Skip to content
Sencai.docs

Provision & manage instances

Cloud instances are virtual machines that Sencai provisions and tracks on your behalf, running on your connected cloud provider account. See Connect a cloud provider first if you haven’t done that yet - a connected account is required before you can provision an instance. If you already have servers running on a provider, see Import existing infrastructure instead of recreating them here.

The instances list

Section titled “The instances list”

Cloud Instances (/gravity/instances) shows every instance in the active organization - name, provider, region, type, status, IP address, monthly cost, and when it was created. From here you can search by name or IP, filter by provider or status, switch between table and card views, and open an instance to see its full detail.

Selected instances can be exported as a reviewable Terraform (.tf) file - useful if you want a portable record of what Sencai provisioned, without credentials embedded in the output.

Provisioning a new instance

Section titled “Provisioning a new instance”

New instance opens a five-step wizard (/gravity/instances/new):

  1. Provider - pick one of the supported cloud providers. If your organization’s instance limit for its plan is already reached, this step tells you so before you go any further.
  2. Region & instance type - choose a region, then an instance size from a table of vCPU/RAM/disk/price options for that provider and region.
  3. Configuration:
    • Cloud account - which of your connected credentials to provision into. This is required; Sencai always provisions into an account you control, never a Sencai-owned default.
    • Name - lowercase letters, numbers, and hyphens, 2–48 characters.
    • Tags - free-form labels for organizing and finding instances later.
    • SSH public key (optional) and an advanced cloud-init script field are both available and saved with the instance’s configuration. Whether either one is actually applied to the server at boot isn’t guaranteed for every provider today - verify access after provisioning rather than assuming it ran. Sencai separately sets up its own access account on every instance it provisions, independent of these two fields, which is what the browser terminal uses.
    • Operating system - a list of images for the chosen provider, with LTS releases marked. An image that cannot run a container is marked “no container deploy”.
    • Container (optional) - start a private image from your registry, or a public image from Docker Hub, GHCR or Quay, on the new server. The server installs a container runtime, verifies the signature of an image from your registry, pulls the image by digest and starts it. A container and your own cloud-init script exclude each other. See Deploy a container to a new instance.
    • Storage - a root disk (minimum 30 GB) plus any number of additional data disks, each with its own size and type.
    • Oracle Cloud additionally requires an existing subnet OCID - Oracle doesn’t let Sencai create a virtual network for you, so you supply one from your own OCI console.
  4. Network (optional) - attach the instance to an existing network and subnet, or leave it on the provider’s default networking.
  5. Review - confirm every setting, including the estimated monthly cost and the container, if you chose one (image, digest, ports, and the names of its environment variables), then provision.

Provisioning is asynchronous - the instance moves through a Provisioning state before becoming Running, and every step is tracked so you can see exactly what’s happening rather than staring at a spinner. Every provisioning action is recorded in your organization’s audit log, including which user triggered it.

Instance states

Section titled “Instance states”
State Meaning
Pending Queued for provisioning
Provisioning Being created
Running Fully operational - stop, restart, resize, or terminate are available
Starting / Stopping Transitioning power state
Stopped Powered off
Terminating Being permanently destroyed
Imported Adopted from your provider account rather than provisioned by Sencai
Failed Provisioning or an operation failed - check the instance’s activity log for the provider’s own error message

If an instance is stuck in Provisioning or lands in Failed, the most common cause is the connected cloud account - an invalid credential, an account-level quota at the provider, or (for Oracle) a missing subnet. Check Connect a cloud provider to confirm the credential still validates.

