Images and your cloud

Pull, build, push and publish images, and the cloud account you link for machines.

CommandDescription
cua imageImages: local OCI pull/build/push.
cua image pullPull an image into the local cache.
cua image buildBuild an image from an images.cua.ai/v1alpha1 Image resource (JSON).
cua image pushCopy an image (host architecture) to another registry reference.
cua imagesThe sandbox image catalog (the images the docs list): which exist, their variants, and which ship cua-spacesd and a browser.
cua images lsList the catalog: ref, OS, container or VM, local runtime, cua-spacesd, browsers, summary.
cua images infoShow one catalog entry (a ref or an alias such as linux).
cua images buildBuild a sandbox image definition (a libs/images directory): the rootfs, the bootable VM disk and the KubeVirt containerDisk.
cua images packPack the disks cua images build --outputs disk wrote as KubeVirt containerDisks <repo>:<tag>-<arch> (push, or load into docker).
cua images publishPublish a built image as immutable pins <series>-<stamp> and <series>-disk-<stamp>, refusing any that exist.
cua images releaseRun an image's release pipeline (its release.json): build, doctor lanes, content digest, save; with --publish push, publish pins and verify; with --promote move the floating tags.
cua images promoteMove a series' moving tags (edge, edge-disk) to the pins a cua images publish record names, after the gates passed.
cua buildBuild an image from a Dockerfile, in a Space, as pinned checkpoints that Spaces fork from in under a second.
cua cloudSpaces in your own cloud account (AWS, Google Cloud, Hetzner, Modal): connect, status, test, disconnect, sweep; and pool hosts there (cua cloud add aws).
cua cloud statusYour clouds: found credentials, the connected account and region, what each runs at what hourly cost, and what Cua created there.
cua cloud connectConnect a cloud account Spaces can be created in (after the checks cua cloud test runs).
cua cloud testCheck a cloud account without creating anything: credentials, permissions (by dry run), quota, the region and machine types.
cua cloud disconnectForget a connected cloud.
cua cloud auditWhat Cua did in your clouds: connects, disconnects, and every resource recorded, created, confirmed and deleted (by you, a sweep, the automatic sweep or disconnect --delete).
cua cloud sweepFind what Cua left in your clouds: expired Spaces and resources whose Space is gone (with --all, every Cua resource).
cua cloud addAdd hosts in your cloud to your pool: computers made for Cua work that join by themselves (cua cloud add aws).
cua cloud add awsEC2 hosts in your connected AWS account (cua cloud connect aws) that join your pool by themselves: Ubuntu 24.04 for CPU types, the AWS Deep Learning Base GPU image for g*/p* types.
cua cloud planWhat the elastic pool would do for some Spaces: where each goes (your devices first, then hosts with room, then new cloud machines at the least cost) and what it costs.
cua cloud hostsThe hosts the elastic pool runs in your clouds: add them by hand (pinned: the scaler never removes them), list or remove them.
cua cloud hosts listThe hosts with their state and cost.
cua cloud hosts addAdd hosts by hand (pinned: never removed by the scaler).
cua cloud hosts removeRemove hosts this home added (their Spaces end).
cua cloud budgetThe elastic pool's budget: a $/hour cap, a monthly cap, the autoscale switch.
cua cloud reconcileRun the elastic pool's scale-in pass now (the daemon runs one every 30 s): idle hosts go at the end of their paid time.

Every command also accepts the global options.

cua image#

Images: local OCI pull/build/push.

cua image [OPTIONS] <COMMAND>

Alias: cua img.

cua image pull#

Pull an image into the local cache.

cua image pull [OPTIONS] <REFERENCE>
ArgumentTypeDefaultDescription
<REFERENCE>stringrequiredImage reference or alias.

Examples

cua image pull linux
cua image pull ghcr.io/trycua/linux:24.04

cua image build#

Build an image from an images.cua.ai/v1alpha1 Image resource (JSON).

cua image build [OPTIONS] --base <BASE> <SPEC>
ArgumentTypeDefaultDescription
<SPEC>pathrequiredImage resource file (JSON).
FlagTypeDefaultDescription
--basestringrequiredBase image (container:<ref>, vm:<ref>, disk:<path>).
--pushstringPush the result to this reference.

