Create a volume

An empty ext4 file system, or one made from a backup (from_backup). A volume is attached with the volumes field of a sandbox. What a volume holds is on the node that made it: a node that copies its sandboxes' disks to an object store copies a volume only as its backups (POST /internal/volumes/{id}/backups, a copy at one instant), and a host that is lost takes its volumes with it, all but their backups, from which a volume is made again on any node that copies to the same store.

Takes write.

POST

https://api.glac.ai/v1/volumes

View as Markdown

Authorization

apiKeyHTTPrequired

Header parameters

X-Request-Idoptionalstring
The caller's own id for the request: 1 to 64 letters, digits, ., _ and -. The node then knows the request by it: in the answer's X-Request-Id, in error bodies and in its log. Anything else is ignored, and the node makes an id.

pattern: ^[A-Za-z0-9._\-]{1,64}$
Idempotency-Keyoptionalstring
Makes the request safe to send again. See "Idempotency-Key" in the introduction.

maxLength: 255 · minLength: 1

Request bodyJSONoptional

nameoptionalstring
A name given by the caller to a sandbox, a snapshot, a volume or an SSH key: 1 to 63 lower-case letters, digits and hyphens, not starting or ending with a hyphen, and not starting with an id prefix (sbx-, exe-, snap-, vol-, evt-, req-; an SSH key's not with sshkey- either). A DNS label that cannot be taken for an id. Unique among sandboxes, among snapshots, among volumes and among SSH keys.

pattern: ^[a-z0-9]([a-z0-9\-]{0,61}[a-z0-9])?$
kindoptionaldriveorplainorshared
What kind of volume (Volume.kind). Default: shared where shared is true; else drive on a node whose machines keep Drives (drives of the node), plain on one whose do not. drive on a node whose machines keep none is 503 not_served_here; drive or plain with shared true, and shared with shared false, are 400 invalid_field.
size_bytesoptionalinteger
The most it can hold: at least 16 MiB, at most 16 TiB (an account's plan may give less, which its control plane holds it to). Only what is written takes space on the node.

format: int64 · maximum: 17592186044416 · minimum: 16777216 · default: 68719476736
sharedoptionalboolean
default: false
from_backupoptionalstring
A backup to make the volume from (bak-…): it is the backup's volume's size and kind (size_bytes and shared are that volume's, and the call may give them only as they are), and holds what that volume held at the backup's moment. The volume is restoring until the node's uploader has brought the backup whole from the object store, then ready. A backup of this node's, or one made elsewhere that from_backup_index names (what a control plane gives).
placement_refusalsoptionalarray | null
With from_backup: the nodes that refused to make this volume before this one was asked, as its control plane gives them (a node's report says it takes them: takes_placement_refusals). Kept with the restore, and shown as the volume's placement_refusals. Without from_backup: 400 invalid_field.
durabilityoptionalstandardorstrict
How a Drive is kept (Volume.durability): strict only for a Drive (400 invalid_field for another kind), on a node that copies its disks to an object store (else 409 strict_unsupported); attached only to a sandbox whose machine's spare disks offer its guest flushes (made from a template built since strict Drives: else 409 strict_unsupported).

default: "standard"
seed_imageoptionalstring
Of a Drive (400 invalid_field for another kind): an image named by its digest (<repository>@sha256:…) that the node's ready list keeps ready (--ready-images, the platform's own), whose seed the Drive is laid out with: what a control plane asks for a new database's Drive, naming the image the database's instance runs. The image declares the directory of it that is its seed (/usr/local/share/glac/drive-seed); the Drive's file system holds that directory at glac-seed/<its name> from the start, its blocks are the node's seed's (laid out once per image, Drive size and node, and written to the object store once, as the platform's: sealed with the platform's key), and its first version in the store names those, so that nothing of the seed is copied or sent for it. Made empty, as without it, where the image is named by a tag, is no ready image of the list by that digest, declares no seed, or its seed for this size is not in the store yet (it is made then, for the next one), or where the node's uploader is not at work: the answer is the same Drive either way.
regionoptionalnaoreuorapornull
The region to make it in, read by the API and not passed on. Null or left out: the region the API itself runs in. Where no machine of that region can take it, the next region does; what has to go to one machine (made from a snapshot or with volumes, or sent again with the same Idempotency-Key) goes there, whatever the region. A volume made from a backup is made in the backup's region: another is 400 invalid_field. Not a region: 400 unknown_region. The answer's region says where it was made.

Returns

201

The volume.

JSON

regionrequired
The region of the node that holds it, as the node was told (--region): where a control plane placed it. Null on a node that is in no region.
One of the following:
string
null
}
idstringrequired
pattern: ^vol-[0-9a-hjkmnp-tv-z]{16}$
objectstringrequired
namerequired
One of the following:
Name
null
}
sharedbooleanrequired
Decided at creation. False: a disk one sandbox has at a time. True: a file system any number of sandboxes have at once.
kinddriveorplainorsharedrequired
Decided at creation. drive: a disk one sandbox has at a time, kept on the node as a layer over zeros (the blocks written to it, in a sparse file, and a bitmap of them), which a machine's Firecracker keeps as it keeps a root disk in layers; a snapshot of a sandbox carries a copy of each Drive it has, and a sandbox made from the snapshot (or a fork) has a Drive of its own made of it. What a volume that is not shared is made as on a node whose machines keep Drives (drives of the node). plain: a disk one sandbox has at a time, a file system in a file of its own; what such a volume is made as on a node whose machines keep no Drives, and where kind asks for it. shared: shared is true.
size_bytesintegerrequired
The most it can hold.

