Skip to content
open-computeopen-computeopen-compute

Collect a support bundle

Trigger: need an offline diagnosis of release, doctor, metrics, schema, or recent receipts. Blast radius is one new bounded local tar; nothing is uploaded automatically.

Read-only diagnosis: confirm the output parent exists, the target file does not exist, and it is not a symlink:

Terminal window
/opt/open-compute/ocd --config /var/lib/open-compute/instances/default/compute.toml doctor --json

Allowed mutation:

Terminal window
/opt/open-compute/ocd --config /var/lib/open-compute/instances/default/compute.toml support-bundle --output /var/tmp/open-compute-support-20260826.tar --json
/usr/bin/shasum -a 256 /var/tmp/open-compute-support-20260826.tar

Expect archive mode 0600, containing only allowlisted release, redacted policy, doctor, metrics, schema, bounded events/receipts, file digests, sanitized object-backend state, deployment-runtime.json, and an optional bounded workerd-last-exit.json. Secret canary, size cap, target already exists, or a non-canonical path are stop conditions. Do not bypass the scanner or hand-add DB, DO, object payload, object path/key, request body, customer encryption key, or provider credential. Rollback is a controlled destroy of that exact file by the operator. Verification: check the output SHA-256, inspect entry names offline, and confirm no secrets or tenant object identifiers.