feat: add image management functionality with ORAS support

- Implemented image database operations in src/images.ts including listing, retrieving, saving, and deleting images.
- Created migration scripts in src/migrations.ts for managing the images table and related schema changes.
- Introduced ORAS binary setup and image push/pull functionality in src/oras.ts.
- Added subcommands for image management (push, pull, tag, rmi) in src/subcommands.
- Enhanced error handling and validation for image names and states.
- Updated state management in src/state.ts to use a unified DbError class for database operations.
- Improved utility functions in src/utils.ts for image validation and size formatting.

deno.json

···
   "imports": {
     "@cliffy/command": "jsr:@cliffy/command@^1.0.0-rc.8",
     "@cliffy/flags": "jsr:@cliffy/flags@^1.0.0-rc.8",
+    "@cliffy/prompt": "jsr:@cliffy/prompt@^1.0.0-rc.8",
     "@cliffy/table": "jsr:@cliffy/table@^1.0.0-rc.8",
     "@db/sqlite": "jsr:@db/sqlite@^0.12.0",
     "@es-toolkit/es-toolkit": "jsr:@es-toolkit/es-toolkit@^1.41.0",
     "@paralleldrive/cuid2": "npm:@paralleldrive/cuid2@^3.0.4",
     "@soapbox/kysely-deno-sqlite": "jsr:@soapbox/kysely-deno-sqlite@^2.2.0",
     "@std/assert": "jsr:@std/assert@1",
+    "@std/io": "jsr:@std/io@^0.225.2",
+    "@std/path": "jsr:@std/path@^1.1.2",
     "@std/toml": "jsr:@std/toml@^1.0.11",
     "@zod/zod": "jsr:@zod/zod@^4.1.12",
     "chalk": "npm:chalk@^5.6.2",

deno.lock

···
 {
   "version": "5",
   "specifiers": {
+    "jsr:@cliffy/ansi@1.0.0-rc.8": "1.0.0-rc.8",
     "jsr:@cliffy/command@^1.0.0-rc.8": "1.0.0-rc.8",
     "jsr:@cliffy/flags@1.0.0-rc.8": "1.0.0-rc.8",
     "jsr:@cliffy/flags@^1.0.0-rc.8": "1.0.0-rc.8",
     "jsr:@cliffy/internal@1.0.0-rc.8": "1.0.0-rc.8",
+    "jsr:@cliffy/keycode@1.0.0-rc.8": "1.0.0-rc.8",
+    "jsr:@cliffy/prompt@^1.0.0-rc.8": "1.0.0-rc.8",
     "jsr:@cliffy/table@1.0.0-rc.8": "1.0.0-rc.8",
     "jsr:@cliffy/table@^1.0.0-rc.8": "1.0.0-rc.8",
     "jsr:@db/sqlite@0.12": "0.12.0",
···
     "jsr:@soapbox/kysely-deno-sqlite@^2.2.0": "2.2.0",
     "jsr:@std/assert@0.217": "0.217.0",
     "jsr:@std/assert@1": "1.0.15",
+    "jsr:@std/assert@~1.0.6": "1.0.15",
+    "jsr:@std/bytes@^1.0.5": "1.0.6",
     "jsr:@std/collections@^1.1.3": "1.1.3",
     "jsr:@std/encoding@1": "1.0.10",
+    "jsr:@std/encoding@~1.0.5": "1.0.10",
     "jsr:@std/fmt@1": "1.0.8",
     "jsr:@std/fmt@~1.0.2": "1.0.8",
     "jsr:@std/fs@1": "1.0.19",
     "jsr:@std/internal@^1.0.10": "1.0.12",
     "jsr:@std/internal@^1.0.12": "1.0.12",
     "jsr:@std/internal@^1.0.9": "1.0.12",
+    "jsr:@std/io@~0.225.2": "0.225.2",
     "jsr:@std/path@0.217": "0.217.0",
     "jsr:@std/path@1": "1.1.2",
     "jsr:@std/path@^1.1.1": "1.1.2",
+    "jsr:@std/path@^1.1.2": "1.1.2",
+    "jsr:@std/path@~1.0.6": "1.0.9",
     "jsr:@std/text@~1.0.7": "1.0.16",
     "jsr:@std/toml@^1.0.11": "1.0.11",
     "jsr:@zod/zod@^4.1.12": "4.1.12",
···
     "npm:moniker@~0.1.2": "0.1.2"
   },
   "jsr": {
+    "@cliffy/ansi@1.0.0-rc.8": {
+      "integrity": "ba37f10ce55bbfbdd8ddd987f91f029b17bce88385b98ba3058870f3b007b80c",
+      "dependencies": [
+        "jsr:@cliffy/internal",
+        "jsr:@std/encoding@~1.0.5"
+      ]
+    },
     "@cliffy/command@1.0.0-rc.8": {
       "integrity": "758147790797c74a707e5294cc7285df665422a13d2a483437092ffce40b5557",
       "dependencies": [
···
     "@cliffy/internal@1.0.0-rc.8": {
       "integrity": "34cdf2fad9b084b5aed493b138d573f52d4e988767215f7460daf0b918ff43d8"
     },
+    "@cliffy/keycode@1.0.0-rc.8": {
+      "integrity": "76dbf85a67ec0aea2e29ca049b8507b6b3f62a2a971bd744d8d3fc447c177cd9"
+    },
+    "@cliffy/prompt@1.0.0-rc.8": {
+      "integrity": "eba403ea1d47b9971bf2210fa35f4dc7ebd2aba87beec9540ae47552806e2f25",
+      "dependencies": [
+        "jsr:@cliffy/ansi",
+        "jsr:@cliffy/internal",
+        "jsr:@cliffy/keycode",
+        "jsr:@std/assert@~1.0.6",
+        "jsr:@std/fmt@~1.0.2",
+        "jsr:@std/path@~1.0.6",
+        "jsr:@std/text"
+      ]
+    },
     "@cliffy/table@1.0.0-rc.8": {
       "integrity": "8bbcdc2ba5e0061b4b13810a24e6f5c6ab19c09f0cce9eb691ccd76c7c6c9db5",
       "dependencies": [
···
     "@denosaurs/plug@1.1.0": {
       "integrity": "eb2f0b7546c7bca2000d8b0282c54d50d91cf6d75cb26a80df25a6de8c4bc044",
       "dependencies": [
-        "jsr:@std/encoding",
+        "jsr:@std/encoding@1",
         "jsr:@std/fmt@1",
         "jsr:@std/fs",
         "jsr:@std/path@1"
···
       "dependencies": [
         "jsr:@std/internal@^1.0.12"
       ]
+    },
+    "@std/bytes@1.0.6": {
+      "integrity": "f6ac6adbd8ccd99314045f5703e23af0a68d7f7e58364b47d2c7f408aeb5820a"
     },
     "@std/collections@1.1.3": {
       "integrity": "bf8b0818886df6a32b64c7d3b037a425111f28278d69fd0995aeb62777c986b0"
···
     "@std/internal@1.0.12": {
       "integrity": "972a634fd5bc34b242024402972cd5143eac68d8dffaca5eaa4dba30ce17b027"
     },
+    "@std/io@0.225.2": {
+      "integrity": "3c740cd4ee4c082e6cfc86458f47e2ab7cb353dc6234d5e9b1f91a2de5f4d6c7",
+      "dependencies": [
+        "jsr:@std/bytes"
+      ]
+    },
     "@std/path@0.217.0": {
       "integrity": "1217cc25534bca9a2f672d7fe7c6f356e4027df400c0e85c0ef3e4343bc67d11",
       "dependencies": [
         "jsr:@std/assert@0.217"
       ]
+    },
+    "@std/path@1.0.9": {
+      "integrity": "260a49f11edd3db93dd38350bf9cd1b4d1366afa98e81b86167b4e3dd750129e"
     },
     "@std/path@1.1.2": {
       "integrity": "c0b13b97dfe06546d5e16bf3966b1cadf92e1cc83e56ba5476ad8b498d9e3038",
···
     "dependencies": [
       "jsr:@cliffy/command@^1.0.0-rc.8",
       "jsr:@cliffy/flags@^1.0.0-rc.8",
+      "jsr:@cliffy/prompt@^1.0.0-rc.8",
       "jsr:@cliffy/table@^1.0.0-rc.8",
       "jsr:@db/sqlite@0.12",
       "jsr:@es-toolkit/es-toolkit@^1.41.0",
       "jsr:@soapbox/kysely-deno-sqlite@^2.2.0",
       "jsr:@std/assert@1",
+      "jsr:@std/io@~0.225.2",
+      "jsr:@std/path@^1.1.2",
       "jsr:@std/toml@^1.0.11",
       "jsr:@zod/zod@^4.1.12",
       "npm:@paralleldrive/cuid2@^3.0.4",

