diff --git a/lib/pve/cli.rb b/lib/pve/cli.rb
index c9c68e5..172fbbb 100644
--- a/lib/pve/cli.rb
+++ b/lib/pve/cli.rb
@@ -11,9 +11,6 @@ require_relative 'cli/qm'
 require_relative 'cli/node'
 require_relative 'cli/storage'
 
-class UsageError <RuntimeError
-end
-
 class DenCli::Sub
   def provide_help name: nil, aliases: nil, min: nil
     base = self
@@ -26,6 +23,73 @@ class DenCli::Sub
 end
 
 class PVE::Cli
+  class RuntimeError <::RuntimeError
+  end
+
+  class UsageError <RuntimeError
+  end
+  def UsageError msg
+    raise UsageError, msg
+  end
+
+  class OperationalError <RuntimeError
+  end
+  def OperationalError msg
+    raise OperationalError, msg
+  end
+
+  class ConditionViolation <RuntimeError
+  end
+  def ConditionViolation msg
+    raise ConditionViolation, msg
+  end
+
+  class Output
+    LINERESET = "\r\e[J"
+    RESET     = "\e[0m"
+    SUCCESS_  = "\e[32;1m✓"
+    SUCCESS   = "#{LINERESET}[%s] #{SUCCESS_}#{RESET} "
+    FAILED_   = "\e[31;1m✗"
+    FAILED    = "#{LINERESET}[%s] #{FAILED_}#{RESET} "
+    PROGRESS_ = "\e[33;1m%s"
+    PROGRESS  = "#{LINERESET}[%s] #{PROGRESS_}#{RESET} "
+    INFO_     = "\e[33;1m•"
+    INFO      = "#{LINERESET}[%s] #{INFO_}#{RESET} "
+
+    attr_accessor :host
+
+    def initialize host
+      @host, @spinners, @spin = host, "▖▘▝▗", 0
+    end
+
+    def progress format, *args, **kwargs
+      STDERR.printf PROGRESS, @host, @spinners[@spin = (@spin + 1) % 4]
+      STDERR.printf( format, *args, **kwargs)
+    end
+
+    def info format, *args, **kwargs
+      STDERR.printf INFO, @host
+      STDERR.printf( format, *args, **kwargs)
+      STDERR.puts
+    end
+
+    def failed format, *args, **kwargs
+      STDERR.printf FAILED, @host
+      STDERR.printf( format, *args, **kwargs)
+      STDERR.puts
+    end
+
+    def success format, *args, **kwargs
+      STDERR.printf SUCCESS, @host
+      STDERR.printf( format, *args, **kwargs)
+      STDERR.puts
+    end
+
+    def reset
+      STDERR.printf LINERESET
+    end
+  end
+
   attr_reader :cfg, :cli
 
   def connect
@@ -44,6 +108,7 @@ class PVE::Cli
         symbolize_names: true
     @cli = DenCli.new File.basename($0), "PVE CLI"
     @interactive = false
+    @out = Output.new "<>"
     prepare
   end
 
@@ -52,18 +117,18 @@ class PVE::Cli
   end
 
   def enter host, *args
+    @out.host = host.name
     r = host.enter *args
-    STDERR.puts "! #{$?.exitstatus}"  unless r
+    operational_error "Exitstatus: #{$?.exitstatus}"  unless r
   end
 
   def wait_state host, state, timeout: nil, lock: nil
-    spinners, spin = "▖▘▝▗", 0
+    @out.host = host.name
     r =
       host.wait state, lock: lock, timeout: timeout, secs: 0.2 do |state, lock|
-        lock = " (locked: #{lock})"  if lock
-        STDERR.printf "\r[%s] \e[33;1m%s\e[0m Still %s%s...\e[J", host.name, spinners[spin = (spin + 1) % 4], state, lock
+        @out.progress "Still %s%s...", state, lock ? " (locked: #{lock})" : ''
       end
-    STDERR.printf "\r\e[J"
+    @out.reset
     exit 1  if interactive?  and  !r
   end
 