The instance detail page

Section titled “The instance detail page”

Opening an instance (/gravity/instances/[id]) shows a header with an action bar (start, stop, resize, terminate, and Terminal or Finish import where they apply) and tabs for:

  • Overview - networking (IPv4/IPv6/external ID), billing, and ownership details. On a server created with a container it also holds the Container panel: the deploy’s progress, the image and digest, the ports, volumes and variable names, and the state of its pull credential.
  • Resources - what is attached to this instance. One card per kind lists the disks, network, security groups and firewalls, IP addresses, load balancers, final snapshots, DNS records and the generated SSH key. A row links to its own page when Sencai holds one; an item that Sencai has only seen in an inventory scan says so and offers Import when it can be imported. A section that could not be worked out says why instead of showing as empty, so “nothing attached” is only shown when it is really so. Below the cards are the managed services created for the instance and the load balancers that send traffic to it.
  • Agent - enroll the fleet agent on this instance, or view its status if one is already connected.
  • Software - installed package inventory and end-of-life warnings, once a fleet agent is reporting.
  • Backups - backup status where the provider and configuration support it.
  • Logs - recent log lines shipped by the fleet agent, once one is enrolled.
  • Monitoring - a link into the platform’s monitoring view for this instance.
  • Activity - a running history of actions taken on the instance.

Provider facts next to the Sencai record

Section titled “Provider facts next to the Sencai record”

Detail pages for cloud resources - instances, storage disks, inventory assets, managed services, DNS zones, backup policies, CDN distributions and network overviews - share one layout: a header, a facts section, related links and, where it applies, an Import action. The facts section has two columns. At the provider shows what the last inventory scan read from your provider; Recorded in Sencai shows what only Sencai knows (IDs, dates, import state). Where Sencai’s record and the provider hold the same fact, it is shown once; where they hold different values, the row is marked and shows what the other source says. If the provider facts could not be loaded, the column says the lookup failed rather than showing nothing.

Lifecycle actions

Section titled “Lifecycle actions”

From an instance’s detail page or the list’s row menu:

  • Start / Stop - available once the instance is running or stopped, on most providers. OVHcloud instances don’t support a power stop/start through Sencai today - terminate is still available for those. On Scaleway, stopping ends the compute charge but the volumes keep billing, and the public address is released while the instance is stopped, so it can differ after a start. Stop Scaleway instances from Sencai rather than from inside the operating system: a shutdown from inside leaves the instance in a standby state that is still billed as running.
  • Resize - change to a different instance type. Not available while Hetzner is the provider (Hetzner instance types are fixed at creation); available for other providers while the instance is running or stopped.
  • Terminate - permanently destroys the instance. You’re asked to type the instance’s name to confirm - this can’t be undone. The same dialog can take a final snapshot first, and, for an instance whose SSH key Sencai generated, offers the checkbox Also delete the SSH key Sencai generated for this VM (see SSH key deletion).
  • Restart and retry-after-failure are not available yet; both show as disabled with a “coming soon” label.

All lifecycle actions go through the same provider connection that created the instance, and all of them are audited.

Deleting the SSH key with the VM

Section titled “Deleting the SSH key with the VM”

When Sencai generated an SSH key for an instance, the delete dialog shows the key’s name and fingerprint under an unticked checkbox, Also delete the SSH key Sencai generated for this VM. Tick it to remove the key together with the VM. A line under the checkbox says when the key will go:

  • After the provider confirms the VM is deleted - the normal case.
  • Only after the final snapshot is finished and the provider confirms the VM is deleted - when you also ticked the final-snapshot box.
  • Right away - when the VM was never created at the provider, so there is nothing to wait for.

In some cases the checkbox is disabled and the line says why: Sencai cannot confirm that no machine still uses this key, so the key is kept. That also covers a key you supplied yourself and instances brought in by import, which never had a generated key. If the deletion of the VM fails, the key is not deleted either. When you do delete the key, the private copy stored in Sencai is deleted for good and cannot be downloaded again; if you added the key to other servers or tools, remove it there too, because Sencai cannot see those copies. The confirmation message after you delete tells you whether the key was scheduled for deletion, was deleted, or was kept.

Browser terminal

Section titled “Browser terminal”

If the instance is Running (or was brought in through import and has a connection target configured), a Terminal button opens a browser-based session - no local SSH client or key management needed. See Remote access for how this works and what it requires.

A server that is only reachable inside a private network can be reached through a VPN profile: choose the profile in the instance’s connection setup and the terminal goes through it.

Tags and cost

Section titled “Tags and cost”

Tags set at creation (or added later) help you organize instances and appear in cost allocation views, so it’s worth tagging consistently - by environment, team, or project - rather than leaving instances untagged.

What’s next

Section titled “What’s next”