Skip to content

Rescue Mode

Rescue mode boots an admin-approved rescue medium on an instance without touching the original root disk, issues a temporary credential, and always restores the original boot configuration on exit or expiry.

API-only in this build

Rescue is implemented at the Client API level (GET/POST /api/client/cloud/{instance}/rescue). There is no dedicated customer page for rescue in this build; use the API or an operator tool.

Lifecycle

DISABLED → ENTERING → ACTIVE → EXITING → DISABLED
  • FAILED — entry did not complete; the original boot configuration still applies and the mutation lock is released.
  • RECOVERY_REQUIRED — the exit could not prove the original boot configuration was restored; an operator must reconcile. The original disk is never deleted.

Rules

  • Only ISOs flagged is_rescue, bootable and ready with an active provider mapping are selectable (admin-approved rescue media).
  • The original boot config (boot, ide2) and the root-disk reference are snapshotted before any provider write.
  • A RESCUE_TRANSITION mutation lock is held for the duration, so rebuild / migration / restore cannot race the rescue.
  • The temporary credential is encrypted, reveal-once, and shares the same CSPRNG policy as provisioning.
  • Expiry restores the boot config; it never destroys the original disk.
  • License expiry does not trap the customer: rescue entry is gated by the license gate and the session can always be exited.

API

Method Path
GET /api/client/cloud/{cloudInstance}/rescue
POST /api/client/cloud/{cloudInstance}/rescue/enter
POST /api/client/cloud/{cloudInstance}/rescue/exit

Error codes

RESCUE_UNSUPPORTED, RESCUE_ALREADY_ACTIVE, RESCUE_NOT_ACTIVE, RESCUE_IMAGE_INVALID, RESCUE_ENTER_FAILED, RESCUE_EXIT_FAILED, RESCUE_RECOVERY_REQUIRED, INSTANCE_MUTATION_LOCKED.