@@ -71,7 +136,7 @@ class PVE::Cli
     log = task.log start: logn, limit: limit
     log = []  if [{n: 1, t: 'no content'}] == log
     unless log.empty?
-      STDERR.printf "\r\e[J"
+      @out.reset
       log.each {|l| puts l[:t] }
       logn = log.last[:n]
     end
@@ -80,9 +145,9 @@ class PVE::Cli
 
   def wait task, secs: nil, text: nil, timeout: nil
     secs ||= 0.1
-    spinners, spin, logn = "▖▘▝▗", 0, 0
-    STDERR.puts task.upid
-    host = task.host&.name
+    logn = 0
+    STDOUT.puts task.upid
+    @out.host = host = task.host&.name || '<>'
     loop do
       s = task.status
       logn = self.task_log task, logn
@@ -92,17 +157,14 @@ class PVE::Cli
           break  if 0 == logn - r
           logn = r
         end
-        STDERR.printf "\r[%s] %s %s %s\e[J\n",
-          host || s.id,
-          s.successfull? ? "\e[32;1m✓\e[0m" : "\e[31;1m✗\e[0m",
-          text && "#{text}:",
-          s.stopped? ? :finished : s.status
+        if s.successfull?
+          @out.success "%s %s", text && "#{text}:", s.stopped? ? :finished : s.status
+        else
+          @out.failed "%s %s", text && "#{text}:", s.stopped? ? :finished : s.status
+        end
         return s
       end
-      STDERR.printf "\r[%s] \e[33;1m%s\e[0m %s...\e[J",
-        host || s[:id],
-        spinners[spin = (spin + 1) % 4],
-        text || "Working"
+      @out.progress text || "Working"
       sleep secs
     end
   end
@@ -116,7 +178,7 @@ class PVE::Cli
   def start host, node: nil, timeout: nil, fire: nil, secs: nil
     timeout ||= 60
     if host.running?
-      STDERR.puts "Already running."
+      condition_violation "Already running."
       return
     end
     task = host.start
@@ -130,7 +192,7 @@ class PVE::Cli
   def stop host, timeout: nil, fire: nil, secs: nil
     timeout ||= 30
     if host.stopped?
-      STDERR.puts "Already stopped."
+      preset_error "Already stopped."
       return
     end
     task = host.stop
@@ -161,6 +223,137 @@ class PVE::Cli
     end
   end
 
