diff --git a/.tool-versions b/.tool-versions
index d554c9c..1ade732 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1 +1 @@
-ruby 3.3.3
+ruby 2.7.4
diff --git a/lib/kuby/basic_logger.rb b/lib/kuby/basic_logger.rb
index 9826500..02e7cb1 100644
--- a/lib/kuby/basic_logger.rb
+++ b/lib/kuby/basic_logger.rb
@@ -5,25 +5,25 @@
 
 module Kuby
   class BasicLogger < Logger
-    # extend T::Sig
+    extend T::Sig
 
-    # T::Sig::WithoutRuntime.sig {
-    #   override.params(
-    #     logdev: T.any(String, IO, StringIO, NilClass),
-    #     shift_age: Integer,
-    #     shift_size: Integer,
-    #     level: Integer,
-    #     progname: T.nilable(String),
-    #     formatter: T.nilable(FormatterProcType),
-    #     datetime_format: T.nilable(String),
-    #     shift_period_suffix: T.nilable(String)
-    #   ).void
-    # }
+    T::Sig::WithoutRuntime.sig {
+      override.params(
+        logdev: T.any(String, IO, StringIO, NilClass),
+        shift_age: Integer,
+        shift_size: Integer,
+        level: Integer,
+        progname: T.nilable(String),
+        formatter: T.nilable(FormatterProcType),
+        datetime_format: T.nilable(String),
+        shift_period_suffix: T.nilable(String)
+      ).void
+    }
     def initialize(
         logdev, shift_age = 0, shift_size = 1048576, level: DEBUG,
         progname: nil, formatter: nil, datetime_format: nil,
         shift_period_suffix: '%Y%m%d')
-      # @logdev = T.let(@logdev, T.nilable(Logger::LogDevice))
+      @logdev = T.let(@logdev, T.nilable(Logger::LogDevice))
 
       super
 
@@ -32,12 +32,12 @@ def initialize(
       end
     end
 
-    # T::Sig::WithoutRuntime.sig {
-    #   override.params(
-    #     progname_or_msg: T.untyped,
-    #     block: T.nilable(T.proc.returns(T.untyped))
-    #   ).void
-    # }
+    T::Sig::WithoutRuntime.sig {
+      override.params(
+        progname_or_msg: T.untyped,
+        block: T.nilable(T.proc.returns(T.untyped))
+      ).void
+    }
     def info(progname_or_msg = nil, &block)
       if block
         super(progname_or_msg) { ColorizedString[block.call].yellow }
@@ -46,12 +46,12 @@ def info(progname_or_msg = nil, &block)
       end
     end
 
-    # T::Sig::WithoutRuntime.sig {
-    #   override.params(
-    #     progname_or_msg: T.untyped,
-    #     block: T.nilable(T.proc.returns(T.untyped))
-    #   ).void
-    # }
+    T::Sig::WithoutRuntime.sig {
+      override.params(
+        progname_or_msg: T.untyped,
+        block: T.nilable(T.proc.returns(T.untyped))
+      ).void
+    }
     def fatal(progname_or_msg = nil, &block)
       if block
         super(progname_or_msg) { ColorizedString[block.call].red }
@@ -61,13 +61,13 @@ def fatal(progname_or_msg = nil, &block)
     end
 
     # adhere to the "CLI" interface
-    # T::Sig::WithoutRuntime.sig {
-    #   params(
-    #     out: T.any(IO, StringIO),
-    #     err: T.any(IO, StringIO),
-    #     block: T.proc.void
-    #   ).void
-    # }
+    T::Sig::WithoutRuntime.sig {
+      params(
+        out: T.any(IO, StringIO),
+        err: T.any(IO, StringIO),
+        block: T.proc.void
+      ).void
+    }
     def with_pipes(out = STDOUT, err = STDERR, &block)
       previous_logdev = @logdev&.dev || STDERR
       reopen(err)
@@ -76,7 +76,7 @@ def with_pipes(out = STDOUT, err = STDERR, &block)
       reopen(previous_logdev)
     end
 
-    # T::Sig::WithoutRuntime.sig { returns(T.nilable(Process::Status)) }
+    T::Sig::WithoutRuntime.sig { returns(T.nilable(Process::Status)) }
     def last_status
       nil
     end
diff --git a/lib/kuby/cli_base.rb b/lib/kuby/cli_base.rb
index 18e55b2..82076e1 100644
--- a/lib/kuby/cli_base.rb
+++ b/lib/kuby/cli_base.rb
@@ -5,39 +5,39 @@
 
 module Kuby
   class CLIBase
-    # extend T::Sig
+    extend T::Sig
 
-    # BeforeCallback = T.type_alias { T.proc.params(cmd: T::Array[String]).void }
-    # AfterCallback = T.type_alias do
-    #   T.proc.params(cmd: T::Array[String], last_status: T.nilable(Process::Status)).void
-    # end
+    BeforeCallback = T.type_alias { T.proc.params(cmd: T::Array[String]).void }
+    AfterCallback = T.type_alias do
+      T.proc.params(cmd: T::Array[String], last_status: T.nilable(Process::Status)).void
+    end
 
-    # T::Sig::WithoutRuntime.sig { returns(T.nilable(Process::Status)) }
+    T::Sig::WithoutRuntime.sig { returns(T.nilable(Process::Status)) }
     def last_status
       Thread.current[status_key]
     end
 
-    # T::Sig::WithoutRuntime.sig { params(block: BeforeCallback).void }
+    T::Sig::WithoutRuntime.sig { params(block: BeforeCallback).void }
     def before_execute(&block)
-      # @before_execute = T.let(@before_execute, T.nilable(T::Array[BeforeCallback]))
+      @before_execute = T.let(@before_execute, T.nilable(T::Array[BeforeCallback]))
       @before_execute ||= []
       @before_execute << block
     end
 
-    # T::Sig::WithoutRuntime.sig { params(block: AfterCallback).void }
+    T::Sig::WithoutRuntime.sig { params(block: AfterCallback).void }
     def after_execute(&block)
-      # @after_execute = T.let(@after_execute, T.nilable(T::Array[AfterCallback]))
+      @after_execute = T.let(@after_execute, T.nilable(T::Array[AfterCallback]))
       @after_execute ||= []
       @after_execute << block
     end
 
-    # T::Sig::WithoutRuntime.sig {
-    #   params(
-    #     out: T.any(IO, StringIO),
-    #     err: T.any(IO, StringIO),
-    #     block: T.proc.void
-    #   ).void
-    # }
+    T::Sig::WithoutRuntime.sig {
+      params(
+        out: T.any(IO, StringIO),
+        err: T.any(IO, StringIO),
+        block: T.proc.void
+      ).void
+    }
     def with_pipes(out = STDOUT, err = STDERR, &block)
       previous_stdout = self.stdout
       previous_stderr = self.stderr
@@ -49,34 +49,34 @@ def with_pipes(out = STDOUT, err = STDERR, &block)
       self.stderr = previous_stderr
     end
 
-    # T::Sig::WithoutRuntime.sig { returns(T.nilable(T.any(IO, StringIO))) }
+    T::Sig::WithoutRuntime.sig { returns(T.nilable(T.any(IO, StringIO))) }
     def stdout
       Thread.current[stdout_key] || STDOUT
     end
 
-    # T::Sig::WithoutRuntime.sig { params(new_stdout: T.nilable(T.any(IO, StringIO))).void }
+    T::Sig::WithoutRuntime.sig { params(new_stdout: T.nilable(T.any(IO, StringIO))).void }
     def stdout=(new_stdout)
       Thread.current[stdout_key] = new_stdout
     end
 
-    # T::Sig::WithoutRuntime.sig { returns(T.nilable(T.any(IO, StringIO))) }
+    T::Sig::WithoutRuntime.sig { returns(T.nilable(T.any(IO, StringIO))) }
     def stderr
       Thread.current[stderr_key] || STDERR
     end
 
-    # T::Sig::WithoutRuntime.sig { params(new_stderr: T.nilable(T.any(IO, StringIO))).void }
+    T::Sig::WithoutRuntime.sig { params(new_stderr: T.nilable(T.any(IO, StringIO))).void }
     def stderr=(new_stderr)
       Thread.current[stderr_key] = new_stderr
     end
 
     private
 
-    # T::Sig::WithoutRuntime.sig {
-    #   params(
-    #     cmd: T::Array[String],
-    #     block: T.proc.params(stdin: IO).void
-    #   ).void
-    # }
+    T::Sig::WithoutRuntime.sig {
+      params(
+        cmd: T::Array[String],
+        block: T.proc.params(stdin: IO).void
+      ).void
+    }
     def open3_w(cmd, &block)
       run_before_callbacks(cmd)
       cmd_s = cmd.join(' ')
@@ -99,20 +99,20 @@ def open3_w(cmd, &block)
         yield(p_stdin)
 
         p_stdin.close
-        self.last_status = wait_thread.value
+        self.last_status = T.cast(wait_thread.value, Process::Status)
         run_after_callbacks(cmd)
         wait_thread.join
       end
     end
 
-    # T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).void }
+    T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).void }
     def execc(cmd)
       run_before_callbacks(cmd)
       cmd_s = cmd.join(' ')
       exec(cmd_s)
     end
 
-    # T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).void }
+    T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).void }
     def systemm(cmd)
       if stdout == STDOUT && stderr == STDERR
         systemm_default(cmd)
@@ -121,7 +121,7 @@ def systemm(cmd)
       end
     end
 
-    # T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).void }
+    T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).void }
     def systemm_default(cmd)
       run_before_callbacks(cmd)
       cmd_s = cmd.join(' ')
@@ -131,7 +131,7 @@ def systemm_default(cmd)
       end
     end
 
-    # T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).void }
+    T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).void }
     def systemm_open3(cmd)
       run_before_callbacks(cmd)
       cmd_s = cmd.join(' ')
@@ -152,14 +152,14 @@ def systemm_open3(cmd)
         end
 
         p_stdin.close
-        self.last_status = wait_thread.value
+        self.last_status = T.cast(wait_thread.value, Process::Status)
         run_after_callbacks(cmd)
         wait_thread.join
       end
     end
 
 
-    # T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).returns(String) }
+    T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).returns(String) }
     def backticks(cmd)
       if stdout == STDOUT && stderr == STDERR
         backticks_default(cmd)
@@ -168,7 +168,7 @@ def backticks(cmd)
       end
     end
 
-    # T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).returns(String) }
+    T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).returns(String) }
     def backticks_default(cmd)
       run_before_callbacks(cmd)
       cmd_s = cmd.join(' ')
@@ -178,7 +178,7 @@ def backticks_default(cmd)
       end
     end
 
-    # T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).returns(String) }
+    T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).returns(String) }
     def backticks_open3(cmd)
       run_before_callbacks(cmd)
       cmd_s = cmd.join(' ')
@@ -200,7 +200,7 @@ def backticks_open3(cmd)
         end
 
         p_stdin.close
-        self.last_status = wait_thread.value
+        self.last_status = T.cast(wait_thread.value, Process::Status)
         run_after_callbacks(cmd)
         wait_thread.join
       end
@@ -208,32 +208,32 @@ def backticks_open3(cmd)
       result.string
     end
 
-    # T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).void }
+    T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).void }
     def run_before_callbacks(cmd)
       (@before_execute || []).each { |cb| cb.call(cmd) }
     end
 
-    # T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).void }
+    T::Sig::WithoutRuntime.sig { params(cmd: T::Array[String]).void }
     def run_after_callbacks(cmd)
       (@after_execute || []).each { |cb| cb.call(cmd, last_status) }
     end
 
-    # T::Sig::WithoutRuntime.sig { params(status: Process::Status).void }
+    T::Sig::WithoutRuntime.sig { params(status: Process::Status).void }
     def last_status=(status)
       Thread.current[status_key] = status
     end
 
-    # T::Sig::WithoutRuntime.sig { returns(Symbol) }
+    T::Sig::WithoutRuntime.sig { returns(Symbol) }
     def status_key
       raise NotImplementedError, "#{__method__} must be defined in derived classes"
     end
 
-    # T::Sig::WithoutRuntime.sig { returns(Symbol) }
+    T::Sig::WithoutRuntime.sig { returns(Symbol) }
     def stdout_key
       raise NotImplementedError, "#{__method__} must be defined in derived classes"
     end
 
-    # T::Sig::WithoutRuntime.sig { returns(Symbol) }
+    T::Sig::WithoutRuntime.sig { returns(Symbol) }
     def stderr_key
       raise NotImplementedError, "#{__method__} must be defined in derived classes"
     end
diff --git a/lib/kuby/commands.rb b/lib/kuby/commands.rb
index 41ff016..447cb87 100644
--- a/lib/kuby/commands.rb
+++ b/lib/kuby/commands.rb
@@ -8,7 +8,7 @@
 
 module Kuby
   class Commands
-    # extend T::Sig
+    extend T::Sig
     extend GLI::App
 
     # GLI doesn't have a wildcard option, so it's impossible to tell it to
@@ -22,12 +22,12 @@ class Commands
     # avoid the usual series of cryptic alias_method calls (note that there
     # is no singleton class version of #prepend in the Ruby language).
     singleton_class.send(:prepend, Module.new do
-      # extend T::Sig
+      extend T::Sig
 