main.ts

···
 #!/usr/bin/env -S deno run --allow-run --allow-read --allow-env
 
 import { Command } from "@cliffy/command";
+import { Secret } from "@cliffy/prompt/secret";
+import { readAll } from "@std/io";
 import chalk from "chalk";
 import { Effect, pipe } from "effect";
 import pkg from "./deno.json" with { type: "json" };
 import { initVmFile, mergeConfig, parseVmFile } from "./src/config.ts";
 import { CONFIG_FILE_NAME } from "./src/constants.ts";
 import { createBridgeNetworkIfNeeded } from "./src/network.ts";
+import images from "./src/subcommands/images.ts";
 import inspect from "./src/subcommands/inspect.ts";
+import login from "./src/subcommands/login.ts";
+import logout from "./src/subcommands/logout.ts";
 import logs from "./src/subcommands/logs.ts";
 import ps from "./src/subcommands/ps.ts";
+import pull from "./src/subcommands/pull.ts";
+import push from "./src/subcommands/push.ts";
 import restart from "./src/subcommands/restart.ts";
 import rm from "./src/subcommands/rm.ts";
+import rmi from "./src/subcommands/rmi.ts";
+import run from "./src/subcommands/run.ts";
 import start from "./src/subcommands/start.ts";
 import stop from "./src/subcommands/stop.ts";
+import tag from "./src/subcommands/tag.ts";
+
+import { getImage } from "./src/images.ts";
+import { getImageArchivePath } from "./src/mod.ts";
 import {
   createDriveImageIfNeeded,
   downloadIso,
···
     .option(
       "-p, --port-forward <mappings:string>",
       "Port forwarding rules in the format hostPort:guestPort (comma-separated for multiple)",
+    )
+    .option(
+      "--install",
+      "Persist changes to the VM disk image",
     )
     .example(
       "Create a default VM configuration file",
···
     )
     .action(async (options: Options, input?: string) => {
       const program = Effect.gen(function* () {
+        if (input) {
+          const [image, archivePath] = yield* Effect.all([
+            pipe(
+              getImage(input),
+              Effect.catchAll(() => Effect.succeed(null)),
+            ),
+            pipe(
+              getImageArchivePath(input),
+              Effect.catchAll(() => Effect.succeed(null)),
+            ),
+          ]);
+
+          if (image || archivePath) {
+            yield* Effect.tryPromise({
+              try: () => run(input),
+              catch: () => {},
+            });
+            return;
+          }
+        }
+
         const resolvedInput = handleInput(input);
         let isoPath: string | null = resolvedInput;
 
···
           yield* createBridgeNetworkIfNeeded(options.bridge);
         }
 
-        if (!input && !config?.vm?.iso && isValidISOurl(isoPath!)) {
+        if (!input && !config?.vm?.iso && !isValidISOurl(isoPath!)) {
           isoPath = null;
+        }
+
+        if (isValidISOurl(isoPath!)) {
+          isoPath = yield* downloadIso(isoPath!, options);
         }
 
         yield* runQemu(isoPath, options);
···
         `You can edit this file to customize your VM settings and then start the VM with:`,
       );
       console.log(`  ${chalk.greenBright(`dflybsd-up`)}`);
+    })
+    .command(
+      "pull",
+      "Pull VM image from an OCI-compliant registry, e.g., ghcr.io, docker hub",
+    )
+    .arguments("<image:string>")
+    .action(async (_options: unknown, image: string) => {
+      await pull(image);
+    })
+    .command(
+      "push",
+      "Push VM image to an OCI-compliant registry, e.g., ghcr.io, docker hub",
+    )
+    .arguments("<image:string>")
+    .action(async (_options: unknown, image: string) => {
+      await push(image);
+    })
+    .command(
+      "tag",
+      "Create a tag 'image' that refers to the VM image of 'vm-name'",
+    )
+    .arguments("<vm-name:string> <image:string>")
+    .action(async (_options: unknown, vmName: string, image: string) => {
+      await tag(vmName, image);
+    })
+    .command(
+      "login",
+      "Authenticate to an OCI-compliant registry, e.g., ghcr.io, docker.io (docker hub), etc.",
+    )
+    .option("-u, --username <username:string>", "Registry username")
+    .arguments("<registry:string>")
+    .action(async (options: unknown, registry: string) => {
+      const username = (options as { username: string }).username;
+
+      let password: string | undefined;
+      const stdinIsTTY = Deno.stdin.isTerminal();
+
+      if (!stdinIsTTY) {
+        const buffer = await readAll(Deno.stdin);
+        password = new TextDecoder().decode(buffer).trim();
+      } else {
+        password = await Secret.prompt("Registry Password: ");
+      }
+
+      console.log(
+        `Authenticating to registry ${chalk.greenBright(registry)} as ${
+          chalk.greenBright(username)
+        }...`,
+      );
+      await login(username, password, registry);
+    })
+    .command("logout", "Logout from an OCI-compliant registry")
+    .arguments("<registry:string>")
+    .action(async (_options: unknown, registry: string) => {
+      await logout(registry);
+    })
+    .command("images", "List all local VM images")
+    .action(async () => {
+      await images();
+    })
+    .command("rmi", "Remove a local VM image")
+    .arguments("<image:string>")
+    .action(async (_options: unknown, image: string) => {
+      await rmi(image);
+    })
+    .command("run", "Create and run a VM from an image")
+    .arguments("<image:string>")
+    .option("-c, --cpu <type:string>", "Type of CPU to emulate", {
+      default: "host",
+    })
+    .option("-C, --cpus <number:number>", "Number of CPU cores", {
+      default: 2,
+    })
+    .option("-m, --memory <size:string>", "Amount of memory for the VM", {
+      default: "2G",
+    })
+    .option(
+      "-b, --bridge <name:string>",
+      "Name of the network bridge to use for networking (e.g., br0)",
+    )
+    .option(
+      "-d, --detach",
+      "Run VM in the background and print VM name",
+    )
+    .option(
+      "-p, --port-forward <mappings:string>",
+      "Port forwarding rules in the format hostPort:guestPort (comma-separated for multiple)",
+    )
+    .action(async (_options: unknown, image: string) => {
+      await run(image);
     })
     .parse(Deno.args);
 }

src/config.ts

···
     image: _.get(flags, "image", defaultConfig.vm.image!) as string,
     bridge: _.get(flags, "bridge", defaultConfig.network.bridge!) as string,
     size: _.get(flags, "size", defaultConfig.vm.size!) as string,
+    install: _.get(flags, "install", false) as boolean,
   });
 };

