# spin workspace

**Spinbox is experimental: APIs change and data may be lost.** What is built and what proves it is on [Status](https://spin-stack.github.io/website/reference/status.md); what Spinbox does not do is on [Limitations](https://spin-stack.github.io/website/overview/limitations.md).

> spin workspace: Manage workspaces.

<!-- Generated by tools/refgen from spin:cmd/cli. Edit the source, not this file. -->

```
Manage workspaces

Usage:
  spin workspace [flags]
  spin workspace [command]

Aliases:
  workspace, ws

Available Commands:
  approve-egress-root Let the workspace trust the installation's egress root
  approve-settings    Approve the startup settings the workspace is handed
  audiences           Who the workspace's identity may be given for, as its owner's word says
  clone               Clone a running workspace
  console             What the workspace's machine printed to its serial console
  create              Create a new workspace
  delete              Delete a workspace
  deleted             List your workspaces in the trash
  denials             What a workspace attempted past its policy (admin)
  egress              What a workspace has reached beyond this installation
  get                 Get workspace details
  grant               Give a workspace more cores and memory of its own
  guests              The people who log in to a workspace besides its owner
  history             Show workspace state change history
  keep                Keep a running workspace awake for a while
  list                List your workspaces
  logs                Search what the workspace's machine printed to its console
  logs-consent        Say whether the workspace's journal and console may be collected
  move                Move a running workspace to another host
  policies            The network policies a workspace can be created with
  quarantine          Hold a workspace in quarantine (admin)
  recover             Re-home a workspace whose host is gone
  release             Give back what a workspace was granted
  reset               Put a stopped workspace's disk back to what it was created from
  restore             Put a stopped workspace's disk back to a snapshot, or to what it was created from
  retag               Change which network policies a workspace runs under
  sign                Sign the workspace's next access: who logs in, as you invited them
  start               Start a stopped workspace
  status              Why a workspace is not behaving
  stop                Stop a running workspace
  suspend             Put a running workspace down with its processes where they are
  undelete            Take a workspace out of the trash, stopped
  unquarantine        Release a quarantined workspace (admin)
  update              Update workspace properties
  watch               Record where a workspace connects, into its logs

Flags:
  -h, --help   help for workspace

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

Use "spin workspace [command] --help" for more information about a command.
```

### spin workspace approve-egress-root

```
A workspace's guest puts the installation's egress root in its trust store - the CA its host's
egress proxy stands in for brokered hosts with - only while its owner's word names it: a root
there reads what the guest's TLS clients send through the proxy. This signs a word naming the
root the control plane offers, once held to the one this machine pinned for the installation
(the first offered; 'spin trust egress-root' pins another).

Usage:
  spin workspace approve-egress-root <workspace> [flags]

Flags:
  -h, --help   help for approve-egress-root

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace approve-settings

```
A workspace applies its startup settings - dotfiles and the command that installs them, the
login shell, the environment, the editor's settings and the Taskfile - only as its access
approves them, by their digest. This shows the settings the control plane would hand it now,
and signs an access approving exactly those: settings changed afterwards, by anyone, are not
applied until approved again.

Usage:
  spin workspace approve-settings <workspace> [flags]

Flags:
  -h, --help   help for approve-settings
  -y, --yes    Skip confirmation

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace audiences

```
A host gives a workspace's identity token - to the guest, or through its egress proxy - only
for an audience its owner's word names and the installation allows: the installation's list is
the control plane's to write, so it alone never widens who the identity reaches.

With no flags this shows the word's audiences and the installation's. --add and --remove sign
the owner's next word naming more or fewer; --any signs one naming any audience the
installation allows, which trusts the installation's list.

Usage:
  spin workspace audiences <workspace> [flags]

Flags:
      --add strings      an audience to name
      --any              name any audience the installation allows
  -h, --help             help for audiences
      --remove strings   an audience to name no more

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace clone

```
Clone a running workspace: a snapshot of its disk is taken and published, and a workspace
is created from it with the source's team, project and ref, size, network policies and
environment, owned by you. The source runs on. The snapshot stays as the clone's floor. This
answers once the clone exists, which takes as long as publishing the source's disk.

Like a create, the clone's first access is signed here with a key of your keyring.