+  def rbd_device_map image_spec, &exe
+    dev = IO.popen( [*%w[rbd device map], image_spec]) {|io| io.read }.chomp
+    raise OperationalError, "Device mapping #{image_spec} localy failed."  unless $?.success?
+    begin
+      yield dev
+    ensure
+      system *%w[rbd device unmap], image_spec
+      raise OperationalError, "Device unmapping #{image_spec} failed."  unless $?.success?
+    end
+  end
+
+  def rbd_devices_maps spec, *specs, &exe
+    rbd_device_map spec do |dev|
+      if specs.empty?
+        yield dev
+      else
+        rbd_devices_maps *specs do |*devs|
+          yield dev, *devs
+        end
+      end
+    end
+  end
+
+  def mount dev, mp, &exe
+    system 'mount', dev.to_s, mp.to_s
+    begin yield
+    ensure
+      # it could be possible, that a process is working in fs, yet.
+      sleep 1
+      system 'umount', mp.to_s
+    end
+  end
+
+  def ct_volume_move ct, disk, destination
+    @out.host = ct.name
+    host = Proxmox::Node.find_by_name! Socket.gethostname
+    unless host.node == ct.node.node
+      ConditionViolation( "CT is hosted on #{ct.node.node}, not local (#{Socket.gethostname})")
+    end
+    # Lock, we do not want changes, while we check/prepare,
+    # these checks could be obsolete while moving.
+    configupdate = {}
+    ct.lock :migrate do
+      disk =
+        case disk
+        when 'rootfs', /\Amp\d+\z/ then disk.to_sym
+        else UsageError( "Unknown disk #{disk}")
+        end
+      ctcnf = ct.config
+      UsageError( "CT has no disk #{disk}")  if ctcnf[disk].nil?
+      UsageError( "CT not stopped, yet.")    unless ct.stopped?
+      dest = host.storage.find {|x| destination == x.storage }
+      ConditionViolation( "Destination storage #{dest.storage} disabled")    unless dest.enabled?
+      ConditionViolation( "Destination storage #{dest.storage} not active")  unless dest.active?
+
+      unless /\A([^:]+):([^,]+)(,.+)?\z/ =~ ctcnf[disk]
+        OperationalError( "disk-specification cannot be parsed: [#{disk}: #{ctcnf[disk]}]")
+      end
+      source, name, diskopts = $1, $2, $3.to_s
+      src = host.storage.find {|x| source == x.storage }
+
+      ConditionViolation( "Source storage #{dest.storage} disabled")    unless dest.enabled?
+      ConditionViolation( "Source storage #{dest.storage} not active")  unless dest.active?
+      case src.type
+      when 'rbd'
+      else ConditionViolation( "Storage type #{src.type} not supported as source. (supported: rbd only, yet)")
+      end
+      #unless c = src.content.find {|x| x.name == name }
+      #  usage_error "Source storage #{src.storage} has no disk named #{name}"
+      #end
+      case dest.type
+      when 'rbd'
+      else ConditionViolation( "Storage type #{dest.type} not supported as destination. (supported: rbd only, yet)")
+      end
+      #if c = dest.content.find {|x| x.name == name }
+      #  usage_error "Destination storage #{dest.storage} has already a disk named #{name}"
+      #end
+
+      src_image_spec, dest_image_spec = "#{source}/#{name}", "#{destination}/#{name}"
+      mp_path = Pathname.new( "/var/lib/lxc/").join ct.vmid.to_s
+      mp_path.mkdir  unless mp_path.exist?
+      src_mp, dest_mp = mp_path + src_image_spec.gsub('/','-'), mp_path + dest_image_spec.gsub('/','-')
+
+      src_mp.mkdir   unless src_mp.exist?
+      dest_mp.mkdir  unless dest_mp.exist?
+      # We check, if something is mounted already on our mountpoints.
+      # We check it later, too, but later cleaning up would be impossible.
+      # We do not trust only this checks, so we check later, too.
+      ConditionViolation( "Something already mounted at #{src_mp}")   if src_mp.mountpoint?
+      ConditionViolation( "Something already mounted at #{dest_mp}")  if dest_mp.mountpoint?
+
+      rbd_image_info = JSON.parse IO.popen( [*%w[rbd info --format json], src_image_spec]) {|io| io.read }
+      OperationalError( "Couldn't determine size of #{src_image_spec}.")  unless $?.success?
+
+      # checks and preparation done.
+      size = rbd_image_info['size']/1024/1024
+
+      unless system *%w[rbd create -s], size.to_s, dest_image_spec
+        OperationalError( "Creating disk #{dest_image_spec} failed.")
+      end
+      @out.progress "Map devices %s, %s \e[J", ct.name, dest_image_spec, src_image_spec
+      rbd_devices_maps dest_image_spec, src_image_spec do |dest_dev, src_dev|
+        @out.info "Maped source      device %s => %s => %s", src_image_spec, src_dev, src_mp
+        @out.info "Maped destination device %s => %s => %s", dest_image_spec, dest_dev, dest_mp
+        @out.info "Formatting destination disk"
+        unless system *%w[mkfs.xfs -mreflink=1 -bsize=4096 -ssize=4096], dest_dev
+          OperationalError( "Formatting #{dest_image_spec} failed.")
+        end
+        OperationalError( "Something already mounted at #{src_mp}")  if src_mp.mountpoint?
+        @out.progress "Mounting source disk"
+        mount src_dev, src_mp do
+          OperationalError( "Something already mounted at #{src_mp}")  if dest_mp.mountpoint?
+          @out.progress "Mounting destination disk"
+          mount dest_dev, dest_mp do
+            #@out.info "rsyncing..."
+            #system *%w[rsync -aHAX --info=progress2], "#{src_mp}/", "#{dest_mp}/"
+            IO.popen %w[rsync -ahHAX --info=progress2] + ["#{src_mp}/", "#{dest_mp}/"] do |io|
+              io.each_line("\r") {|l| @out.progress 'rsync|%s', l.chomp }
+            end
+            OperationalError( "rsync had an error. [#{$?.exitcode}]")  unless $?.success?
+          end
+        end
+      end
+
+      unusedfield = (0..20).map{|i| "unused#{i}" }.find {|n| ctcnf[n].nil? }
+      configupdate = {unusedfield => "#{source}:#{name}", disk => "#{destination}:#{name}#{diskopts}"}
+    end
+    ct.cnfset **configupdate
+    @out.success "disk moved."
+  end
+
   def node_opt node = nil
     node ? [Proxmox::Node.find_by_name!( node)] : Proxmox::Node.all
   end
@@ -174,10 +367,17 @@ class PVE::Cli
     end
   end
 
