Service VMs
Atlas runs regional services in tenant-0 VMs on Metal hosts. They use the same VM lifecycle and WG Mesh as tenant VMs. Atlas grants mesh privilege because these services need to reach VMs across tenant boundaries.
Atlas owns each VM and its setup record. The software inside the VM owns its traffic or storage work.
| Service | Why it exists | Read next |
|---|---|---|
| HTTP proxy | Accepts public web traffic and stores replicated routes. | Proxy overview, Atlas setup |
| Cargo | Runs image and object-storage services. | Cargo setup and storage |
| IPv6 router | Translates public IPv6 addresses to VM mesh addresses. | Router setup and packet path |
What Atlas creates
Reserve a tenant-0 public IPv4 allocation on the Public IP Pool form before you provision a service. Each service VM uses one. Atlas creates a privileged, termination-protected VM through the normal VM service and attaches that allocation.
The service record and VM have different states. For example, the VM can exist while its service record is still Pending. Do not infer service readiness from the VM state.
| Service status | Meaning |
|---|---|
Pending | A VM is being created or a setup job is queued. |
Provisioning | The setup job is working through service-specific steps. |
Active | That service's setup checks passed. It does not prove future traffic or storage health. |
Failed | A setup step failed. The Failure field names its phase. An operator must act. |
Archived | Atlas removed the service record's VM and related resources. |
Cargo also starts as Not Provisioned. See Cargo recovery before replacing its VM.
Why a service can wait
Atlas queues a setup job after VM creation. If the VM is still a draft, the job leaves the service Pending. The scheduler queues it again. The router waits for Metal to apply its public IPv4 address as well, because its next step replaces the full network configuration.
Check the service record first
A Pending record does not need a second provision request. A Failed record does not automatically retry. Read its Failure field and the linked SSH Task before taking the service-specific recovery action.
How packages reach a VM
The HTTP proxy and IPv6 router use the same package path. Atlas builds a reproducible archive from their service directories and publishes it as a File. Atlas Settings stores the file and its SHA-256 hash. The VM installer downloads the archive, checks the hash, and runs its setup script.
An unchanged archive is not published again. Proxy setup also skips a package or configuration that already has the expected hash. Cargo uses its own installation script and does not use this package path.
Source code and contracts
- Service contract lists the service records and their VM rules.
- Package builder and installer define the shared archive path.
- Proxy Server, Cargo Server, and IPv6 Router Server own their service records.