Examples:
  spin workspace clone mydev
  spin workspace clone mydev --name experiment --wait

Usage:
  spin workspace clone <workspace> [flags]

Flags:
  -h, --help               help for clone
      --name string        The clone's name (generated if empty)
      --timeout duration   How long --wait waits; by default, until the control plane gives up on it
      --wait               Return once the clone is running

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace console

```
Show the tail of a workspace's serial console: the kernel, then the guest's init,
then the supervisor.

This is where a machine that never came up says why. It is read from the host that holds
it, so a workspace that has moved to another host has nothing here about the run that failed
on the one it left - unless the installation collects consoles, and then 'spin workspace logs'
searches what every run of it printed.

Usage:
  spin workspace console <workspace> [flags]

Flags:
  -h, --help          help for console
      --lines int32   How many lines from the end (default 200)

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace create

```
Create a new workspace from an image or a snapshot. An image is a published starting disk
the installation allows; without --image, the installation's default is used. Its size is a
preset the installation offers; without --preset, the installation's default.

Every workspace answers to its access, which you sign here with a key of your keyring (the keys
you registered, 'spin ssh-key add', and signed, 'spin sign'): who logs in - you, and the guests
you invite - whether logs leave the workspace and which settings it applies. The host it runs
on lets a key in only by it, and the control plane cannot write one. Settings are applied once
you approve them (--approve-settings, or 'spin workspace approve-settings').

A project of a team (--team, --project) is the workspace's shape - its image, preset and network
policies - and the repository its guest clones into /workspace/<repository name>, at --ref or the
project's own. Opening one approves the settings, since the repository is one of them.

Examples:
  spin workspace create --name mydev
  spin workspace create --name mydev --preset large
  spin workspace create --name build --env GOPROXY=direct --network-tag registry-only
  spin workspace create --name copy --from-snapshot <snapshot-id>
  spin workspace create --team /engineering --project qboot --ref release/2

Usage:
  spin workspace create [flags]

Flags:
      --approve-settings       Show your startup settings and approve them in the first access
      --env strings            Environment variables (KEY=VALUE)
      --from-snapshot string   Start from a snapshot instead of an image
  -h, --help                   help for create
      --image string           the ref of the disk image to start from, with its version (default: the base image of the machine this installation runs)
      --name string            Workspace name (auto-generated if empty)
      --network-tag strings    Network policy to run under, by name (repeatable)
      --preset string          The preset it is sized by, by name (default: the installation's)
      --project string         A project of --team to open, by slug: its image, preset and policies, and its repository cloned
      --ref string             The branch or tag to open the project at (default: the project's)
      --team string            The team, by id, path or me (your personal team if empty)
      --timeout duration       How long --wait waits; by default, until the control plane gives up on it
      --wait                   Return once the workspace is running

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace delete

```
Delete a workspace. Where the installation keeps a trash, the workspace goes there with
its disk and can be undeleted until its days are up (spin workspace deleted, spin workspace
undelete); --permanently erases it now, as does deleting one that is in the trash already.

Usage:
  spin workspace delete <workspace> [flags]

Flags:
      --force         Delete it in a state a delete is otherwise refused in: one stuck starting or stopping
  -h, --help          help for delete
      --permanently   Erase it now instead of keeping it in the trash
  -y, --yes           Skip confirmation

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace deleted

```
List your workspaces in the trash

Usage:
  spin workspace deleted [flags]

Flags:
  -h, --help   help for deleted

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace denials

```
The egress a workspace's policy refused, as its supervisor reported it, newest first:
what was attempted while it was held, and around the holding. Reading it is an
administrator's act.

Usage:
  spin workspace denials <id> [flags]

Flags:
  -h, --help          help for denials
      --limit int32   How many of the newest to read (default 100)

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace egress

```
List every destination a running workspace's machine has been allowed to reach, with the
host's own packet and byte counters and, where its resolver answered for it, the name it was
asked for.

This is what an allowlist is written from: a network policy is a list of destinations, and a
guess at one either breaks the workspace or allows what nobody meant to. The host keeps the
record for six hours, so a workspace has to be running on one to answer.

Usage:
  spin workspace egress <workspace> [flags]

Flags:
  -h, --help   help for egress

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace get

```
Get workspace details

Usage:
  spin workspace get <workspace> [flags]

Flags:
  -h, --help   help for get

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace grant

```
Give a workspace more cores and memory of its own, while it runs: its host sets them aside
and its machine is grown at once. It keeps them - across stops and starts - until they are
given back with 'spin workspace release', the workspace is deleted, or the time --for gives is
up. Each grant says its time anew: one without --for is kept until it is given back.