-      # T::Sig::WithoutRuntime.sig { params(args: T::Array[String]).void }
+      T::Sig::WithoutRuntime.sig { params(args: T::Array[String]).void }
       def run(args)
         if idx = args.index('rails') || idx = args.index('rake')
-          # @rails_options = T.let(@rails_options, T.nilable(T::Array[String]))
+          @rails_options = T.let(@rails_options, T.nilable(T::Array[String]))
           @rails_options = args[(idx + 1)..-1]
           super(args[0..idx])
         else
@@ -37,16 +37,16 @@ def run(args)
       end
     end)
 
-    # T::Sig::WithoutRuntime.sig { returns(Kuby::Tasks) }
+    T::Sig::WithoutRuntime.sig { returns(Kuby::Tasks) }
     def self.tasks
       Kuby::Tasks.new(Kuby.environment)
     end
 
-    # T::Sig::WithoutRuntime.sig {
-    #   params(
-    #     global_options: T::Hash[T.any(String, Symbol), T.any(String, Integer)]
-    #   ).void
-    # }
+    T::Sig::WithoutRuntime.sig {
+      params(
+        global_options: T::Hash[T.any(String, Symbol), T.any(String, Integer)]
+      ).void
+    }
     def self.load_kuby_config!(global_options)
       return if @kuby_config_loaded
 
@@ -289,7 +289,7 @@ def self.load_kuby_config!(global_options)
       rc.desc 'Runs an arbitrary command inside a running Rails pod.'
       rc.command :exec do |c|
         c.action do |global_options, options, args|
-          tasks.remote_exec([*args, *@rails_options])
+          tasks.remote_exec([*args, *T.unsafe(@rails_options)])
         end
       end
 
diff --git a/lib/kuby/definition.rb b/lib/kuby/definition.rb
index 80f0b14..886c0ac 100644
--- a/lib/kuby/definition.rb
+++ b/lib/kuby/definition.rb
@@ -2,23 +2,23 @@
 
 module Kuby
   class Definition
-    # extend T::Sig
+    extend T::Sig
 
-    # T::Sig::WithoutRuntime.sig { returns(String) }
+    T::Sig::WithoutRuntime.sig { returns(String) }
     attr_reader :app_name
 
-    # T::Sig::WithoutRuntime.sig { params(app_name: String, block: T.nilable(T.proc.void)).void }
+    T::Sig::WithoutRuntime.sig { params(app_name: String, block: T.nilable(T.proc.void)).void }
     def initialize(app_name, &block)
       @app_name = app_name
-      # @environments = T.let(@environments, T.nilable(T::Hash[Symbol, Environment]))
+      @environments = T.let(@environments, T.nilable(T::Hash[Symbol, Environment]))
     end
 
-    # T::Sig::WithoutRuntime.sig {
-    #   params(
-    #     name: Symbol,
-    #     block: T.nilable(T.proc.void)
-    #   ).returns(Kuby::Environment)
-    # }
+    T::Sig::WithoutRuntime.sig {
+      params(
+        name: Symbol,
+        block: T.nilable(T.proc.void)
+      ).returns(Kuby::Environment)
+    }
     def environment(name = Kuby.env, &block)
       name = name.to_s
 
@@ -28,10 +28,10 @@ def environment(name = Kuby.env, &block)
         environments[name].instance_eval(&block)
       end
 
-      environments[name]
+      T.must(environments[name])
     end
 
-    # T::Sig::WithoutRuntime.sig { returns(T::Hash[Symbol, Kuby::Environment]) }
+    T::Sig::WithoutRuntime.sig { returns(T::Hash[Symbol, Kuby::Environment]) }
     def environments
       @environments ||= {}
     end
diff --git a/lib/kuby/docker.rb b/lib/kuby/docker.rb
index 355d267..bbe56ed 100644
--- a/lib/kuby/docker.rb
+++ b/lib/kuby/docker.rb
@@ -4,7 +4,7 @@
 
 module Kuby
   module Docker
-    LATEST_TAG = 'latest'.freeze
+    LATEST_TAG = T.let('latest'.freeze, String)
 
     autoload :Alpine,           'kuby/docker/alpine'
     autoload :AppImage,         'kuby/docker/app_image'
diff --git a/lib/kuby/docker/alpine.rb b/lib/kuby/docker/alpine.rb
index 75bfc99..7df99e5 100644
--- a/lib/kuby/docker/alpine.rb
+++ b/lib/kuby/docker/alpine.rb
@@ -3,42 +3,42 @@
 module Kuby
   module Docker
     class Alpine < Distro
-      SHELL_EXE = '/bin/sh'.freeze
+      SHELL_EXE = T.let('/bin/sh'.freeze, String)
 
-      DEFAULT_PACKAGES = [
+      DEFAULT_PACKAGES = T.let([
         [:ca_certificates, nil],
         [:nodejs, '12.14.1'],
         [:yarn, '1.21.1'],
         [:c_toolchain, nil],
         [:tzdata, nil],
         [:git, nil]
-      ].freeze
+      ].freeze, T::Array[[Symbol, T.nilable(String)]])
 
-      # T::Sig::WithoutRuntime.sig { returns(Layer) }
+      T::Sig::WithoutRuntime.sig { returns(Layer) }
       attr_reader :phase
 
-      # T::Sig::WithoutRuntime.sig { override.params(packages: T::Array[Distro::PackageImpl], into: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { override.params(packages: T::Array[Distro::PackageImpl], into: Dockerfile).void }
       def install(packages, into:)
         dockerfile = into
         install_managed(packages, dockerfile)
         install_unmanaged(packages, dockerfile)
       end
 
-      # T::Sig::WithoutRuntime.sig { override.returns(T::Array[[Symbol, T.nilable(String)]]) }
+      T::Sig::WithoutRuntime.sig { override.returns(T::Array[[Symbol, T.nilable(String)]]) }
       def default_packages
         DEFAULT_PACKAGES
       end
 
-      # T::Sig::WithoutRuntime.sig { override.returns(String) }
+      T::Sig::WithoutRuntime.sig { override.returns(String) }
       def shell_exe
         SHELL_EXE
       end
 
       private
 
-      # T::Sig::WithoutRuntime.sig { params(packages: T::Array[Distro::PackageImpl], dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { params(packages: T::Array[Distro::PackageImpl], dockerfile: Dockerfile).void }
       def install_managed(packages, dockerfile)
-        pkgs = packages.select(&:managed?)
+        pkgs = T.cast(packages.select(&:managed?), T::Array[Distro::ManagedPackageImpl])
 
         unless pkgs.empty?
           package_names = pkgs.map { |pkg| pkg.package_name_for(:alpine) }
@@ -48,7 +48,7 @@ def install_managed(packages, dockerfile)
         end
       end
 
-      # T::Sig::WithoutRuntime.sig { params(packages: T::Array[Distro::PackageImpl], dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { params(packages: T::Array[Distro::PackageImpl], dockerfile: Dockerfile).void }
       def install_unmanaged(packages, dockerfile)
         packages
           .reject(&:managed?)
diff --git a/lib/kuby/docker/app_image.rb b/lib/kuby/docker/app_image.rb
index 1173d54..ebf5ba3 100644
--- a/lib/kuby/docker/app_image.rb
+++ b/lib/kuby/docker/app_image.rb
@@ -4,18 +4,18 @@
 module Kuby
   module Docker
     class AppImage < ::Kuby::Docker::TimestampedImage
-      # extend T::Sig
+      extend T::Sig
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     dockerfile: T.any(Dockerfile, T.proc.returns(Dockerfile)),
-      #     image_url: String,
-      #     credentials: Credentials,
-      #     registry_index_url: T.nilable(String),
-      #     main_tag: T.nilable(String),
-      #     alias_tags: T::Array[String]
-      #   ).void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          dockerfile: T.any(Dockerfile, T.proc.returns(Dockerfile)),
+          image_url: String,
+          credentials: Credentials,
+          registry_index_url: T.nilable(String),
+          main_tag: T.nilable(String),
+          alias_tags: T::Array[String]
+        ).void
+      }
       def initialize(dockerfile, image_url, credentials, registry_index_url = nil, main_tag = nil, alias_tags = [])
         super
         @identifier = "app"
diff --git a/lib/kuby/docker/app_phase.rb b/lib/kuby/docker/app_phase.rb
index 9c90d2d..54a822d 100644
--- a/lib/kuby/docker/app_phase.rb
+++ b/lib/kuby/docker/app_phase.rb
@@ -3,16 +3,16 @@
 module Kuby
   module Docker
     class AppPhase < Layer
-      # extend T::Sig
+      extend T::Sig
 
-      # T::Sig::WithoutRuntime.sig { params(environment: Environment).void }
+      T::Sig::WithoutRuntime.sig { params(environment: Environment).void }
       def initialize(environment)
         super
 
-        @env_vars = {}
+        @env_vars = T.let({}, T::Hash[String, String])
       end
 
-      # T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
       def apply_to(dockerfile)
         @env_vars.each_pair do |key, value|
           dockerfile.env("#{key}='#{value}'")
@@ -27,7 +27,7 @@ def apply_to(dockerfile)
         end
       end
 
-      # T::Sig::WithoutRuntime.sig { params(key: String, value: String).void }
+      T::Sig::WithoutRuntime.sig { params(key: String, value: String).void }
       def env(key, value)
         @env_vars[key] = value
       end
diff --git a/lib/kuby/docker/assets_phase.rb b/lib/kuby/docker/assets_phase.rb
index 8197486..7a67f34 100644
--- a/lib/kuby/docker/assets_phase.rb
+++ b/lib/kuby/docker/assets_phase.rb
@@ -3,9 +3,9 @@
 module Kuby
   module Docker
     class AssetsPhase < Layer
-      # extend T::Sig
+      extend T::Sig
 
-      # T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
       def apply_to(dockerfile)
         dockerfile.run(
           'bundle', 'exec', 'rake', 'assets:precompile'
diff --git a/lib/kuby/docker/bundler_phase.rb b/lib/kuby/docker/bundler_phase.rb
index c664f99..efbdfa5 100644
--- a/lib/kuby/docker/bundler_phase.rb
+++ b/lib/kuby/docker/bundler_phase.rb
@@ -5,49 +5,49 @@
 module Kuby
   module Docker
     class BundlerPhase < Layer
-      # extend T::Sig
+      extend T::Sig
 
-      DEFAULT_GEMFILE = 'Gemfile'.freeze
-      DEFAULT_WITHOUT = 
-        ['development', 'test', 'deploy'].freeze
-      
+      DEFAULT_GEMFILE = T.let('Gemfile'.freeze, String)
+      DEFAULT_WITHOUT = T.let(
+        ['development', 'test', 'deploy'].freeze, T::Array[String]
+      )
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       attr_reader :version
 
-      # T::Sig::WithoutRuntime.sig { params(version: String).returns(String) }
+      T::Sig::WithoutRuntime.sig { params(version: String).returns(String) }
       attr_writer :version
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       attr_reader :gemfile
 
-      # T::Sig::WithoutRuntime.sig { params(gemfile: String).returns(String) }
+      T::Sig::WithoutRuntime.sig { params(gemfile: String).returns(String) }
       attr_writer :gemfile
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(T::Array[String])) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(T::Array[String])) }
       attr_reader :without
 
-      # T::Sig::WithoutRuntime.sig { params(without: T::Array[String]).returns(T::Array[String]) }
+      T::Sig::WithoutRuntime.sig { params(without: T::Array[String]).returns(T::Array[String]) }
       attr_writer :without
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       attr_reader :executable
 
-      # T::Sig::WithoutRuntime.sig { params(executable: String).returns(String) }
+      T::Sig::WithoutRuntime.sig { params(executable: String).returns(String) }
       attr_writer :executable
 
-      # T::Sig::WithoutRuntime.sig { params(environment: Environment).void }
+      T::Sig::WithoutRuntime.sig { params(environment: Environment).void }
       def initialize(environment)
         super
 
-        # @version = T.let(@version, T.nilable(String))
-        # @gemfile = T.let(@gemfile, T.nilable(String))
-        @gemfiles = []
-        # @without = T.let(@without, T.nilable(T::Array[String]))
-        # @executable = T.let(@executable, T.nilable(String))
+        @version = T.let(@version, T.nilable(String))
+        @gemfile = T.let(@gemfile, T.nilable(String))
+        @gemfiles = T.let([], T::Array[String])
+        @without = T.let(@without, T.nilable(T::Array[String]))
+        @executable = T.let(@executable, T.nilable(String))
       end
 
-      # T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
       def apply_to(dockerfile)
         gf = gemfile || DEFAULT_GEMFILE
         lf = "#{gf}.lock"
@@ -91,14 +91,14 @@ def apply_to(dockerfile)
         dockerfile.env("PATH=#{container_path.join('bin')}:$PATH")
       end
 
-      # T::Sig::WithoutRuntime.sig { params(paths: String).void }
+      T::Sig::WithoutRuntime.sig { params(paths: String).void }
       def gemfiles(*paths)
         @gemfiles.concat(paths)
       end
 
       private
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def default_version
         Bundler::VERSION
       end
diff --git a/lib/kuby/docker/cli.rb b/lib/kuby/docker/cli.rb
index a5e7196..5e87c39 100644
--- a/lib/kuby/docker/cli.rb
+++ b/lib/kuby/docker/cli.rb
@@ -7,29 +7,29 @@
 module Kuby
   module Docker
     class CLI < CLIBase
-      # extend T::Sig
+      extend T::Sig
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       attr_reader :executable
 
