onResume: 'reboot' (JavaScript) / on_resume="reboot" (Python) to
connect():
onResume / on_resume defaults to 'restore', the memory restore connect()
has always done.
This is a resume-side choice, and it is not the same as a
filesystem-only snapshot, which is a
pause-side choice. A filesystem-only snapshot never captures memory in the
first place;
onResume: 'reboot' / on_resume="reboot" skips the memory of a
snapshot that has it.When to reboot instead of restoring
A reboot is the way past a memory image that will not restore cleanly: a sandbox that ran out of memory before it was paused comes back under the same pressure, and the resume can hang instead of completing. A reboot never reads that memory, so it cannot hang on it. Because the choice is made at resume time, it also applies to snapshots taken without the caller’s involvement: a sandbox auto-paused on timeout keeps its memory. A reboot is slower than a restore, not faster: a memory restore takes about a second, while a reboot costs roughly a fresh boot.Restore vs. reboot
Connections from clients outside the sandbox are not one of the differences:
they drop when the sandbox pauses and have to be re-established on resume either
way (see Persistence).
What you get on disk
A reboot from a memory-inclusive snapshot gives you crash-recovery semantics: the disk image is what a power loss would have left. Filesystem metadata is repaired as the disk is mounted, but data writes that had not been flushed when the sandbox was paused are gone. Expect the same losses you would expect from pulling the power on a machine — a partially written file, or a database that replays its own log on startup. Anything written and flushed survives; anything still sitting in the page cache does not.Keep a snapshot afterwards
Once the sandbox is running again, the memory in the original snapshot is no longer reachable. Read or write what you need, then pause it — that records a new snapshot you can resume normally.Only a paused sandbox is rebooted
- Already running? The option is ignored and you get the running sandbox
back.
connect()never shortens a sandbox’s lifetime: the new expiry is the later of the current expiry and now plus the timeout you pass (Persistence). To reboot it,pause()it first and then connect withonResume: 'reboot'/on_resume="reboot". - Still starting? A reboot that would drop memory is refused while a start is already in flight, because the reboot cannot join a start that is restoring memory. Let the start finish, then pause, then reboot. This can happen without you doing anything: with auto-resume enabled, inbound traffic can start a paused sandbox on its own.
- Paused without memory? A
filesystem-only snapshot already
reboots on every resume, so
onResume: 'reboot'/on_resume="reboot"changes nothing for it and is harmless to pass.
If the reboot fails
A reboot that starts and then fails to boot leaves the sandbox paused with its snapshot intact, so you can retry the reboot, or connect normally to restore the memory as before. An attempt that does not succeed consumes nothing.Self-hosted deployments
On a control plane that knows the option but does not have it turned on, anonResume: 'reboot' / on_resume="reboot" that would actually drop memory fails
with an explicit error rather than quietly restoring the memory, so you can tell
a reboot that did not happen from one that did.
Related
- Sandbox persistence — pause and resume, and the sandbox state machine.
- Filesystem-only snapshots — persist only the filesystem at pause time.
- Connect to a sandbox — resume a paused sandbox explicitly.
- Auto-resume on request — waking a paused sandbox with inbound traffic.