}
+
+	byOS, ok := binaryCompatibilityMatrix[hostOs]
+	if !ok {
+		return false
+	}
+
+	byArch, ok := byOS[hostArch]
+	if !ok {
+		return false
+	}
+
+	_, ok = byArch[binaryArch]
+
+	return ok
+}
+
+func IsBinaryCompatibleWithArch(binaryArch, hostArch string) bool {
+	return IsBinaryCompatibleWithHost(runtime.GOOS, binaryArch, runtime.GOOS, hostArch)
+}
diff --git a/pkg/sys/channels.go b/pkg/sys/channels.go
new file mode 100644
index 0000000..b2e45d9
--- /dev/null
+++ b/pkg/sys/channels.go
@@ -0,0 +1,10 @@
+package sys
+
+func IsClosedChan[T any](c <-chan T) bool {
+	select {
+	case <-c:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/pkg/sys/copy.go b/pkg/sys/copy.go
new file mode 100644
index 0000000..a4a5162
--- /dev/null
+++ b/pkg/sys/copy.go
@@ -0,0 +1,101 @@
+package sys
+
+import (
+	"context"
+	"io"
+	"sync"
+	"sync/atomic"
+	"syscall"
+	"time"
+
+	"github.com/engity-com/bifroest/pkg/errors"
+)
+
+type FullDuplexCopyOpts struct {
+	OnStart       func()
+	OnEnd         func(l2r, r2l int64, duration time.Duration, err error, wasInL2r *bool)
+	OnStreamStart func(isL2r bool)
+	OnStreamEnd   func(isL2r bool, err error)
+}
+
+func FullDuplexCopy(ctx context.Context, left io.ReadWriter, right io.ReadWriter, opts *FullDuplexCopyOpts) (rErr error) {
+	type done struct {
+		wasL2r bool
+		error  error
+	}
+	dones := make(chan done, 2)
+	var wg sync.WaitGroup
+	var errWasInL2r *bool
+	var l2r, r2l atomic.Int64
+	started := time.Now()
+	go func() {
+		wg.Wait()
+		close(dones)
+
+		if opts != nil {
+			if f := opts.OnEnd; f != nil {
+				f(l2r.Load(), r2l.Load(), time.Since(started), rErr, errWasInL2r)
+			}
+		}
+	}()
+
+	copyFull := func(from io.Reader, to io.Writer, isL2r bool) {
+		defer wg.Done()
+		if opts != nil {
+			if f := opts.OnStreamStart; f != nil {
+				f(isL2r)
+			}
+		}
+
+		n, err := io.Copy(to, from)
+		if isRelevantError(err) {
+			dones <- done{isL2r, err}
+		} else {
+			dones <- done{isL2r, nil}
+		}
+		if isL2r {
+			l2r.Store(n)
+		} else {
+			r2l.Store(n)
+		}
+		if opts != nil {
+			if f := opts.OnStreamEnd; f != nil {
+				f(isL2r, err)
+			}
+		}
+	}
+	wg.Add(2)
+	go copyFull(right, left, false)
+	go copyFull(left, right, true)
+
+	if opts != nil {
+		if f := opts.OnStart; f != nil {
+			f()
+		}
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			if err := ctx.Err(); !isSilentError(err) {
+				errWasInL2r = nil
+				return err
+			}
+			return nil
+		case v := <-dones:
+			if isRelevantError(v.error) {
+				errWasInL2r = &v.wasL2r
+				return v.error
+			}
+			return nil
+		}
+	}
+}
+
+func isSilentError(err error) bool {
+	return errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled)
+}
+
+func isRelevantError(err error) bool {
+	return err != nil && !errors.Is(err, syscall.EIO) && !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF)
+}
diff --git a/pkg/sys/file.go b/pkg/sys/file.go
new file mode 100644
index 0000000..0e5e3ca
--- /dev/null
+++ b/pkg/sys/file.go
@@ -0,0 +1,18 @@
+package sys
+
+import "os"
+