src/constants.ts

···
 export const LOGS_DIR: string = `${CONFIG_DIR}/logs`;
 export const EMPTY_DISK_THRESHOLD_KB = 100;
 export const CONFIG_FILE_NAME: string = "vmconfig.toml";
+export const IMAGE_DIR: string = `${CONFIG_DIR}/images`;

src/context.ts

···
 import { DB_PATH } from "./constants.ts";
-import { createDb, type Database, migrateToLatest } from "./db.ts";
+import { createDb, type Database } from "./db.ts";
+import { migrateToLatest } from "./migrations.ts";
 
 export const db: Database = createDb(DB_PATH);
 await migrateToLatest(db);

src/db.ts

···
 import { Database as Sqlite } from "@db/sqlite";
 import { DenoSqlite3Dialect } from "@soapbox/kysely-deno-sqlite";
-import {
-  Kysely,
-  type Migration,
-  type MigrationProvider,
-  Migrator,
-  sql,
-} from "kysely";
+import { Kysely } from "kysely";
 import { CONFIG_DIR } from "./constants.ts";
 import type { STATUS } from "./types.ts";
 
···
 
 export type DatabaseSchema = {
   virtual_machines: VirtualMachine;
+  images: Image;
 };
 
 export type VirtualMachine = {
···
   updatedAt?: string;
 };
 
-const migrations: Record<string, Migration> = {};
-
-const migrationProvider: MigrationProvider = {
-  // deno-lint-ignore require-await
-  async getMigrations() {
-    return migrations;
-  },
-};
-
-migrations["001"] = {
-  async up(db: Kysely<unknown>): Promise<void> {
-    await db.schema
-      .createTable("virtual_machines")
-      .addColumn("id", "varchar", (col) => col.primaryKey())
-      .addColumn("name", "varchar", (col) => col.notNull().unique())
-      .addColumn("bridge", "varchar")
-      .addColumn("macAddress", "varchar", (col) => col.notNull().unique())
-      .addColumn("memory", "varchar", (col) => col.notNull())
-      .addColumn("cpus", "integer", (col) => col.notNull())
-      .addColumn("cpu", "varchar", (col) => col.notNull())
-      .addColumn("diskSize", "varchar", (col) => col.notNull())
-      .addColumn("drivePath", "varchar")
-      .addColumn("version", "varchar", (col) => col.notNull())
-      .addColumn("diskFormat", "varchar")
-      .addColumn("isoPath", "varchar")
-      .addColumn("status", "varchar", (col) => col.notNull())
-      .addColumn("pid", "integer")
-      .addColumn(
-        "createdAt",
-        "varchar",
-        (col) => col.notNull().defaultTo(sql`CURRENT_TIMESTAMP`),
-      )
-      .addColumn(
-        "updatedAt",
-        "varchar",
-        (col) => col.notNull().defaultTo(sql`CURRENT_TIMESTAMP`),
-      )
-      .execute();
-  },
-
-  async down(db: Kysely<unknown>): Promise<void> {
-    await db.schema.dropTable("virtual_machines").execute();
-  },
-};
-
-migrations["002"] = {
-  async up(db: Kysely<unknown>): Promise<void> {
-    await db.schema
-      .alterTable("virtual_machines")
-      .addColumn("portForward", "varchar")
-      .execute();
-  },
-
-  async down(db: Kysely<unknown>): Promise<void> {
-    await db.schema
-      .alterTable("virtual_machines")
-      .dropColumn("portForward")
-      .execute();
-  },
-};
-
-export const migrateToLatest = async (db: Database): Promise<void> => {
-  const migrator = new Migrator({ db, provider: migrationProvider });
-  const { error } = await migrator.migrateToLatest();
-  if (error) throw error;
+export type Image = {
+  id: string;
+  repository: string;
+  tag: string;
+  size: number;
+  path: string;
+  format: string;
+  digest?: string;
+  createdAt?: string;
 };
 
 export type Database = Kysely<DatabaseSchema>;

src/images.ts

···
+import { Data, Effect } from "effect";
+import type { DeleteResult, InsertResult } from "kysely";
+import { ctx } from "./context.ts";
+import type { Image } from "./db.ts";
+
+export class DbError extends Data.TaggedError("DatabaseError")<{
+  message?: string;
+}> {}
+
+export const listImages = (): Effect.Effect<Image[], DbError, never> =>
+  Effect.tryPromise({
+    try: () => ctx.db.selectFrom("images").selectAll().execute(),
+    catch: (error) =>
+      new DbError({
+        message: error instanceof Error ? error.message : String(error),
+      }),
+  });
+
+export const getImage = (
+  id: string,
+): Effect.Effect<Image | undefined, DbError, never> =>
+  Effect.tryPromise({
+    try: () =>
+      ctx.db
+        .selectFrom("images")
+        .selectAll()
+        .where((eb) =>
+          eb.or([
+            eb.and([
+              eb("repository", "=", id.split(":")[0]),
+              eb("tag", "=", id.split(":")[1] || "latest"),
+            ]),
+            eb("id", "=", id),
+            eb("digest", "=", id),
+          ])
+        )
+        .executeTakeFirst(),
+    catch: (error) =>
+      new DbError({
+        message: error instanceof Error ? error.message : String(error),
+      }),
+  });
+
+export const saveImage = (
+  image: Image,
+): Effect.Effect<InsertResult[], DbError, never> =>
+  Effect.tryPromise({
+    try: () =>
+      ctx.db.insertInto("images")
+        .values(image)
+        .onConflict((oc) =>
+          oc
+            .column("repository")
+            .column("tag")
+            .doUpdateSet({
+              size: image.size,
+              path: image.path,
+              format: image.format,
+              digest: image.digest,
+            })
+        )
+        .execute(),
+    catch: (error) =>
+      new DbError({
+        message: error instanceof Error ? error.message : String(error),
+      }),
+  });
+
+export const deleteImage = (
+  id: string,
+): Effect.Effect<DeleteResult[], DbError, never> =>
+  Effect.tryPromise({
+    try: () =>
+      ctx.db.deleteFrom("images").where((eb) =>
+        eb.or([
+          eb.and([
+            eb("repository", "=", id.split(":")[0]),
+            eb("tag", "=", id.split(":")[1] || "latest"),
+          ]),
+          eb("id", "=", id),
+        ])
+      ).execute(),
+    catch: (error) =>
+      new DbError({
+        message: error instanceof Error ? error.message : String(error),
+      }),
+  });