format: int64 · minimum: 0
used_bytesintegerrequired
What it holds now, in bytes: what its file takes on the node, which is the blocks its file system uses, a few hundred kB for an empty one of 256 MiB and 5 MB for one of 64 GiB. It grows as files are written, and falls again when they are removed: the blocks they took go back to the node when the node next counts what its volumes keep (once a minute), and before that when the sandbox that has the volume sleeps, is started again from its disk or gives the volume up. What stays is the file system's own: its tables, and its journal as far as that has been written (512 MiB at the most on a volume of 64 GiB). A volume that is not shared gives nothing back on a node whose volume_discard is false, nor while it is with a sandbox that was made from a template or a snapshot of before volumes did this. A node counts a volume as keeping this, moment by moment, for as long as it is there, whether or not a sandbox has it.

format: int64 · minimum: 0
attached_toarray ofstringrequired
The sandboxes that have it.

pattern: ^sbx-[0-9a-hjkmnp-tv-z]{16}$
created_atstringrequired
format: date-time
host_failurerequired
What the last hard stop of the node's host left uncertain about the volume's disk. Null for a volume that was whole on the host's disk: one that no sandbox had, one whose sandbox was asleep with everything on the disk, and every shared volume (the node holds its file system itself, and what a sandbox was told is written there is on the disk).
One of the following:
VolumeHostFailure
atstringrequired
When the node came back and found the volume like this.

format: date-time
diskstringrequired
unverified: a sandbox could write the volume when the host went down, or had written it so shortly before that the node had not yet forced it to the host's disk. Its file system replays its journal when it is next mounted; what was written in the last half minute before the host went down may be missing or incomplete.

detailstringrequired
The same in a sentence for people.

null
}
statusreadyorrestoringorfailedrequired
ready; restoring while a volume made from a backup is being brought back from the object store (it cannot be attached until it is ready); failed where that could not be done (failure says why): such a volume can only be deleted.
from_backuprequired
The backup it was made from; null for a volume made empty.
One of the following:
string
null
}
failurestring | nullrequired
Why it could not be made from its backup; null otherwise.
restore_attemptinteger | nullrequired
Of a volume made from a backup, which attempt to make it this is: 1 where it was placed; 2 where that failed and its control plane made it again from the same backup on another node of the backup's region (under the same id: the second and last attempt, failed for good where it fails too). Null for a volume made empty.

maximum: 2 · minimum: 1
first_failurestring | nullrequired
With restore_attempt 2: why the first attempt, on another node, could not make it. Null otherwise.
placement_refusalsarray | nullrequired
Of a volume made from a backup: the nodes of the backup's region that refused to make it before it was made anywhere (each refused before it made anything: its drive was full, the account had no room left there, it could not be reached), in the order they were asked, as its control plane said them; the node that made it was the next. Null where the first node asked made it.
backupsobjectrequired
How a volume's backups are taken, by the control plane it belongs to (control/README.md, 「卷的备份」): every day or not (daily), how many of those daily backups are kept (keep), and for how many days a backup taken by a call or before a version of a stateful service is kept (expires_in_days). Kept by the node with the volume, and gone with it; a node of no control plane keeps the rule and takes no backup by it.
- dailybooleanrequired
  A backup every day. False until it is said otherwise.
- keepintegerrequired
  How many daily backups are kept: the newest; one taken every day is kept this many days. 7 until it is said otherwise.
  
  maximum: 90 · minimum: 1
- expires_in_daysintegerrequired
  For how many days a backup taken by a call (and one before a version) is kept, unless the call says otherwise. 30 until it is said otherwise.
  
  maximum: 365 · minimum: 1
}
durabilityoptional
How a Drive is kept, decided at creation (VolumeCreate.durability). standard: a guest's fsync returns at once, and a host that is lost loses at most the last second of writes. strict: a guest's fsync, and every flush of its file system, returns once the object store holds every write before it, at the cost of a request to the store for each. Of a plain volume: strict where the node made it for a static instance (mounted in its guest with barriers, so that a guest's fsync returns once the host's disk holds what it wrote), null otherwise; null of a shared one.
One of the following:
string
null
}

400

The request is not one this call takes. invalid_json: the body is not a JSON object; unknown_field: the body has a field this call does not take; unknown_parameter: the query has a parameter this call does not take; invalid_field: a field or query parameter has the wrong type or is out of range; invalid_name: name is not a valid name; invalid_idempotency_key: Idempotency-Key is empty or over 255 characters.

JSON

errorobjectrequired
- typestringrequired
  The kind of failure. It decides the status: invalid_request 400, unauthenticated 401, forbidden 403, not_found 404, conflict 409, too_large 413, internal 500, bad_gateway 502 (the preview listener, the egress proxy, and a takeover that could not bring its sandbox), unavailable 503, timeout 504.
- codestringrequired
  Which failure. The top-level x-error-codes table of this document says what each one means.
- messagestringrequired
  For people. English.
- paramstring | nullrequired
  The field or query parameter at fault, when there is one.
- retryablebooleanrequired
  True when the same request may succeed later without anything else changing.
- request_idstringrequired
  The X-Request-Id of the response it is in, also when that response is a replay for an Idempotency-Key.
  
  pattern: ^[A-Za-z0-9._\-]{1,64}$
- docs_urlstring | nullrequired
  The node's --docs-url with the code appended, or null.
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none.
tooptionalstring | null
With moved and sandbox_moved: the node the sandbox was released to, as the control plane named it, or null.
epochoptionalinteger
With moved and sandbox_moved: the epoch the sandbox was released at. With wrong_epoch: the epoch this node holds it at, or released it at.

