Skip to main content
Everything you do after your secure environment is running. The Helm and kubectl commands below use <namespace>: your secure environment’s namespace. The one-line installer names it after your client and gives the Helm release the same name, so <namespace> is both. tracebloc cluster info shows it. For a manual Helm install, it’s the namespace and release name you chose.
Day-to-day management — inspecting the cluster, ingesting and removing data — is easiest with the tracebloc CLI. The Helm/kubectl commands here cover the lifecycle bits the CLI doesn’t (upgrade, stop/start, uninstall) and deeper debugging.

​
Which version am I on?

The install summary also prints the version. For support, tracebloc doctor --diagnose writes a redacted support bundle, tracebloc-doctor-<timestamp>.txt, to the current directory; it includes the chart version.

​
Health & status

For deeper debugging:
Then check My Secure Environment: your secure environment should read Active now under its name.

​
Logs

​
Stop & start (local machine)

Free up your machine without losing anything — data persists between stops.
If you installed with TRACEBLOC_CLUSTER_NAME, use that name instead of tracebloc here and in the uninstall commands below. Native k3s (the default on a new Linux machine) has no k3d cluster. It runs as the k3s system service:
On a new Mac, k3s runs in a VM in Apple’s container runtime (see Mac prerequisites). The login item io.tracebloc.node checks every minute and starts the node again, so unload it first. Then stop the node and the container system with the runtime they run on:
If launchctl print finds no com.apple.container.apiserver, the container system and the node are already stopped. The node is named after kubectl’s context, k3s-tracebloc, or k3s-<name> if you installed with TRACEBLOC_CLUSTER_NAME. To start again, load the login item. It starts the container system, then the node:
The stop lasts until you log in again: the login item loads at every login and brings the node back.

​
Upgrade

The auto-upgrade CronJob keeps your secure environment current by default: every hour it checks for a new release and upgrades the services. To update the CLI now:
It re-runs the official installer (signature-verified) and brings the CLI to the latest release. On macOS, and on Linux with k3d, it leaves a healthy secure environment’s services to the hourly auto-upgrade. If the installer finds something it has to repair, or your CLI is older than the oldest it supports, it runs the full install, which also brings the services up to date. On native k3s, the default on a new Linux machine, it always runs the full install. On Windows it prints the command to run in a new PowerShell window. Safe to re-run. To upgrade the services right away, use Helm:
--reset-then-reuse-values preserves the values the installer applied. It needs Helm 3.14 or later (Helm 4 works; the installer installs Helm 4). Append --version <x.y.z> to pin a specific release.

​
Roll back

​
Move to another machine

Your secure environment’s identity is its Client ID, not the machine. To relocate, reuse the old host’s credentials:
  1. On the old host, read the Client ID and its password from the secure environment’s Secret:
  2. On the new host, pass them to the installer. Without them, the installer signs you in through the browser and creates a new secure environment instead:
  3. Re-ingest your datasets on the new host. Ingested data doesn’t move with the credentials, and copying ~/.tracebloc across doesn’t carry it over.
  4. Once the new host shows Online, remove the old one with the manual steps under Uninstall (k3d cluster delete on k3d, or helm uninstall on native k3s and any other cluster).
Don’t run tracebloc delete on the old host. It revokes the machine credential first, and that is now the credential the new host uses, so the new host goes offline too.

​
Uninstall

To remove tracebloc from this machine, run:
It shows what it will remove and keep, then asks you to type the name of your secure environment to confirm. --yes skips the confirmation (for automation).
  • Removed from this machine: the machine credential is revoked, the Helm release is uninstalled, the local cluster is deleted, the tracebloc container images are reclaimed, ~/.tracebloc is cleared, and the tracebloc CLI removes itself.
  • Kept on tracebloc: your use cases, the catalog entries of your datasets, and the models trained here.
  • Left in place: on k3d, Docker, kubectl, k3d, helm and NVIDIA drivers. Remove them yourself if nothing else uses them.
  • On native k3s (Linux): k3s itself is removed too, through k3s’s own uninstall, so tracebloc delete asks for administrator rights once and lists every command it runs as root before it runs any. A k3s that an administrator prepared for you stays; removing it takes that administrator. --keep-data copies your volumes to ~/.tracebloc/kept-data/<time>/ first.
This can’t be undone. Datasets stored on this machine are erased. tracebloc delete --keep-data keeps ~/.tracebloc (local config and any datasets stored there on the host), but datasets kept inside the cluster go with it. On a macOS or Linux k3d install, that’s where datasets live by default. On native k3s, --keep-data copies them out first (see above).
tracebloc delete refuses while experiments are still running. Wait for them to finish, or pass --force to stop them. It targets the cluster it was installed on, as recorded at install time, not kubectl’s current context, and it refuses if the cluster it reaches is not the one your secure environment runs on. Pass --context only if the install record is missing.
After tracebloc delete or k3d cluster delete, check kubectl config current-context before you run another kubectl or helm command. Deleting the k3d cluster removes its context, and k3d may make another cluster in your kubeconfig current, such as a remote or production cluster. Switch with kubectl config use-context <context>, or clear it with kubectl config unset current-context.
k3d cluster delete tracebloc (local) or helm uninstall <namespace> -n <namespace> (any cluster) removes only the cluster or the release. After k3d cluster delete, check kubectl config current-context (see the warning above). The machine credential stays live, so your secure environment stays registered on your dashboard, and the tracebloc CLI and ~/.tracebloc stay on disk. Prefer tracebloc delete.After a helm uninstall, PVCs are annotated helm.sh/resource-policy: keep, so your data survives. To remove it too: kubectl delete pvc --all -n <namespace>.

​
Back up

Your data lives in the secure environment’s PVCs: the dataset PVC and the MySQL PVC, which holds the ingested tables (kubectl get pvc -n <namespace> lists them). Back up those volumes on your normal schedule — tracebloc keeps nothing of yours off your infrastructure. On a default macOS or Linux local install, those volumes sit inside the cluster node, not in ~/.tracebloc; on native k3s the node is this machine, and they sit in k3s’s storage directory (see Linux prerequisites). To back them up as a host directory, install with TRACEBLOC_STORAGE_MODE=hostpath: your data then lives under ~/.tracebloc (or TRACEBLOC_HOST_DATA_DIR).