src/migrations.ts

···
+import {
+  type Kysely,
+  type Migration,
+  type MigrationProvider,
+  Migrator,
+  sql,
+} from "kysely";
+import type { Database } from "./db.ts";
+
+const migrations: Record<string, Migration> = {};
+
+const migrationProvider: MigrationProvider = {
+  // deno-lint-ignore require-await
+  async getMigrations() {
+    return migrations;
+  },
+};
+
+migrations["001"] = {
+  async up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+      .createTable("virtual_machines")
+      .addColumn("id", "varchar", (col) => col.primaryKey())
+      .addColumn("name", "varchar", (col) => col.notNull().unique())
+      .addColumn("bridge", "varchar")
+      .addColumn("macAddress", "varchar", (col) => col.notNull().unique())
+      .addColumn("memory", "varchar", (col) => col.notNull())
+      .addColumn("cpus", "integer", (col) => col.notNull())
+      .addColumn("cpu", "varchar", (col) => col.notNull())
+      .addColumn("diskSize", "varchar", (col) => col.notNull())
+      .addColumn("drivePath", "varchar")
+      .addColumn("version", "varchar", (col) => col.notNull())
+      .addColumn("diskFormat", "varchar")
+      .addColumn("isoPath", "varchar")
+      .addColumn("status", "varchar", (col) => col.notNull())
+      .addColumn("pid", "integer")
+      .addColumn(
+        "createdAt",
+        "varchar",
+        (col) => col.notNull().defaultTo(sql`CURRENT_TIMESTAMP`),
+      )
+      .addColumn(
+        "updatedAt",
+        "varchar",
+        (col) => col.notNull().defaultTo(sql`CURRENT_TIMESTAMP`),
+      )
+      .execute();
+  },
+
+  async down(db: Kysely<unknown>): Promise<void> {
+    await db.schema.dropTable("virtual_machines").execute();
+  },
+};
+
+migrations["002"] = {
+  async up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+      .alterTable("virtual_machines")
+      .addColumn("portForward", "varchar")
+      .execute();
+  },
+
+  async down(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+      .alterTable("virtual_machines")
+      .dropColumn("portForward")
+      .execute();
+  },
+};
+
+migrations["003"] = {
+  async up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+      .createTable("images")
+      .addColumn("id", "varchar", (col) => col.primaryKey())
+      .addColumn("repository", "varchar", (col) => col.notNull())
+      .addColumn("tag", "varchar", (col) => col.notNull())
+      .addColumn("size", "integer", (col) => col.notNull())
+      .addColumn("path", "varchar", (col) => col.notNull())
+      .addColumn("createdAt", "varchar", (col) => col.notNull())
+      .execute();
+  },
+
+  async down(db: Kysely<unknown>): Promise<void> {
+    await db.schema.dropTable("images").execute();
+  },
+};
+
+migrations["004"] = {
+  async up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+      .alterTable("images")
+      .addColumn("format", "varchar", (col) => col.notNull().defaultTo("qcow2"))
+      .execute();
+  },
+
+  async down(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+      .alterTable("images")
+      .dropColumn("format")
+      .execute();
+  },
+};
+
+migrations["005"] = {
+  async up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+      .createTable("images_new")
+      .addColumn("id", "varchar", (col) => col.primaryKey())
+      .addColumn("repository", "varchar", (col) => col.notNull())
+      .addColumn("tag", "varchar", (col) => col.notNull())
+      .addColumn("size", "integer", (col) => col.notNull())
+      .addColumn("path", "varchar", (col) => col.notNull())
+      .addColumn("format", "varchar", (col) => col.notNull().defaultTo("qcow2"))
+      .addColumn("createdAt", "varchar", (col) => col.notNull())
+      .addUniqueConstraint("images_repository_tag_unique", [
+        "repository",
+        "tag",
+      ])
+      .execute();
+
+    await sql`
+      INSERT INTO images_new (id, repository, tag, size, path, format, createdAt)
+      SELECT id, repository, tag, size, path, format, createdAt FROM images
+    `.execute(db);
+
+    await db.schema.dropTable("images").execute();
+    await sql`ALTER TABLE images_new RENAME TO images`.execute(db);
+  },
+
+  async down(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+      .createTable("images_old")
+      .addColumn("id", "varchar", (col) => col.primaryKey())
+      .addColumn("repository", "varchar", (col) => col.notNull())
+      .addColumn("tag", "varchar", (col) => col.notNull())
+      .addColumn("size", "integer", (col) => col.notNull())
+      .addColumn("path", "varchar", (col) => col.notNull())
+      .addColumn("format", "varchar", (col) => col.notNull().defaultTo("qcow2"))
+      .addColumn("createdAt", "varchar", (col) => col.notNull())
+      .execute();
+
+    await sql`
+      INSERT INTO images_old (id, repository, tag, size, path, format, createdAt)
+      SELECT id, repository, tag, size, path, format, createdAt FROM images
+    `.execute(db);
+
+    await db.schema.dropTable("images").execute();
+    await sql`ALTER TABLE images_old RENAME TO images`.execute(db);
+  },
+};
+
+migrations["006"] = {
+  async up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+      .createTable("images_new")
+      .addColumn("id", "varchar", (col) => col.primaryKey())
+      .addColumn("repository", "varchar", (col) => col.notNull())
+      .addColumn("tag", "varchar", (col) => col.notNull())
+      .addColumn("size", "integer", (col) => col.notNull())
+      .addColumn("path", "varchar", (col) => col.notNull())
+      .addColumn("format", "varchar", (col) => col.notNull().defaultTo("qcow2"))
+      .addColumn(
+        "createdAt",
+        "varchar",
+        (col) => col.notNull().defaultTo(sql`CURRENT_TIMESTAMP`),
+      )
+      .addUniqueConstraint("images_repository_tag_unique", [
+        "repository",
+        "tag",
+      ])
+      .execute();
+
+    await sql`
+      INSERT INTO images_new (id, repository, tag, size, path, format, createdAt)
+      SELECT id, repository, tag, size, path, format, createdAt FROM images
+    `.execute(db);
+
+    await db.schema.dropTable("images").execute();
+    await sql`ALTER TABLE images_new RENAME TO images`.execute(db);
+  },
+
+  async down(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+      .createTable("images_old")
+      .addColumn("id", "varchar", (col) => col.primaryKey())
+      .addColumn("repository", "varchar", (col) => col.notNull())
+      .addColumn("tag", "varchar", (col) => col.notNull())
+      .addColumn("size", "integer", (col) => col.notNull())
+      .addColumn("path", "varchar", (col) => col.notNull())
+      .addColumn("format", "varchar", (col) => col.notNull().defaultTo("qcow2"))
+      .addColumn("createdAt", "varchar", (col) => col.notNull())
+      .addUniqueConstraint("images_repository_tag_unique", [
+        "repository",
+        "tag",
+      ])
+      .execute();
+
+    await sql`
+      INSERT INTO images_old (id, repository, tag, size, path, format, createdAt)
+      SELECT id, repository, tag, size, path, format, createdAt FROM images
+    `.execute(db);
+  },
+};
+
+migrations["007"] = {
+  async up(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+      .alterTable("images")
+      .addColumn("digest", "varchar")
+      .execute();
+  },
+  async down(db: Kysely<unknown>): Promise<void> {
+    await db.schema
+      .alterTable("images")
+      .dropColumn("digest")
+      .execute();
+  },
+};
+
+export const migrateToLatest = async (db: Database): Promise<void> => {
+  const migrator = new Migrator({ db, provider: migrationProvider });
+  const { error } = await migrator.migrateToLatest();
+  if (error) throw error;
+};

src/mod.ts

···
 export * from "./context.ts";
 export * from "./db.ts";
 export * from "./network.ts";
+export * from "./oras.ts";
 export * from "./state.ts";
 export * from "./types.ts";
 export * from "./utils.ts";