-  def hosting_table target:, status:, sort:
+  def hosting_table target:, status:, sort:, tags:
     connect
-    to = TablizedOutput.new %w[Status HA ID Name Host Uptime CPU/% Mem/MiB Mem/% Disk/MiB Disk/%], format: '<<<<<>>>>>>'
+    to = TablizedOutput.new %w[Status HA ID Name Host Uptime CPU/% Mem/MiB Mem/% Disk/MiB Disk/% Tags], format: '<<<<<>>>>>><'
     target &&= /\A#{target}\z/i
+    nottags = nil
+    if tags
+      tags = tags.split /,/
+      nottags = tags.grep /\A-/
+      tags -= nottags
+      nottags.map! {|x| x[1..-1] }
+    end
     status =
       case status
       when /\Asta(r(t(ed?)?)?)?\z/i, /\Aon(l(i(ne?)?)?)?\z/i, /\Ar(u(n(n(i(ng?)?)?)?)?)?\z/i, '1'
@@ -186,17 +386,25 @@ class PVE::Cli
         %i[stopped offline]
       when nil, '', /\Aa(ll?)?\z/i then nil
       else
-        raise DenKn::UsageError, "Unknown state #{status}"
+        usage_error "Unknown state #{status}"
       end
     push =
-      if target and status
-        lambda {|n| to.push tablized_virt( n)  if n === target and status.include?( n.state) }
-      elsif target
-        lambda {|n| to.push tablized_virt( n)  if n === target }
-      elsif status
-        lambda {|n| to.push tablized_virt( n)  if status.include? n.state }
-      else
-        lambda {|n| to.push tablized_virt( n) }
+      begin
+        condition = []
+        condition.push lambda {|n| n === target }  if target
+        if status
+          condition.push lambda {|n| !n.respond_to?( :status) or status.include?( n.status) }
+        end
+        if tags
+          condition.push lambda {|n|
+            if n.respond_to?( :tags) and n.tags
+              nt = n.tags
+              [] == tags - nt and nottags == nottags - nt
+            else false
+            end
+          }
+        end
+        lambda {|n| to.push tablized_virt( n)  if condition.all? {|c| c.call n} }
       end
     yield push
     to.print order: sort.each_char.map {|c| (2*c.ord[5]-1) * (' sainhucmd'.index( c.downcase)) }
@@ -257,25 +465,30 @@ class PVE::Cli
   def call *argv
     cli.call *argv
   rescue RestClient::ExceptionWithResponse
-    STDERR.puts "#{$!.request}: #{$!.to_s} - #{$!.response} (#{$!.class})" #, $!.backtrace.map {|b|"  #{b}"}
-  rescue UsageError, DenCli::UsageError
-    STDERR.puts $!
+    @out.failed "%s: %s - %s (%s)", $!.request, $!, $!.response, $!.class
+    #STDERR.puts $!.backtrace.map {|b|"  #{b}"}
+    exit 1
+  rescue DenCli::UsageError, RuntimeError
+    @out.failed "%s", $!
     exit 1
   end
 