Examples

cua image build image.json --base container:ubuntu:24.04
cua image build image.json --base container:ubuntu:24.04 --push ghcr.io/acme/desktop:1

cua image push#

Copy an image (host architecture) to another registry reference.

cua image push [OPTIONS] <REFERENCE> <DESTINATION>
ArgumentTypeDefaultDescription
<REFERENCE>stringrequiredSource image reference or alias.
<DESTINATION>stringrequiredDestination registry reference.

Examples

cua image push linux ghcr.io/acme/desktop:1

cua images#

The sandbox image catalog (the images the docs list): which exist, their variants, and which ship cua-spacesd and a browser.

cua images [OPTIONS] <COMMAND>

cua images ls#

List the catalog: ref, OS, container or VM, local runtime, cua-spacesd, browsers, summary.

cua images ls [OPTIONS]

Alias: cua images list.

FlagTypeDefaultDescription
--osstringOnly this OS: linux, windows or macos.
--allbooleanfalseInclude unpublished entries (benchmark images).
--browserbooleanfalseOnly images with a browser the cua-driver browser tools drive.

Examples

cua images ls
 
# Images whose browser the cua-driver browser tools drive
cua images ls --browser
cua images ls --all --json

cua images info#

Show one catalog entry (a ref or an alias such as linux).

cua images info [OPTIONS] <REFERENCE>
ArgumentTypeDefaultDescription
<REFERENCE>stringrequiredImage ref or alias.

Examples

cua images info linux

cua images build#

Build a sandbox image definition (a libs/images directory): the rootfs, the bootable VM disk and the KubeVirt containerDisk.

Outputs: rootfs <repo>:docker-<tag>-<arch>; disk <out>/<name>/<arch>/disk.img; containerdisk <repo>:<tag>-<arch>. --push pushes the outputs the image.json lists (a VM-only image never pushes its rootfs).

cua images build [OPTIONS] <DIR>
ArgumentTypeDefaultDescription
<DIR>pathrequiredImage definition directory (Dockerfile, image.json).
FlagTypeDefaultDescription
--platformstringPlatforms, comma separated (default: the host's, or the image's only one).
--tagstringlocalTag for the per-arch outputs.
--repostringRepository (default: image.json repository, else cua-e2e-local/<name>).
--outputsstringrootfsOutputs: rootfs, disk, containerdisk (comma separated).
--build-argstringDocker build argument KEY=VALUE (repeatable).
--build-contextstringNamed build context NAME=PATH (repeatable).
--labelstringExtra rootfs label KEY=VALUE (repeatable).
--outpathWhere disks go (default: $CUA_IMAGES_OUT or ~/.cache/cua-images).
--disk-sizestring20GVirtual size of the disk.
--targetstringDockerfile stage to build (a tier: slim, full); disks go to <out>/<name>-<target>/<arch>. Default: the Dockerfile's last stage.
--pushbooleanfalsePush the published outputs.
--dry-runbooleanfalsePrint the steps without running them.

Examples

cua images build libs/images/omarchy --outputs rootfs,disk
cua images build libs/images/omarchy --tag build-1a2b3c4d --outputs containerdisk --push
cua images build libs/images/linux --target slim --tag 24.04-slim-local --outputs rootfs,disk
cua images build libs/images/linux --platform linux/amd64,linux/arm64 --dry-run

cua images pack#

Pack the disks cua images build --outputs disk wrote as KubeVirt containerDisks <repo>:<tag>-<arch> (push, or load into docker).

Packs exactly the disk the doctor checked, so the pushed bytes are the tested ones.

cua images pack [OPTIONS] <DIR>
ArgumentTypeDefaultDescription
<DIR>pathrequiredImage definition directory.
FlagTypeDefaultDescription
--platformstringPlatforms, comma separated (default: the host's, or the image's only one).
--tagstringlocalTag for the per-arch containerDisks.
--repostringRepository (default: image.json repository, else cua-e2e-local/<name>).
--outpathWhere the disks are (default: $CUA_IMAGES_OUT or ~/.cache/cua-images).
--targetstringThe --target the disks were built with (their <name>-<target> dir).
--pushbooleanfalsePush instead of loading into docker.
--dry-runbooleanfalsePrint what would be packed.

Examples

cua images pack libs/images/omarchy --tag ci-1a2b3c4d --push --json

cua images publish#

Publish a built image as immutable pins <series>-<stamp> and <series>-disk-<stamp>, refusing any that exist. Moves nothing.