src/oras.ts

···
+import { createId } from "@paralleldrive/cuid2";
+import { basename, dirname } from "@std/path";
+import chalk from "chalk";
+import { Data, Effect, pipe } from "effect";
+import { IMAGE_DIR } from "./constants.ts";
+import { getImage, saveImage } from "./images.ts";
+import { CONFIG_DIR, failOnMissingImage } from "./mod.ts";
+import { du } from "./utils.ts";
+
+const DEFAULT_ORAS_VERSION = "1.3.0";
+
+export class PushImageError extends Data.TaggedError("PushImageError")<{
+  cause?: unknown;
+}> {}
+
+export class PullImageError extends Data.TaggedError("PullImageError")<{
+  cause?: unknown;
+}> {}
+
+export class CreateDirectoryError
+  extends Data.TaggedError("CreateDirectoryError")<{
+    cause?: unknown;
+  }> {}
+
+export class ImageAlreadyPulledError
+  extends Data.TaggedError("ImageAlreadyPulledError")<{
+    name: string;
+  }> {}
+
+export async function setupOrasBinary(): Promise<void> {
+  Deno.env.set(
+    "PATH",
+    `${CONFIG_DIR}/bin:${Deno.env.get("PATH")}`,
+  );
+
+  const oras = new Deno.Command("which", {
+    args: ["oras"],
+    stdout: "null",
+    stderr: "null",
+  })
+    .spawn();
+
+  const orasStatus = await oras.status;
+  if (orasStatus.success) {
+    return;
+  }
+
+  const version = Deno.env.get("ORAS_VERSION") || DEFAULT_ORAS_VERSION;
+
+  console.log(`Downloading ORAS version ${version}...`);
+
+  const os = Deno.build.os;
+  let arch = "amd64";
+
+  if (Deno.build.arch === "aarch64") {
+    arch = "arm64";
+  }
+
+  if (os !== "linux" && os !== "darwin") {
+    console.error("Unsupported OS. Please download ORAS manually.");
+    Deno.exit(1);
+  }
+
+  // https://github.com/oras-project/oras/releases/download/v1.3.0/oras_1.3.0_darwin_amd64.tar.gz
+  const downloadUrl =
+    `https://github.com/oras-project/oras/releases/download/v${version}/oras_${version}_${os}_${arch}.tar.gz`;
+
+  console.log(`Downloading ORAS from ${chalk.greenBright(downloadUrl)}`);
+
+  const downloadProcess = new Deno.Command("curl", {
+    args: ["-L", downloadUrl, "-o", `oras_${version}_${os}_${arch}.tar.gz`],
+    stdout: "inherit",
+    stderr: "inherit",
+    cwd: "/tmp",
+  })
+    .spawn();
+
+  const status = await downloadProcess.status;
+  if (!status.success) {
+    console.error("Failed to download ORAS binary.");
+    Deno.exit(1);
+  }
+
+  console.log("Extracting ORAS binary...");
+
+  const extractProcess = new Deno.Command("tar", {
+    args: [
+      "-xzf",
+      `oras_${version}_${os}_${arch}.tar.gz`,
+      "-C",
+      "./",
+    ],
+    stdout: "inherit",
+    stderr: "inherit",
+    cwd: "/tmp",
+  })
+    .spawn();
+
+  const extractStatus = await extractProcess.status;
+  if (!extractStatus.success) {
+    console.error("Failed to extract ORAS binary.");
+    Deno.exit(1);
+  }
+
+  await Deno.remove(`/tmp/oras_${version}_${os}_${arch}.tar.gz`);
+
+  await Deno.mkdir(`${CONFIG_DIR}/bin`, { recursive: true });
+
+  await Deno.rename(
+    `/tmp/oras`,
+    `${CONFIG_DIR}/bin/oras`,
+  );
+  await Deno.chmod(`${CONFIG_DIR}/bin/oras`, 0o755);
+
+  console.log(
+    `ORAS binary installed at ${
+      chalk.greenBright(
+        `${CONFIG_DIR}/bin/oras`,
+      )
+    }`,
+  );
+}
+
+const archiveImage = (img: { path: string }) =>
+  Effect.tryPromise({
+    try: async () => {
+      console.log("Archiving image for push...");
+      const tarProcess = new Deno.Command("tar", {
+        args: [
+          "-cSzf",
+          `${img.path}.tar.gz`,
+          "-C",
+          dirname(img.path),
+          basename(img.path),
+        ],
+        stdout: "inherit",
+        stderr: "inherit",
+      }).spawn();
+
+      const tarStatus = await tarProcess.status;
+      if (!tarStatus.success) {
+        throw new Error(`Failed to create tar archive for image`);
+      }
+      return `${img.path}.tar.gz`;
+    },
+    catch: (error: unknown) =>
+      new PushImageError({
+        cause: error instanceof Error ? error.message : String(error),
+      }),
+  });
+
+const pushToRegistry = (
+  img: { repository: string; tag: string; path: string },
+) =>
+  Effect.tryPromise({
+    try: async () => {
+      console.log(`Pushing image ${img.repository}...`);
+      const process = new Deno.Command("oras", {
+        args: [
+          "push",
+          `${img.repository}:${img.tag}-amd64`,
+          "--artifact-type",
+          "application/vnd.oci.image.layer.v1.tar",
+          "--annotation",
+          "org.opencontainers.image.architecture=amd64",
+          "--annotation",
+          "org.opencontainers.image.os=openbsd",
+          "--annotation",
+          "org.opencontainers.image.description=QEMU raw disk image",
+          basename(img.path),
+        ],
+        stdout: "inherit",
+        stderr: "inherit",
+        cwd: dirname(img.path),
+      }).spawn();
+
+      const { code } = await process.status;
+      if (code !== 0) {
+        throw new Error(`ORAS push failed with exit code ${code}`);
+      }
+      return img.path;
+    },
+    catch: (error: unknown) =>
+      new PushImageError({
+        cause: error instanceof Error ? error.message : String(error),
+      }),
+  });
+
+const cleanup = (path: string) =>
+  Effect.tryPromise({
+    try: () => Deno.remove(path),
+    catch: (error: unknown) =>
+      new PushImageError({
+        cause: error instanceof Error ? error.message : String(error),
+      }),
+  });
+
+const createImageDirIfMissing = Effect.promise(() =>
+  Deno.mkdir(IMAGE_DIR, { recursive: true })
+);
+
+const checkIfImageAlreadyPulled = (image: string) =>
+  pipe(
+    getImageDigest(image),
+    Effect.flatMap(getImage),
+    Effect.flatMap((img) => {
+      if (img) {
+        return Effect.fail(
+          new ImageAlreadyPulledError({ name: image }),
+        );
+      }
+      return Effect.succeed(void 0);
+    }),
+  );
+
+export const pullFromRegistry = (image: string) =>
+  pipe(
+    Effect.tryPromise({
+      try: async () => {
+        console.log(`Pulling image ${image}`);
+        const process = new Deno.Command("oras", {
+          args: [
+            "pull",
+            `${image}-amd64`,
+          ],
+          stdin: "inherit",
+          stdout: "inherit",
+          stderr: "inherit",
+          cwd: IMAGE_DIR,
+        }).spawn();
+
+        const { code } = await process.status;
+        if (code !== 0) {
+          throw new Error(`ORAS pull failed with exit code ${code}`);
+        }
+      },
+      catch: (error: unknown) =>
+        new PullImageError({
+          cause: error instanceof Error ? error.message : String(error),
+        }),
+    }),
+  );
+
+export const getImageArchivePath = (image: string) =>
+  Effect.tryPromise({
+    try: async () => {
+      const process = new Deno.Command("oras", {
+        args: [
+          "manifest",
+          "fetch",
+          `${image}-amd64`,
+        ],
+        stdout: "piped",
+        stderr: "inherit",
+      }).spawn();
+
+      const { code, stdout } = await process.output();
+      if (code !== 0) {
+        throw new Error(`ORAS manifest fetch failed with exit code ${code}`);
+      }
+
+      const manifest = JSON.parse(new TextDecoder().decode(stdout));
+      const layers = manifest.layers;
+      if (!layers || layers.length === 0) {
+        throw new Error(`No layers found in manifest for image ${image}`);
+      }
+
+      if (
+        !layers[0].annotations ||
+        !layers[0].annotations["org.opencontainers.image.title"]
+      ) {
+        throw new Error(
+          `No title annotation found for layer in image ${image}`,
+        );
+      }
+
+      const path = `${IMAGE_DIR}/${
+        layers[0].annotations["org.opencontainers.image.title"]
+      }`;
+
+      if (!(await Deno.stat(path).catch(() => false))) {
+        throw new Error(`Image archive not found at expected path ${path}`);
+      }
+
+      return path;
+    },
+    catch: (error: unknown) =>
+      new PullImageError({
+        cause: error instanceof Error ? error.message : String(error),
+      }),
+  });
+
+const getImageDigest = (image: string) =>
+  Effect.tryPromise({
+    try: async () => {
+      const process = new Deno.Command("oras", {
+        args: [
+          "manifest",
+          "fetch",
+          `${image}-amd64`,
+        ],
+        stdout: "piped",
+        stderr: "inherit",
+      }).spawn();
+
+      const { code, stdout } = await process.output();
+      if (code !== 0) {
+        throw new Error(`ORAS manifest fetch failed with exit code ${code}`);
+      }
+
+      const manifest = JSON.parse(new TextDecoder().decode(stdout));
+      if (!manifest.layers[0] || !manifest.layers[0].digest) {
+        throw new Error(`No digest found in manifest for image ${image}`);
+      }
+
+      return manifest.layers[0].digest as string;
+    },
+    catch: (error: unknown) =>
+      new PullImageError({
+        cause: error instanceof Error ? error.message : String(error),
+      }),
+  });
+
+const extractImage = (path: string) =>
+  Effect.tryPromise({
+    try: async () => {
+      console.log("Extracting image archive...");
+      const tarProcess = new Deno.Command("tar", {
+        args: [
+          "-xSzf",
+          path,
+          "-C",
+          dirname(path),
+        ],
+        stdout: "inherit",
+        stderr: "inherit",
+        cwd: IMAGE_DIR,
+      }).spawn();
+
+      const tarStatus = await tarProcess.status;
+      if (!tarStatus.success) {
+        throw new Error(`Failed to extract tar archive for image`);
+      }
+      return path.replace(/\.tar\.gz$/, "");
+    },
+    catch: (error: unknown) =>
+      new PullImageError({
+        cause: error instanceof Error ? error.message : String(error),
+      }),
+  });
+
+const savePulledImage = (
+  imagePath: string,
+  digest: string,
+  name: string,
+) =>
+  Effect.gen(function* () {
+    yield* saveImage({
+      id: createId(),
+      repository: name.split(":")[0],
+      tag: name.split(":")[1] || "latest",
+      size: yield* du(imagePath),
+      path: imagePath,
+      format: imagePath.endsWith(".qcow2") ? "qcow2" : "raw",
+      digest,
+    });
+    return `${imagePath}.tar.gz`;
+  });
+
+export const pushImage = (image: string) =>
+  pipe(
+    getImage(image),
+    Effect.flatMap(failOnMissingImage),
+    Effect.flatMap((img) =>
+      pipe(
+        archiveImage(img),
+        Effect.tap((archivedPath) => {
+          img.path = archivedPath;
+          return Effect.succeed(void 0);
+        }),
+        Effect.flatMap(() => pushToRegistry(img)),
+        Effect.flatMap(cleanup),
+      )
+    ),
+  );
+
+export const pullImage = (image: string) =>
+  pipe(
+    Effect.all([createImageDirIfMissing, checkIfImageAlreadyPulled(image)]),
+    Effect.flatMap(() => pullFromRegistry(image)),
+    Effect.flatMap(() => getImageArchivePath(image)),
+    Effect.flatMap(extractImage),
+    Effect.flatMap((imagePath: string) =>
+      Effect.all([
+        Effect.succeed(imagePath),
+        getImageDigest(image),
+        Effect.succeed(image),
+      ])
+    ),
+    Effect.flatMap(([imagePath, digest, image]) =>
+      savePulledImage(imagePath, digest, image)
+    ),
+    Effect.flatMap(cleanup),
+    Effect.catchTag("ImageAlreadyPulledError", () =>
+      Effect.sync(() => console.log(`Image ${image} is already pulled.`))),
+  );