format: int64 · minimum: 1
offsetoptionalinteger
With sandbox_moved: the position in the command's output the call, stream or terminal had reached (a stream's last event's id): read on from it where the sandbox went (Last-Event-ID, or from).

format: int64 · minimum: 0
exec_idoptionalstring
With sandbox_moved of POST …/run: the id of the command the call started and waited for, which goes on where the sandbox went: wait for it there through the control plane with GET …/exec/{exec_id}?wait_seconds= once the move is over. The same call made again starts the command a second time, unless it comes with the same Idempotency-Key.
disk_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the disk as of the sleep; null where it did.

minimum: 0
memory_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the memory image of that sleep; null where it did.

minimum: 0
drives_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the sandbox's Drives as they are (slice D2); null where it did, or where it has none.

minimum: 0
image_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the image the sandbox's disk is over (its node copies a disk before its template's image is there); null where it did.

minimum: 0
imageoptionalstring
With image_missing: the id of the image the object store does not have, as the disks over it and a template's disk_image name it.

pattern: ^[A-Za-z0-9_-]{1,128}$
buildoptionalstring
With build_missing: the build of Firecracker that wrote the sandbox's memory, which this node does not keep.

pattern: ^[0-9a-f]{16}$

401

missing_api_key, invalid_api_key, expired_api_key, invalid_token.

JSON

errorobjectrequired
- typestringrequired
- codestringrequired
- messagestringrequired
- paramstring | nullrequired
- retryablebooleanrequired
- request_idstringrequired
- docs_urlstring | nullrequired
}
move_idoptionalstring
With already_moving: the move of the sandbox that is under way.
upgrade_idoptionalstring
With upgrade_in_progress (the key's upgrade that is not over), upgrade_started (the upgrade that has begun) and rollback_gone (the upgrade whose revert is refused): that upgrade.

pattern: ^upg-[0-9a-hjkmnp-tv-z]{16}$
moveoptionalobject
With move_over, move_going_back and move_taken_over (POST /internal/moves/{id}/cancel): the move, as it stands.
- objectstringrequired
- idstringrequired
  pattern: ^mov-[0-9a-hjkmnp-tv-z]{16}$
- sandbox_idstringrequired
- project_idstringrequired
- fromobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- toobjectrequired
  idstringrequired
  namestring | nullrequired
  Its name; null for a node that is off the books since.
- epochintegerrequired
  The epoch the table held the sandbox at when the move began: the old node releases it at it, the new one takes it over one on, the old one takes it back two on, and from the object store three on.
  
  minimum: 1
- stepstringrequired
  Where it stands: releasing (the old node is asked to release it; the table has it there), taking_over (the new node is asked to take it over; the table has it there), reclaiming (the new node refused it, and the old one is asked to take it back), restoring (the old one kept nothing of it, and takes it over from the object store), done (on the new node), failed (where it was, or back there, or where a failure no time clears or an operator's cancel found it: error says why).
- whystringrequired
  What made it: the operator's move, an evacuation, a recovery.
- wakebooleanrequired
  Whether the new node wakes it: as the call said, or as it was (it ran) when the move began.
- from_storebooleanrequired
  The new node takes it from the object store alone.
- releaseobject | nullrequired
  What the old node's release answered (sandboxd/openapi/openapi.json, releaseSandbox), without the release's key; null before it answered.
- takeoverobject | nullrequired
  What the takeover that ended it answered (takeoverSandbox of the node's document): where its disk and memory came from (source), how long each took (ms), memory; null before.
- errorrequired
  Why it failed, of one that failed (the new node's refusal, where it was taken back to the old node); null, of one that is done; of one under way, what the step it is at was last told where it is asked again.
  
  One of the following:
  object
  null
- attemptsintegerrequired
  How many times the step it is at was asked without an answer that settles it.
  
  minimum: 0
- next_attempt_atstring | nullrequired
  When that step is asked again; null where it is not waiting.
  
  format: date-time
- batchstring | nullrequired
  The evacuation (evc-…) or recovery (rcv-…) it is of.
- created_atstringrequired
  format: date-time
- updated_atstringrequired
  format: date-time
- ended_atstring | nullrequired
  format: date-time
}
lease_untiloptionalstring
With lease_held: until when the node may still hold the lease it was granted last, and the time after it for the node to have seen it run out (recoverNode is refused until then).

format: date-time
activeoptionalobject | null
With standby: the active copy, as the standby last read the lease; null while no copy holds it.
- namestringrequired
- urlstringrequired
- termintegerrequired
  minimum: 1
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none (the node's SecretHosts).
problemsoptionalarray ofobject
With invalid_definition: every problem of the definition, each where it is and what it is.
- atstringrequired
  Where in the definition, a dotted path (services.web.port); empty for the whole of it.
- messagestringrequired
}
reportoptionalobject
With compose_refused: the import's report, which says what is refused, why, and what to change.
- objectcompose_importrequired
- namestring | nullrequired
  The model's name: each service's label compose.project. Null: it has none.
- dry_runbooleanrequired
- strictbooleanrequired
- profilesarray ofstringrequired
- treatmentsobjectrequired
  How many items of the report have each treatment.
  
  doneintegerrequired
  minimum: 0
  adaptedintegerrequired
  minimum: 0
  ignoredintegerrequired
  minimum: 0
  refusedintegerrequired
  minimum: 0
- itemsarray ofobjectrequired
  The model's top-level elements: name, each volume, network, config and secret, extensions.
  