   def per_argument arguments, print: nil, &exe
     arguments.each do |argument|
-      STDERR.printf print, argument  if print
+      @out.host = argument
+      @out.info "\e[1;34m#{print}\e[0m", argument  if print
       begin
         yield argument
       rescue RestClient::ExceptionWithResponse
-        STDERR.puts "#{$!.request}: #{$!.to_s} - #{JSON.parse( $!.response.body)}"
-      rescue UsageError, DenCli::UsageError
-        STDERR.puts $!
+        @out.failed "%s: %s - %s", $!.request, $!, JSON.parse( $!.response.body)
+      rescue DenCli::UsageError, RuntimeError
+        @out.failed "%s", $!
       rescue RestClient::BadRequest
-        STDERR.puts $!.message.inspect
+        @out.failed "%p", $!.message
+      rescue Interrupt
+        @out.failed "Interrupted by user"
       rescue SystemExit
-        STDERR.puts "Failed with exit code: #{$!.status}"  if 0 < $!.status
+        @out.failed "Exitcode: %d", $!.status  if 0 < $!.status
       end
     end
   end
@@ -320,8 +533,8 @@ class PVE::Cli
     end
     [
       case v.status
-      when "running", "online" then ColoredString.new v.status, "32"
-      when "stopped" then ColoredString.new v.status, "31"
+      when :running, :online then ColoredString.new v.status, "32"
+      when :stopped, :offline then ColoredString.new v.status, "31"
       else v.status
       end,
       ha&.state || '·',
@@ -340,6 +553,7 @@ class PVE::Cli
       if v.respond_to?(:maxdisk) and 0 < v.maxdisk.to_i
         TablizedOutput::Percentage.new( v.disk.to_f/v.maxdisk.to_f)
       else unknown end,
+      v.respond_to?(:tags) ? v.tags.join(', ') : '',
     ]
   end
 end
diff --git a/lib/pve/cli/base.rb b/lib/pve/cli/base.rb
index 00599a6..9c23cc5 100644
--- a/lib/pve/cli/base.rb
+++ b/lib/pve/cli/base.rb
@@ -15,8 +15,8 @@ def cli_base
       each {|c| puts c }
   }
 
-  cli.cmd( :status, "Lists Nodes/VMs/CTs with status", &lambda {|target=nil, sort:, node: nil, status: nil|
-    hosting_table target: target, status: status, sort: sort do |push|
+  cli.cmd( :status, "Lists Nodes/VMs/CTs with status", &lambda {|target=nil, sort:, node: nil, status: nil, tags: nil|
+    hosting_table target: target, status: status, sort: sort, tags: tags do |push|
       node_opt( node).
         each( &push).lazy.
         flat_map {|n| [ Thread.new( n, &:lxc), Thread.new( n, &:qemu) ] }.
@@ -25,7 +25,8 @@ def cli_base
   }).
     opt( :sort, '-s', '--sort=COLUMNS', "Sort by COLUMNs eg hn for host and name ([s]tatus, h[a], [i]d, [n]ame (default), [h]ost, [u]ptime, [c]pu, [m]em, [d]isk)", default: 'n').
     opt( :node, '-n', '--node=NODE', "List only hosted by this NODE").
-    opt( :status, '-S', '--status=STATUS', "Filter for status (running, stopped, ...) (default: no filter)")
+    opt( :status, '-S', '--status=STATUS', "Filter for status (running, stopped, ...) (default: no filter)").
+    opt( :tags, '-t', '--tags=TAGS', "Filter by comma-seperated tags.  All tags must be present for Machine")
 
   def val2str v
     case v
diff --git a/lib/pve/cli/ct.rb b/lib/pve/cli/ct.rb
index 0371394..353c8df 100644
--- a/lib/pve/cli/ct.rb
+++ b/lib/pve/cli/ct.rb
@@ -9,8 +9,8 @@ def cli_ct
       end.sort.each {|c| puts c }
     }
 