-      # T::Sig::WithoutRuntime.sig { params(executable: T.nilable(String)).void }
+      T::Sig::WithoutRuntime.sig { params(executable: T.nilable(String)).void }
       def initialize(executable = nil)
-        @executable = executable || Kuby::Utils.which('docker')
+        @executable = T.let(executable || Kuby::Utils.which('docker'), String)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       def config_file
         if File.exist?(default_config_file)
           default_config_file
         end
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def default_config_file
         File.join(Dir.home, '.docker', 'config.json')
       end
 
-      # T::Sig::WithoutRuntime.sig { params(url: String, username: String, password: String).void }
+      T::Sig::WithoutRuntime.sig { params(url: String, username: String, password: String).void }
       def login(url:, username:, password:)
         cmd = [
           executable, 'login', url, '--username', username, '--password-stdin'
@@ -39,29 +39,29 @@ def login(url:, username:, password:)
           stdin.puts(password)
         end
 
-        unless last_status.success?
+        unless T.must(last_status).success?
           raise LoginError, 'build failed: docker command exited with '\
-            "status code #{last_status.exitstatus}"
+            "status code #{T.must(last_status).exitstatus}"
         end
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
       def auths
         return [] unless config_file
 
-        config = JSON.parse(File.read(config_file))
+        config = JSON.parse(File.read(T.must(config_file)))
         config.fetch('auths', {}).keys
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     image: Image,
-      #     build_args: T::Hash[T.any(Symbol, String), String],
-      #     docker_args: T::Array[String],
-      #     context: T.nilable(String),
-      #     cache_from: T.nilable(String)
-      #   ).void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          image: Image,
+          build_args: T::Hash[T.any(Symbol, String), String],
+          docker_args: T::Array[String],
+          context: T.nilable(String),
+          cache_from: T.nilable(String)
+        ).void
+      }
       def build(image, build_args: {}, docker_args: [], context: nil, cache_from: nil)
         cmd = [
           executable, 'build',
@@ -85,21 +85,21 @@ def build(image, build_args: {}, docker_args: [], context: nil, cache_from: nil)
           stdin.puts(image.dockerfile.to_s)
         end
 
-        unless last_status.success?
+        unless T.must(last_status).success?
           raise BuildError, 'build failed: docker command exited with '\
-            "status code #{last_status.exitstatus}"
+            "status code #{T.must(last_status).exitstatus}"
         end
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     image_url: String,
-      #     tag: String,
-      #     env: T::Hash[T.any(Symbol, String), String],
-      #     ports: T::Array[T.any(String, Integer)]
-      #   )
-      #   .void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          image_url: String,
+          tag: String,
+          env: T::Hash[T.any(Symbol, String), String],
+          ports: T::Array[T.any(String, Integer)]
+        )
+        .void
+      }
       def run(image_url:, tag: 'latest', env: {}, ports: [])
         cmd = [
           executable, 'run',
@@ -113,7 +113,7 @@ def run(image_url:, tag: 'latest', env: {}, ports: [])
         execc(cmd)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(container: String, command: String, tty: T::Boolean).returns(String) }
+      T::Sig::WithoutRuntime.sig { params(container: String, command: String, tty: T::Boolean).returns(String) }
       def exec_capture(container:, command:, tty: true)
         cmd = [executable, 'exec']
         cmd << '-it' if tty
@@ -122,7 +122,7 @@ def exec_capture(container:, command:, tty: true)
         backticks(cmd)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(image_url: String, tag: String, format: T.nilable(String)).returns(String) }
+      T::Sig::WithoutRuntime.sig { params(image_url: String, tag: String, format: T.nilable(String)).returns(String) }
       def inspect(image_url:, tag: 'latest', format: nil)
         cmd = [executable, 'inspect']
         cmd += ['--format', "'#{format}'"]
@@ -131,7 +131,7 @@ def inspect(image_url:, tag: 'latest', format: nil)
         backticks(cmd)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(image_url: String, digests: T::Boolean).returns(T::Array[T::Hash[Symbol, String]]) }
+      T::Sig::WithoutRuntime.sig { params(image_url: String, digests: T::Boolean).returns(T::Array[T::Hash[Symbol, String]]) }
       def images(image_url, digests: true)
         cmd = [
           executable, 'images', image_url,
@@ -147,41 +147,41 @@ def images(image_url, digests: true)
         end
       end
 
-      # T::Sig::WithoutRuntime.sig { params(image_url: String, tag: String).void }
+      T::Sig::WithoutRuntime.sig { params(image_url: String, tag: String).void }
       def push(image_url, tag)
         systemm([
           executable, 'push', "#{image_url}:#{tag}"
         ])
 
-        unless last_status.success?
+        unless T.must(last_status).success?
           raise PushError, 'push failed: docker command exited with '\
-            "status code #{last_status.exitstatus}"
+            "status code #{T.must(last_status).exitstatus}"
         end
       end
 
-      # T::Sig::WithoutRuntime.sig { params(image_url: String, tag: String).void }
+      T::Sig::WithoutRuntime.sig { params(image_url: String, tag: String).void }
       def pull(image_url, tag)
         systemm([
           executable, 'pull', "#{image_url}:#{tag}"
         ])
 
-        unless last_status.success?
+        unless T.must(last_status).success?
           raise PullError, 'pull failed: docker command exited with '\
-            "status code #{last_status.exitstatus}"
+            "status code #{T.must(last_status).exitstatus}"
         end
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Symbol) }
+      T::Sig::WithoutRuntime.sig { returns(Symbol) }
       def status_key
         :kuby_docker_cli_last_status
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Symbol) }
+      T::Sig::WithoutRuntime.sig { returns(Symbol) }
       def stdout_key
         :kuby_docker_stdout
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Symbol) }
+      T::Sig::WithoutRuntime.sig { returns(Symbol) }
       def stderr_key
         :kuby_docker_stderr
       end
diff --git a/lib/kuby/docker/copy_phase.rb b/lib/kuby/docker/copy_phase.rb
index 71c277b..5330f41 100644
--- a/lib/kuby/docker/copy_phase.rb
+++ b/lib/kuby/docker/copy_phase.rb
@@ -3,25 +3,25 @@
 module Kuby
   module Docker
     class CopyPhase < Layer
-      # extend T::Sig
+      extend T::Sig
 
-      DEFAULT_PATHS = ['./'].freeze
+      DEFAULT_PATHS = T.let(['./'].freeze, T::Array[String])
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
       attr_reader :paths
 
-      # T::Sig::WithoutRuntime.sig { params(environment: Environment).void }
+      T::Sig::WithoutRuntime.sig { params(environment: Environment).void }
       def initialize(environment)
         super
-        @paths = []
+        @paths = T.let([], T::Array[String])
       end
 
-      # T::Sig::WithoutRuntime.sig { params(path: String).void }
+      T::Sig::WithoutRuntime.sig { params(path: String).void }
       def <<(path)
         paths << path
       end
 
-      # T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
       def apply_to(dockerfile)
         to_copy = paths.empty? ? DEFAULT_PATHS : paths
         to_copy.each { |path| dockerfile.copy(path, '.') }
diff --git a/lib/kuby/docker/debian.rb b/lib/kuby/docker/debian.rb
index 2fe16e9..e6d9dc5 100644
--- a/lib/kuby/docker/debian.rb
+++ b/lib/kuby/docker/debian.rb
@@ -3,39 +3,39 @@
 module Kuby
   module Docker
     class Debian < Distro
-      SHELL_EXE = '/bin/bash'.freeze
+      SHELL_EXE = T.let('/bin/bash'.freeze, String)
 
-      DEFAULT_PACKAGES = [
+      DEFAULT_PACKAGES = T.let([
         [:ca_certificates, nil],
         [:nodejs, '12.14.1'],
         [:yarn, '1.21.1']
-      ].freeze
+      ].freeze, T::Array[[Symbol, T.nilable(String)]])
 
-      # T::Sig::WithoutRuntime.sig { returns(Layer) }
+      T::Sig::WithoutRuntime.sig { returns(Layer) }
       attr_reader :phase
 
-      # T::Sig::WithoutRuntime.sig { override.params(packages: T::Array[Distro::PackageImpl], into: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { override.params(packages: T::Array[Distro::PackageImpl], into: Dockerfile).void }
       def install(packages, into:)
         dockerfile = into
         install_managed(packages, dockerfile)
         install_unmanaged(packages, dockerfile)
       end
 
-      # T::Sig::WithoutRuntime.sig { override.returns(T::Array[[Symbol, T.nilable(String)]]) }
+      T::Sig::WithoutRuntime.sig { override.returns(T::Array[[Symbol, T.nilable(String)]]) }
       def default_packages
         DEFAULT_PACKAGES
       end
 
-      # T::Sig::WithoutRuntime.sig { override.returns(String) }
+      T::Sig::WithoutRuntime.sig { override.returns(String) }
       def shell_exe
         SHELL_EXE
       end
 
       private
 
-      # T::Sig::WithoutRuntime.sig { params(packages: T::Array[Distro::PackageImpl], dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { params(packages: T::Array[Distro::PackageImpl], dockerfile: Dockerfile).void }
       def install_managed(packages, dockerfile)
-        pkgs = packages.select(&:managed?)
+        pkgs = T.cast(packages.select(&:managed?), T::Array[Distro::ManagedPackageImpl])
 
         pkg_cmd = <<~CMD.strip
           apt-get update -qq && \\
@@ -52,7 +52,7 @@ def install_managed(packages, dockerfile)
         dockerfile.run(pkg_cmd)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(packages: T::Array[Distro::PackageImpl], dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { params(packages: T::Array[Distro::PackageImpl], dockerfile: Dockerfile).void }
       def install_unmanaged(packages, dockerfile)
         packages
           .reject(&:managed?)
diff --git a/lib/kuby/docker/distro.rb b/lib/kuby/docker/distro.rb
index 535eb3d..aecc997 100644
--- a/lib/kuby/docker/distro.rb
+++ b/lib/kuby/docker/distro.rb
@@ -3,37 +3,37 @@
 module Kuby
   module Docker
     class Distro
-      # extend T::Sig
-      # extend T::Helpers
+      extend T::Sig
+      extend T::Helpers
 
-      # abstract!
+      abstract!
 
-      # PackageImpl = T.type_alias {
-      #   T.any(Packages::Package, Packages::ManagedPackage, Packages::SimpleManagedPackage)
-      # }
+      PackageImpl = T.type_alias {
+        T.any(Packages::Package, Packages::ManagedPackage, Packages::SimpleManagedPackage)
+      }
 
-      # ManagedPackageImpl = T.type_alias {
-      #   T.any(Packages::ManagedPackage, Packages::SimpleManagedPackage)
-      # }
+      ManagedPackageImpl = T.type_alias {
+        T.any(Packages::ManagedPackage, Packages::SimpleManagedPackage)
+      }
 
-      # T::Sig::WithoutRuntime.sig { params(phase: Layer).void }
+      T::Sig::WithoutRuntime.sig { params(phase: Layer).void }
       def initialize(phase)
         @phase = phase
       end
 
-      # T::Sig::WithoutRuntime.sig { params(packages: T::Array[PackageImpl], into: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { params(packages: T::Array[PackageImpl], into: Dockerfile).void }
       def install(packages, into:)
         raise NotImplementedError,
           "#{__method__} must be defined in derived classes"
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[[Symbol, T.nilable(String)]]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[[Symbol, T.nilable(String)]]) }
       def default_packages
         raise NotImplementedError,
           "#{__method__} must be defined in derived classes"
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def shell_exe
         raise NotImplementedError,
           "#{__method__} must be defined in derived classes"
diff --git a/lib/kuby/docker/docker_uri.rb b/lib/kuby/docker/docker_uri.rb
index 4e070b3..bf26777 100644
--- a/lib/kuby/docker/docker_uri.rb
+++ b/lib/kuby/docker/docker_uri.rb
@@ -3,13 +3,13 @@
 module Kuby
   module Docker
     class DockerURI
-      # extend T::Sig
+      extend T::Sig
 
-      DEFAULT_REGISTRY_HOST = 'docker.io'.freeze
-      DEFAULT_REGISTRY_INDEX_HOST = 'index.docker.io'.freeze
-      DEFAULT_PORT = 443
+      DEFAULT_REGISTRY_HOST = T.let('docker.io'.freeze, String)
+      DEFAULT_REGISTRY_INDEX_HOST = T.let('index.docker.io'.freeze, String)
+      DEFAULT_PORT = T.let(443, Integer)
 
-      # T::Sig::WithoutRuntime.sig { params(url: String).returns(DockerURI) }
+      T::Sig::WithoutRuntime.sig { params(url: String).returns(DockerURI) }
       def self.parse_uri(url)
         parse(
           url,
@@ -18,7 +18,7 @@ def self.parse_uri(url)
         )
       end
 