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdoneoradaptedorignoredorrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
- servicesarray ofobjectrequired
  The services the import takes, in the model's order.
  
  namestringrequired
  The service's name, which is its app's.
  
  app_idstring | nullrequired
  Its app. Null: a dry run of a service the project does not have.
  
  pattern: ^app-
  statuscreatedorchangedorunchangedrequired
  What the import does (or, in a dry run, would do) to its app: makes it, writes what changed, or nothing.
  
  kindserviceorjobrequired
  job: a service of the model waits for it to complete, and it runs to its end in each deploy that needs it.
  
  statefulbooleanrequired
  It mounts a volume of its own: one instance, which has the volume.
  
  versionbooleanrequired
  Whether the import's deploy makes a version of it: what its version would be made of, its references resolved, is not what its current version is.
  
  itemsarray ofobjectrequired
  atstringrequired
  Where in the model: of a service, its attribute (ports[0], depends_on.db, environment.KEY), empty for the service as a whole; of the top level, the element (volumes.db-data).
  
  treatmentdoneoradaptedorignoredorrefusedrequired
  done: it means the same on the platform; adapted: the platform does the same another way; ignored: it matters to a local run alone (refused with strict); refused: the platform cannot do it, and doing without it would let the program go wrong quietly.
  
  whystringrequired
  changestring | nullrequired
  Of one that is refused: what to change. Null otherwise.
  
  appobjectrequired
  The fields of the service's app as the import writes them: what its versions are made of, and what holds at once.
  
  imagestring | nullrequired
  What the app's next version is made of, with the seven fields after it: its newest version's, with what was changed since. null: the app has no image, and no version.
  
  image_pull_secretstring | nullrequired
  The name of the secret that holds the credentials of the image's registry. No answer has its value. null: none.
  
  start_commandrequired
  One of the following:
  StartCommand
  null
  start_argsrequired
  What follows the image's ENTRYPOINT in the place of its CMD. null: the image's CMD, or the whole of start_command.
  
  One of the following:
  array<string>
  null
  portinteger | nullrequired
  readyobjectrequired
  How to tell that an instance is up, which a version's template is saved after: exactly one of the three. The first two are asked from outside the instance, so the service has to listen on every address (0.0.0.0).
  
  httpoptionalstring
  A path, beginning with /: a GET of it on the app's port is answered with a status from 200 to 399.
  
  tcpoptionaltrue
  The app's port takes a connection.
  
  commandoptional
  A command that succeeds in the instance. It is run by the instance's shell: a list of arguments is written as one line for it.
  
  One of the following:
  string
  array<string>
  envmap ofstringrequired
  secretsmap ofstringrequired
  Names of secrets. No answer has a value.
  
  sizeobjectrequired
  What one instance may use at most. It is billed by what it uses.
  
  vcpusintegerrequired
  minimum: 1
  memory_bytesintegerrequired
  An even number of MiB (a whole number of the 2 MiB pages a node loads a machine's memory in), in bytes. Any other size is 400 invalid_field (param size.memory_bytes): no node would make an instance of it, as none makes a sandbox of it (the node's SandboxLimitsCreate.memory_bytes).
  
  minimum: 134217728
  volumesarray ofobjectrequired
  volumestringrequired
  pathstringrequired
  read_onlybooleanrequired
  nocopyoptionalunknown
  There only where it was given as true.
  
  kindstringrequired
  filesarray ofobjectrequired
  pathstringrequired
  modeintegerrequired
  uidintegerrequired
  gidintegerrequired
  contentoptionalstring
  secretoptionalstring
  userstring | nullrequired
  working_dirstring | nullrequired
  stoprequired
  One of the following:
  ServiceStop
  signalstring | nullrequired
  grace_msinteger | nullrequired
  null
  hostnamestring | nullrequired
  regionsarray ofstringrequired
  In the order na, eu, ap.
  
  scaleobjectrequired
  min_instancesintegerrequired
  How many instances of the app are kept awake in a region, whether a request comes or not: the floor. The nodes of the region that serve the app share it as they share max_instances (two nodes and a floor of 2: one on each; a floor of 1: one, on the node that is tried first; a floor of 5: three and two), and a node that is away is made up for by the others. A node makes its part when it is told, not at the first request, and neither stops nor deletes those instances for being idle; they are metered as instances that are awake. 0, which is what it is when nothing is said: none. Lowered, the instances beyond it are idle from that moment, and are stopped and deleted as idle instances are. At most max_instances, where that is given, and at most what the account's plan lets an app ask for in a region (caps.app_instances.limit: 5, 50 and 500): more is refused, 403 plan_cap_reached.
  
  minimum: 0
  max_instancesinteger | nullrequired
  How many instances the app has at the most in a region: the nodes of the region that serve the app share it. At most what the account's plan lets an app ask for (caps.app_instances.limit: 5 on the free plan, 50 on p20, 200 on p100, 500 on p300, 1,000 on p1000, 2,000 on p2000): more is refused, 403 plan_cap_reached, and what an app asked for on a plan that let it is kept, and held to the plan's number. null: the plan's number for an app that names none (caps.app_instances.default: 2, 10, 20, 50, 100 and 200), or min_instances where that is more. What the nodes are told is no more than the account has room for awake beside everything else of it that is awake, nor less than the app has awake.
  