What it may hold is its preset's: at least what it started at, and at most the preset's size,
or as much as its host has room for where the preset grows to the host's. A running
workspace's host has to have the room now; with --move, a host that has not is left for one
that has: the workspace is suspended where it runs, its processes as they are, and resumed
there from the instant its memory was checkpointed. It is paused from that instant until it
runs there, which takes as long as storing its memory and publishing its disk - minutes, for
a large one - and nothing it did is lost.

Examples:
  spin workspace grant mydev --cpu 4
  spin workspace grant mydev --cpu 4 --memory 8192
  spin workspace grant mydev --cpu 8 --for 2h

Usage:
  spin workspace grant <workspace> [flags]

Flags:
      --cpu int32      Cores it is to hold
      --for duration   How long the grant lasts before it is given back on its own (default: until it is given back)
  -h, --help           help for grant
      --memory int32   Memory it is to hold, in MB
      --move           Move it to a host with room when its own has none (it is paused while it moves)

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace guests

```
A guest logs in to a workspace with any key of their own keyring, sees it and opens its ports,
and changes nothing else: who logs in and what leaves the machine stay its owner's to say.
Inviting and removing sign the next access, on this machine.

Usage:
  spin workspace guests [flags]
  spin workspace guests [command]

Available Commands:
  add         Invite a person, and sign the access that names them
  list        The guests, as invited and as the access names them
  remove      Take a guest out, and sign the access without them

Flags:
  -h, --help   help for guests

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")

Use "spin workspace guests [command] --help" for more information about a command.
```

#### spin workspace guests add

```
Invite a person, and sign the access that names them

Usage:
  spin workspace guests add <workspace> <email> [flags]

Flags:
  -h, --help   help for add

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

#### spin workspace guests list

```
The guests, as invited and as the access names them

Usage:
  spin workspace guests list <workspace> [flags]

Flags:
  -h, --help   help for list

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

#### spin workspace guests remove

```
The control plane refuses them at once; the workspace's host, once the access without them is
signed - which this does - from their next login on.

Usage:
  spin workspace guests remove <workspace> <email | user id> [flags]

Flags:
  -h, --help   help for remove

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace history

```
Show workspace state change history

Usage:
  spin workspace history <workspace> [flags]

Flags:
  -h, --help          help for history
      --limit int32   Number of events to show (default 50)

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace keep

```
Answer the question asked ten minutes before a suspension: for the duration given - 2h, 90m,
up to 24h - neither the idle suspension nor the running cap puts the workspace down, and the
question on its page and in its terminals is withdrawn. An extension with an end, never
permanent: it is asked again ten minutes before the end. Inside the workspace,
'/run/spin-stack/supervisor/bin/spin-supervisor keep <duration>' does the same.

Usage:
  spin workspace keep <workspace> <duration> [flags]

Flags:
  -h, --help   help for keep

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace list

```
List your workspaces

Usage:
  spin workspace list [flags]

Flags:
  -h, --help           help for list
      --state string   Filter by state (running, stopped, etc.)

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace logs

```
Search the workspace's console as the installation kept it, newest first: every run
of it, on whichever host ran it, for the installation's retention.

Only where the installation collects consoles (collect_workspace_logs); otherwise
'spin workspace console' reads the tail from the host that holds it.

Examples:
  spin workspace logs my-ws
  spin workspace logs my-ws 'panic OR "out of memory"' --since 24h

Usage:
  spin workspace logs <workspace> [query] [flags]

Flags:
  -h, --help             help for logs
      --limit int32      how many lines, newest first: 1 to 1000 (default 100)
      --since duration   how far back to look, at most 744h (31 days) (default 1h0m0s)

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace logs-consent

```
A workspace's journal and its console leave it only while its access consents, and the
installation collects them: either can say no. The owner signs the consent, on this machine.

Usage:
  spin workspace logs-consent <workspace> <on|off> [flags]

Flags:
  -h, --help   help for logs-consent

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace move

```
Move a running workspace to another host, holding what it holds: it is suspended where it
runs, its processes as they are, and resumed there from the instant its memory was
checkpointed. It is paused from that instant until it runs there, which takes as long as
storing its memory and publishing its disk - minutes, for a large one - and nothing it did is
lost. Placement chooses the host, as it does at a start.

A workspace that is not running has no host to be moved off: placement decides where it runs
at its next start.

Usage:
  spin workspace move <workspace> [flags]

Flags:
  -h, --help   help for move

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace policies

```
List the network policies the hosts report they enforce, by name: these are the words
'spin workspace create --network-tag' takes.

