Snapshots and private images
A snapshot restores the same computer; a private image creates a new one. Neither is an independent backup: both are stored alongside the computers. Keep an off-site copy of important data and verify that copy before deleting the original.
Operations
| Method | Path | Purpose |
|---|---|---|
| POST | /computers/{id}/snapshots |
{name}; includes memory when running or paused (202) |
| GET | /computers/{id}/snapshots |
id, name, has_memory, size_gb, created_at |
| GET, DELETE | /snapshots/{snp_id} |
Detail / delete (202). Deleting held data returns 409 invalid_state |
| POST | /snapshots/{snp_id}/restore |
Restore in place: disk-only ends stopped; with memory ends paused; start or resume explicitly afterwards. Overwriting held data returns 409 invalid_state |
| GET | /images |
Public images and your private images; `retention_state: active |
| GET | /images/{image} |
Detail, package manifest, build date, base_os, retention_state, scheduled_deletion_at |
| POST | /images |
{name, from_computer_id} (a stopped computer) creates a private img_... (202). Quota 2 per day (Tier 1), 10 per day (Tier 2) |
| DELETE | /images/{img_id} |
Refused (409 invalid_state) while computers use it or a legal hold prevents deletion; needs computers:delete |
Access to private images is checked separately from access to the destination computer; unauthorized image reads, deletes and use return 404 not_found. Creating a private image needs access to its stopped source computer and computers:write. For a key with a finite image list, creating an image adds the new image ID to that key and its parent keys, never unrelated images. Image permissions survive deletion of the source computer.
Restore
Restore works on running, paused, stopped and error computers, and uses restoring while it runs. Before changing anything the API compares the snapshot's recorded configuration with the current vcpu, memory_gb, disk_gb, image and desktop; a mismatch returns 409 invalid_state and nothing is applied. This applies to disk-only as well as memory snapshots. A disk-only restore ends stopped; a memory restore ends paused with its saved memory available. Neither waits for agent readiness; both set ready=false and clear timeout_at. The computer keeps its ID, mode, size, billing counters, cap history, network and access policy and setup history; restore never refunds earlier usage or reruns a completed setup script. Files and processes from the time of the snapshot may reappear, so check current access and network policy before running anything. The next explicit start or resume arms a new timer. A failed restore leaves the computer off in error with ready=false until a restore succeeds or the computer is reconciled.
Limits: 3 snapshots per computer (Tier 1), 5 (Tier 2). Snapshots and images are not backups. New computers from a private image get fresh SSH host keys, machine-id and agent identity.
Retention
Snapshots follow their source computer. When you delete a computer, its snapshots are hidden and their charges stop with it; after the 24-hour quarantine they are purged and snapshot.deleted is emitted for each, before computer.deleted. Under low-balance quarantine the snapshots are preserved recoverably with charges suspended, and restore is refused while the source is suspended. Purged snapshots are omitted from lists and return 404 not_found.
Private images are independent flattened copies: deleting their source computer neither deletes them nor stops their normal account-storage billing. Low-balance retention also covers private images, including accounts that hold only images, with the same notices and seven-day recoverable quarantine. Quarantined images refuse new computers (409 invalid_state); after funded recovery they are active again. Public images are excluded and always report active / null. image.deleted is emitted only after an image is gone.
Choose the next explicit action
A disk-only restore ends stopped: inspect the completed operation and start explicitly when ready. A memory snapshot ends paused: inspect its result and resume explicitly. If CPU, RAM, disk, image or desktop configuration differs, restore refuses; resize back before trying the matching snapshot. Restoring does not refund previous usage or erase the record of a prior setup attempt. A legal hold can refuse destruction while leaving the billing state unchanged.
Dory is in development; these pages describe the planned service and may change. Questions: support@computeengines.com.