  minimum: 1
  concurrencyinteger | nullrequired
  A cap on what one instance has in hand at a time: the requests the edges sent it, and the connections it has open on its project's network (through its service's address, which the node shares out among the instances connection by connection, or to its own). An instance with that many is full, and another is made for more. null, which is what it is when nothing is said: no cap. A node then adds an instance when the ones it has are near their size in CPU or memory, and an app does not have to guess a number; a service that takes one request at a time gives one.
  
  maximum: 1000 · minimum: 1
  sleep_after_msintegerrequired
  After how long without a request an instance stops. One that stays stopped is deleted by its node after delete_after_ms, and the next request that needs an instance gets a new one; the instances min_instances keeps awake are neither stopped nor deleted.
  
  maximum: 600000 · minimum: 0
  sleep_notice_msinteger | nullrequired
  How long before an instance stops for being idle the programs connected to its guest's /run/sbx/awake are sent the line sleep N, in milliseconds: they flush what they hold, close their connections, or raise a hold, which puts the stop off. The stop comes that long after, whether they answer or not; where nobody is connected, it is not put off. A keyed instance is told as well. 0 or null: not told (the default).
  
  maximum: 60000 · minimum: 0
  sleep_hold_max_msintegerrequired
  How long the holds a program in an instance raises keep it up after its time idle has run out, in milliseconds: a program connects to /run/sbx/awake and sends + before it answers a request whose work goes on after the answer, and - (or closes the connection, or dies) when that work is done; the instance stops sleep_after_ms after the last hold is lowered. Past this time it stops whatever holds it, the programs connected told sleep N cap first where sleep_notice_ms asks for a notice. Held, it runs and is metered as running. 0: holds are not heeded. Null: 30000 (the default).
  
  maximum: 900000 · minimum: 0
  delete_after_msinteger | nullrequired
  After how long idle an instance is deleted, counted from where its stop is counted from: the next request that needs one gets a new instance, a clone of the version's template, without what the deleted one had gathered in its memory and on its disk (keep what is to last in a volume or a database). A second to an hour, the platform's time, which is the most: more is refused (400 invalid_field), and an instance that is to stay warm is one of min_instances. null, which is what it is when nothing is said: the hour of the nodes (--app-delete-after-seconds). A change holds for the instances the app has as for the ones made after: each node judges every instance by the app's time as it is, once a second at the least. Not for the app's keyed instances, which keys.delete_after_idle_ms is for.
  
  maximum: 3600000 · minimum: 1000
  suspend_after_msoptionalinteger | null
  How long a stopped instance stays paused before its memory is saved and it sleeps for real, in milliseconds: paused, the next request is answered in a millisecond or two and its memory is metered; asleep, it wakes in a few more and only what it keeps is. Its node holds it to the longest it holds any instance paused (ten minutes); the host's memory running short, a slot another machine needs and a sleep somebody asks for put it to sleep sooner. Null (the default): its node's longest. A database's suspend_after_seconds is its app's.
  
  maximum: 86400000 · minimum: 1000
  wake_daily_atoptionalstring | null
  A time of day in UTC, HH:MM, at which the app's keyed instances and its stateful service's instance that rest are woken every day, for work of their own that waits for a wake (a database's maintenance, say); the instances the nodes make and delete by the app's requests are woken by requests alone. The wake is no activity: what runs then is, and once that is done the instance rests again. A stateful service's instance is woken besides for the next run of its PostgreSQL server's pg_cron jobs, whatever this says. Null (the default): none. A database's wake_daily_at is its app's.
  
  pattern: ^([01][0-9]|2[0-3]):[0-5][0-9]$
  keysrequired
  One of the following:
  object
  null
  egressobject | nullrequired
  Egress rules as a sandbox has them (default, allow, deny, http, inject), null when there are none; kept as the calls gave them (a PATCH merges them key by key, as a node does). They hold at once and make no version: the nodes that serve the app put them on every instance of its group, the ones there are (one that runs for the connections it has too) and the ones made after; a keyed instance does not have them. The control plane checks only that they are an object of those keys of at most 256 KiB: what the rules say is a node's to check, when it applies them, and an instance whose rules its node cannot read is refused everything (the node's log says why).
  
  defaultoptionalallowordenyornull
  allowoptionalarray | null
  denyoptionalarray | null
  httpoptionalarray | null
  injectoptionalarray | null
  deny_portsoptionalarray | null
  Ports no connection reaches, TCP or UDP, wherever it goes and whatever else the rules say. A Browsers session's always hold 25, 465, 587 and the ports mining pools listen on (3333, 4444, 5555, 7777, 14444, 45700): the control plane adds them to whatever a change of its rules gives.
  
  metadatamap ofstringrequired
  logsobjectrequired
  What the app's log has, each part as it was given or at its default (AppLogSettings).
  
  outputbooleanrequired
  keepbooleanrequired
  requestsobjectrequired
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  keep_errorsbooleanrequired
  publicbooleanrequired
  Whether it answers at its default domain (url).
  
  depends_onarray ofobjectrequired
  servicestringrequired
  conditionstringrequired
  networkobjectrequired
  aliasesarray ofstringrequired
  endpoint_modestringrequired
  drivesoptionalarray ofobject
  The Drives its instance mounts (AppCreate.drives): none, [], where it names none.
  
  drivestringrequired
  pathstringrequired
  modestringrequired
  key_drivesoptionalarray ofobject
  The Drives each key's instance has of its own (AppCreate.key_drives): none, [], where it gives none.
  
  namestringrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  format: int64
  nocopyoptionalunknown
  There only where it was given as true.
  
  runtimeoptional
  Its runtime settings (AppCreate.runtime). null: none.
  