-      # T::Sig::WithoutRuntime.sig { params(url: String).returns(DockerURI) }
+      T::Sig::WithoutRuntime.sig { params(url: String).returns(DockerURI) }
       def self.parse_index_uri(url)
         parse(
           url,
@@ -27,13 +27,13 @@ def self.parse_index_uri(url)
         )
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     url: String,
-      #     default_host: T.nilable(String),
-      #     default_port: T.nilable(Integer)
-      #   ).returns(DockerURI)
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          url: String,
+          default_host: T.nilable(String),
+          default_port: T.nilable(Integer)
+        ).returns(DockerURI)
+      }
       def self.parse(url, default_host:, default_port:)
         if idx = url.index('://')
           url = url[(idx + 3)..-1] || ''
@@ -41,8 +41,8 @@ def self.parse(url, default_host:, default_port:)
 
         host_port, *path = url.split('/')
         host, port, *path = if host_port =~ /[.:]/
-          hst, prt = host_port.split(':')
-          [hst, prt || default_port, *path]
+          hst, prt = T.must(host_port).split(':')
+          [T.must(hst), prt || default_port, *path]
         else
           [default_host, default_port, host_port, *path]
         end
@@ -50,23 +50,23 @@ def self.parse(url, default_host:, default_port:)
         new(host.to_s, port.to_i, (path || []).join('/'))
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       attr_reader :host
 
-      # T::Sig::WithoutRuntime.sig { returns(Integer) }
+      T::Sig::WithoutRuntime.sig { returns(Integer) }
       attr_reader :port
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       attr_reader :path
 
-      # T::Sig::WithoutRuntime.sig { params(host: String, port: Integer, path: String).void }
+      T::Sig::WithoutRuntime.sig { params(host: String, port: Integer, path: String).void }
       def initialize(host, port, path)
         @host = host
         @port = port
         @path = path
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Boolean) }
+      T::Sig::WithoutRuntime.sig { returns(T::Boolean) }
       def has_default_port?
         port == DEFAULT_PORT
       end
diff --git a/lib/kuby/docker/dockerfile.rb b/lib/kuby/docker/dockerfile.rb
index 082716f..4f4878b 100644
--- a/lib/kuby/docker/dockerfile.rb
+++ b/lib/kuby/docker/dockerfile.rb
@@ -5,39 +5,39 @@
 module Kuby
   module Docker
     class Dockerfile
-      # extend T::Sig
+      extend T::Sig
 
       class Command
-        # extend T::Sig
+        extend T::Sig
 
-        # T::Sig::WithoutRuntime.sig { returns(T::Array[T.any(String, Integer)]) }
+        T::Sig::WithoutRuntime.sig { returns(T::Array[T.any(String, Integer)]) }
         attr_reader :args
 
-        # T::Sig::WithoutRuntime.sig { params(args: T::Array[T.any(String, Integer)]).void }
+        T::Sig::WithoutRuntime.sig { params(args: T::Array[T.any(String, Integer)]).void }
         def initialize(args)
           @args = args
         end
 
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         def to_s
           args.join(' ')
         end
       end
 
       class From < Command
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         attr_reader :image_url
 
-        # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+        T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
         attr_reader :as
 
-        # T::Sig::WithoutRuntime.sig { params(image_url: String, as: T.nilable(String)).void }
+        T::Sig::WithoutRuntime.sig { params(image_url: String, as: T.nilable(String)).void }
         def initialize(image_url, as: nil)
           @image_url = image_url
           @as = as
         end
 
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         def to_s
           str = "FROM #{image_url}"
           str << " AS #{as}" if as
@@ -46,38 +46,38 @@ def to_s
       end
 
       class Workdir < Command
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         def to_s; "WORKDIR #{super}"; end
       end
 
       class Env < Command
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         def to_s; "ENV #{super}"; end
       end
 
       class Run < Command
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         def to_s; "RUN #{super}"; end
       end
 
       class Copy < Command
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         attr_reader :source
 
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         attr_reader :dest
 
-        # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+        T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
         attr_reader :from
 
-        # T::Sig::WithoutRuntime.sig { params(source: String, dest: String, from: T.nilable(String)).void }
+        T::Sig::WithoutRuntime.sig { params(source: String, dest: String, from: T.nilable(String)).void }
         def initialize(source, dest, from: nil)
           @source = source
           @dest = dest
           @from = from
         end
 
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         def to_s
           cmd = ['COPY']
           cmd << "--from=#{from}" if from
@@ -87,100 +87,100 @@ def to_s
       end
 
       class Expose < Command
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         def to_s; "EXPOSE #{super}"; end
       end
 
       class Cmd < Command
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         def to_s; "CMD #{super}"; end
       end
 
       class Arg < Command
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         def to_s; "ARG #{super}"; end
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[Command]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[Command]) }
       attr_reader :commands
 
-      # T::Sig::WithoutRuntime.sig { returns(Integer) }
+      T::Sig::WithoutRuntime.sig { returns(Integer) }
       attr_reader :cursor
 
-      # T::Sig::WithoutRuntime.sig { void }
+      T::Sig::WithoutRuntime.sig { void }
       def initialize
-        @commands = []
-        @cursor = 0
+        @commands = T.let([], T::Array[Command])
+        @cursor = T.let(0, Integer)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(image_url: String, as: T.nilable(String)).void }
+      T::Sig::WithoutRuntime.sig { params(image_url: String, as: T.nilable(String)).void }
       def from(image_url, as: nil)
         add From.new(image_url, as: as)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(args: String).void }
+      T::Sig::WithoutRuntime.sig { params(args: String).void }
       def workdir(*args)
         add Workdir.new(args)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(args: String).void }
+      T::Sig::WithoutRuntime.sig { params(args: String).void }
       def env(*args)
         add Env.new(args)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(args: String).void }
+      T::Sig::WithoutRuntime.sig { params(args: String).void }
       def arg(*args)
         add Arg.new(args)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(args: String).void }
+      T::Sig::WithoutRuntime.sig { params(args: String).void }
       def run(*args)
         add Run.new(args)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(source: String, dest: String, from: T.nilable(String)).void }
+      T::Sig::WithoutRuntime.sig { params(source: String, dest: String, from: T.nilable(String)).void }
       def copy(source, dest, from: nil)
         add Copy.new(source, dest, from: from)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(port: Integer).void }
+      T::Sig::WithoutRuntime.sig { params(port: Integer).void }
       def expose(port)
         add Expose.new([port])
       end
 
-      # T::Sig::WithoutRuntime.sig { params(args: String).void }
+      T::Sig::WithoutRuntime.sig { params(args: String).void }
       def cmd(*args)
         add Cmd.new(args)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def to_s
         # ensure trailing newline
         "#{commands.map(&:to_s).join("\n")}\n"
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def checksum
         Digest::SHA256.hexdigest(to_s)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[Integer]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[Integer]) }
       def exposed_ports
         commands
           .select { |c| c.is_a?(Expose) }
-          .map { |c| c.args.first }
+          .map { |c| T.cast(c.args.first, Integer) }
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       def current_workdir
         found = commands.reverse_each.find do |command|
           command.is_a?(Kuby::Docker::Dockerfile::Workdir)
         end
 
-        found.args.first if found
+        T.cast(found.args.first, String) if found
       end
 
-      # T::Sig::WithoutRuntime.sig { params(pos: Integer, block: T.proc.void).void }
+      T::Sig::WithoutRuntime.sig { params(pos: Integer, block: T.proc.void).void }
       def insert_at(pos, &block)
         @cursor = pos
         yield
@@ -190,7 +190,7 @@ def insert_at(pos, &block)
 
       private
 
-      # T::Sig::WithoutRuntime.sig { params(cmd: Command).void }
+      T::Sig::WithoutRuntime.sig { params(cmd: Command).void }
       def add(cmd)
         commands.insert(cursor, cmd)
         @cursor += 1
diff --git a/lib/kuby/docker/image.rb b/lib/kuby/docker/image.rb
index bb83c72..90357bf 100644
--- a/lib/kuby/docker/image.rb
+++ b/lib/kuby/docker/image.rb
@@ -3,149 +3,149 @@
 module Kuby
   module Docker
     class Image
-      # extend T::Sig
+      extend T::Sig
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       attr_reader :identifier
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       attr_reader :image_url
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       attr_reader :registry_index_url
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Credentials) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Credentials) }
       attr_reader :credentials
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       attr_reader :main_tag
 
-      # T::Sig::WithoutRuntime.sig { returns T::Array[String] }
+      T::Sig::WithoutRuntime.sig { returns T::Array[String] }
       attr_reader :alias_tags
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     dockerfile: T.any(Dockerfile, T.proc.returns(Kuby::Docker::Dockerfile)),
-      #     image_url: String,
-      #     credentials: Kuby::Docker::Credentials,
-      #     registry_index_url: T.nilable(String),
-      #     main_tag: T.nilable(String),
-      #     alias_tags: T::Array[String]
-      #   ).void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          dockerfile: T.any(Dockerfile, T.proc.returns(Kuby::Docker::Dockerfile)),
+          image_url: String,
+          credentials: Kuby::Docker::Credentials,
+          registry_index_url: T.nilable(String),
+          main_tag: T.nilable(String),
+          alias_tags: T::Array[String]
+        ).void
+      }
       def initialize(dockerfile, image_url, credentials, registry_index_url = nil, main_tag = nil, alias_tags = [])
-        @dockerfile = dockerfile
-        @image_url = image_url
-        @registry_index_url = registry_index_url
-        @credentials = credentials
-        @main_tag = main_tag
-        @alias_tags = alias_tags
-        # @identifier = T.let(@identifier, T.nilable(String))
-
-        # @image_host = T.let(@image_host, T.nilable(String))
-        # @image_hostname = T.let(@image_hostname, T.nilable(String))
-        # @registry_index_host = T.let(@registry_index_host, T.nilable(String))
-        # @registry_index_hostname = T.let(@registry_index_hostname, T.nilable(String))
-        # @registry_index_uri = T.let(@registry_index_uri, T.nilable(DockerURI))
-        # @image_repo = T.let(@image_repo, T.nilable(String))
-        # @full_image_uri = T.let(@full_image_uri, T.nilable(DockerURI))
-        # @docker_cli = T.let(@docker_cli, T.nilable(Docker::CLI))
-      end
-
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Image) }
+        @dockerfile = T.let(dockerfile, T.any(Dockerfile, T.proc.returns(Dockerfile)))
+        @image_url = T.let(image_url, String)
+        @registry_index_url = T.let(registry_index_url, T.nilable(String))
+        @credentials = T.let(credentials, Credentials)
+        @main_tag = T.let(main_tag, T.nilable(String))
+        @alias_tags = T.let(alias_tags, T::Array[String])
+        @identifier = T.let(@identifier, T.nilable(String))
+
+        @image_host = T.let(@image_host, T.nilable(String))
+        @image_hostname = T.let(@image_hostname, T.nilable(String))
+        @registry_index_host = T.let(@registry_index_host, T.nilable(String))
+        @registry_index_hostname = T.let(@registry_index_hostname, T.nilable(String))
+        @registry_index_uri = T.let(@registry_index_uri, T.nilable(DockerURI))
+        @image_repo = T.let(@image_repo, T.nilable(String))
+        @full_image_uri = T.let(@full_image_uri, T.nilable(DockerURI))
+        @docker_cli = T.let(@docker_cli, T.nilable(Docker::CLI))
+      end
+
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Image) }
       def new_version
         raise NotImplementedError, 'please use a Docker::Image subclass'
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Image) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Image) }
       def current_version
         raise NotImplementedError, 'please use a Docker::Image subclass'
       end
 
-      # T::Sig::WithoutRuntime.sig { params(current_tag: T.nilable(String)).returns(Image) }
+      T::Sig::WithoutRuntime.sig { params(current_tag: T.nilable(String)).returns(Image) }
       def previous_version(current_tag = nil)
         raise NotImplementedError, 'please use a Docker::Image subclass'
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Dockerfile) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Dockerfile) }
       def dockerfile
         if @dockerfile.respond_to?(:call)
-          @dockerfile.call
+          T.cast(@dockerfile, T.proc.returns(Dockerfile)).call
         else
-          @dockerfile
+          T.cast(@dockerfile, Dockerfile)
         end
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def image_host
         @image_host ||= "#{image_uri.host}:#{image_uri.port}"
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def registry_index_host
         @registry_index_host ||= "#{registry_index_uri.host}:#{registry_index_uri.port}"
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def registry_index_hostname
         @registry_index_hostname ||= registry_index_uri.host
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def image_hostname
         @image_hostname ||= image_uri.host
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def image_repo
         @image_repo ||= image_uri.path
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::DockerURI) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::DockerURI) }
       def image_uri
         @full_image_uri ||= DockerURI.parse_uri(image_url)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::DockerURI) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::DockerURI) }
       def registry_index_uri
         @registry_index_uri ||= DockerURI.parse_index_uri(registry_index_url || image_url)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
       def tags
         [main_tag, *alias_tags].compact
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     build_args: T::Hash[String, String],
-      #     docker_args: T::Array[String],
-      #     context: T.nilable(String),
-      #     cache_from: T.nilable(String)
-      #   ).void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          build_args: T::Hash[String, String],
+          docker_args: T::Array[String],
+          context: T.nilable(String),
+          cache_from: T.nilable(String)
+        ).void
+      }
       def build(build_args = {}, docker_args = [], context: nil, cache_from: nil)
         raise NotImplementedError, 'please use a Docker::Image subclass'
       end
 
-      # T::Sig::WithoutRuntime.sig { params(tag: String).void }
+      T::Sig::WithoutRuntime.sig { params(tag: String).void }
       def push(tag)
         raise NotImplementedError, 'please use a Docker::Image subclass'
       end
 
