> Fetch the index of every Tonbo docs page as Markdown at https://tonbo.dev/llms.txt

# Rules for Machines

Last updated 2 November 2026

> Machines are not open yet. These pages describe Machines as they will open; until then, a create answers [`region_not_offered`](https://tonbo.dev/docs/machines/troubleshooting/manage.md#region_not_offered) (422), “Machines are not offered in any region yet.”

Check your Machine against these rules before you rely on it: each keeps its data safe, its requests answered or its bill small.

Each rule links to its page, which shows what to write and what not to.

## Keep state

- [Keep what must last in its database or on its Volume](https://tonbo.dev/docs/machines/rules/state.md#database)
- [Reconnect, and read the clock again, after a wake](https://tonbo.dev/docs/machines/rules/state.md#reconnect)
- [Await synced() before you answer](https://tonbo.dev/docs/machines/rules/state.md#synced)
- [Open the database with the settings the Machine gives you](https://tonbo.dev/docs/machines/rules/state.md#open)
- [Handle SIGTERM: sync and exit within the stop grace](https://tonbo.dev/docs/machines/rules/state.md#sigterm)
- [Finish the work before you answer, or keep the request open while it runs](https://tonbo.dev/docs/machines/rules/state.md#finish)

## Requests

- [Listen on 0.0.0.0, at a port you declare](https://tonbo.dev/docs/machines/rules/requests.md#listen)
- [Start listening within seconds](https://tonbo.dev/docs/machines/rules/requests.md#start-fast)
- [Keep a port private unless it must be public](https://tonbo.dev/docs/machines/rules/requests.md#private)
- [Check your own users’ credentials on a public port only](https://tonbo.dev/docs/machines/rules/requests.md#own-users)
- [Call a private port with a personal key or an exchanged token](https://tonbo.dev/docs/machines/rules/requests.md#key)
- [Retry a 503 after its Retry-After](https://tonbo.dev/docs/machines/rules/requests.md#retry)

## Images and changes

- [Name the smallest shape that fits](https://tonbo.dev/docs/machines/rules/images.md#shape)
- [Build the image for linux/arm64](https://tonbo.dev/docs/machines/rules/images.md#arm64)
- [Use a glibc-based image when the Machine opens its database](https://tonbo.dev/docs/machines/rules/images.md#glibc)
- [Name the tag again after you push to it](https://tonbo.dev/docs/machines/rules/images.md#retag)
- [Put the Machine to sleep to apply a change now](https://tonbo.dev/docs/machines/rules/images.md#apply-now)

## Access

- [Put in env only what every member of the account may hold](https://tonbo.dev/docs/machines/rules/access.md#env)
- [Never build a secret into the image](https://tonbo.dev/docs/machines/rules/access.md#image-secrets)
- [Use your own credentials with other services](https://tonbo.dev/docs/machines/rules/access.md#credentials)