A policy is an installation's, not a workspace's: an operator writes it on each host, and the
host is what enforces it. A tag no host reports is refused at create rather than failing when
the workspace starts. Where two hosts give one name different prefixes, both are shown: a tag
that means two things is a misconfiguration worth seeing.

Usage:
  spin workspace policies [flags]

Flags:
  -h, --help   help for policies

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace quarantine

```
Hold a workspace in quarantine: an administrator's decision, and until one releases it
the workspace cannot be started, moved or deleted by its own person, its disk kept as it was.
A running workspace is stopped first, forced, and held when its host says it stopped. What the
workspace attempted, kept beside it, is what spin workspace denials reads.

Usage:
  spin workspace quarantine <id> [flags]

Flags:
  -h, --help            help for quarantine
      --reason string   Why it is held: kept on the audit entry for the act
  -y, --yes             Skip confirmation

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace recover

```
Move a workspace to another host after the one it was on died.

A workspace cannot be started on a host that is not connected, and no amount of retrying
changes that. Recovering takes its disk from the dead host and places it on a live one.

The cost is the work the dead host had written and not yet published. Run without
--accept-data-loss to see that cost; nothing is changed until you pass it.

Usage:
  spin workspace recover <workspace> [flags]

Flags:
      --accept-data-loss   go ahead and give up the work the old host had not published
  -h, --help               help for recover

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace release

```
Give back the cores and memory a workspace was granted: it holds what its preset started it
at again, and a running machine is shrunk to it at once. Memory the guest will not let go of is
lent to it instead, and taken back as it frees it.

Usage:
  spin workspace release <workspace> [flags]

Flags:
  -h, --help   help for release

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace reset

```
Put a stopped workspace's disk back to the snapshot it was created from: the image, or
the snapshot it was made from. Everything the workspace has ever written is given up.

Nothing is uploaded and nothing is downloaded - the disk it goes back to is one its host
already has - so this is the cheapest way back there is. The disk it had is kept with its
snapshots, so a snapshot taken before the reset is still a way back to that work.

Usage:
  spin workspace reset <workspace> [flags]

Flags:
  -h, --help               help for reset
      --start              Start the workspace on the disk it was created from and wait until it is running
      --timeout duration   How long --start waits; by default, until the control plane gives up on it
  -y, --yes                Skip confirmation

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace restore

```
Put a stopped workspace's disk back to one of its snapshots. Without a snapshot, the
disk goes back to what the workspace was created from.

Everything the workspace wrote after the snapshot is given up, which is why the workspace has
to be stopped first. The disk it had is kept with its snapshots, so restoring to a snapshot
taken after the one restored undoes the restore.

With --with-memory the snapshot's running processes come back too, from the instant it was
taken, and the workspace may be running: it is put back to that instant.

Usage:
  spin workspace restore <workspace> [snapshot-id] [flags]

Flags:
  -h, --help               help for restore
      --start              Start the workspace on the restored disk and wait until it is running
      --timeout duration   How long --start waits; by default, until the control plane gives up on it
      --with-memory        Resume the snapshot's processes too; the workspace may be running

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace retag

```
Replace the network policies a workspace runs under, while it runs. The host is told
at once, so a change takes effect without a restart.

The tags given are the whole set, not an addition: 'retag ws --network-tag web' leaves the
workspace carrying web and nothing else. Naming none means what it means on a create - the
installation's default. To have a workspace reach nothing, name the policy 'offline', which
every host has.

Taking a policy away closes what it opened, including the connections the workspace already
had: the addresses its lookups opened under the leaving policies are forgotten and its open
connections are dropped, so the next packet of each is judged by the policy as it now is.
Adding a policy closes nothing.

You may choose among the policies the installation declares ('spin workspace policies'). An
administrator may name any policy a host reports.

Usage:
  spin workspace retag <workspace> [flags]

Flags:
  -h, --help                  help for retag
      --network-tag strings   Network policy to run under, by name (repeatable); the whole set, not an addition

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace sign

```
A workspace lets in whoever its access names - you, and the guests you invited - and nobody
else: its host holds every login to it, with each person's own keyring. This signs the next
access with a key of your keyring, on this machine, naming the guests as they are now and
keeping every consent as it was. A workspace you created and never signed lets nobody in
until you do.

Usage:
  spin workspace sign <workspace> [flags]

Flags:
  -h, --help   help for sign

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace start

```
Start a stopped workspace on its disk, or resume a suspended one from the memory it kept.