-    ct_cli.cmd( :status, "Lists CTs with status", aliases: [nil], &lambda {|target=nil, sort: nil, node: nil, status: nil|
-      hosting_table target: target, status: status, sort: sort do |push|
+    ct_cli.cmd( :status, "Lists CTs with status", aliases: [nil], &lambda {|target=nil, sort: nil, node: nil, status: nil, tags: nil|
+      hosting_table target: target, status: status, sort: sort, tags: tags do |push|
         node_opt( node).
           each( &push).lazy.
           map {|n| Thread.new n, &:lxc }.
@@ -19,31 +19,40 @@ def cli_ct
     }).
       opt( :sort, '-s', '--sort=COLUMNS', "Sort by COLUMNs eg hn for host and name ([s]tatus, h[a], [i]d, [n]ame (default), [h]ost, [u]ptime, [c]pu, [m]em, [d]isk)", default: 'n').
       opt( :node, '-n', '--node=NODE', "List only hosted by this NODE").
-      opt( :status, '-S', '--status=STATUS', "Filter for status (running, stopped, ...) (default: no filter)")
+      opt( :status, '-S', '--status=STATUS', "Filter for status (running, stopped, ...) (default: no filter)").
+      opt( :tags, '-t', '--tags=TAGS', "Filter by comma-seperated tags.  All tags must be present for CT")
 
     ct_cli.cmd :enter, "Enter Console of CT", &lambda {|name_or_id|
       connect
-      STDERR.puts "! #{$?.exitstatus}"  unless Proxmox::LXC.find!( name_or_id).enter
+      @out.host = name_or_id
+      @out.failed "Exitstatus #{$?.exitstatus}"  unless Proxmox::LXC.find!( name_or_id).enter
     }
 
     ct_cli.cmd :exec, "Executes Command in CT", min: 4, &lambda {|name_or_id, *command|
       connect
-      STDERR.puts "! #{$?.exitstatus}"  unless Proxmox::LXC.find!( name_or_id).exec *command
+      @out.host = name_or_id
+      @out.failed "Exitstatus #{$?.exitstatus}"  unless Proxmox::LXC.find!( name_or_id).exec *command
     }
 
     ct_cli.cmd( :migrate, "Migrates halted CT(s) to an other host", min: 2, &lambda {|target, *names_or_ids, fire:, timeout:, secs:|
       connect
       node = Proxmox::Node.find_by_name! target
-      per_argument names_or_ids, print: "\e[1;34mMigrate CT %s:\e[0m" do |name_or_id|
+      per_argument names_or_ids, print: "Migrate CT:" do |name_or_id|
         ct = Proxmox::LXC.find! name_or_id
         task = ct.migrate node
         wait task, text: "Migrating", timeout: timeout  unless fire
       end
     }).tap {|c| opts_wait c }
 
+    ct_cli.cmd( :volume_move, "Moves volume to an other storage/pool and marks old volume as unused.", min: 11, aliases: %i[volmv mv], &lambda {|name_or_id, volume, destination|
+      connect
+      ct = Proxmox::LXC.find! name_or_id
+      ct_volume_move ct, volume, destination
+    })
+
     ct_cli.cmd( :start, "Starts CT(s)", min: 4, &lambda {|*names_or_ids, node: nil, fire:, timeout:, secs:|
       connect
-      per_argument names_or_ids, print: "\e[1;34mStart CT %s:\e[0m" do |name_or_id|
+      per_argument names_or_ids, print: "Start CT:" do |name_or_id|
         ct = Proxmox::LXC.find! name_or_id
         start ct, node: node, fire: fire, timeout: timeout, secs: secs
       end
@@ -51,7 +60,7 @@ def cli_ct
 