  One of the following:
  Runtime
  ulimitsmap ofRuntimeLimitGivenrequired
  sysctlsmap ofstringrequired
  tmpfsarray ofobjectrequired
  pathstringrequired
  size_bytesinteger | nullrequired
  modeintegerrequired
  dnsobjectrequired
  serversarray ofstringrequired
  searcharray ofstringrequired
  optionsarray ofstringrequired
  shm_size_bytesinteger | nullrequired
  null
  tracesoptionalobject
  What the app's requests' traces have, each part as it was given or at its default (AppTraceSettings): no span where sample_rate is 0.
  
  sample_ratenumberrequired
  maximum: 1 · minimum: 0
  trust_incomingbooleanrequired
- volumesarray ofobjectrequired
  The volumes of the project the services mount.
  
  modelstring | nullrequired
  Its name in the model. Null: made for a path a stateful service mounts with no volume named.
  
  namestringrequired
  Its name in the project.
  
  idstring | nullrequired
  Null: not made yet (to_make).
  
  pattern: ^vol-
  sharedbooleanrequired
  Several services mount it, or one with several instances: every instance of each mounts it at once.
  
  statusto_makeormadeorthereorexternalrequired
  to_make: the import makes it (a dry run says so of what it would make); made: this import made it; there: an earlier import made it, or a volume of its name was there; external: the model names it external, and the project has it.
  
  used_byarray ofstringrequired
- secretsarray ofobjectrequired
  The secrets of the model that services are granted.
  
  modelstringrequired
  Its name in the model.
  
  namestringrequired
  The project's secret that holds it: the model's name, with each character a secret's name does not take written as an underscore.
  
  therebooleanrequired
  Whether the project has it. An import (not a dry run) with one that is not there is refused 404 secret_not_found.
  
  used_byarray ofstringrequired
- left_outarray ofobjectrequired
  The services of profiles that are not turned on, which the import does not touch.
  
  namestringrequired
  profilesarray ofstringrequired
- absentarray ofstringrequired
  The project's services that the model does not have: kept as they are.
- deploystring | nullrequired
  The deploy the import made (GET /v1/deploys/{id}). Null: a dry run, or nothing would get a version.
  
  pattern: ^dpl-
}
accountsoptionalarray ofobject
With sole_owner: the accounts the user is the only owner of.
- idstringrequired
  pattern: ^acct-[0-9a-hjkmnp-tv-z]{16}$
- namestringrequired
}

403

The credential may not do this. needs_api_key: a sandbox token cannot do this. account_share_reached: its account holds as much of this node's data drive as one account may (drive.accounts of GET /internal/node), and has not the room to write a gigabyte to the volume (its size, where that is less). Nothing was made.

JSON

errorobjectrequired
- typestringrequired
  The kind of failure. It decides the status: invalid_request 400, unauthenticated 401, forbidden 403, not_found 404, conflict 409, too_large 413, internal 500, bad_gateway 502 (the preview listener, the egress proxy, and a takeover that could not bring its sandbox), unavailable 503, timeout 504.
- codestringrequired
  Which failure. The top-level x-error-codes table of this document says what each one means.
- messagestringrequired
  For people. English.
- paramstring | nullrequired
  The field or query parameter at fault, when there is one.
- retryablebooleanrequired
  True when the same request may succeed later without anything else changing.
- request_idstringrequired
  The X-Request-Id of the response it is in, also when that response is a replay for an Idempotency-Key.
  
  pattern: ^[A-Za-z0-9._\-]{1,64}$
- docs_urlstring | nullrequired
  The node's --docs-url with the code appended, or null.
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none.
tooptionalstring | null
With moved and sandbox_moved: the node the sandbox was released to, as the control plane named it, or null.
epochoptionalinteger
With moved and sandbox_moved: the epoch the sandbox was released at. With wrong_epoch: the epoch this node holds it at, or released it at.

format: int64 · minimum: 1
offsetoptionalinteger
With sandbox_moved: the position in the command's output the call, stream or terminal had reached (a stream's last event's id): read on from it where the sandbox went (Last-Event-ID, or from).

format: int64 · minimum: 0
exec_idoptionalstring
With sandbox_moved of POST …/run: the id of the command the call started and waited for, which goes on where the sandbox went: wait for it there through the control plane with GET …/exec/{exec_id}?wait_seconds= once the move is over. The same call made again starts the command a second time, unless it comes with the same Idempotency-Key.
disk_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the disk as of the sleep; null where it did.

minimum: 0
memory_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the memory image of that sleep; null where it did.

minimum: 0
drives_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the sandbox's Drives as they are (slice D2); null where it did, or where it has none.

minimum: 0
image_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the image the sandbox's disk is over (its node copies a disk before its template's image is there); null where it did.

minimum: 0
imageoptionalstring
With image_missing: the id of the image the object store does not have, as the disks over it and a template's disk_image name it.

pattern: ^[A-Za-z0-9_-]{1,128}$
buildoptionalstring
With build_missing: the build of Firecracker that wrote the sandbox's memory, which this node does not keep.

pattern: ^[0-9a-f]{16}$

404

Something the request names does not exist. backup_not_found: from_backup names no backup of the caller's that this call can make a volume from.