-      # T::Sig::WithoutRuntime.sig { params(tag: String).void }
+      T::Sig::WithoutRuntime.sig { params(tag: String).void }
       def pull(tag)
         raise NotImplementedError, 'please use a Docker::Image subclass'
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::CLI) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::CLI) }
       def docker_cli
         @docker_cli ||= Docker::CLI.new
       end
 
       private
 
-      # T::Sig::WithoutRuntime.sig { params(main_tag: String, alias_tags: T::Array[String]).returns(Image) }
+      T::Sig::WithoutRuntime.sig { params(main_tag: String, alias_tags: T::Array[String]).returns(Image) }
       def duplicate_with_tags(main_tag, alias_tags)
         self.class.new(dockerfile, image_url, credentials, registry_index_url, main_tag, alias_tags)
       end
diff --git a/lib/kuby/docker/inline_layer.rb b/lib/kuby/docker/inline_layer.rb
index 00bb2b0..78d0e66 100644
--- a/lib/kuby/docker/inline_layer.rb
+++ b/lib/kuby/docker/inline_layer.rb
@@ -3,17 +3,17 @@
 module Kuby
   module Docker
     class InlineLayer < Layer
-      # extend T::Sig
+      extend T::Sig
 
-      # T::Sig::WithoutRuntime.sig { returns(T.proc.params(df: Dockerfile).void) }
+      T::Sig::WithoutRuntime.sig { returns(T.proc.params(df: Dockerfile).void) }
       attr_reader :block
 
-      # T::Sig::WithoutRuntime.sig { params(block: T.proc.params(df: Dockerfile).void).void }
+      T::Sig::WithoutRuntime.sig { params(block: T.proc.params(df: Dockerfile).void).void }
       def initialize(block)
         @block = block
       end
 
-      # T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
       def apply_to(dockerfile)
         block.call(dockerfile)
       end
diff --git a/lib/kuby/docker/layer.rb b/lib/kuby/docker/layer.rb
index 0a3104d..d208a32 100644
--- a/lib/kuby/docker/layer.rb
+++ b/lib/kuby/docker/layer.rb
@@ -3,20 +3,20 @@
 module Kuby
   module Docker
     class Layer
-      # extend T::Sig
-      # extend T::Helpers
+      extend T::Sig
+      extend T::Helpers
 
-      # abstract!
+      abstract!
 
-      # T::Sig::WithoutRuntime.sig { returns(Environment) }
+      T::Sig::WithoutRuntime.sig { returns(Environment) }
       attr_reader :environment
 
-      # T::Sig::WithoutRuntime.sig { params(environment: Environment).void }
+      T::Sig::WithoutRuntime.sig { params(environment: Environment).void }
       def initialize(environment)
         @environment = environment
       end
 
-      # T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
       def apply_to(dockerfile)
         raise NotImplementedError,
           "#{__method__} must be defined in derived classes"
diff --git a/lib/kuby/docker/layer_stack.rb b/lib/kuby/docker/layer_stack.rb
index 7b260c0..01de935 100644
--- a/lib/kuby/docker/layer_stack.rb
+++ b/lib/kuby/docker/layer_stack.rb
@@ -3,44 +3,44 @@
 module Kuby
   module Docker
     class LayerStack
-      # extend T::Sig
-      # extend T::Generic
+      extend T::Sig
+      extend T::Generic
 
-      # Elem = type_member { { fixed: Kuby::Docker::Layer } }
+      Elem = type_member { { fixed: Kuby::Docker::Layer } }
 
       include Enumerable
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[Symbol]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[Symbol]) }
       attr_reader :stack
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Hash[Symbol, Kuby::Docker::Layer]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Hash[Symbol, Kuby::Docker::Layer]) }
       attr_reader :layers
 
-      # T::Sig::WithoutRuntime.sig { void }
+      T::Sig::WithoutRuntime.sig { void }
       def initialize
-        @stack = []
-        @layers = {}
+        @stack = T.let([], T::Array[Symbol])
+        @layers = T.let({}, T::Hash[Symbol, Layer])
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   override.params(
-      #     block: T.nilable(T.proc.params(layer: Kuby::Docker::Layer).void)
-      #   )
-      #   .void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        override.params(
+          block: T.nilable(T.proc.params(layer: Kuby::Docker::Layer).void)
+        )
+        .void
+      }
       def each(&block)
-        return to_enum(__method__) unless block_given?
-        @stack.each { |name| yield layers[name] }
+        return to_enum(T.must(__method__)) unless block_given?
+        @stack.each { |name| yield T.must(layers[name]) }
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     name: Symbol,
-      #     layer: T.nilable(Layer),
-      #     block: T.nilable(T.proc.params(df: Kuby::Docker::Dockerfile).void)
-      #   )
-      #   .void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          name: Symbol,
+          layer: T.nilable(Layer),
+          block: T.nilable(T.proc.params(df: Kuby::Docker::Dockerfile).void)
+        )
+        .void
+      }
       def use(name, layer = nil, &block)
         stack << name
 
@@ -53,15 +53,15 @@ def use(name, layer = nil, &block)
         end
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     name: Symbol,
-      #     layer: T.nilable(T.any(Layer, T::Hash[Symbol, T.untyped])),
-      #     options: T::Hash[Symbol, T.untyped],
-      #     block: T.nilable(T.proc.params(df: Kuby::Docker::Dockerfile).void)
-      #   )
-      #   .void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          name: Symbol,
+          layer: T.nilable(T.any(Layer, T::Hash[Symbol, T.untyped])),
+          options: T::Hash[Symbol, T.untyped],
+          block: T.nilable(T.proc.params(df: Kuby::Docker::Dockerfile).void)
+        )
+        .void
+      }
       def insert(name, layer = nil, options = {}, &block)
         # this is truly gross but it's the only way I can think of to be able
         # to call insert these two ways:
@@ -94,7 +94,7 @@ def insert(name, layer = nil, options = {}, &block)
         end
       end
 
-      # T::Sig::WithoutRuntime.sig { params(name: Symbol, layer: Layer).void }
+      T::Sig::WithoutRuntime.sig { params(name: Symbol, layer: Layer).void }
       def replace(name, layer)
         unless layers.include?(name)
           raise ArgumentError, "Could not find existing layer '#{name}'"
@@ -103,13 +103,13 @@ def replace(name, layer)
         layers[name] = layer
       end
 
-      # T::Sig::WithoutRuntime.sig { params(name: Symbol).void }
+      T::Sig::WithoutRuntime.sig { params(name: Symbol).void }
       def delete(name)
         stack.delete(name)
         layers.delete(name)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(name: Symbol).returns(T::Boolean) }
+      T::Sig::WithoutRuntime.sig { params(name: Symbol).returns(T::Boolean) }
       def includes?(name)
         layers.include?(name)
       end
diff --git a/lib/kuby/docker/local_tags.rb b/lib/kuby/docker/local_tags.rb
index 0239d65..0a258f0 100644
--- a/lib/kuby/docker/local_tags.rb
+++ b/lib/kuby/docker/local_tags.rb
@@ -3,34 +3,34 @@
 module Kuby
   module Docker
     class LocalTags
-      # extend T::Sig
+      extend T::Sig
 
-      # T::Sig::WithoutRuntime.sig { returns Kuby::Docker::CLI }
+      T::Sig::WithoutRuntime.sig { returns Kuby::Docker::CLI }
       attr_reader :cli
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       attr_reader :image_url
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     cli: Kuby::Docker::CLI,
-      #     image_url: String
-      #   )
-      #   .void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          cli: Kuby::Docker::CLI,
+          image_url: String
+        )
+        .void
+      }
       def initialize(cli, image_url)
         @cli = cli
         @image_url = image_url
-        # @latest_timestamp_tag = T.let(@latest_timestamp_tag, T.nilable(TimestampTag))
+        @latest_timestamp_tag = T.let(@latest_timestamp_tag, T.nilable(TimestampTag))
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
       def tags
         images = cli.images(image_url)
-        images.map { |image| image[:tag] }
+        images.map { |image| T.must(image[:tag]) }
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
       def latest_tags
         # find "latest" tag
         images = cli.images(image_url)
@@ -48,12 +48,12 @@ def latest_tags
         end
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[Kuby::Docker::TimestampTag]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[Kuby::Docker::TimestampTag]) }
       def timestamp_tags
         tags.map { |t| TimestampTag.try_parse(t) }.compact
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(Kuby::Docker::TimestampTag)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(Kuby::Docker::TimestampTag)) }
       def latest_timestamp_tag
         @latest_timestamp_tag ||= timestamp_tags.sort.last
       end
diff --git a/lib/kuby/docker/package_list.rb b/lib/kuby/docker/package_list.rb
index 4b74157..1a6582a 100644
--- a/lib/kuby/docker/package_list.rb
+++ b/lib/kuby/docker/package_list.rb
@@ -3,48 +3,48 @@
 module Kuby
   module Docker
     class PackageList
-      # extend T::Sig
-      # extend T::Generic
+      extend T::Sig
+      extend T::Generic
 
-      # Elem = type_member { { fixed: Distro::PackageImpl } }
+      Elem = type_member { { fixed: Distro::PackageImpl } }
 
       include Enumerable
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[Distro::PackageImpl]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[Distro::PackageImpl]) }
       attr_reader :packages
 
-      # T::Sig::WithoutRuntime.sig { params(package_tuples: T::Array[[Symbol, T.nilable(String)]]).void }
+      T::Sig::WithoutRuntime.sig { params(package_tuples: T::Array[[Symbol, T.nilable(String)]]).void }
       def initialize(package_tuples)
-        @packages = []
+        @packages = T.let([], T::Array[Distro::PackageImpl])
         package_tuples.each { |name, version| add(name, version) }
       end
 
-      # T::Sig::WithoutRuntime.sig { params(name: Symbol).returns(T.nilable(Distro::PackageImpl)) }
+      T::Sig::WithoutRuntime.sig { params(name: Symbol).returns(T.nilable(Distro::PackageImpl)) }
       def [](name)
         packages.find { |pkg| pkg.name == name }
       end
 
-      # T::Sig::WithoutRuntime.sig { params(name: Symbol, version: T.nilable(String)).void }
+      T::Sig::WithoutRuntime.sig { params(name: Symbol, version: T.nilable(String)).void }
       def add(name, version = nil)
         packages << Packages::Package.new(name, version)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(name: String).void }
+      T::Sig::WithoutRuntime.sig { params(name: String).void }
       def delete(name)
         packages.delete_if { |pkg| pkg.name == name }
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   override.params(
-      #     block: T.proc.params(package: Distro::PackageImpl).void
-      #   )
-      #   .void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        override.params(
+          block: T.proc.params(package: Distro::PackageImpl).void
+        )
+        .void
+      }
       def each(&block)
         packages.each(&block)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Boolean) }
+      T::Sig::WithoutRuntime.sig { returns(T::Boolean) }
       def empty?
         packages.empty?
       end
diff --git a/lib/kuby/docker/package_phase.rb b/lib/kuby/docker/package_phase.rb
index aed73da..d8b717e 100644
--- a/lib/kuby/docker/package_phase.rb
+++ b/lib/kuby/docker/package_phase.rb
@@ -3,31 +3,31 @@
 module Kuby
   module Docker
     class PackagePhase < Layer
-      # extend T::Sig
+      extend T::Sig
 
-      # Operation = T.type_alias { [Symbol, Symbol, T.nilable(String)] }
+      Operation = T.type_alias { [Symbol, Symbol, T.nilable(String)] }
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[Operation]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[Operation]) }
       attr_reader :operations
 
-      # T::Sig::WithoutRuntime.sig { params(environment: Kuby::Environment).void }
+      T::Sig::WithoutRuntime.sig { params(environment: Kuby::Environment).void }
       def initialize(environment)
         super
 
-        @operations = []
+        @operations = T.let([], T::Array[Operation])
       end
 
-      # T::Sig::WithoutRuntime.sig { params(package_name: Symbol, version: T.nilable(String)).void }
+      T::Sig::WithoutRuntime.sig { params(package_name: Symbol, version: T.nilable(String)).void }
       def add(package_name, version = nil)
         operations << [:add, package_name, version]
       end
 
-      # T::Sig::WithoutRuntime.sig { params(package_name: Symbol).void }
+      T::Sig::WithoutRuntime.sig { params(package_name: Symbol).void }
       def remove(package_name)
         operations << [:remove, package_name, nil]
       end
 
-      # T::Sig::WithoutRuntime.sig { override.params(dockerfile: Kuby::Docker::Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { override.params(dockerfile: Kuby::Docker::Dockerfile).void }
       def apply_to(dockerfile)
         packages = distro_spec.default_packages.dup
 
@@ -50,18 +50,18 @@ def apply_to(dockerfile)
 
       private
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Distro) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Distro) }
       def distro_spec
         environment.docker.distro_spec
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     package_name: Symbol,
-      #     version: T.nilable(String)
-      #   )
-      #   .returns(Kuby::Docker::Distro::PackageImpl)
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          package_name: Symbol,
+          version: T.nilable(String)
+        )
+        .returns(Kuby::Docker::Distro::PackageImpl)
+      }
       def get_package(package_name, version)
         if package = Kuby.packages[package_name]
           package.with_version(version)
diff --git a/lib/kuby/docker/packages/managed_package.rb b/lib/kuby/docker/packages/managed_package.rb
index eeb0b5b..0d88640 100644
--- a/lib/kuby/docker/packages/managed_package.rb
+++ b/lib/kuby/docker/packages/managed_package.rb
@@ -4,27 +4,27 @@ module Kuby
   module Docker
     module Packages
       class ManagedPackage
-        # extend T::Sig
+        extend T::Sig
 
