Skip to content
Ortam

Saves and recovery

A running Sandbox is saved automatically to storage separate from its host. You don’t call anything to save, and you don’t manage backups.

What a save keeps

The whole persistent filesystem, as one coherent version with what’s needed to restore it: your projects, settings, installed packages and tools, system changes, Docker images and volumes. Deleted files and file permissions are kept as they are. Each save is encrypted with its own key before it leaves the host, and those keys never enter the VM.

Not kept: memory and running processes, open sessions, temporary mounts such as /tmp and /run, and the credentials Ortam delivers for Connections.

Warning
Credentials your agents write to files are ordinary files and are saved, and copies of a Sandbox keep the same SSH keys and secrets: copying doesn’t rotate them. A file you delete is gone from later saves but stays in earlier ones. Data in external services isn’t part of a save.

When saves happen

Ortam saves a running Sandbox about every [save interval]. That’s a schedule, not a promise about how much a failure can lose: a save can lag, and the Sandbox’s status says when saving is delayed or failing.

A save counts only once it’s complete and stored independently of the host, within [storage failure domain]. An incomplete or failed save never replaces the last completed one. Until the first save completes, only the base or Snapshot the Sandbox was created from can be recovered.

Saves are crash-consistent, like pulling the power: if an application needs a clean state, pause its writes before relying on a save.

If a host fails

Changes after the last completed save can be lost, even writes Linux reported as finished, along with memory and open sessions. Ortam reports which save it recovered from and which commands were running, and never presents that save as the latest live state.

Nothing restarts or reruns on its own. The next start or command brings the Sandbox back from that save; it can wait while Ortam makes sure the failed host can no longer write. Until then, Snapshots of the Sandbox are refused.

Recovery restores files only. Command records and output, settings, Connections and grants stay as they are.