--from-disk boots a suspended workspace from its disk instead, and drops that memory: its
processes start again as after a power cut. It is what is left when the memory was taken on a
machine no host of this installation runs now ('spin workspace get' says so).

Usage:
  spin workspace start <workspace> [flags]

Flags:
      --from-disk          boot a suspended workspace from its disk, dropping the memory it was suspended with
  -h, --help               help for start
      --timeout duration   How long --wait waits; by default, until the control plane gives up on it
      --wait               Return once the workspace is running

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace status

```
Show what each party believes about a workspace, and where they disagree.

A workspace's state is held by four parties that can disagree: the control plane has a
lifecycle state it set, the supervisor inside the guest reports what it is doing, the host
either heartbeats or does not, and the volume either serves the disk or refuses. "spin workspace get" shows the first of those. This shows all four, and names the
gaps between them - which is usually the answer.

Usage:
  spin workspace status <workspace> [flags]

Flags:
  -h, --help   help for status

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace stop

```
Stop a running workspace. Its disk is kept for the next start.

Use --force to stop its machine without waiting for the guest to shut down: it is also what
ends a stop that did not finish. 'spin workspace get' lists what a workspace can be asked.

Usage:
  spin workspace stop <workspace> [flags]

Flags:
      --force              Stop the machine without waiting for the guest; also ends a stop that did not finish
  -h, --help               help for stop
      --timeout duration   How long --wait waits; by default, until the control plane gives up on it
      --wait               Return once the workspace is stopped

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace suspend

```
Checkpoint a running workspace's memory and disk and stop its machine. Its next start
resumes that instant - the processes go on from where they were, on any host carrying the same
machine, not only the one it was suspended on.

This is what a host being drained does to what it runs. It answers once the memory is stored
and the disk is published, which takes as long as that does; the machine is paused from the
checkpoint on, so it does nothing past that instant and nothing it did is lost.

The checkpoint is a snapshot like any other: 'spin snapshot list' shows it, and deleting it is
what makes the workspace start from its disk instead.

Usage:
  spin workspace suspend <workspace> [flags]

Flags:
  -h, --help   help for suspend

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace undelete

```
Take a workspace out of the trash, stopped, with its disk. It keeps its name unless another
workspace took it meanwhile, in which case the name gets a suffix. Name it by the id
spin workspace deleted shows.

Usage:
  spin workspace undelete <id> [flags]

Flags:
  -h, --help   help for undelete

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace unquarantine

```
Release a quarantined workspace: back to stopped, where it was held from, with its disk
as it was - or, where the stop its quarantine asked for ended failed, failed as it is and no
longer held. The account of what it attempted is kept, and stays to be read (spin workspace
denials).

Usage:
  spin workspace unquarantine <id> [flags]

Flags:
  -h, --help   help for unquarantine
  -y, --yes    Skip confirmation

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace update

```
Update workspace properties such as name and environment variables.

Cores and memory are 'spin workspace grant' and 'spin workspace release', while it runs.

Examples:
  spin workspace update mydev --name newname
  spin workspace update mydev --env KEY=value --env OTHER=val2
  spin workspace update mydev --name newname --env DEBUG=true
  spin workspace update mydev --wake-on-access

Usage:
  spin workspace update <workspace> [flags]

Flags:
      --env strings      Environment variables (KEY=VALUE)
  -h, --help             help for update
      --name string      New workspace name
      --wake-on-access   Resume it, when suspended, for a signed-in visitor of one of its ports (never an anonymous one)

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```

### spin workspace watch

```
Have the workspace's host record where it connects: each name it looks up, each
destination it is first let through to or refused, and what it goes on sending and receiving
there, with the time. It is written to the workspace's logs as the service "network", where the
installation collects logs, and read with them ('spin workspace logs', or the workspace's page).

The watch holds across stops and starts until it is turned off with --off. It says where the
workspace went, never what it sent: no packet is kept.

Usage:
  spin workspace watch <workspace> [flags]

Flags:
  -h, --help   help for watch
      --off    Stop recording where the workspace connects

Global Flags:
      --config string    config file (default is $HOME/.spin/config.yaml)
  -o, --output string    text for a person, or json: one document of what the API answered, and no prose (default "text")
      --profile string   named profile to use; SPIN_PROFILE names it when this flag does not (default "default")
```