FAQ

What Marolum is

Does Marolum need write access to my state bucket? No. It sends ListObjectsV2 and GetObject and nothing else. There is no configuration that makes it write, and its own tests confirm overwrite and delete attempts are refused under its grant. Connect a backend

Can Marolum run, approve, or block a deployment? No. It is a record, and records do not have veto power. It never runs pulumi, never edits state, and never sits in a pipeline's critical path: a runner reports to it beside the deployment, and Marolum being down never changes an exit code. Runner integration

Does it work with Pulumi Cloud? No. Marolum observes self-managed state. Its adapters cover Pulumi DIY, Terraform and OpenTofu on S3/S3-compatible storage, Google Cloud Storage, Azure Blob, Linux filesystem and PostgreSQL state backends. Live GCS/Azure qualification remains outstanding. Filesystem and PostgreSQL sources use protected operator configuration; cloud sources can also be added in the console. Backend configuration and engine limits

Does it support Terraform or OpenTofu? Within stated bounds. State observation is verified against Terraform 1.15.9 and OpenTofu 1.12.6; other builds are unverified. Terraform and OpenTofu can write native S3 lock files when locking is enabled, but Marolum does not currently observe them. Backend-native update history remains unavailable for those engines, so lock and update-history observation are Pulumi-only and these backends answer engine-unsupported for both rather than showing empty results. Connect a backend

Can it tell me who ran a deployment? No. Pulumi DIY state carries no actor, and Marolum does not invent one. Runner evidence carries the token's authority kind and name: credential provenance, not a person. Known limitations

Does it decrypt Pulumi secrets? No. Pulumi-marked secrets are redacted before they reach a browser model. Unmarked plaintext in an output is shown as Pulumi stored it, so treat the database as sensitive. Security and privacy

Setting up

How long does the first setup take? About fifteen minutes on a laptop with the Quickstart; an afternoon for a cloud deployment by hand; less with the Pulumi programs.

Why does the container run as UID 1000, and why do the docs keep saying chown? The process runs as the node user (ID 1000) and reads its secret files by numeric ID. On a Linux host a file you create as another user is unreadable inside the container until you chown 1000:1000 it. Docker Desktop on macOS and Windows maps ownership for you. Deployment and setup

Why won't it read my Kubernetes Secret or a projected file? Projected volumes materialize files as symlinks, and the file rules reject symlinks. Write the files into an emptyDir from an init container instead. Set up on Kubernetes

Can I put /data on EFS, NFS, or Azure Files? No. SQLite runs in WAL mode, which needs host-local locking. Use a block volume, or PostgreSQL. Deployment and setup

Can I run two replicas for high availability? On SQLite, no: the second refuses with ownership-conflict. On PostgreSQL with an Enterprise license, yes, up to a declared ceiling. PostgreSQL operations

Do I need PostgreSQL? Only if your compute cannot keep an exclusive block volume (Fargate, Container Apps), you need replicas, or you have measured SQLite past its envelope. SQLite is complete and supported. PostgreSQL operations

Which layout is my bucket? List .pulumi/stacks/ under your prefix: directories mean project-scoped, files directly there mean legacy. Marolum never guesses. Find your backend details

Does pulling the image need a registry login? No. Published images are pulled anonymously from Docker Hub. Check the exact version's availability record: tester.json labels an evaluation candidate; supported.json labels supported-release availability. A tester is not a supported commercial release, and a working billing account does not establish image availability. Upgrades and versioning

Using the console

I signed in and it bounced me back to the sign-in screen. The browser dropped the Secure session cookie because the page is plain HTTP. On a laptop over http://127.0.0.1, set MAROLUM_ALLOW_HTTP=true; anywhere else, put TLS in front and leave it unset. Troubleshooting

The diagnostic says Reachable but Stacks is empty. The check reached the namespace; it did not establish that state parsed successfully. Check for an empty namespace, the wrong layout or prefix, and observation failures. Backend problems

Why are there two rows for one deployment? One row is the runner's report and the other is Pulumi's backend record, each labelled by its source. When the exact retained Marolum marker matches, Marolum records that they describe the same run; both rows stay listed, and a runner row that never finalized shows the backend's outcome marked adopted from correlated record. Without that marker, or if backend history was pruned before observation, no join is recorded. A preview remains runner-only. Reading the operation timeline

What does "Before coverage began" mean? You are looking at a window earlier than Marolum's first observation of that stack. That interval is unknowable; history the backend pruned before then is gone. Coverage and gaps

Can I filter Operations by evidence source? There is no source-kind filter in this build. Read each operation's evidence label; the available filters cover outcome, scope and time. Known limitations

Why does a failed operation show resource changes? Outcome and impact are separate facts. A failed update can have deleted things before it failed; a successful one can have changed nothing. Two questions every row answers

Can a viewer see everything? Every observation and operation, yes; no administration. Business stack read scopes narrow retained history per user, but live observation pages stay installation-wide. Users and permissions

Why can't the administrator read a transcript? Transcript bodies need the distinct transcript-reader role, on purpose. Assign it to a separate account. Roles and permissions

Data and retention

How far back does history go? As far back as the backend still held update history when Marolum first observed the stack, and forward from there forever (within retention). Nothing pruned earlier is reconstructed.