     ct_cli.cmd( :stop, "Stops CT(s)", min: 3, &lambda {|*names_or_ids, fire: nil, timeout:, secs:|
       connect
-      per_argument names_or_ids, print: "\e[1;34mStart CT %s:\e[0m" do |name_or_id|
+      per_argument names_or_ids, print: "Start CT:" do |name_or_id|
         ct = Proxmox::LXC.find! name_or_id
         stop ct, fire: fire, timeout: timeout, secs: secs
       end
diff --git a/lib/pve/cli/qm.rb b/lib/pve/cli/qm.rb
index 351c2e3..94f2bbc 100644
--- a/lib/pve/cli/qm.rb
+++ b/lib/pve/cli/qm.rb
@@ -51,8 +51,8 @@ def cli_qm
       opt( :timeout, "-tTIMEOUT", "--timeout=TIMEOUT", "Wait for max TIMEOUT seconds (default: endless)", default: nil).
       opt( :secs, "-sSECONDS", "--seconds=SECONDS", "Check every SECONDS for state (default: 0.2)", default: 0.2)
 
-    qm_cli.cmd( :status, "Lists VMs with status", aliases: [nil], &lambda {|target=nil, sort: nil, node: nil, status: nil|
-      hosting_table target: target, state: state, sort: sort do |push|
+    qm_cli.cmd( :status, "Lists VMs with status", aliases: [nil], &lambda {|target=nil, sort: nil, node: nil, status: nil, tags: nil|
+      hosting_table target: target, status: status, sort: sort, tags: tags do |push|
         node_opt( node).
           each( &push).lazy.
           flat_map {|n| [ Thread.new( n, &:qemu) ] }.
@@ -61,7 +61,8 @@ def cli_qm
     }).
       opt( :sort, '-s', '--sort=COLUMNS', "Sort by COLUMNs eg hn for host and name ([s]tatus, h[a], [i]d, [n]ame (default), [h]ost, [u]ptime, [c]pu, [m]em, [d]isk)", default: 'n').
       opt( :node, '-n', '--node=NODE', "List only hosted by this NODE").
-      opt( :status, '-S', '--status=STATUS', "Filter for status (running, stopped, ...) (default: no filter)")
+      opt( :status, '-S', '--status=STATUS', "Filter for status (running, stopped, ...) (default: no filter)").
+      opt( :tags, '-t', '--tags=TAGS', "Filter by comma-seperated tags.  All tags must be present for CT")
 
     qm_cli.cmd :exec, "Executes Command in VM via qemu-guest-agent", min: 4, &lambda {|name_or_id, *command|
       connect
diff --git a/lib/pve/helper.rb b/lib/pve/helper.rb
index 45f0515..68e21ea 100644
--- a/lib/pve/helper.rb
+++ b/lib/pve/helper.rb
@@ -163,7 +163,14 @@ class TablizedOutput
     end
     @stdout.puts \
       @header.each_with_index.map {|s, i|
-        "#{' ' * (@maxs[i] - s.length)}#{s}"
+        #"#{' ' * (@maxs[i] - s.length)}#{s}"
+        pad = ' ' * (@maxs[i] - s.length)
+        case @format[i]
+        when '<'
+          "#{s}#{pad}"
+        else
+          "#{pad}#{s}"
+        end
       }.join( ' | ')
     ls.each_with_index do |l, i|
       @stdout.puts \
diff --git a/lib/pve/proxmox.rb b/lib/pve/proxmox.rb
index 45e5aed..e7dda5a 100644
--- a/lib/pve/proxmox.rb
+++ b/lib/pve/proxmox.rb
@@ -19,6 +19,8 @@ module Proxmox
   end
   class AlreadyExists < Exception
   end
+  class AlreadyLocked < Exception
+  end
 
   def self.cnfstr2hash str
     str.
@@ -134,7 +136,7 @@ module Proxmox
     end
 
     def rest_put path, **data, &exe
-      data = __data__( data)
+      data = __data__( **data)
       STDERR.puts "PUT #{path} <= #{data}"  if $DEBUG
       __response__ Proxmox.connection[path].put( data, __headers__( :'Content-Type' => 'application/json'))
     rescue RestClient::Exception
@@ -227,6 +229,12 @@ module Proxmox
 
     attr_reader :name
 
+    def __update__ **data
+      data[:status] &&= data[:status].to_sym
+      super **data
+    end
+    private :__update__
+
     def === t
       @name =~ t or @vmid.to_s =~ t or @sid =~ t
     end
@@ -241,8 +249,8 @@ module Proxmox
       @name = @node
     end
 