JSON

errorobjectrequired
- typestringrequired
  The kind of failure. It decides the status: invalid_request 400, unauthenticated 401, forbidden 403, not_found 404, conflict 409, too_large 413, internal 500, bad_gateway 502 (the preview listener, the egress proxy, and a takeover that could not bring its sandbox), unavailable 503, timeout 504.
- codestringrequired
  Which failure. The top-level x-error-codes table of this document says what each one means.
- messagestringrequired
  For people. English.
- paramstring | nullrequired
  The field or query parameter at fault, when there is one.
- retryablebooleanrequired
  True when the same request may succeed later without anything else changing.
- request_idstringrequired
  The X-Request-Id of the response it is in, also when that response is a replay for an Idempotency-Key.
  
  pattern: ^[A-Za-z0-9._\-]{1,64}$
- docs_urlstring | nullrequired
  The node's --docs-url with the code appended, or null.
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none.
tooptionalstring | null
With moved and sandbox_moved: the node the sandbox was released to, as the control plane named it, or null.
epochoptionalinteger
With moved and sandbox_moved: the epoch the sandbox was released at. With wrong_epoch: the epoch this node holds it at, or released it at.

format: int64 · minimum: 1
offsetoptionalinteger
With sandbox_moved: the position in the command's output the call, stream or terminal had reached (a stream's last event's id): read on from it where the sandbox went (Last-Event-ID, or from).

format: int64 · minimum: 0
exec_idoptionalstring
With sandbox_moved of POST …/run: the id of the command the call started and waited for, which goes on where the sandbox went: wait for it there through the control plane with GET …/exec/{exec_id}?wait_seconds= once the move is over. The same call made again starts the command a second time, unless it comes with the same Idempotency-Key.
disk_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the disk as of the sleep; null where it did.

minimum: 0
memory_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the memory image of that sleep; null where it did.

minimum: 0
drives_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the sandbox's Drives as they are (slice D2); null where it did, or where it has none.

minimum: 0
image_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the image the sandbox's disk is over (its node copies a disk before its template's image is there); null where it did.

minimum: 0
imageoptionalstring
With image_missing: the id of the image the object store does not have, as the disks over it and a template's disk_image name it.

pattern: ^[A-Za-z0-9_-]{1,128}$
buildoptionalstring
With build_missing: the build of Firecracker that wrote the sandbox's memory, which this node does not keep.

pattern: ^[0-9a-f]{16}$

409

The state of something stands in the way. name_taken: a volume has the name; idempotency_key_reused: the key was used with another body; idempotency_in_progress: the first request with the key is still running. backup_not_ready: the backup is still being made; backup_unusable: the backup failed.

JSON

errorobjectrequired
- typestringrequired
  The kind of failure. It decides the status: invalid_request 400, unauthenticated 401, forbidden 403, not_found 404, conflict 409, too_large 413, internal 500, bad_gateway 502 (the preview listener, the egress proxy, and a takeover that could not bring its sandbox), unavailable 503, timeout 504.
- codestringrequired
  Which failure. The top-level x-error-codes table of this document says what each one means.
- messagestringrequired
  For people. English.
- paramstring | nullrequired
  The field or query parameter at fault, when there is one.
- retryablebooleanrequired
  True when the same request may succeed later without anything else changing.
- request_idstringrequired
  The X-Request-Id of the response it is in, also when that response is a replay for an Idempotency-Key.
  
  pattern: ^[A-Za-z0-9._\-]{1,64}$
- docs_urlstring | nullrequired
  The node's --docs-url with the code appended, or null.
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none.
tooptionalstring | null
With moved and sandbox_moved: the node the sandbox was released to, as the control plane named it, or null.
epochoptionalinteger
With moved and sandbox_moved: the epoch the sandbox was released at. With wrong_epoch: the epoch this node holds it at, or released it at.

format: int64 · minimum: 1
offsetoptionalinteger
With sandbox_moved: the position in the command's output the call, stream or terminal had reached (a stream's last event's id): read on from it where the sandbox went (Last-Event-ID, or from).

format: int64 · minimum: 0
exec_idoptionalstring
With sandbox_moved of POST …/run: the id of the command the call started and waited for, which goes on where the sandbox went: wait for it there through the control plane with GET …/exec/{exec_id}?wait_seconds= once the move is over. The same call made again starts the command a second time, unless it comes with the same Idempotency-Key.
disk_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the disk as of the sleep; null where it did.

minimum: 0
memory_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the memory image of that sleep; null where it did.

minimum: 0
drives_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the sandbox's Drives as they are (slice D2); null where it did, or where it has none.

minimum: 0
image_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the image the sandbox's disk is over (its node copies a disk before its template's image is there); null where it did.

minimum: 0
imageoptionalstring
With image_missing: the id of the image the object store does not have, as the disks over it and a template's disk_image name it.

pattern: ^[A-Za-z0-9_-]{1,128}$
buildoptionalstring
With build_missing: the build of Firecracker that wrote the sandbox's memory, which this node does not keep.

pattern: ^[0-9a-f]{16}$

503

Not available. not_served_here: shared was asked for, and this node has no file server for shared volumes; or from_backup, and this node copies nothing to an object store (--upload); or from_backup on a node that is keyed and does not hold the key of whose the volume is, or the platform's: this node is keyed (src/seal.rs) and does not hold the key of the project whose it is, or the platform's (the message says which): the control plane gives it, and the same call is made again (Retry-After).