-        # T::Sig::WithoutRuntime.sig { returns(Symbol) }
+        T::Sig::WithoutRuntime.sig { returns(Symbol) }
         attr_reader :name
 
-        # T::Sig::WithoutRuntime.sig { returns(T::Hash[Symbol, String]) }
+        T::Sig::WithoutRuntime.sig { returns(T::Hash[Symbol, String]) }
         attr_reader :names_per_distro
 
-        # T::Sig::WithoutRuntime.sig {
-        #   params(
-        #     name: Symbol,
-        #     names_per_distro: T::Hash[Symbol, String]
-        #   )
-        #   .void
-        # }
+        T::Sig::WithoutRuntime.sig {
+          params(
+            name: Symbol,
+            names_per_distro: T::Hash[Symbol, String]
+          )
+          .void
+        }
         def initialize(name, names_per_distro)
           @name = name
           @names_per_distro = names_per_distro
         end
 
-        # T::Sig::WithoutRuntime.sig { params(distro: Symbol).returns(String) }
+        T::Sig::WithoutRuntime.sig { params(distro: Symbol).returns(String) }
         def package_name_for(distro)
           names_per_distro.fetch(distro) do
             raise UnsupportedDistroError, "Couldn't install #{name} "\
@@ -32,12 +32,12 @@ def package_name_for(distro)
           end
         end
 
-        # T::Sig::WithoutRuntime.sig { params(ver: String).returns(T.self_type) }
+        T::Sig::WithoutRuntime.sig { params(ver: String).returns(T.self_type) }
         def with_version(ver)
           self
         end
 
-        # T::Sig::WithoutRuntime.sig { returns(T::Boolean) }
+        T::Sig::WithoutRuntime.sig { returns(T::Boolean) }
         def managed?
           true
         end
diff --git a/lib/kuby/docker/packages/nodejs.rb b/lib/kuby/docker/packages/nodejs.rb
index 9301947..a5f7e07 100644
--- a/lib/kuby/docker/packages/nodejs.rb
+++ b/lib/kuby/docker/packages/nodejs.rb
@@ -4,26 +4,26 @@ module Kuby
   module Docker
     module Packages
       class Nodejs < Package
-        # extend T::Sig
+        extend T::Sig
 
-        # T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
+        T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
         def install_on_debian(dockerfile)
           install_from_image("node:#{version}", dockerfile)
         end
 
-        # T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
+        T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
         def install_on_alpine(dockerfile)
           install_from_image("node:#{version}-alpine", dockerfile)
         end
 
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         def version
           @version || 'current'
         end
 
         private
 
-        # T::Sig::WithoutRuntime.sig { params(image: String, dockerfile: Dockerfile).void }
+        T::Sig::WithoutRuntime.sig { params(image: String, dockerfile: Dockerfile).void }
         def install_from_image(image, dockerfile)
           dockerfile.insert_at(0) do
             dockerfile.from(image, as: 'nodejs')
diff --git a/lib/kuby/docker/packages/package.rb b/lib/kuby/docker/packages/package.rb
index 0562158..4c7a461 100644
--- a/lib/kuby/docker/packages/package.rb
+++ b/lib/kuby/docker/packages/package.rb
@@ -4,29 +4,29 @@ module Kuby
   module Docker
     module Packages
       class Package
-        # extend T::Sig
-        # extend T::Helpers
+        extend T::Sig
+        extend T::Helpers
 
-        # abstract!
+        abstract!
 
-        # T::Sig::WithoutRuntime.sig { returns(Symbol) }
+        T::Sig::WithoutRuntime.sig { returns(Symbol) }
         attr_reader :name
 
-        # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+        T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
         attr_reader :version
 
-        # T::Sig::WithoutRuntime.sig { params(name: Symbol, version: T.nilable(String)).void }
+        T::Sig::WithoutRuntime.sig { params(name: Symbol, version: T.nilable(String)).void }
         def initialize(name, version = nil)
           @name = name
           @version = version
         end
 
-        # T::Sig::WithoutRuntime.sig { params(ver: String).returns(T.self_type) }
+        T::Sig::WithoutRuntime.sig { params(ver: String).returns(T.self_type) }
         def with_version(ver)
           self.class.new(name, ver)
         end
 
-        # T::Sig::WithoutRuntime.sig { returns(T::Boolean) }
+        T::Sig::WithoutRuntime.sig { returns(T::Boolean) }
         def managed?
           false
         end
diff --git a/lib/kuby/docker/packages/simple_managed_package.rb b/lib/kuby/docker/packages/simple_managed_package.rb
index 6dbde1d..ad01a60 100644
--- a/lib/kuby/docker/packages/simple_managed_package.rb
+++ b/lib/kuby/docker/packages/simple_managed_package.rb
@@ -4,27 +4,27 @@ module Kuby
   module Docker
     module Packages
       class SimpleManagedPackage
-        # extend T::Sig
+        extend T::Sig
 
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         attr_reader :name
 
-        # T::Sig::WithoutRuntime.sig { params(name: T.any(String, Symbol)).void }
+        T::Sig::WithoutRuntime.sig { params(name: T.any(String, Symbol)).void }
         def initialize(name)
-          @name = name.to_s
+          @name = T.let(name.to_s, String)
         end
 
-        # T::Sig::WithoutRuntime.sig { params(distro: Symbol).returns(String) }
+        T::Sig::WithoutRuntime.sig { params(distro: Symbol).returns(String) }
         def package_name_for(distro)
           name
         end
 
-        # T::Sig::WithoutRuntime.sig { params(ver: String).returns(T.self_type) }
+        T::Sig::WithoutRuntime.sig { params(ver: String).returns(T.self_type) }
         def with_version(ver)
           self
         end
 
-        # T::Sig::WithoutRuntime.sig { returns(T::Boolean) }
+        T::Sig::WithoutRuntime.sig { returns(T::Boolean) }
         def managed?
           true
         end
diff --git a/lib/kuby/docker/packages/yarn.rb b/lib/kuby/docker/packages/yarn.rb
index e310c97..da4dbad 100644
--- a/lib/kuby/docker/packages/yarn.rb
+++ b/lib/kuby/docker/packages/yarn.rb
@@ -4,16 +4,16 @@ module Kuby
   module Docker
     module Packages
       class Yarn < Package
-        # extend T::Sig
+        extend T::Sig
 
-        # T::Sig::WithoutRuntime.sig { params(name: Symbol, version: T.nilable(String)).void }
+        T::Sig::WithoutRuntime.sig { params(name: Symbol, version: T.nilable(String)).void }
         def initialize(name, version = nil)
           super
 
-          # @url = T.let(@url, T.nilable(String))
+          @url = T.let(@url, T.nilable(String))
         end
 
-        # T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
+        T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
         def install_on_debian(dockerfile)
           dockerfile.run(<<~CMD.strip)
             wget #{url} && \\
@@ -29,7 +29,7 @@ def install_on_debian(dockerfile)
           dockerfile.env("PATH=$PATH:/opt/yarn/bin")
         end
 
-        # T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
+        T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
         def install_on_alpine(dockerfile)
           dockerfile.run(<<~CMD.strip)
             wget #{url} && \\
@@ -47,7 +47,7 @@ def install_on_alpine(dockerfile)
 
         private
 
-        # T::Sig::WithoutRuntime.sig { returns(String) }
+        T::Sig::WithoutRuntime.sig { returns(String) }
         def url
           @url ||= if version
             "https://github.com/yarnpkg/yarn/releases/download/v#{version}/yarn-v#{version}.tar.gz"
diff --git a/lib/kuby/docker/remote_tags.rb b/lib/kuby/docker/remote_tags.rb
index 2ecdfbd..e7e96e9 100644
--- a/lib/kuby/docker/remote_tags.rb
+++ b/lib/kuby/docker/remote_tags.rb
@@ -5,27 +5,27 @@
 module Kuby
   module Docker
     class RemoteTags
-      # extend T::Sig
+      extend T::Sig
 
-      # T::Sig::WithoutRuntime.sig { returns(::Docker::Remote::Client) }
+      T::Sig::WithoutRuntime.sig { returns(::Docker::Remote::Client) }
       attr_reader :remote_client
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       attr_reader :image_url
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     remote_client: ::Docker::Remote::Client,
-      #     image_url: String
-      #   )
-      #   .void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          remote_client: ::Docker::Remote::Client,
+          image_url: String
+        )
+        .void
+      }
       def initialize(remote_client, image_url)
         @remote_client = remote_client
         @image_url = image_url
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
       def tags
         remote_client.tags || []
       rescue ::Docker::Remote::UnknownRepoError, ::Docker::Remote::UnauthorizedError, ::Docker::Remote::TooManyRetriesError
@@ -33,13 +33,13 @@ def tags
         []
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[String]) }
       def latest_tags
         # not available for remote repos
         []
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[Kuby::Docker::TimestampTag]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[Kuby::Docker::TimestampTag]) }
       def timestamp_tags
         tags.map { |t| TimestampTag.try_parse(t) }.compact
       end
diff --git a/lib/kuby/docker/setup_phase.rb b/lib/kuby/docker/setup_phase.rb
index 56e2bf5..ccff36e 100644
--- a/lib/kuby/docker/setup_phase.rb
+++ b/lib/kuby/docker/setup_phase.rb
@@ -3,39 +3,39 @@
 module Kuby
   module Docker
     class SetupPhase < Layer
-      # extend T::Sig
+      extend T::Sig
 
-      DEFAULT_WORKING_DIR = '/usr/src/app'.freeze
+      DEFAULT_WORKING_DIR = T.let('/usr/src/app'.freeze, String)
 
-      # T::Sig::WithoutRuntime.sig { params(base_image: String).returns(String) }
+      T::Sig::WithoutRuntime.sig { params(base_image: String).returns(String) }
       attr_writer :base_image
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       attr_reader :working_dir
 
-      # T::Sig::WithoutRuntime.sig { params(working_dir: String).returns(String) }
+      T::Sig::WithoutRuntime.sig { params(working_dir: String).returns(String) }
       attr_writer :working_dir
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       attr_reader :rails_env
 
-      # T::Sig::WithoutRuntime.sig { params(rails_env: String).returns(String) }
+      T::Sig::WithoutRuntime.sig { params(rails_env: String).returns(String) }
       attr_writer :rails_env
 
-      # T::Sig::WithoutRuntime.sig { returns(Docker::Spec) }
+      T::Sig::WithoutRuntime.sig { returns(Docker::Spec) }
       attr_reader :docker_spec
 
-      # T::Sig::WithoutRuntime.sig { params(environment: Environment, docker_spec: Docker::Spec).void }
+      T::Sig::WithoutRuntime.sig { params(environment: Environment, docker_spec: Docker::Spec).void }
       def initialize(environment, docker_spec)
         super(environment)
 
-        # @base_image = T.let(@base_image, T.nilable(String))
-        # @working_dir = T.let(@working_dir, T.nilable(String))
-        # @rails_env = T.let(@rails_env, T.nilable(String))
-        @docker_spec = docker_spec
+        @base_image = T.let(@base_image, T.nilable(String))
+        @working_dir = T.let(@working_dir, T.nilable(String))
+        @rails_env = T.let(@rails_env, T.nilable(String))
+        @docker_spec = T.let(docker_spec, Docker::Spec)
       end
 
-      # T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
       def apply_to(dockerfile)
         dockerfile.from(base_image)
         dockerfile.workdir(working_dir || DEFAULT_WORKING_DIR)
@@ -44,14 +44,14 @@ def apply_to(dockerfile)
         dockerfile.arg('RAILS_MASTER_KEY')
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def base_image
         @base_image || default_base_image
       end
 
       private
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def default_base_image
         case docker_spec.distro_name
           when :debian
diff --git a/lib/kuby/docker/spec.rb b/lib/kuby/docker/spec.rb
index 1864657..b205605 100644
--- a/lib/kuby/docker/spec.rb
+++ b/lib/kuby/docker/spec.rb
@@ -3,173 +3,173 @@
 module Kuby
   module Docker
     class Spec
-      # extend T::Sig
+      extend T::Sig
 
-      DEFAULT_DISTRO = :debian
-      DEFAULT_APP_ROOT_PATH = '.'.freeze
+      DEFAULT_DISTRO = T.let(:debian, Symbol)
+      DEFAULT_APP_ROOT_PATH = T.let('.'.freeze, String)
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Environment) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Environment) }
       attr_reader :environment
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       attr_reader :image_url_str
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       attr_reader :registry_index_url_str
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(String)) }
       attr_reader :app_root_path
 
-      # T::Sig::WithoutRuntime.sig { returns T.nilable(Kuby::Docker::AppImage) }
+      T::Sig::WithoutRuntime.sig { returns T.nilable(Kuby::Docker::AppImage) }
       attr_reader :image
 
-      # T::Sig::WithoutRuntime.sig { params(environment: Kuby::Environment).void }
+      T::Sig::WithoutRuntime.sig { params(environment: Kuby::Environment).void }
       def initialize(environment)
         @environment = environment
 