+type CloneableFile interface {
+	Fd() uintptr
+	Name() string
+}
+
+func CloneFile(f CloneableFile) (*os.File, error) {
+	cf, err := cloneFile(f)
+	if err != nil {
+		return nil, &os.PathError{
+			Op: "clone", Path: f.Name(), Err: err,
+		}
+	}
+	return cf, nil
+}
diff --git a/pkg/sys/file_linux.go b/pkg/sys/file_linux.go
new file mode 100644
index 0000000..63f3762
--- /dev/null
+++ b/pkg/sys/file_linux.go
@@ -0,0 +1,17 @@
+//go:build unix
+
+package sys
+
+import (
+	"os"
+	"syscall"
+)
+
+func cloneFile(f CloneableFile) (*os.File, error) {
+	fd, err := syscall.Dup(int(f.Fd()))
+	if err != nil {
+		return nil, err
+	}
+	cloned := os.NewFile(uintptr(fd), f.Name())
+	return cloned, nil
+}
diff --git a/pkg/sys/file_test.go b/pkg/sys/file_test.go
new file mode 100644
index 0000000..4ab1faa
--- /dev/null
+++ b/pkg/sys/file_test.go
@@ -0,0 +1,58 @@
+package sys
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/engity-com/bifroest/pkg/common"
+)
+
+func TestCloneFile(t *testing.T) {
+	dir := t.TempDir()
+	f, err := os.Create(filepath.Join(dir, "just-a-file"))
+	require.NoError(t, err)
+	defer common.IgnoreCloseError(f)
+
+	for lineN := 0; lineN < 10; lineN++ {
+		_, err = fmt.Fprintf(f, "%d:abcdefg", lineN)
+		require.NoError(t, err)
+	}
+	_, err = f.Seek(0, 0)
+	require.NoError(t, err)
+
+	read := func(expectedLineN int, from io.Reader) {
+		expected := fmt.Sprintf("%d:abcdefg", expectedLineN)
+		buf := make([]byte, len(expected))
+		n, err := from.Read(buf)
+		require.NoError(t, err)
+		require.Equal(t, len(expected), n)
+		assert.Equal(t, expected, string(buf[:n]))
+	}
+
+	read(0, f)
+	read(1, f)
+
+	f1, err := CloneFile(f)
+	require.NoError(t, err)
+	read(2, f1)
+	read(3, f1)
+	require.NoError(t, f1.Close())
+
+	read(4, f)
+
+	f2, err := CloneFile(f)
+	require.NoError(t, err)
+	read(5, f2)
+	read(6, f2)
+	require.NoError(t, f2.Close())
+
+	read(7, f)
+	read(8, f)
+	read(9, f)
+}
diff --git a/pkg/sys/file_windows.go b/pkg/sys/file_windows.go
new file mode 100644
index 0000000..6ed33e3
--- /dev/null
+++ b/pkg/sys/file_windows.go
@@ -0,0 +1,19 @@
+//go:build windows
+
+package sys
+
+import (
+	"os"
+
+	"golang.org/x/sys/windows"
+)
+
+func cloneFile(f CloneableFile) (*os.File, error) {
+	var h windows.Handle
+	p := windows.CurrentProcess()
+	if err := windows.DuplicateHandle(p, windows.Handle(f.Fd()), p, &h, 0, false, windows.DUPLICATE_SAME_ACCESS); err != nil {
+		return nil, err
+	}
+	cloned := os.NewFile(uintptr(h), f.Name())
+	return cloned, nil
+}
diff --git a/pkg/sys/os.go b/pkg/sys/os.go
new file mode 100644
index 0000000..94abb5d
--- /dev/null
+++ b/pkg/sys/os.go
@@ -0,0 +1,6 @@
+package sys
+
+const (
+	OsWindows = "windows"
+	OsLinux   = "linux"
+)
diff --git a/pkg/sys/signal.go b/pkg/sys/signal.go
index f1217ab..d57aea7 100644
--- a/pkg/sys/signal.go
+++ b/pkg/sys/signal.go
@@ -3,16 +3,28 @@ package sys
 import (
 	"errors"
 	"fmt"
+	"os"
 	"strconv"
 	"strings"
 	"syscall"
+
+	"github.com/vmihailenco/msgpack/v5"
+
+	"github.com/engity-com/bifroest/pkg/codec"
 )
 