src/state.ts

···
 import { Data, Effect } from "effect";
+import type { DeleteResult, InsertResult, UpdateResult } from "kysely";
 import { ctx } from "./context.ts";
 import type { VirtualMachine } from "./db.ts";
 import type { STATUS } from "./types.ts";
 
-export class DatabaseInsertError
-  extends Data.TaggedError("DatabaseInsertError")<{
-    cause: unknown;
-    message: string;
-  }> {}
-
-export class DatabaseUpdateError
-  extends Data.TaggedError("DatabaseUpdateError")<{
-    cause: unknown;
-    message: string;
-  }> {}
-
-export class DatabaseDeleteError
-  extends Data.TaggedError("DatabaseDeleteError")<{
-    cause: unknown;
-    message: string;
-  }> {}
-
-export class DatabaseQueryError extends Data.TaggedError("DatabaseQueryError")<{
-  cause: unknown;
-  message: string;
+export class DbError extends Data.TaggedError("DatabaseError")<{
+  cause?: unknown;
 }> {}
 
 export class InstanceNotFoundError
   extends Data.TaggedError("InstanceNotFoundError")<{
     name: string;
-    message: string;
+    message?: string;
   }> {}
 
-export const saveInstanceState = (vm: VirtualMachine) =>
+export const saveInstanceState = (
+  vm: VirtualMachine,
+): Effect.Effect<InsertResult[], DbError, never> =>
   Effect.tryPromise({
     try: () =>
       ctx.db.insertInto("virtual_machines")
         .values(vm)
         .execute(),
-    catch: (cause) =>
-      new DatabaseInsertError({
-        cause,
-        message: `Failed to save instance state for VM: ${vm.name}`,
-      }),
+    catch: (error) => new DbError({ cause: error }),
   });
 
 export const updateInstanceState = (
   name: string,
   status: STATUS,
   pid?: number,
-) =>
+): Effect.Effect<UpdateResult[], DbError, never> =>
   Effect.tryPromise({
     try: () =>
       ctx.db.updateTable("virtual_machines")
-        .set({ status, pid, updatedAt: new Date().toISOString() })
+        .set({
+          status,
+          pid,
+          updatedAt: new Date().toISOString(),
+        })
         .where((eb) =>
           eb.or([
             eb("name", "=", name),
···
           ])
         )
         .execute(),
-    catch: (cause) =>
-      new DatabaseUpdateError({
-        cause,
-        message: `Failed to update instance state for: ${name}`,
-      }),
+    catch: (error) => new DbError({ cause: error }),
   });
 
-export const removeInstanceState = (name: string) =>
+export const removeInstanceState = (
+  name: string,
+): Effect.Effect<DeleteResult[], DbError, never> =>
   Effect.tryPromise({
     try: () =>
       ctx.db.deleteFrom("virtual_machines")
···
           ])
         )
         .execute(),
-    catch: (cause) =>
-      new DatabaseDeleteError({
-        cause,
-        message: `Failed to remove instance state for: ${name}`,
-      }),
+    catch: (error) => new DbError({ cause: error }),
   });
 