JSON

errorobjectrequired
- typestringrequired
  The kind of failure. It decides the status: invalid_request 400, unauthenticated 401, forbidden 403, not_found 404, conflict 409, too_large 413, internal 500, bad_gateway 502 (the preview listener, the egress proxy, and a takeover that could not bring its sandbox), unavailable 503, timeout 504.
- codestringrequired
  Which failure. The top-level x-error-codes table of this document says what each one means.
- messagestringrequired
  For people. English.
- paramstring | nullrequired
  The field or query parameter at fault, when there is one.
- retryablebooleanrequired
  True when the same request may succeed later without anything else changing.
- request_idstringrequired
  The X-Request-Id of the response it is in, also when that response is a replay for an Idempotency-Key.
  
  pattern: ^[A-Za-z0-9._\-]{1,64}$
- docs_urlstring | nullrequired
  The node's --docs-url with the code appended, or null.
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none.
tooptionalstring | null
With moved and sandbox_moved: the node the sandbox was released to, as the control plane named it, or null.
epochoptionalinteger
With moved and sandbox_moved: the epoch the sandbox was released at. With wrong_epoch: the epoch this node holds it at, or released it at.

format: int64 · minimum: 1
offsetoptionalinteger
With sandbox_moved: the position in the command's output the call, stream or terminal had reached (a stream's last event's id): read on from it where the sandbox went (Last-Event-ID, or from).

format: int64 · minimum: 0
exec_idoptionalstring
With sandbox_moved of POST …/run: the id of the command the call started and waited for, which goes on where the sandbox went: wait for it there through the control plane with GET …/exec/{exec_id}?wait_seconds= once the move is over. The same call made again starts the command a second time, unless it comes with the same Idempotency-Key.
disk_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the disk as of the sleep; null where it did.

minimum: 0
memory_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the memory image of that sleep; null where it did.

minimum: 0
drives_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the sandbox's Drives as they are (slice D2); null where it did, or where it has none.

minimum: 0
image_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the image the sandbox's disk is over (its node copies a disk before its template's image is there); null where it did.

minimum: 0
imageoptionalstring
With image_missing: the id of the image the object store does not have, as the disks over it and a template's disk_image name it.

pattern: ^[A-Za-z0-9_-]{1,128}$
buildoptionalstring
With build_missing: the build of Firecracker that wrote the sandbox's memory, which this node does not keep.

pattern: ^[0-9a-f]{16}$

default

Any other failure, in the same shape. internal (500): the node failed; the message says no more, and the node's log has the reason under the request's id. unavailable (503, retryable): no_capacity, every network slot of the node is in use; memory_full, a machine the call has to start (made, woken, booted from its disk, resumed, rolled back, built) does not fit in the host's memory beside what the machines that run on it are promised, and nothing paused or idle could be put to sleep to make room for it (memory of the node); drive_full, the call would have a template built and the node's data drive has no room for one (drive of the node); unavailable, the node is shutting down, the sandbox was still starting after 10 minutes, or it did not answer, or it is being moved to this node (with Retry-After: 1); fenced, the node's lease fences the sandbox (Node.lease). moved (409): the sandbox was moved to another node, which to names.

JSON

errorobjectrequired
- typestringrequired
  The kind of failure. It decides the status: invalid_request 400, unauthenticated 401, forbidden 403, not_found 404, conflict 409, too_large 413, internal 500, bad_gateway 502 (the preview listener, the egress proxy, and a takeover that could not bring its sandbox), unavailable 503, timeout 504.
- codestringrequired
  Which failure. The top-level x-error-codes table of this document says what each one means.
- messagestringrequired
  For people. English.
- paramstring | nullrequired
  The field or query parameter at fault, when there is one.
- retryablebooleanrequired
  True when the same request may succeed later without anything else changing.
- request_idstringrequired
  The X-Request-Id of the response it is in, also when that response is a replay for an Idempotency-Key.
  
  pattern: ^[A-Za-z0-9._\-]{1,64}$
- docs_urlstring | nullrequired
  The node's --docs-url with the code appended, or null.
}
allowed_hostsoptionalarray | null
With secret_host_not_allowed: the hosts the secret may go to, as the secret has them; null where it was given none.
tooptionalstring | null
With moved and sandbox_moved: the node the sandbox was released to, as the control plane named it, or null.
epochoptionalinteger
With moved and sandbox_moved: the epoch the sandbox was released at. With wrong_epoch: the epoch this node holds it at, or released it at.

format: int64 · minimum: 1
offsetoptionalinteger
With sandbox_moved: the position in the command's output the call, stream or terminal had reached (a stream's last event's id): read on from it where the sandbox went (Last-Event-ID, or from).

format: int64 · minimum: 0
exec_idoptionalstring
With sandbox_moved of POST …/run: the id of the command the call started and waited for, which goes on where the sandbox went: wait for it there through the control plane with GET …/exec/{exec_id}?wait_seconds= once the move is over. The same call made again starts the command a second time, unless it comes with the same Idempotency-Key.
disk_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the disk as of the sleep; null where it did.

minimum: 0
memory_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the memory image of that sleep; null where it did.

minimum: 0
drives_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the sandbox's Drives as they are (slice D2); null where it did, or where it has none.

minimum: 0
image_msoptionalnumber | null
With copy_behind: how long the release waited for the store to hold the image the sandbox's disk is over (its node copies a disk before its template's image is there); null where it did.

minimum: 0
imageoptionalstring
With image_missing: the id of the image the object store does not have, as the disks over it and a template's disk_image name it.

pattern: ^[A-Za-z0-9_-]{1,128}$
buildoptionalstring
With build_missing: the build of Firecracker that wrote the sandbox's memory, which this node does not keep.

pattern: ^[0-9a-f]{16}$