Reads the per-arch images cua images build --tag TAG --push wrote (<repo>:<tag>-<arch>, and <repo>:docker-<tag>-<arch> when the image has a rootfs output). Writes the record cua images promote takes.

cua images publish [OPTIONS] --tag <TAG> --series <SERIES> <DIR>
ArgumentTypeDefaultDescription
<DIR>pathrequiredImage definition directory.
FlagTypeDefaultDescription
--tagstringrequiredThe build tag the per-arch images were pushed under.
--seriesstringrequiredSeries / channel (edge, 24.04).
--stampstringPin stamp <yyyymmdd>-<sha7> (default: today and git HEAD).
--repostringRepository (default: image.json repository).
--platformstringPlatforms (default: image.json platforms).
--annotationstringExtra index annotation KEY=VALUE (repeatable).
--descriptor-annotationstringAnnotation on one child's descriptor, VARIANT/ARCH:KEY=VALUE (rootfs/amd64:ai.cua.doctor.status=pass; repeatable).
--recordpathWrite the publish record (JSON) here.
--dry-runbooleanfalseResolve and print, push nothing.

Examples

cua images publish libs/images/omarchy --tag build-1a2b3c4d --series edge --record pins.json
cua images publish libs/images/linux --tag build-20260925-1a2b3c4 --series 24.04 --descriptor-annotation rootfs/amd64:ai.cua.doctor.status=pass
cua images publish libs/images/omarchy --tag build-1a2b3c4d --series edge --dry-run

cua images release#

Run an image's release pipeline (its release.json): build, doctor lanes, content digest, save; with --publish push, publish pins and verify; with --promote move the floating tags. The same command runs locally and in CI.

Phases: prepare, build, gate (doctor lanes), stage, push, publish, verify, promote. Push refuses unless every required gate passed (this run, or a state-*.json merged from other jobs in <work>/evidence). Evidence, logs and the summary go to <work>/evidence (a plain directory CI uploads as-is).

cua images release [OPTIONS] <DIR>
ArgumentTypeDefaultDescription
<DIR>pathrequiredImage directory with a release.json.
FlagTypeDefaultDescription
--tierstringTier (slim, full) for images that have tiers.
--archstringArches, comma separated (default: release.json arches). Repeatable.
--stampstringPin stamp <yyyymmdd>-<sha7> (default: today and git HEAD).
--workpathWork directory (default: $CUA_RELEASE_WORK, else under the cua build cache, which cua cache prune manages).
--stepsstringOnly these steps: phase names or step-id prefixes (comma separated). Repeatable.
--fromstringRerun from this phase or step; the steps before it must have passed.
--varstringVariable KEY=VALUE for release.json templates (repeatable).
--assumestringTreat a host capability as present (kvm) or absent (!runsc). Repeatable.
--scopestringThis run's state file name, state-<scope>.json (default: the arches); CI jobs sharing an evidence directory use distinct scopes.
--resumebooleanfalseSkip steps that passed with the same inputs and whose outputs exist.
--dry-runbooleanfalsePrint the plan; run nothing.
--publishbooleanfalseAlso push, publish immutable pins and verify them.
--promotebooleanfalseAlso move the floating tags to the pins.

Examples

# Plan only
cua images release libs/images/linux --tier slim --dry-run
 
# Build and doctor amd64 locally; resume after a failure
cua images release libs/images/linux --tier slim --arch amd64 --resume
 
# Rerun from the doctor lanes (the build must have passed)
cua images release libs/images/linux --tier slim --from gate
 
# One CI job's slice
cua images release libs/images/linux --tier full --arch arm64 --steps build,gate,stage --work release
 
# Publish and promote (the gates must have passed)
cua images release libs/images/omarchy --publish --promote --resume

cua images promote#

Move a series' moving tags (edge, edge-disk) to the pins a cua images publish record names, after the gates passed.

cua images promote [OPTIONS] <RECORD>
ArgumentTypeDefaultDescription
<RECORD>pathrequiredRecord written by cua images publish --record.
FlagTypeDefaultDescription
--dry-runbooleanfalseCheck and print, move nothing.