-export const getInstanceState = (name: string) =>
+export const getInstanceState = (
+  name: string,
+): Effect.Effect<VirtualMachine | undefined, DbError, never> =>
   Effect.tryPromise({
     try: () =>
       ctx.db.selectFrom("virtual_machines")
···
           ])
         )
         .executeTakeFirst(),
-    catch: (cause) =>
-      new DatabaseQueryError({
-        cause,
-        message: `Failed to query instance state for: ${name}`,
-      }),
+    catch: (error) => new DbError({ cause: error }),
   });
 
 export const getInstanceStateOrFail = (name: string) =>

src/subcommands/images.ts

···
+import { Table } from "@cliffy/table";
+import dayjs from "dayjs";
+import relativeTime from "dayjs/plugin/relativeTime.js";
+import utc from "dayjs/plugin/utc.js";
+import { Effect, pipe } from "effect";
+import type { Image } from "../db.ts";
+import { type DbError, listImages } from "../images.ts";
+import { humanFileSize } from "../utils.ts";
+
+dayjs.extend(relativeTime);
+dayjs.extend(utc);
+
+const createTable = () =>
+  Effect.succeed(
+    new Table(
+      ["REPOSITORY", "TAG", "IMAGE ID", "CREATED", "SIZE"],
+    ),
+  );
+
+const populateTable = (table: Table, images: Image[]) =>
+  Effect.gen(function* () {
+    for (const image of images) {
+      table.push([
+        image.repository,
+        image.tag,
+        image.id,
+        dayjs.utc(image.createdAt).local().fromNow(),
+        yield* humanFileSize(image.size),
+      ]);
+    }
+    return table;
+  });
+
+const displayTable = (table: Table) =>
+  Effect.sync(() => {
+    console.log(table.padding(2).toString());
+  });
+
+const handleError = (error: DbError | Error) =>
+  Effect.sync(() => {
+    console.error(`Failed to fetch virtual machines: ${error}`);
+    Deno.exit(1);
+  });
+
+const lsEffect = () =>
+  pipe(
+    Effect.all([listImages(), createTable()]),
+    Effect.flatMap(([images, table]) => populateTable(table, images)),
+    Effect.flatMap(displayTable),
+    Effect.catchAll(handleError),
+  );
+
+export default async function () {
+  await Effect.runPromise(lsEffect());
+}

src/subcommands/inspect.ts

···
-import { Effect, pipe } from "effect";
-import { getInstanceStateOrFail } from "../state.ts";
+import { Data, Effect, pipe } from "effect";
+import type { Image, VirtualMachine } from "../db.ts";
+import { getImage } from "../images.ts";
+import { getInstanceState } from "../state.ts";
+
+class ItemNotFoundError extends Data.TaggedError("ItemNotFoundError")<{
+  name: string;
+}> {}
 
-const inspectVirtualMachine = (name: string) =>
+const find = (name: string) =>
   pipe(
-    getInstanceStateOrFail(name),
-    Effect.tap((vm) =>
-      Effect.sync(() => {
-        console.log(vm);
-      })
+    Effect.all([getInstanceState(name), getImage(name)]),
+    Effect.flatMap(([vm, image]) =>
+      vm || image
+        ? Effect.succeed(vm || image)
+        : Effect.fail(new ItemNotFoundError({ name }))
     ),
   );
 
-export default async function (name: string) {
-  const program = pipe(
-    inspectVirtualMachine(name),
-    Effect.catchTags({
-      InstanceNotFoundError: (_error) =>
-        Effect.sync(() => {
-          console.error(`Virtual machine with name or ID ${name} not found.`);
-          Deno.exit(1);
-        }),
-      DatabaseQueryError: (error) =>
-        Effect.sync(() => {
-          console.error(`Database error: ${error.message}`);
-          Deno.exit(1);
-        }),
-    }),
-    Effect.catchAll((error) =>
-      Effect.sync(() => {
-        console.error(`Error: ${String(error)}`);
-        Deno.exit(1);
-      })
-    ),
+const display = (vm: VirtualMachine | Image | undefined) =>
+  Effect.sync(() => {
+    console.log(vm);
+  });
+
+const handleError = (error: ItemNotFoundError | Error) =>
+  Effect.sync(() => {
+    if (error instanceof ItemNotFoundError) {
+      console.error(
+        `Virtual machine with name or ID ${error.name} not found.`,
+      );
+    } else {
+      console.error(`An error occurred: ${error}`);
+    }
+    Deno.exit(1);
+  });
+
+const inspectEffect = (name: string) =>
+  pipe(
+    find(name),
+    Effect.flatMap(display),
+    Effect.catchAll(handleError),
   );
 
-  await Effect.runPromise(program);
+export default async function (name: string) {
+  await Effect.runPromise(inspectEffect(name));
 }

src/subcommands/login.ts

···
+import { setupOrasBinary } from "../oras.ts";
+
+export default async function (
+  username: string,
+  password: string,
+  reqistry: string,
+) {
+  await setupOrasBinary();
+
+  const cmd = new Deno.Command("oras", {
+    args: [
+      "login",
+      "--username",
+      username,
+      "--password-stdin",
+      reqistry,
+    ],
+    stdin: "piped",
+    stderr: "inherit",
+    stdout: "inherit",
+  });
+
+  const process = cmd.spawn();
+  if (process.stdin) {
+    const writer = process.stdin.getWriter();
+    await writer.write(new TextEncoder().encode(password + "\n"));
+    writer.close();
+  }
+
+  const status = await process.status;
+
+  if (!status.success) {
+    Deno.exit(status.code);
+  }
+}

src/subcommands/logout.ts

···
+import { setupOrasBinary } from "../oras.ts";
+
+export default async function (registry: string) {
+  await setupOrasBinary();
+
+  const cmd = new Deno.Command("oras", {
+    args: ["logout", registry],
+    stderr: "inherit",
+    stdout: "inherit",
+  });
+
+  const process = cmd.spawn();
+
+  const status = await process.status;
+
+  if (!status.success) {
+    Deno.exit(status.code);
+  }
+}

src/subcommands/pull.ts

···
+import { Effect, pipe } from "effect";
+import { pullImage, setupOrasBinary } from "../oras.ts";
+import { validateImage } from "../utils.ts";
+
+export default async function (image: string): Promise<void> {
+  await Effect.runPromise(
+    pipe(
+      Effect.promise(() => setupOrasBinary()),
+      Effect.tap(() => validateImage(image)),
+      Effect.tap(() => pullImage(image)),
+      Effect.catchAll((error) =>
+        Effect.sync(() => {
+          console.error(`Failed to pull image: ${error.cause}`);
+          Deno.exit(1);
+        })
+      ),
+    ),
+  );
+}

src/subcommands/push.ts

···
+import { Effect, pipe } from "effect";
+import { pushImage, setupOrasBinary } from "../oras.ts";
+import { validateImage } from "../utils.ts";
+
+export default async function (image: string): Promise<void> {
+  await Effect.runPromise(
+    pipe(
+      Effect.promise(() => setupOrasBinary()),
+      Effect.tap(() => validateImage(image)),
+      Effect.tap(() => pushImage(image)),
+      Effect.catchAll((error) =>
+        Effect.sync(() => {
+          console.error(`Failed to push image: ${error.cause}`);
+          Deno.exit(1);
+        })
+      ),
+    ),
+  );
+}

src/subcommands/restart.ts

···
           );
           Deno.exit(1);
         }),
-      DatabaseQueryError: (error) =>
-        Effect.sync(() => {
-          console.error(`Database error: ${error.message}`);
-          Deno.exit(1);
-        }),
-      DatabaseUpdateError: (error) =>
-        Effect.sync(() => {
-          console.error(`Failed to update database: ${error.message}`);
-          Deno.exit(1);
-        }),
     }),
     Effect.catchAll((error) =>
       Effect.sync(() => {

src/subcommands/rmi.ts

···
+import { Effect, pipe } from "effect";
+import { deleteImage, getImage } from "../images.ts";
+import { failOnMissingImage } from "../utils.ts";
+
+export default async function (id: string) {
+  await Effect.runPromise(
+    pipe(
+      getImage(id),
+      Effect.flatMap(failOnMissingImage),
+      Effect.tap(() => deleteImage(id)),
+      Effect.tap(() => console.log(`Image ${id} removed successfully.`)),
+      Effect.catchAll((error) =>
+        Effect.sync(() => {
+          console.error(`Failed to remove image: ${error.message}`);
+          Deno.exit(1);
+        })
+      ),
+    ),
+  );
+}