-        # @credentials = T.let(@credentials, T.nilable(Credentials))
-        # @setup_phase = T.let(@setup_phase, T.nilable(SetupPhase))
-        # @package_phase = T.let(@package_phase, T.nilable(PackagePhase))
-        # @bundler_phase = T.let(@bundler_phase, T.nilable(BundlerPhase))
-        # @yarn_phase = T.let(@yarn_phase, T.nilable(YarnPhase))
-        # @copy_phase = T.let(@copy_phase, T.nilable(CopyPhase))
-        # @app_phase = T.let(@app_phase, T.nilable(AppPhase))
-        # @assets_phase = T.let(@assets_phase, T.nilable(AssetsPhase))
-        # @webserver_phase = T.let(@webserver_phase, T.nilable(WebserverPhase))
+        @credentials = T.let(@credentials, T.nilable(Credentials))
+        @setup_phase = T.let(@setup_phase, T.nilable(SetupPhase))
+        @package_phase = T.let(@package_phase, T.nilable(PackagePhase))
+        @bundler_phase = T.let(@bundler_phase, T.nilable(BundlerPhase))
+        @yarn_phase = T.let(@yarn_phase, T.nilable(YarnPhase))
+        @copy_phase = T.let(@copy_phase, T.nilable(CopyPhase))
+        @app_phase = T.let(@app_phase, T.nilable(AppPhase))
+        @assets_phase = T.let(@assets_phase, T.nilable(AssetsPhase))
+        @webserver_phase = T.let(@webserver_phase, T.nilable(WebserverPhase))
 
-        # @distro_name = T.let(@distro_name, T.nilable(Symbol))
-        # @distro_spec = T.let(@distro_spec, T.nilable(Distro))
-        # @layer_stack = T.let(@layer_stack, T.nilable(Kuby::Docker::LayerStack))
+        @distro_name = T.let(@distro_name, T.nilable(Symbol))
+        @distro_spec = T.let(@distro_spec, T.nilable(Distro))
+        @layer_stack = T.let(@layer_stack, T.nilable(Kuby::Docker::LayerStack))
 
-        # @image_url_str = T.let(@image_url_str, T.nilable(String))
-        # @registry_index_url_str = T.let(@registry_index_url_str, T.nilable(String))
-        # @image = T.let(@image, T.nilable(Docker::AppImage))
+        @image_url_str = T.let(@image_url_str, T.nilable(String))
+        @registry_index_url_str = T.let(@registry_index_url_str, T.nilable(String))
+        @image = T.let(@image, T.nilable(Docker::AppImage))
 
-        @app_root_path = DEFAULT_APP_ROOT_PATH
+        @app_root_path = T.let(DEFAULT_APP_ROOT_PATH, String)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Symbol) }
+      T::Sig::WithoutRuntime.sig { returns(Symbol) }
       def distro_name
         @distro_name || DEFAULT_DISTRO
       end
 
-      # T::Sig::WithoutRuntime.sig { params(image_url: String).void }
+      T::Sig::WithoutRuntime.sig { params(image_url: String).void }
       def base_image(image_url)
         setup_phase.base_image = image_url
       end
 
-      # T::Sig::WithoutRuntime.sig { params(dir: String).void }
+      T::Sig::WithoutRuntime.sig { params(dir: String).void }
       def working_dir(dir)
         setup_phase.working_dir = dir
       end
 
-      # T::Sig::WithoutRuntime.sig { params(env: String).void }
+      T::Sig::WithoutRuntime.sig { params(env: String).void }
       def rails_env(env)
         setup_phase.rails_env = env
       end
 
-      # T::Sig::WithoutRuntime.sig { params(version: String).void }
+      T::Sig::WithoutRuntime.sig { params(version: String).void }
       def bundler_version(version)
         bundler_phase.version = version
       end
 
-      # T::Sig::WithoutRuntime.sig { params(path: String).void }
+      T::Sig::WithoutRuntime.sig { params(path: String).void }
       def gemfile(path)
         bundler_phase.gemfile = path
       end
 
-      # T::Sig::WithoutRuntime.sig { params(path: String).void }
+      T::Sig::WithoutRuntime.sig { params(path: String).void }
       def app_root(path)
         @app_root_path = path
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     package_name: Symbol,
-      #     version: T.nilable(String)
-      #   )
-      #   .void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          package_name: Symbol,
+          version: T.nilable(String)
+        )
+        .void
+      }
       def package(package_name, version = nil)
         package_phase.add(package_name, version)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(distro_name: Symbol).void }
+      T::Sig::WithoutRuntime.sig { params(distro_name: Symbol).void }
       def distro(distro_name)
         @distro_name = distro_name
         @distro_spec = nil
       end
 
-      # T::Sig::WithoutRuntime.sig { params(path: String).void }
+      T::Sig::WithoutRuntime.sig { params(path: String).void }
       def files(path)
         copy_phase << path
       end
 
-      # T::Sig::WithoutRuntime.sig { params(port: Integer).void }
+      T::Sig::WithoutRuntime.sig { params(port: Integer).void }
       def port(port)
         webserver_phase.port = port
       end
 
-      # T::Sig::WithoutRuntime.sig { params(url: String).void }
+      T::Sig::WithoutRuntime.sig { params(url: String).void }
       def image_url(url)
         @image_url_str = url
       end
 
-      # T::Sig::WithoutRuntime.sig { params(url: String).void }
+      T::Sig::WithoutRuntime.sig { params(url: String).void }
       def registry_index_url(url)
         @registry_index_url_str = url
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     name: Symbol,
-      #     layer: T.nilable(Layer),
-      #     block: T.nilable(T.proc.params(df: Kuby::Docker::Dockerfile).void)
-      #   )
-      #   .void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          name: Symbol,
+          layer: T.nilable(Layer),
+          block: T.nilable(T.proc.params(df: Kuby::Docker::Dockerfile).void)
+        )
+        .void
+      }
       def use(name, layer = nil, &block)
         layer_stack.use(name, layer, &block)
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     name: Symbol,
-      #     layer: T.nilable(T.any(Layer, T::Hash[Symbol, T.untyped])),
-      #     options: T::Hash[Symbol, T.untyped],
-      #     block: T.nilable(T.proc.params(df: Dockerfile).void)
-      #   )
-      #   .void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          name: Symbol,
+          layer: T.nilable(T.any(Layer, T::Hash[Symbol, T.untyped])),
+          options: T::Hash[Symbol, T.untyped],
+          block: T.nilable(T.proc.params(df: Dockerfile).void)
+        )
+        .void
+      }
       def insert(name, layer = nil, options = {}, &block)
         layer_stack.insert(name, layer, options, &block)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(name: Symbol, layer: Layer).void }
+      T::Sig::WithoutRuntime.sig { params(name: Symbol, layer: Layer).void }
       def replace(name, layer)
         layer_stack.replace(name, layer)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(name: Symbol).void }
+      T::Sig::WithoutRuntime.sig { params(name: Symbol).void }
       def delete(name)
         layer_stack.delete(name)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(name: Symbol).returns(T::Boolean) }
+      T::Sig::WithoutRuntime.sig { params(name: Symbol).returns(T::Boolean) }
       def exists?(name)
         layer_stack.includes?(name)
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(block: T.nilable(T.proc.void)).returns(Kuby::Docker::Credentials)
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(block: T.nilable(T.proc.void)).returns(Kuby::Docker::Credentials)
+      }
       def credentials(&block)
         @credentials ||= Credentials.new
         @credentials.instance_eval(&block) if block
         @credentials
       end
 
-      # T::Sig::WithoutRuntime.sig { void }
+      T::Sig::WithoutRuntime.sig { void }
       def after_configuration
         @image = begin
           dockerfile = Dockerfile.new.tap do |df|
@@ -177,52 +177,52 @@ def after_configuration
           end
 
           Docker::AppImage.new(
-            dockerfile, image_url_str, credentials, registry_index_url_str
+            dockerfile, T.must(image_url_str), credentials, registry_index_url_str
           )
         end
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::SetupPhase) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::SetupPhase) }
       def setup_phase
         @setup_phase ||= SetupPhase.new(environment, self)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::PackagePhase) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::PackagePhase) }
       def package_phase
         @package_phase ||= PackagePhase.new(environment)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::BundlerPhase) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::BundlerPhase) }
       def bundler_phase
         @bundler_phase ||= BundlerPhase.new(environment)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::YarnPhase) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::YarnPhase) }
       def yarn_phase
         @yarn_phase ||= YarnPhase.new(environment)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::CopyPhase) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::CopyPhase) }
       def copy_phase
         @copy_phase ||= CopyPhase.new(environment)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::AppPhase) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::AppPhase) }
       def app_phase
         @app_phase ||= AppPhase.new(environment)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::AssetsPhase) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::AssetsPhase) }
       def assets_phase
         @assets_phase ||= AssetsPhase.new(environment)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::WebserverPhase) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::WebserverPhase) }
       def webserver_phase
         @webserver_phase ||= WebserverPhase.new(environment)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Distro) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Distro) }
       def distro_spec
         @distro_spec ||= if distro_klass = Kuby.distros[distro_name]
           distro_klass.new(self)
@@ -233,7 +233,7 @@ def distro_spec
 
       private
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::LayerStack) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::LayerStack) }
       def layer_stack
         @layer_stack ||= Kuby::Docker::LayerStack.new.tap do |stack|
           stack.use(:setup_phase, setup_phase)
diff --git a/lib/kuby/docker/timestamp_tag.rb b/lib/kuby/docker/timestamp_tag.rb
index cba7c74..ab90e41 100644
--- a/lib/kuby/docker/timestamp_tag.rb
+++ b/lib/kuby/docker/timestamp_tag.rb
@@ -5,11 +5,11 @@
 module Kuby
   module Docker
     class TimestampTag
-      # extend T::Sig
+      extend T::Sig
 
-      FORMAT = '%Y%m%d%H%M%S'.freeze
+      FORMAT = T.let('%Y%m%d%H%M%S'.freeze, String)
 
-      # T::Sig::WithoutRuntime.sig { params(str: T.nilable(String)).returns(T.nilable(Kuby::Docker::TimestampTag)) }
+      T::Sig::WithoutRuntime.sig { params(str: T.nilable(String)).returns(T.nilable(Kuby::Docker::TimestampTag)) }
       def self.try_parse(str)
         return nil unless str
 
@@ -27,40 +27,40 @@ def self.try_parse(str)
         new(time)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::TimestampTag) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::TimestampTag) }
       def self.now
         new(Time.now.utc)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Time) }
+      T::Sig::WithoutRuntime.sig { returns(Time) }
       attr_reader :time
 
-      # T::Sig::WithoutRuntime.sig { params(time: Time).void }
+      T::Sig::WithoutRuntime.sig { params(time: Time).void }
       def initialize(time)
-        @time = time
+        @time = T.let(time, Time)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def to_s
         time.strftime(FORMAT)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(other: Kuby::Docker::TimestampTag).returns(T.nilable(Integer)) }
+      T::Sig::WithoutRuntime.sig { params(other: Kuby::Docker::TimestampTag).returns(T.nilable(Integer)) }
       def <=>(other)
         time <=> other.time
       end
 
-      # T::Sig::WithoutRuntime.sig { params(other: Kuby::Docker::TimestampTag).returns(T::Boolean) }
+      T::Sig::WithoutRuntime.sig { params(other: Kuby::Docker::TimestampTag).returns(T::Boolean) }
       def ==(other)
         time == other.time
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Integer) }
+      T::Sig::WithoutRuntime.sig { returns(Integer) }
       def hash
         time.hash
       end
 
-      # T::Sig::WithoutRuntime.sig { params(other: Kuby::Docker::TimestampTag).returns(T::Boolean) }
+      T::Sig::WithoutRuntime.sig { params(other: Kuby::Docker::TimestampTag).returns(T::Boolean) }
       def eql?(other)
         time == other.time
       end
diff --git a/lib/kuby/docker/timestamped_image.rb b/lib/kuby/docker/timestamped_image.rb
index 62ed397..254caaa 100644
--- a/lib/kuby/docker/timestamped_image.rb
+++ b/lib/kuby/docker/timestamped_image.rb
@@ -5,38 +5,38 @@
 module Kuby
   module Docker
     class TimestampedImage < Image
-      # extend T::Sig
-
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     dockerfile: T.any(Dockerfile, T.proc.returns(Kuby::Docker::Dockerfile)),
-      #     image_url: String,
-      #     credentials: Kuby::Docker::Credentials,
-      #     registry_index_url_str: T.nilable(String),
-      #     main_tag: T.nilable(String),
-      #     alias_tags: T::Array[String]
-      #   ).void
-      # }
+      extend T::Sig
+
+      T::Sig::WithoutRuntime.sig {
+        params(
+          dockerfile: T.any(Dockerfile, T.proc.returns(Kuby::Docker::Dockerfile)),
+          image_url: String,
+          credentials: Kuby::Docker::Credentials,
+          registry_index_url_str: T.nilable(String),
+          main_tag: T.nilable(String),
+          alias_tags: T::Array[String]
+        ).void
+      }
       def initialize(dockerfile, image_url, credentials, registry_index_url_str = nil, main_tag = nil, alias_tags = [])
-        # @new_version = T.let(@new_version, T.nilable(Image))
-        # @current_version = T.let(@current_version, T.nilable(Image))
-        # @previous_version = T.let(@previous_version, T.nilable(Image))
+        @new_version = T.let(@new_version, T.nilable(Image))
+        @current_version = T.let(@current_version, T.nilable(Image))
+        @previous_version = T.let(@previous_version, T.nilable(Image))
 
