> ## Documentation Index
> Fetch the complete documentation index at: https://craftspace.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Backup and upgrade

> One volume to back up, and one file to swap.

## Backup

Everything durable is under `CRAFTSPACE_HOME`, which is the `/data` volume in the container. Snapshot that
and you have the install: the database, the generated secrets, the unpacked assets.

<Warning>
  **A backup of that volume is a full credential compromise if it leaks.** The sealing key that opens your
  connection credentials lives in the same database as the sealed credentials themselves, so a dump carries
  both halves. Treat it as being as sensitive as every vendor token inside it: encrypt it at rest, and keep
  it off shared storage.
</Warning>

## Upgrade

From the Settings screen, an install running under `craftspace supervise` can download a newer release,
health-check it and point back at the previous binary if the new one never answers.

With Docker, pull the new tag and recreate the container. The volume carries everything across.

```sh theme={null}
docker pull ghcr.io/abuaboud/craftspace:latest
docker stop craftspace && docker rm craftspace
# then the same docker run as before
```

## Rolling back

Safe, and worth knowing why. Migrations run as one transaction on Postgres, so a migration that throws
leaves the schema exactly where it was and the old version keeps serving.

Two consequences follow from that, and they are the rules a release has to obey:

* Putting the old image back genuinely recovers the box.
* A release may only **add** what the previous release reads, never remove it, or the rolled-back code
  meets a schema it cannot use.