Skip to content
OpfieldOpfieldOpfield

Shut down, start, and isolate an app

The danger zone of an app’s Settings tab has two actions that act on everything in a scope at once: Shut down stops what runs, and the Kill switch isolates the app so that nothing of it is reachable. Both restore exactly what they changed. The scope is the whole app or one environment.

Both need the Operator role on the app or the environment (apps:operate).

Shut down and start

Section titled “Shut down and start”

Shut down opens a dialog with the scope and what will change, counted live:

  • running containers, deployments, and Compose projects stop;
  • managed databases and managed storage pause; their data stays;
  • routes and Pages routes show the maintenance page.

Resources stay editable while the app is shut down. The app and its environments show Stopped.

Start brings back only what Shut down changed and what is still in the state it left: a container that someone started by hand meanwhile is left alone, and a resource that was already stopped before stays stopped. Routes return to their own maintenance state.

Kill switch

Section titled “Kill switch”

The kill switch is for a security incident: it cuts all traffic to and from the app while keeping every resource and its data as it is. Isolate app opens a dialog with the scope and what will change. Type the app’s name to confirm.

While isolated:

  • every route of the scope, and every route outside the app that forwards to one of its workloads, shows the maintenance page; no maintenance access code works;
  • container links, database and storage links, and Secure Links of the app’s workloads are cut;
  • containers and Compose services lose network access; a container on the host network is stopped instead;
  • direct database and storage ports close;
  • data stays as it is.

The app shows Isolated, and every resource of it shows a notice on its own page. Isolated resources are frozen: recreating, updating, changing environment variables or networks, deploying, applying Compose, migrating, creating links, editing routes, and moving resources in or out of the environment are refused. Stop, start, restart, logs, console, and delete still work.

Turn off releases the kill switch and restores everything to its previous state, item by item: the same networks with the same addresses and aliases, the same links, routes, and ports. A resource deleted meanwhile is skipped. A node that is offline during the release is restored when it reconnects. When a step fails, the notice lists it and Opfield keeps retrying.

Container network isolation needs a Docker daemon from 2.12 or later on the node. On an older daemon, that item fails with a request to update the node, and the rest of the kill switch still applies.

Things to know

Section titled “Things to know”
  • A scope that is isolated cannot be shut down; turn the kill switch off first.
  • An app or environment cannot be deleted while it is shut down or isolated.
  • Shutdown, start, isolation, and release are recorded in the audit log and on the app’s Activity tab.
  • Through the API and MCP: POST /api/apps/{id}/shutdown, /start, /isolation, and DELETE /api/apps/{id}/isolation; MCP manage_app_incident with shutdown, start, isolate, release, and status.