# Snapshots

A snapshot is a saved state of a sandbox. HareBox takes them for you, and you can take your own.

| Trigger | When | Contains |
|---|---|---|
| `automatic` | Every 30 s or better while `ready` on Shared | Disk |
| `stop` | When a sandbox stops | Disk |
| `manual` | When you ask | Disk, and memory if asked |

```sh
harebox new --name snap-demo
harebox exec current -- "echo v1 > /home/user/f"
harebox snapshot current --memory
harebox snapshots current
```

**Older states are usable.** Keep points are every 5 minutes for 24 hours, then hourly for 14 days. See [Lifecycle](lifecycle.html#what-survives) for what each state keeps.

## Roll back

```sh
harebox new --name snap-roll
harebox exec current -- "echo keep > /home/user/f"
SNAP=$(harebox snapshot current | jq -r .id)
harebox exec current -- "echo oops > /home/user/f"
harebox restore current --snapshot "$SNAP" --in-place
harebox exec current -- cat /home/user/f
```

By default a restore makes a **new** sandbox, and the source doesn't change. `--in-place` rolls back the sandbox itself.

## How it's stored

Snapshots are 4 MiB encrypted chunks under a per-sandbox key. Identical chunks in one sandbox's history are stored once, and nothing is ever shared across sandboxes or tenants. Deleting a sandbox destroys the key first, so its data is unreadable at once.

## Limits

A sandbox running nested guests can only be saved crash-consistently, without memory, and its snapshot says so in `consistency`. Check `capabilities.memory_snapshot`.