 var (
 	ErrUnknownSignal = errors.New("unknown signal")
 )
 
-type Signal uint8
+type Signal uint16
+
+func (this Signal) SendToProcess(p *os.Process) error {
+	if p == nil {
+		return nil
+	}
+	return this.sendToProcess(p)
+}
 
 func (this Signal) String() string {
 	if this == 0 {
@@ -54,7 +66,7 @@ func (this *Signal) Set(plain string) error {
 	}
 
 	if candidate, ok := strToSignal[plainU]; ok {
-		*this = Signal(candidate)
+		*this = candidate
 		return nil
 	}
 
@@ -97,6 +109,27 @@ func (this Signal) IsEqualTo(other any) bool {
 	}
 }
 
+func (this Signal) EncodeMsgpack(enc *msgpack.Encoder) error {
+	return this.EncodeMsgPack(enc)
+}
+
+func (this *Signal) DecodeMsgpack(dec *msgpack.Decoder) (err error) {
+	return this.DecodeMsgPack(dec)
+}
+
+func (this Signal) EncodeMsgPack(enc codec.MsgPackEncoder) error {
+	return enc.EncodeUint16(uint16(this))
+}
+
+func (this *Signal) DecodeMsgPack(dec codec.MsgPackDecoder) error {
+	v, err := dec.DecodeUint16()
+	if err != nil {
+		return err
+	}
+	*this = Signal(v)
+	return nil
+}
+
 const (
 	prefixSig    = "SIG"
 	prefixSigLen = len(prefixSig)
diff --git a/pkg/sys/signal_unix.go b/pkg/sys/signal_unix.go
index 5a60641..85603cc 100644
--- a/pkg/sys/signal_unix.go
+++ b/pkg/sys/signal_unix.go
@@ -3,6 +3,7 @@
 package sys
 
 import (
+	"os"
 	"syscall"
 )
 
@@ -79,3 +80,7 @@ var (
 		"XFSZ":   SIGXFSZ,
 	}
 )
+
+func (this Signal) sendToProcess(p *os.Process) error {
+	return p.Signal(this.Native())
+}
diff --git a/pkg/sys/signal_windows.go b/pkg/sys/signal_windows.go
index 084b452..0ba8e13 100644
--- a/pkg/sys/signal_windows.go
+++ b/pkg/sys/signal_windows.go
@@ -3,7 +3,12 @@
 package sys
 
 import (
+	"os"
 	"syscall"
+
+	"golang.org/x/sys/windows"
+
+	"github.com/engity-com/bifroest/pkg/errors"
 )
 
 const (
@@ -38,4 +43,32 @@ var (
 		"TERM": SIGTERM,
 		"TRAP": SIGTRAP,
 	}
+
+	dllKernel32                  = windows.NewLazySystemDLL("kernel32.dll")
+	procAttachConsole            = dllKernel32.NewProc("AttachConsole")
+	procSetConsoleCtrlHandler    = dllKernel32.NewProc("SetConsoleCtrlHandler")
+	procGenerateConsoleCtrlEvent = dllKernel32.NewProc("GenerateConsoleCtrlEvent")
 )
+
+func (this Signal) sendToProcess(p *os.Process) error {
+	if this == SIGINT {
+		return this.sendIntToProcess(p)
+	}
+	return p.Signal(this.Native())
+}
+
+func (this Signal) sendIntToProcess(p *os.Process) error {
+	r1, _, err := procAttachConsole.Call(uintptr(p.Pid))
+	if r1 == 0 && !errors.Is(err, syscall.ERROR_ACCESS_DENIED) {
+		return err
+	}
+	r1, _, err = procSetConsoleCtrlHandler.Call(0, 1)
+	if r1 == 0 {
+		return err
+	}
+	r1, _, err = procGenerateConsoleCtrlEvent.Call(windows.CTRL_BREAK_EVENT, uintptr(p.Pid))
+	if r1 == 0 {
+		return err
+	}
+	return nil
+}
diff --git a/pkg/template/bool.go b/pkg/template/bool.go
index c10558d..1a27140 100644
--- a/pkg/template/bool.go
+++ b/pkg/template/bool.go
@@ -10,7 +10,7 @@ import (
 func NewBool(plain string) (Bool, error) {
 	var buf Bool
 	if err := buf.Set(plain); err != nil {
-		return Bool{}, nil
+		return Bool{}, err
 	}
 	return buf, nil
 }
@@ -119,6 +119,10 @@ func (this *Bool) Set(text string) error {
 	return this.UnmarshalText([]byte(text))
 }
 
