Cloud Development Environment Platform  ·  View 15 of 21  ·  Runtime

Stopping a Workspace — Four Reasons, One Mechanism

Idle human, finished agent, planned drain, unplanned loss — and the two blank cells that carry the argument.

Editable source SVG draw.io All views
Detect Decide Quiesce Persist Release Resume Idle human workspace No input, no activity Composite liveness Veto window honoured Freeze the guest Memory image + delta Host capacity freed On next connect Idle agent sandbox Short timeout stricter default No veto Kill the guest Diff + session record Returned to warm pool Host drain (patching) Operator marks host Refuse new placements Freeze in waves Snapshot each Kernel rolled Elsewhere, immediately Host loss (unplanned) Heartbeat gone Fence the host Last 5-min snapshot Host fenced RTO 60 s, loss told Stopping a Workspace — Four Reasons, One Mechanism The two blank cells are the design: an unplanned loss has nothing to quiesce, and a finished agent sandbox has nothing to resume. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • All four reasons converge on the same persist-and-release mechanism, which is why patching, cost control and host failure are one piece of engineering rather than three.
  • Only the human workspace gets a veto window on hibernation, bounded in minutes; an agent sandbox gets none (ADR-10).
  • Host loss has nothing to quiesce, so it is drawn with a blank cell and answered by the last snapshot plus a reported lost interval.

Assumptions

  • Hibernation to durable, resumable state p95 ≤ 12 s for a 2 GB memory image; RTO 60 s to resume elsewhere after host loss.
  • No single host loss affects more than a small fraction of concurrent workspaces; the host is fenced before any resume is attempted.

Risks

  • Fencing is the correctness-critical step: a workspace resumed on a second host while the first still runs is two divergent filesystems with one name.
  • A poison workspace that crashes its own kernel repeatedly must not be auto-restarted into the same loop; it is contained and reported with its cause.
◀  Prebuild Pipeline All views Deployment Topology  ▶
Solution Architecture v1.0 · open source on raw/bare-metal compute · Platform Architecture · 2026-1015-hibernate-and-evacuate