src/subcommands/run.ts

···
+import { parseFlags } from "@cliffy/flags";
+import { Effect, pipe } from "effect";
+import type { Image } from "../db.ts";
+import { getImage } from "../images.ts";
+import { createBridgeNetworkIfNeeded } from "../network.ts";
+import { pullImage, PullImageError, setupOrasBinary } from "../oras.ts";
+import { type Options, runQemu, validateImage } from "../utils.ts";
+
+const pullImageOnMissing = (
+  name: string,
+): Effect.Effect<Image, Error, never> =>
+  pipe(
+    getImage(name),
+    Effect.flatMap((img) => {
+      if (img) {
+        return Effect.succeed(img);
+      }
+      console.log(`Image ${name} not found locally`);
+      return pipe(
+        pullImage(name),
+        Effect.flatMap(() => getImage(name)),
+        Effect.flatMap((pulledImg) =>
+          pulledImg ? Effect.succeed(pulledImg) : Effect.fail(
+            new PullImageError({ cause: "Failed to pull image" }),
+          )
+        ),
+      );
+    }),
+  );
+
+const runImage = (image: Image) =>
+  Effect.gen(function* () {
+    console.log(`Running image ${image.repository}...`);
+    const options = mergeFlags(image);
+    if (options.bridge) {
+      yield* createBridgeNetworkIfNeeded(options.bridge);
+    }
+    yield* runQemu(null, options);
+  });
+
+export default async function (
+  image: string,
+): Promise<void> {
+  await Effect.runPromise(
+    pipe(
+      Effect.promise(() => setupOrasBinary()),
+      Effect.tap(() => validateImage(image)),
+      Effect.flatMap(() => pullImageOnMissing(image)),
+      Effect.flatMap(runImage),
+      Effect.catchAll((error) =>
+        Effect.sync(() => {
+          console.error(`Failed to run image: ${error.cause} ${image}`);
+          Deno.exit(1);
+        })
+      ),
+    ),
+  );
+}
+
+function mergeFlags(image: Image): Options {
+  const { flags } = parseFlags(Deno.args);
+  return {
+    cpu: flags.cpu ? flags.cpu : "host",
+    cpus: flags.cpus ? flags.cpus : 2,
+    memory: flags.memory ? flags.memory : "2G",
+    image: image.path,
+    bridge: flags.bridge,
+    portForward: flags.portForward,
+    detach: flags.detach,
+    install: false,
+    diskFormat: image.format,
+  };
+}

src/subcommands/tag.ts

···
+import { createId } from "@paralleldrive/cuid2";
+import { Effect, pipe } from "effect";
+import { saveImage } from "../images.ts";
+import { getInstanceState, type VirtualMachine } from "../mod.ts";
+import { du, extractTag } from "../utils.ts";
+
+const failIfNoVM = (
+  [vm, tag]: [VirtualMachine | undefined, string],
+) =>
+  Effect.gen(function* () {
+    if (!vm) {
+      throw new Error(`VM with name ${name} not found`);
+    }
+    if (!vm.drivePath) {
+      throw new Error(`VM with name ${name} has no drive attached`);
+    }
+
+    const size = yield* du(vm.drivePath);
+
+    return [vm, tag, size] as [VirtualMachine, string, number];
+  });
+
+export default async function (name: string, image: string) {
+  await Effect.runPromise(
+    pipe(
+      Effect.all([getInstanceState(name), extractTag(image)]),
+      Effect.flatMap(failIfNoVM),
+      Effect.flatMap(([vm, tag, size]) =>
+        saveImage({
+          id: createId(),
+          repository: image.split(":")[0],
+          tag,
+          size,
+          path: vm.drivePath!,
+          format: vm.diskFormat,
+        })
+      ),
+      Effect.catchAll((error) =>
+        Effect.sync(() => {
+          console.error(`Failed to tag image: ${error.cause}`);
+          Deno.exit(1);
+        })
+      ),
+    ),
+  );
+}

src/utils.ts

···
 import { Data, Effect, pipe } from "effect";
 import Moniker from "moniker";
 import { EMPTY_DISK_THRESHOLD_KB, LOGS_DIR } from "./constants.ts";
+import type { Image } from "./db.ts";
 import { generateRandomMacAddress } from "./network.ts";
 import { saveInstanceState, updateInstanceState } from "./state.ts";
 
···
   cause: unknown;
   message: string;
   pid: number;
+}> {}
+
+class InvalidImageNameError extends Data.TaggedError("InvalidImageNameError")<{
+  image: string;
+  cause?: unknown;
+}> {}
+
+class NoSuchImageError extends Data.TaggedError("NoSuchImageError")<{
+  cause: string;
 }> {}
 
 export const DEFAULT_VERSION = "6.4.2";
···
   bridge?: string;
   portForward?: string;
   detach?: boolean;
+  install?: boolean;
 }
 
+export const getCurrentArch = (): string => {
+  switch (Deno.build.arch) {
+    case "x86_64":
+      return "amd64";
+    case "aarch64":
+      return "arm64";
+    default:
+      return Deno.build.arch;
+  }
+};
+
 export const isValidISOurl = (url?: string): boolean => {
   return Boolean(
     (url?.startsWith("http://") || url?.startsWith("https://")) &&
···
   );
 };
 
-const du = (path: string) =>
+export const humanFileSize = (blocks: number) =>
+  Effect.sync(() => {
+    const blockSize = 512; // bytes per block
+    let bytes = blocks * blockSize;
+    const thresh = 1024;
+
+    if (Math.abs(bytes) < thresh) {
+      return `${bytes}B`;
+    }
+
+    const units = ["KB", "MB", "GB", "TB", "PB", "EB", "ZB", "YB"];
+    let u = -1;
+
+    do {
+      bytes /= thresh;
+      ++u;
+    } while (Math.abs(bytes) >= thresh && u < units.length - 1);
+
+    return `${bytes.toFixed(1)}${units[u]}`;
+  });
+
+export const validateImage = (
+  image: string,
+): Effect.Effect<string, InvalidImageNameError, never> => {
+  const regex =
+    /^(?:[a-zA-Z0-9.-]+(?:\.[a-zA-Z0-9.-]+)*\/)?[a-z0-9]+(?:[._-][a-z0-9]+)*\/[a-z0-9]+(?:[._-][a-z0-9]+)*(?::[a-zA-Z0-9._-]+)?$/;
+
+  if (!regex.test(image)) {
+    return Effect.fail(
+      new InvalidImageNameError({
+        image,
+        cause:
+          "Image name does not conform to expected format. Should be in the format 'repository/name:tag'.",
+      }),
+    );
+  }
+  return Effect.succeed(image);
+};
+
+export const extractTag = (name: string) =>
+  pipe(
+    validateImage(name),
+    Effect.flatMap((image) => Effect.succeed(image.split(":")[1] || "latest")),
+  );
+
+export const failOnMissingImage = (
+  image: Image | undefined,
+): Effect.Effect<Image, Error, never> =>
+  image
+    ? Effect.succeed(image)
+    : Effect.fail(new NoSuchImageError({ cause: "No such image" }));
+
+export const du = (path: string) =>
   Effect.tryPromise({
     try: async () => {
       const cmd = new Deno.Command("du", {
···
     : setupNATNetworkArgs(options.portForward),
   "-device",
   `e1000,netdev=net0,mac=${macAddress}`,
+  ...(options.install ? [] : ["-snapshot"]),
   "-display",
   "none",
   "-vga",