-    def offline?()  @status.nil? or 'offline' == @status  end
-    def online?()  'online' == @status  end
+    def offline?()  @status.nil? or :offline == @status  end
+    def online?()  :online == @status  end
 
     def lxc
       return []  if offline?
@@ -292,7 +300,12 @@ module Proxmox
         d = rest_get @rest_prefix
         d[:starttime] &&= Time.at d[:starttime]
         d = {exitstatus: nil}.merge d
-        __update__ d.merge( node: @node, t: 'status', upid: @upid, task: @task)
+        __update__ d.merge( node: @node, upid: @upid, task: @task)
+      end
+
+      def __update__ **data
+        data = data.merge t: 'status'
+        super **data
       end
 
       def initialize
@@ -337,9 +350,16 @@ module Proxmox
 
   class Hosted < Base
     def refresh!
-      __update__ rest_get( "#{@rest_prefix}/status/current").merge( node: @node, t: @t)
+      __updata__ rest_get( "#{@rest_prefix}/status/current").merge( node: @node, t: @t)
     end
 
+    def __update__ **data
+      data[:tags] = (data[:tags]||'').split ';'
+      data[:status] &&= data[:status].to_sym
+      super **data
+    end
+    private :__update__
+
     def === t
       @name =~ t or @vmid.to_s =~ t or @sid =~ t
     end
@@ -405,6 +425,7 @@ module Proxmox
       cnf[:unprivileged] &&= 1 == cnf[:unprivileged]
       cnf[:memory]       &&= cnf[:memory].to_i
       cnf[:cores]        &&= cnf[:cores].to_i
+      cnf[:tags]         &&= cnf[:tags].split ';'
       cnf.update cnf.delete( :lxc).map{|k,v|[k.to_sym,v]}.to_h  if cnf[:lxc]
       cnf
     end
@@ -416,12 +437,38 @@ module Proxmox
         when true then r[k] = 1
         when false then r[k] = 0
         when nil then r[:delete].push k
+        when Array
+          case k
+          when :tags
+            r[k] = v.join ';'
+          else r[k] = v
+          end
         else r[k] = v
         end
       end
       r.delete :delete  if r[:delete].empty?
-      STDERR.puts r.inspect
-      rest_put "#{@rest_prefix}/config", r
+      rest_put "#{@rest_prefix}/config", **r
+    end
+
+    def lock reason, &exe
+      cnf = config
+      raise Proxmox::AlreadyLocked, "Machine #{self} Already locked for: #{cnf[:lock].inspect}"  unless cnf[:lock].nil?
+      r = rest_put "#{@rest_prefix}/config", {lock: reason}
+      if block_given?
+        begin
+          return yield
+        ensure
+          unlock
+        end
+      else
+        r
+      end
+    end
+
+    def unlock
+      system 'pct', 'unlock', @vmid.to_s
+      raise Proxmox::UnlockFailed  unless $?.success?
+      #rest_put "#{@rest_prefix}/config", {delete: %w[lock]}
     end
 
     def resize disk, size
@@ -726,8 +773,9 @@ module Proxmox
     end
 
     def initialize() rest_prefix end
-
-    def to_s() "#{@node.node}:#{@storage}" end
+    def to_s()     "#{@node.node}:#{@storage}" end
+    def active?()  1 == @active end
+    def enabled?() 1 == @enabled end
 
     class Content < Base
       def rest_prefix