Docs/Agent/Change Tracking

Change Tracking

Capture what changed in a running container since it was deployed. Every filesystem modification — new files, changed configs, written logs — is archived as a timestamped layer.

What Is a Layer

A layer is the filesystem diff between a running container and its base image — added, modified, and deleted files. This is the same diff mechanism container runtimes use internally, extracted and archived as an artifact.

Because layers only contain changes, they're typically much smaller than a full image. A container that wrote 50MB of logs and config changes produces a 50MB layer, regardless of the base image size.

Schedule with the Agent

Schedule regular layer captures using pod annotations. Each capture creates a layer and exports it to S3.

# Hourly captures with retention
reel.io/schedule: |
0 * * * * | create layer
next | export layer
0 0 * * * | delete layer --keep-last 24
reel.io/s3-bucket: "container-backups"

The next keyword chains the export to run immediately after the layer is created. See Scheduling Reference for full cron syntax.

One-Shot via CLI

Capture a layer on demand through the agent API:

# Create a layer from a running container
reel --agent create layer my-pod -n production
# List captured layers
reel --agent list layers -n production
# Export a layer locally for inspection
reel --agent export layer <layer-id> -o ./backup

Retention

Manage disk usage with scheduled cleanup:

# Keep last 10 layers per container
0 0 * * * | delete layer --keep-last 10
# Delete layers older than 7 days
0 0 * * * | delete layer --older-than 7d

For the full command reference, see Layer Operations.

Restore

Layers can be restored to new pods or used to roll back deployments. Restore support is under active development — see Layer Operations for available commands.

Incident ForensicsRequirements