diff --git a/proto/message.proto b/proto/message.proto
index 6c56585..f4d20bc 100644
--- a/proto/message.proto
+++ b/proto/message.proto
@@ -28,6 +28,136 @@ message CastFrame {
 
 // message定义
 
+message ContainerRef {
+  string id = 1;
+  string name = 2;
+}
+
+message ContainerRequest {
+  message List {
+    bool all = 1;
+  }
+
+  message Deploy {
+    ContainerDeployParams params = 1;
+  }
+
+  message Start {
+    ContainerRef target = 1;
+  }
+
+  message Stop {
+    ContainerRef target = 1;
+    uint32 timeout_seconds = 2;
+  }
+
+  message Kill {
+    ContainerRef target = 1;
+    string signal = 2;
+  }
+
+  message Remove {
+    ContainerRef target = 1;
+    bool force = 2;
+    bool remove_volumes = 3;
+  }
+
+  oneof action {
+    List list = 10;
+    Deploy deploy = 11;
+    Start start = 12;
+    Stop stop = 13;
+    Kill kill = 14;
+    Remove remove = 15;
+  }
+}
+
+message ContainerDeployParams {
+  string container_name = 1;
+  string container_dir = 2;
+  ContainerSpec spec = 3;
+}
+
+message ContainerSpec {
+  string image = 1;
+  repeated string command = 2;
+  repeated string entrypoint = 3;
+
+  repeated string env = 4;
+  map<string, string> labels = 5;
+
+  repeated VolumeBind volumes = 6;
+  string user = 7;
+  string working_dir = 8;
+  string hostname = 9;
+
+  repeated PortExpose expose = 10;
+  repeated string networks = 11;
+  string network_mode = 12;
+
+  Healthcheck healthcheck = 13;
+  RestartPolicy restart = 14;
+
+  bool privileged = 15;
+  repeated string cap_add = 16;
+  repeated string cap_drop = 17;
+  repeated DeviceMapping devices = 18;
+
+  ResourceLimits resources = 19;
+  repeated Ulimit ulimits = 20;
+  repeated TmpfsMount tmpfs = 21;
+  map<string, string> sysctls = 22;
+  repeated string extra_hosts = 23;
+}
+
+message VolumeBind {
+  string host_path = 1;
+  string container_path = 2;
+  bool read_only = 3;
+}
+
+message PortExpose {
+  uint32 container_port = 1;
+  string protocol = 2; // tcp / udp
+}
+
+message Healthcheck {
+  repeated string test = 1;
+  uint64 interval_ns = 2;
+  uint64 timeout_ns = 3;
+  uint32 retries = 4;
+}
+
+message RestartPolicy {
+  string name = 1; // no, always, unless-stopped, on-failure
+  uint32 maximum_retry_count = 2;
+}
+
+message DeviceMapping {
+  string host_path = 1;
+  string container_path = 2;
+  string cgroup_permissions = 3; // 默认可填 rwm
+}
+
+message ResourceLimits {
+  uint64 memory_bytes = 1;
+  uint64 memory_reservation_bytes = 2;
+  uint64 nano_cpus = 3;
+  uint64 cpu_shares = 4;
+}
+
+message Ulimit {
+  string name = 1;
+  uint64 soft = 2;
+  uint64 hard = 3;
+}
+
+message TmpfsMount {
+  string path = 1;
+  string options = 2;
+}
+
+
 message AuthRequest {
   bytes uuid = 1;
   bytes username = 2;