+func (this Bool) Validate() error {
+	return nil
+}
+
 func (this Bool) IsEqualTo(other any) bool {
 	if other == nil {
 		return false
diff --git a/pkg/template/funcs.go b/pkg/template/funcs.go
index 22af3cf..a444f73 100644
--- a/pkg/template/funcs.go
+++ b/pkg/template/funcs.go
@@ -38,6 +38,7 @@ var (
 		"pathJoin":      path.Join,
 		"fingerprint":   fingerprint,
 		"format":        format,
+		"env":           env,
 	}
 
 	allFuncs template.FuncMap
@@ -345,3 +346,14 @@ func formatDate(what *time.Time, opts ...any) (string, error) {
 
 	return what.Format(layout), nil
 }
+
+func env(key string, or ...string) string {
+	v, ok := os.LookupEnv(key)
+	if ok {
+		return v
+	}
+	if len(or) > 0 {
+		return or[0]
+	}
+	return ""
+}
diff --git a/pkg/template/int64.go b/pkg/template/int64.go
new file mode 100644
index 0000000..3a30758
--- /dev/null
+++ b/pkg/template/int64.go
@@ -0,0 +1,132 @@
+package template
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/engity-com/bifroest/internal/text/template"
+)
+
+func NewInt64(plain string) (Int64, error) {
+	var buf Int64
+	if err := buf.Set(plain); err != nil {
+		return Int64{}, err
+	}
+	return buf, nil
+}
+
+func Int64Of(v int64) Int64 {
+	return Int64{
+		isHardCoded:    true,
+		hardCodedValue: v,
+		plain:          strconv.FormatInt(v, 10),
+	}
+}
+
+func MustNewInt64(plain string) Int64 {
+	buf, err := NewInt64(plain)
+	if err != nil {
+		panic(err)
+	}
+	return buf
+}
+
+type Int64 struct {
+	isHardCoded    bool
+	hardCodedValue int64
+	plain          string
+	tmpl           *template.Template
+}
+
+func (this Int64) Render(data any) (int64, error) {
+	if this.isHardCoded {
+		return this.hardCodedValue, nil
+	}
+
+	if tmpl := this.tmpl; tmpl != nil {
+		var buf strings.Builder
+		if err := tmpl.Execute(&buf, data); err != nil {
+			return 0, err
+		}
+		plain := strings.TrimSpace(buf.String())
+		if len(plain) == 0 {
+			return 0, nil
+		}
+
+		result, err := strconv.ParseInt(plain, 10, 64)
+		if err != nil {
+			return 0, fmt.Errorf("templated int64 results in a value that cannot be parsed as int64: %q", buf.String())
+		}
+		return result, nil
+	}
+	return 0, nil
+}
+
+func (this Int64) IsHardCoded() bool {
+	return this.isHardCoded
+}
+
+func (this Int64) String() string {
+	return this.plain
+}
+
+func (this Int64) IsZero() bool {
+	return len(this.plain) == 0
+}
+
+func (this Int64) MarshalText() (text []byte, err error) {
+	return []byte(this.String()), nil
+}
+
+func (this *Int64) UnmarshalText(text []byte) error {
+	if len(text) == 0 {
+		*this = Int64{
+			isHardCoded:    true,
+			hardCodedValue: 0,
+			plain:          "",
+		}
+		return nil
+	}
+
+	if v, err := strconv.ParseInt(string(text), 10, 64); err == nil {
+		*this = Int64Of(int64(v))
+		return nil
+	}
+
+	tmpl, err := NewTemplate("int64", string(text))
+	if err != nil {
+		return fmt.Errorf("illegal int64 template: %w", err)
+	}
+	*this = Int64{
+		plain: string(text),
+		tmpl:  tmpl,
+	}
+	return nil
+}
+
+func (this *Int64) Set(text string) error {
+	return this.UnmarshalText([]byte(text))
+}
+
+func (this Int64) Validate() error {
+	return nil
+}
+
+func (this Int64) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case Int64:
+		return this.isEqualTo(&v)
+	case *Int64:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this Int64) isEqualTo(other *Int64) bool {
