Rescue mode

Boot a temporary recovery image and inspect an existing guest disk.

Rescue mode boots a droplet from an approved recovery image while retaining its existing volumes for inspection. It is used when the normal guest cannot boot or authenticate.

Enter rescue modeCopy link

Create a snapshot of readable disks before repairing production data. Shut down the droplet and open Recovery → Boot rescue image. Choose an image compatible with its architecture and firmware. The operation changes the boot source; it does not replace or format the original root volume.

Infra records the original boot configuration and exposes the rescue image's access instructions. Network settings still follow the droplet's interfaces and firewall attachments. Rescue mode does not bypass project network policy.

Identify the original diskCopy link

In the rescue guest, inspect devices and filesystem signatures before mounting. The original root disk can have a different kernel device name than it had in normal execution. Use its stable attachment identifier and expected size. To list device sizes and filesystem identifiers, run:

lsblk -o NAME,SIZE,FSTYPE,UUID,MOUNTPOINTS

Mount the required filesystem read-only first. If the guest uses encryption, logical volumes, or a RAID layout, activate them through its operating system's supported recovery procedure. Infra-managed volume encryption and guest-level disk encryption use different keys.

Repair and access recoveryCopy link

Use the guest distribution's tools to inspect logs, repair boot configuration, or replace an authorized public key. Do not copy private keys into the recovery image. Changes to the mounted disk are real writes to the existing volume and are not discarded when rescue mode ends.

Filesystem repair can modify metadata. Unmount the filesystem before running a tool that requires exclusive access. Keep a snapshot or backup when a repair could make later forensic recovery harder.

Return to normal bootCopy link

Unmount repaired filesystems, shut down the rescue guest, and choose Exit rescue mode. Infra restores the recorded normal boot source. Start the droplet and verify guest access and application health before adding traffic.

If the original boot volume was replaced during rescue, select the intended root attachment explicitly. A missing or incompatible root reference blocks normal start instead of falling back to an arbitrary disk.

Access and failure handlingCopy link

Entering rescue mode requires Guest Recovery permission and is audited separately from ordinary console access. Rescue images are project-governed artifacts; only approved revisions are offered for production resources.

A failed rescue boot leaves the original disk retained. Inspect the selected image, firmware, and current operation rather than deleting the root volume. Use guest access for an otherwise healthy system and volume restoration when its disk cannot be repaired.