I purged a lot of evidence but the disk did not shrink. Deletion frees bytes inside the SQLite file; the file only shrinks after an offline VACUUM. Compacting

If I remove a backend and add it back, is the old history gone? No. Re-adding the same configured id preserves its identity and retention fences. Choosing a new id starts separate history, changes token matching, and can read retained source records again with a fresh retention clock. Never reuse an id for different state; disable it when pausing observation. Changing your backends safely

Does a backup include everything? The database holds every account, token digest, observation, and audit row. It does not hold the transcript or state encryption keys; back those up separately or the bodies stay ciphertext. Backup and disaster recovery

Can I roll back an upgrade? Only by restoring the pre-upgrade backup. An older image refuses a newer schema and touches nothing. Upgrades and versioning

Does deleting evidence in Marolum delete anything from my bucket? Never. Retention governs Marolum's copy only.

Runners and CI

Do I have to use marolum exec? No. A backend-only installation retains complete operation history. Runner integration adds previews, in progress/cancelled/incomplete outcomes, and planned-versus-actual comparison. The HTTP contract is public if you prefer your own client. Runner integration

What happens to my deployment if Marolum is down? Nothing. The command runs unchanged, the exit code is its own, and the wrapper prints one warning. Undelivered evidence is lost; the backend observer still records the applying run.

Why does the runner get 404 for a stack I can see? The token's scope does not cover it. Out-of-scope and nonexistent stacks look identical to a token by design. Troubleshooting

Editions and licensing

What do I get without a license? Community: backend observation, the full operation timeline and resource history, up to 1 year of operation and resource history, local accounts with three fixed roles, integration tokens, export. No trial clock, no data truncation. Introduction

What happens when a license lapses? Nothing is deleted and no effective policy changes. Paid-only acts stop (placing a new hold, starting a new PostgreSQL adoption, assigning a custom role), while everything already in place stays. On Enterprise replicas, standbys stop serving and the primary continues. Edition downgrade

Can one license cover two installations? Not with Business or Enterprise: each subscription includes one installation, and additional installations are not currently offered. Replicas that share one Marolum database count as one installation. To move a license to a new installation, release it from the old one first. Enterprise Advanced Security’s offline site license is organization-wide. Decommissioning

Account and billing

Where do I buy a subscription or enter a discount code? Choose an edition and billing interval on Pricing. Sign in when required, review the selection and accept the license agreement on the next page, then continue to Stripe Checkout. Enter an eligible promotion code there and check the final total before completing the purchase. Codes can have product, customer, expiration and redemption limits.

Can I view my license key again? Yes. Sign into Account and select View license key for your active license. You can copy, download or hide it. Viewing returns the same key; it does not rotate it. Keep it secure: anyone with it can attempt activation. Do not put it in screenshots, public issues or support chat. The first collection uses Collect license key after the subscription is reconciled.

Why does my older key require replacement? Older keys were stored only as hashes and cannot be recovered. Account explains when an explicit replacement is required to enable future viewing. Replacement revokes the old key: update the key in your Marolum installation so future renewals can succeed. Existing signed leases retain their normal validity and grace. Do not replace a key merely to view one that is already retrievable.

How do I get invoices, update payment details or cancel renewal? Open Manage billing from Account. Stripe hosts those controls and returns you to Dekglas. Cancellation takes effect at the end of the current billing period. Plan changes are not currently available in the billing portal.

Is my Dekglas account the same as my self-hosted Marolum login? No. The Dekglas account manages your subscription and license. Your self-hosted installation has its own accounts and activation controls. For a forgotten Dekglas password, use the managed sign-in service's recovery flow. Account recovery is a separate support-reviewed process for replacing a lost billing identity, including explicit consent to revoke existing keys.

Advanced Security is sales-led and quoted by deployment size, with a lower starting price for small offline deployments and higher quotes for larger customers; see Pricing. Its organization-wide offline document has no online activation counter; the starting price is not a flat-price unlimited commercial offer. Choose standard Enterprise when connected licensing meets your needs.