Skip to content

Require Verified Recovery State Before Releasing a Stateful Lab

Status

Accepted: A blueprint that protects lab data must not release its managed host until the declared recovery set has been exported and verified, unless the operator explicitly selects unprotected destruction.

Context

The lifecycle boundary of a network lab is not necessarily its current host. Topology definitions, saved device configurations, writable disks, controller state, or evidence from an active exercise can remain significant after the execution capacity becomes disposable. Infrastructure reproducibility alone does not prove that this environment state is recoverable.

The recovery boundary also differs by platform. EVE-NG may require definitions, native device exports, QEMU overlays, and referenced images. GNS3 preserves projects and associated disk state. Containerlab preserves its authoritative source and declared native lab-directory state.

Decision

Protected destroy performs these operations in order:

  1. establish the platform-specific consistency boundary;
  2. export the declared recovery state;
  3. verify manifests, checksums, and required members;
  4. retain the environment if any required check fails;
  5. release resources only after verification succeeds.

Licence material and secrets remain outside the archive. EVE-NG QEMU state requires guest quiescence. One prior verified archive generation is retained where the platform lifecycle supports generation promotion.

Consequences

Positive

  • Release is admitted by recovery evidence rather than a disposable label.
  • A failed export cannot silently become the latest recovery set.
  • Cost control and preservation share one governed lifecycle.

Negative

  • Protected release takes longer than direct destruction.
  • Large image or node-state sets require additional local storage.
  • Application-consistent shutdown remains an operator or guest responsibility.

Alternatives considered

  • Always destroy from infrastructure definitions: rejected because useful state can exist outside those definitions.
  • Always preserve every host disk: rejected because it is expensive and hides the platform-specific recovery contract.

References