+	return this.plain == other.plain
+}
diff --git a/pkg/template/int64_test.go b/pkg/template/int64_test.go
new file mode 100644
index 0000000..10ae44b
--- /dev/null
+++ b/pkg/template/int64_test.go
@@ -0,0 +1,96 @@
+package template
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestInt64(t *testing.T) {
+	cases := []struct {
+		plain             string
+		data              any
+		expected          int64
+		expectedNewErr    error
+		expectedRenderErr error
+		isHardCoded       bool
+		hardCodedValue    int64
+	}{{
+		data:     map[string]any{"foo": "666"},
+		plain:    "{{.foo}}",
+		expected: 666,
+	}, {
+		data:     map[string]any{"foo": "-11"},
+		plain:    "{{.foo}}",
+		expected: -11,
+	}, {
+		data:              map[string]any{"foobar": "666"},
+		plain:             "{{.foo}}",
+		expectedRenderErr: errors.New(`template: int64:1:2: executing "int64" at <.foo>: map has no entry for key "foo"`),
+	}, {
+		data:              map[string]any{"foo": map[string]any{"bar": "abc"}},
+		plain:             "{{.foo.bars}}",
+		expectedRenderErr: errors.New(`template: int64:1:6: executing "int64" at <.foo.bars>: map has no entry for key "bars"`),
+	}, {
+		data:     map[string]any{"foo": map[string]any{"bar": "666"}},
+		plain:    "{{get .foo `bars`}}",
+		expected: 0,
+	}, {
+		data:     map[string]any{"foo": map[string]any{"bar": nil}},
+		plain:    "{{.foo.bar}}",
+		expected: 0,
+	}, {
+		plain:          "1",
+		expected:       1,
+		isHardCoded:    true,
+		hardCodedValue: 1,
+	}, {
+		plain:          "",
+		expected:       0,
+		isHardCoded:    true,
+		hardCodedValue: 0,
+	}, {
+		plain:          "666",
+		expected:       666,
+		isHardCoded:    true,
+		hardCodedValue: 666,
+	}}
+	for i, c := range cases {
+		t.Run(fmt.Sprintf("case-%d", i), func(t *testing.T) {
+			instance, actualErr := NewInt64(c.plain)
+			if expected := c.expectedNewErr; expected != nil {
+				if actualErr != nil {
+					if actualErr.Error() != expected.Error() {
+						t.Fatalf("expected error: %v; but got: %v", expected, actualErr)
+					}
+				} else {
+					t.Fatalf("expected error %v; but got nothing", expected)
+				}
+			} else if actualErr != nil {
+				t.Fatalf("expected no error; but got: %v", actualErr)
+			}
+
+			assert.Equal(t, c.isHardCoded, instance.isHardCoded)
+			assert.Equal(t, c.hardCodedValue, instance.hardCodedValue)
+
+			actual, actualErr := instance.Render(c.data)
+			if expected := c.expectedRenderErr; expected != nil {
+				if actualErr != nil {
+					if actualErr.Error() != expected.Error() {
+						t.Fatalf("expected error: %v; but got: %v", expected, actualErr)
+					}
+				} else {
+					t.Fatalf("expected error %v; but got nothing", expected)
+				}
+			} else if actualErr != nil {
+				t.Fatalf("expected no error; but got: %v", actualErr)
+			}
+
+			if actual != c.expected {
+				t.Fatalf("expected %v; but got: %v", c.expected, actual)
+			}
+		})
+	}
+}
diff --git a/pkg/template/string.go b/pkg/template/string.go
index d34f31b..06d80f8 100644
--- a/pkg/template/string.go
+++ b/pkg/template/string.go
@@ -11,7 +11,7 @@ import (
 func NewString(plain string) (String, error) {
 	var buf String
 	if err := buf.Set(plain); err != nil {
-		return String{}, nil
+		return String{}, err
 	}
 	return buf, nil
 }
@@ -94,6 +94,10 @@ func (this *String) Set(text string) error {
 	return this.UnmarshalText([]byte(text))
 }
 
