Docs/Agent/Change Tracking

Change Tracking

Capture what changed in a running container since it was deployed. Every filesystem modification (new files, changed configs, written logs) is archived as a timestamped layer.

What Is a Layer

A layer is the filesystem diff between a running container and its base image: added, modified, and deleted files. This is the same diff mechanism container runtimes use internally, extracted and archived as an artifact.

Because layers only contain changes, they're typically much smaller than a full image. A container that wrote 50MB of logs and config changes produces a 50MB layer, regardless of the base image size.

Schedule with the Agent

Schedule regular layer captures using pod annotations. Each capture creates a layer and exports it to S3.

# Hourly capture, uploaded straight to S3
reel.io/schedule: |
0 * * * * | create layer
next | upload layer
reel.io/s3-bucket: "container-backups"

The next keyword chains the export to run immediately after the layer is created. See Scheduling Reference for full cron syntax.

One-Shot via CLI

Capture a layer on demand through the agent API:

# Create a layer from a running container
reel create layer --pod my-pod -n production
# List captured layers
reel list layers -n production
# Export a layer locally for inspection
reel export layer --pod my-pod -o ./backup.tar.zst

Retention

When you upload layer, the server-side copy is deleted immediately after streaming to S3. Apply lifecycle rules on the bucket to age out evidence. Captured layers kept on the node are deleted by ID:

# List captured layers, then delete one by ID
reel list layers -n production
reel delete layer <layer-id>

For the full command reference, see Layer Operations.

Restore

A captured layer can either start a fresh pod (restore layer) or roll an existing deployment back to that filesystem state (rollback layer). See Layer Operations for full syntax.

Incident ForensicsRequirements