-        # @remote_client = T.let(@remote_client, T.nilable(::Docker::Remote::Client))
-        # @local = T.let(@local, T.nilable(LocalTags))
-        # @remote = T.let(@remote, T.nilable(RemoteTags))
+        @remote_client = T.let(@remote_client, T.nilable(::Docker::Remote::Client))
+        @local = T.let(@local, T.nilable(LocalTags))
+        @remote = T.let(@remote, T.nilable(RemoteTags))
 
         super
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Image) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Image) }
       def new_version
         @new_version ||= duplicate_with_tags(
           TimestampTag.now.to_s, [Kuby::Docker::LATEST_TAG]
         )
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Image) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::Image) }
       def current_version
         @current_version ||= begin
           duplicate_with_tags(
@@ -47,14 +47,14 @@ def current_version
         end
       end
 
-      # T::Sig::WithoutRuntime.sig { params(current_tag: T.nilable(String)).returns(Kuby::Docker::Image) }
+      T::Sig::WithoutRuntime.sig { params(current_tag: T.nilable(String)).returns(Kuby::Docker::Image) }
       def previous_version(current_tag = nil)
         @previous_version ||= duplicate_with_tags(
           previous_timestamp_tag(current_tag).to_s, []
         )
       end
 
-      # T::Sig::WithoutRuntime.sig { params(current_tag: T.nilable(String)).returns(Kuby::Docker::TimestampTag) }
+      T::Sig::WithoutRuntime.sig { params(current_tag: T.nilable(String)).returns(Kuby::Docker::TimestampTag) }
       def previous_timestamp_tag(current_tag = nil)
         current_tag = TimestampTag.try_parse(current_tag || latest_timestamp_tag.to_s)
         raise MissingTagError, 'could not find current timestamp tag' unless current_tag
@@ -68,24 +68,24 @@ def previous_timestamp_tag(current_tag = nil)
         idx ||= 0
         raise MissingTagError, 'could not find previous timestamp tag' unless idx > 0
 
-        all_tags[idx - 1]
+        T.must(all_tags[idx - 1])
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::TimestampTag) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::TimestampTag) }
       def latest_timestamp_tag
         tag = timestamp_tags.sort.last
         raise MissingTagError, 'could not find latest timestamp tag' unless tag
         tag
       end
 
-      # T::Sig::WithoutRuntime.sig {
-      #   params(
-      #     build_args: T::Hash[String, String],
-      #     docker_args: T::Array[String],
-      #     context: T.nilable(String),
-      #     cache_from: T.nilable(String)
-      #   ).void
-      # }
+      T::Sig::WithoutRuntime.sig {
+        params(
+          build_args: T::Hash[String, String],
+          docker_args: T::Array[String],
+          context: T.nilable(String),
+          cache_from: T.nilable(String)
+        ).void
+      }
       def build(build_args = {}, docker_args = [], context: nil, cache_from: nil)
         docker_cli.build(
           self,
@@ -96,17 +96,17 @@ def build(build_args = {}, docker_args = [], context: nil, cache_from: nil)
         )
       end
 
-      # T::Sig::WithoutRuntime.sig { params(tag: String).void }
+      T::Sig::WithoutRuntime.sig { params(tag: String).void }
       def push(tag)
         docker_cli.push(image_url, tag)
       end
 
-      # T::Sig::WithoutRuntime.sig { params(tag: String).void }
+      T::Sig::WithoutRuntime.sig { params(tag: String).void }
       def pull(tag)
         docker_cli.pull(image_url, tag)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Boolean) }
+      T::Sig::WithoutRuntime.sig { returns(T::Boolean) }
       def exists?
         return false unless main_tag
         timestamp_tags.include?(TimestampTag.try_parse(main_tag))
@@ -114,24 +114,24 @@ def exists?
 
       private
 
-      # T::Sig::WithoutRuntime.sig { returns(::Docker::Remote::Client) }
+      T::Sig::WithoutRuntime.sig { returns(::Docker::Remote::Client) }
       def remote_client
         @remote_client ||= ::Docker::Remote::Client.new(
           registry_index_host, image_repo, credentials.username, credentials.password,
         )
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(T::Array[Kuby::Docker::TimestampTag]) }
+      T::Sig::WithoutRuntime.sig { returns(T::Array[Kuby::Docker::TimestampTag]) }
       def timestamp_tags
         (local.timestamp_tags + remote.timestamp_tags).uniq
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::LocalTags) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::LocalTags) }
       def local
         @local ||= LocalTags.new(docker_cli, image_url)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::RemoteTags) }
+      T::Sig::WithoutRuntime.sig { returns(Kuby::Docker::RemoteTags) }
       def remote
         @remote ||= RemoteTags.new(remote_client, registry_index_host)
       end
diff --git a/lib/kuby/docker/webserver_phase.rb b/lib/kuby/docker/webserver_phase.rb
index 60b0bf6..f85e659 100644
--- a/lib/kuby/docker/webserver_phase.rb
+++ b/lib/kuby/docker/webserver_phase.rb
@@ -3,28 +3,28 @@
 module Kuby
   module Docker
     class WebserverPhase < Layer
-      # extend T::Sig
+      extend T::Sig
 
       class Webserver
-        # extend T::Sig
-        # extend T::Helpers
+        extend T::Sig
+        extend T::Helpers
 
-        # abstract!
+        abstract!
 
-        # T::Sig::WithoutRuntime.sig { returns(WebserverPhase) }
+        T::Sig::WithoutRuntime.sig { returns(WebserverPhase) }
         attr_reader :phase
 
-        # T::Sig::WithoutRuntime.sig { params(phase: WebserverPhase).void }
+        T::Sig::WithoutRuntime.sig { params(phase: WebserverPhase).void }
         def initialize(phase)
           @phase = phase
         end
 
-        # T::Sig::WithoutRuntime.sig { abstract.params(dockerfile: Dockerfile).void }
+        T::Sig::WithoutRuntime.sig { abstract.params(dockerfile: Dockerfile).void }
         def apply_to(dockerfile); end
       end
 
       class Puma < Webserver
-        # T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
+        T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
         def apply_to(dockerfile)
           dockerfile.cmd(
             'puma',
@@ -39,53 +39,53 @@ def apply_to(dockerfile)
         end
       end
 
-      DEFAULT_PORT = 8080
-      DEFAULT_WORKERS = 4
-      WEBSERVER_MAP = { puma: Puma }.freeze
+      DEFAULT_PORT = T.let(8080, Integer)
+      DEFAULT_WORKERS = T.let(4, Integer)
+      WEBSERVER_MAP = T.let({ puma: Puma }.freeze, T::Hash[Symbol, T.class_of(Webserver)])
 
-      # T::Sig::WithoutRuntime.sig { params(port: Integer).returns(Integer) }
+      T::Sig::WithoutRuntime.sig { params(port: Integer).returns(Integer) }
       attr_writer :port
 
-      # T::Sig::WithoutRuntime.sig { params(workers: Integer).returns(Integer) }
+      T::Sig::WithoutRuntime.sig { params(workers: Integer).returns(Integer) }
       attr_writer :workers
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(Symbol)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(Symbol)) }
       attr_reader :webserver
 
-      # T::Sig::WithoutRuntime.sig { params(webserver: Symbol).returns(Symbol) }
+      T::Sig::WithoutRuntime.sig { params(webserver: Symbol).returns(Symbol) }
       attr_writer :webserver
 
-      # T::Sig::WithoutRuntime.sig { override.params(environment: Environment).void }
+      T::Sig::WithoutRuntime.sig { override.params(environment: Environment).void }
       def initialize(environment)
         super
 
-        # @port = T.let(@port, T.nilable(Integer))
-        # @workers = T.let(@workers, T.nilable(Integer))
-        # @webserver = T.let(@webserver, T.nilable(Symbol))
+        @port = T.let(@port, T.nilable(Integer))
+        @workers = T.let(@workers, T.nilable(Integer))
+        @webserver = T.let(@webserver, T.nilable(Symbol))
       end
 
-      # T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { override.params(dockerfile: Dockerfile).void }
       def apply_to(dockerfile)
         ws = webserver || default_webserver
-        ws_class = WEBSERVER_MAP[ws]
+        ws_class = WEBSERVER_MAP[T.must(ws)]
         raise "No webserver named #{ws}" unless ws_class
 
         ws_class.new(self).apply_to(dockerfile)
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Integer) }
+      T::Sig::WithoutRuntime.sig { returns(Integer) }
       def port
         @port || DEFAULT_PORT
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Integer) }
+      T::Sig::WithoutRuntime.sig { returns(Integer) }
       def workers
         @workers || DEFAULT_WORKERS
       end
 
       private
 
-      # T::Sig::WithoutRuntime.sig { returns(T.nilable(Symbol)) }
+      T::Sig::WithoutRuntime.sig { returns(T.nilable(Symbol)) }
       def default_webserver
         if Gem.loaded_specs.include?('puma')
           :puma
diff --git a/lib/kuby/docker/yarn_phase.rb b/lib/kuby/docker/yarn_phase.rb
index c29bdb3..7bf3f28 100644
--- a/lib/kuby/docker/yarn_phase.rb
+++ b/lib/kuby/docker/yarn_phase.rb
@@ -3,9 +3,9 @@
 module Kuby
   module Docker
     class YarnPhase < Layer
-      # extend T::Sig
+      extend T::Sig
 
-      # T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
+      T::Sig::WithoutRuntime.sig { params(dockerfile: Dockerfile).void }
       def apply_to(dockerfile)
         host_path = environment.docker.app_root_path
 
@@ -31,7 +31,7 @@ def apply_to(dockerfile)
 
       private
 
-      # T::Sig::WithoutRuntime.sig { params(path: String).returns(String) }
+      T::Sig::WithoutRuntime.sig { params(path: String).returns(String) }
       def ensure_trailing_delimiter(path)
         path.end_with?(File::SEPARATOR) ? path : File.join(path, '')
       end
diff --git a/lib/kuby/kubernetes/bare_metal_provider.rb b/lib/kuby/kubernetes/bare_metal_provider.rb
index 41a613c..38cf04d 100644
--- a/lib/kuby/kubernetes/bare_metal_provider.rb
+++ b/lib/kuby/kubernetes/bare_metal_provider.rb
@@ -5,9 +5,9 @@
 module Kuby
   module Kubernetes
     class BareMetalProvider < Provider
-      # extend T::Sig
+      extend T::Sig
 
-      DEFAULT_STORAGE_CLASS = 'hostpath'.freeze
+      DEFAULT_STORAGE_CLASS = T.let('hostpath'.freeze, String)
 
       class Config
         extend ::KubeDSL::ValueFields
@@ -16,33 +16,33 @@ class Config
         value_fields :storage_class
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(Config) }
+      T::Sig::WithoutRuntime.sig { returns(Config) }
       attr_reader :config
 
-      # T::Sig::WithoutRuntime.sig { params(environment: Environment).void }
+      T::Sig::WithoutRuntime.sig { params(environment: Environment).void }
       def initialize(environment)
-        @config = Config.new
+        @config = T.let(Config.new, Config)
         super
       end
 
-      # T::Sig::WithoutRuntime.sig { params(block: T.proc.void).void }
+      T::Sig::WithoutRuntime.sig { params(block: T.proc.void).void }
       def configure(&block)
         config.instance_eval(&block) if block
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def kubeconfig_path
         config.kubeconfig
       end
 
-      # T::Sig::WithoutRuntime.sig { returns(String) }
+      T::Sig::WithoutRuntime.sig { returns(String) }
       def storage_class_name
         config.storage_class
       end
 
       private
 
-      # T::Sig::WithoutRuntime.sig { void }
+      T::Sig::WithoutRuntime.sig { void }
       def after_initialize
         configure do
           # default kubeconfig path
diff --git a/lib/kuby/kubernetes/deployer.rb b/lib/kuby/kubernetes/deployer.rb
index 499f557..3958253 100644
--- a/lib/kuby/kubernetes/deployer.rb
+++ b/lib/kuby/kubernetes/deployer.rb
@@ -109,7 +109,7 @@ def deploy_namespaced_resources(resources, ns)
         task.run!(verify_result: true, prune: false)
       ensure
         ENV['KUBECONFIG'] = old_kubeconfig
-        FileUtils.rm_rf(tmpdir)
+        FileUtils.rm_rf(T.must(tmpdir))
       end
 
       def restart_rails_deployment_if_necessary
diff --git a/lib/kuby/trailing_hash.rb b/lib/kuby/trailing_hash.rb
index ac6cad1..de0a3fa 100644
--- a/lib/kuby/trailing_hash.rb
+++ b/lib/kuby/trailing_hash.rb
@@ -3,14 +3,14 @@
 module Kuby
   class TrailingHash < Hash
     def each(&block)
-      return to_enum(__method__) unless block_given?
+      return to_enum(T.must(__method__)) unless block_given?
 
       seen_keys = []
       keys_before = keys
 
       until keys_before.empty?
         keys_before.each do |k|
-          yield k, self[k]
+          yield k, T.must(self[k])
           seen_keys << k
         end