+func (this String) Validate() error {
+	return nil
+}
+
 func (this String) IsEqualTo(other any) bool {
 	if other == nil {
 		return false
diff --git a/pkg/template/strings.go b/pkg/template/strings.go
index 5721925..abe4d15 100644
--- a/pkg/template/strings.go
+++ b/pkg/template/strings.go
@@ -41,6 +41,10 @@ func (this Strings) IsZero() bool {
 	return len(this) == 0
 }
 
+func (this Strings) Validate() error {
+	return nil
+}
+
 func (this Strings) IsEqualTo(other any) bool {
 	if other == nil {
 		return false
diff --git a/pkg/template/text-marshaller.go b/pkg/template/text-marshaller.go
index f2bf60f..460966d 100644
--- a/pkg/template/text-marshaller.go
+++ b/pkg/template/text-marshaller.go
@@ -11,7 +11,7 @@ import (
 func NewTextMarshaller[T TextMarshallerArgument, PT TextMarshallerArgumentP[T]](plain string) (TextMarshaller[T, PT], error) {
 	var buf TextMarshaller[T, PT]
 	if err := buf.Set(plain); err != nil {
-		return TextMarshaller[T, PT]{}, nil
+		return TextMarshaller[T, PT]{}, err
 	}
 	return buf, nil
 }
@@ -104,6 +104,10 @@ func (this TextMarshaller[T, PT]) IsEqualTo(other any) bool {
 	}
 }
 
+func (this TextMarshaller[T, PT]) Validate() error {
+	return nil
+}
+
 func (this TextMarshaller[T, PT]) isEqualTo(other *TextMarshaller[T, PT]) bool {
 	return this.plain == other.plain
 }
diff --git a/pkg/template/uint64.go b/pkg/template/uint64.go
index fb37f40..fc42af6 100644
--- a/pkg/template/uint64.go
+++ b/pkg/template/uint64.go
@@ -11,7 +11,7 @@ import (
 func NewUint64(plain string) (Uint64, error) {
 	var buf Uint64
 	if err := buf.Set(plain); err != nil {
-		return Uint64{}, nil
+		return Uint64{}, err
 	}
 	return buf, nil
 }
@@ -109,6 +109,10 @@ func (this *Uint64) Set(text string) error {
 	return this.UnmarshalText([]byte(text))
 }
 
+func (this Uint64) Validate() error {
+	return nil
+}
+
 func (this Uint64) IsEqualTo(other any) bool {
 	if other == nil {
 		return false
diff --git a/pkg/template/url.go b/pkg/template/url.go
new file mode 100644
index 0000000..ce1e64b
--- /dev/null
+++ b/pkg/template/url.go
@@ -0,0 +1,150 @@
+package template
+
+import (
+	"fmt"
+	"net/url"
+	"strings"
+	"text/template/parse"
+
+	"github.com/engity-com/bifroest/internal/text/template"
+)
+
+func NewUrl(plain string) (Url, error) {
+	var buf Url
+	if err := buf.Set(plain); err != nil {
+		return Url{}, err
+	}
+	return buf, nil
+}
+
+func MustNewUrl(plain string) Url {
+	buf, err := NewUrl(plain)
+	if err != nil {
+		panic(err)
+	}
+	return buf
+}
+
+func UrlOf(in *url.URL) Url {
+	if in == nil {
+		return Url{}
+	}
+	return Url{
+		hardCoded: in,
+		plain:     in.String(),
+	}
+}
+
+type Url struct {
+	plain     string
+	hardCoded *url.URL
+	tmpl      *template.Template
+}
+
+func (this Url) Render(data any) (*url.URL, error) {
+	if v := this.hardCoded; v != nil {
+		return v, nil
+	}
+
+	if tmpl := this.tmpl; tmpl != nil {
+		var buf strings.Builder
+		if err := tmpl.Execute(&buf, data); err != nil {
+			return nil, err
+		}
+		if buf.Len() == 0 {
+			return nil, nil
+		}
+		return url.Parse(buf.String())
+	}
+
+	return nil, nil
+}
+
+func (this Url) IsHardCoded() bool {
+	return this.hardCoded != nil
+}
+
+func (this Url) String() string {
+	return this.plain
+}
+
+func (this Url) IsZero() bool {
+	return len(this.plain) == 0
+}
+
+func (this Url) MarshalText() (text []byte, err error) {
+	return []byte(this.String()), nil
+}
+
+func (this *Url) UnmarshalText(text []byte) error {
+	tmpl, err := NewTemplate("url", string(text))
+	if err != nil {
+		return fmt.Errorf("illegal url template: %w", err)
+	}
+	if len(tmpl.Root.Nodes) == 0 {
+		if len(text) == 0 {
+			*this = Url{}
+			return nil
+		}
+
+		parsed, err := url.Parse(string(text))
+		if err != nil {
+			return fmt.Errorf("illegal url template: %w", err)
+		}
+		*this = Url{
+			hardCoded: parsed,
+			plain:     string(text),
+		}
+		return nil
+	}
+	if len(tmpl.Root.Nodes) == 1 {
+		if tn, ok := tmpl.Root.Nodes[0].(*parse.TextNode); ok {
+			if len(tn.Text) == 0 {
+				*this = Url{}
+				return nil
+			}
+
+			parsed, err := url.Parse(string(tn.Text))
+			if err != nil {
+				return fmt.Errorf("illegal url template: %w", err)
+			}
+			*this = Url{
+				hardCoded: parsed,
+				plain:     string(tn.Text),
+			}
+			return nil
+		}
+	}
+
+	*this = Url{
+		plain: string(text),
+		tmpl:  tmpl,
+	}
+	return nil
+}
+
+func (this *Url) Set(text string) error {
+	return this.UnmarshalText([]byte(text))
+}
+
+func (this Url) Validate() error {
+	return nil
+}
+
+func (this Url) IsEqualTo(other any) bool {
+	if other == nil {
+		return false
+	}
+	switch v := other.(type) {
+	case Url:
+		return this.isEqualTo(&v)
+	case *Url:
+		return this.isEqualTo(v)
+	default:
+		return false
+	}
+}
+
+func (this Url) isEqualTo(other *Url) bool {
+	return this.plain == other.plain
+}
diff --git a/pkg/user/etc-colon-repository.go b/pkg/user/etc-colon-repository.go
index a3a79df..d82c7a6 100644
--- a/pkg/user/etc-colon-repository.go
+++ b/pkg/user/etc-colon-repository.go
@@ -20,7 +20,7 @@ import (
 	"github.com/echocat/slf4g/fields"
 	"github.com/fsnotify/fsnotify"
 	"github.com/otiai10/copy"
-	"github.com/shirou/gopsutil/process"
+	"github.com/shirou/gopsutil/v4/process"
 
 	"github.com/engity-com/bifroest/pkg/common"
 	"github.com/engity-com/bifroest/pkg/errors"
@@ -1313,7 +1313,7 @@ func (this *EtcColonRepository) killAllOf(ctx context.Context, uid uint32) error
 		if len(pUids) == 0 {
 			continue
 		}
-		if pUids[0] != int32(uid) {
+		if pUids[0] != uid {
 			continue
 		}