Examples

cua images promote pins.json
cua images promote pins.json --dry-run

cua build#

Build an image from a Dockerfile, in a Space, as pinned checkpoints that Spaces fork from in under a second. Works in any directory; layers already built are reused.

cua build [OPTIONS] [CONTEXT]
ArgumentTypeDefaultDescription
<CONTEXT>path.The build context: COPY and ADD sources are relative to it, and its .dockerignore applies.
FlagShortTypeDefaultDescription
--file-fstringThe Dockerfile (-: standard input). Default: Dockerfile in the context.
--tag-tstringName the result: build:<tag> is an image for cua spaces create, and cua sb fork finds it.
--build-argstringNAME=VALUE for an ARG (repeatable).
--kindstringvm (default), container or microvm.
--onstringWhere: local (default). A build's layers are checkpoints, which stay on the machine that took them.
--cpusintegervCPUs of the machine (and of Spaces made from the build; default 2).
--memoryintegerMemory in MiB (default 4096).
--step-timeoutstring1hBudget for each step.
--desktopbooleanfalseKeep the desktop (the build's machine is headless by default: only cua-spacesd runs).
--no-cachebooleanfalseBuild every layer again.

Examples

# Build ./Dockerfile with ./ as the context
cua build -t app
 
# Another directory and Dockerfile; build arguments
cua build -f docker/Dockerfile.dev --build-arg PY=3.12 -t app-dev ./services/api
 
# A Dockerfile piped in on stdin, a bigger machine, every layer again
cua build -f - --cpus 4 --memory 8192 --no-cache -t app
 
# Run it
cua spaces create build:app
cua sb fork build-<key> mybox

cua cloud#

Spaces in your own cloud account (AWS, Google Cloud, Hetzner, Modal): connect, status, test, disconnect, sweep; and pool hosts there (cua cloud add aws).

cua cloud [OPTIONS] <COMMAND>

Examples

cua cloud status
cua cloud connect aws --region us-west-2 --default
cua spaces create --on aws
cua cloud add aws --count 2 --type g6.xlarge
cua cloud sweep

cua cloud status#

Your clouds: found credentials, the connected account and region, what each runs at what hourly cost, and what Cua created there.

cua cloud status [OPTIONS] [PROVIDER]

Alias: cua cloud ls.

ArgumentTypeDefaultDescription
<PROVIDER>stringoptionalOnly this cloud (aws, gcp, hetzner, modal).

Examples

cua cloud status
cua cloud status aws --json

cua cloud connect#

Connect a cloud account Spaces can be created in (after the checks cua cloud test runs). AWS, Google Cloud and Modal credentials stay in the cloud's own CLI and Cua stores only the profile, region, project or environment names; Hetzner has no sign-in, so its project API token is saved in the Cua credential store.

cua cloud connect [OPTIONS] <PROVIDER>
ArgumentTypeDefaultDescription
<PROVIDER>stringrequiredaws, gcp, hetzner or modal.
FlagTypeDefaultDescription
--profilestringAWS profile (~/.aws/config) or Modal profile (~/.modal.toml).
--regionstringAWS or Google Cloud region, or Hetzner location (default fsn1).
--zonestringGoogle Cloud zone (default: the region's -a zone).
--projectstringGoogle Cloud project (default: gcloud config get project).
--environmentstringModal environment (default: the profile's).
--ttl-hoursintegerDelete each Space there after this many hours (default 8; 0: never; Modal caps a sandbox at 24; a Hetzner server shuts itself down then and cua cloud sweep --delete removes it).
--token-stdinbooleanfalseHetzner: read the project's Read & Write API token from stdin (otherwise HCLOUD_TOKEN, the saved token or the hcloud CLI's context). It is saved in the Cua credential store once the checks pass.
--defaultbooleanfalseAlso make it the default location (default.on).

Examples

cua cloud connect aws --region us-west-2 --default
cua cloud connect aws --profile sandbox
cua cloud connect gcp --project my-project --region us-central1
cua cloud connect modal --environment spaces
 
# Hetzner: the project's API token on standard input
cua cloud connect hetzner --token-stdin --region fsn1
 
# Spaces there delete themselves after 4 hours (default 8; 0: never)
cua cloud connect aws --ttl-hours 4

cua cloud test#

Check a cloud account without creating anything: credentials, permissions (by dry run), quota, the region and machine types.

cua cloud test [OPTIONS] <PROVIDER>
ArgumentTypeDefaultDescription
<PROVIDER>stringrequiredaws, gcp, hetzner or modal.
FlagTypeDefaultDescription
--profilestringAWS profile (~/.aws/config) or Modal profile (~/.modal.toml).
--regionstringAWS or Google Cloud region, or Hetzner location (default fsn1).
--zonestringGoogle Cloud zone (default: the region's -a zone).
--projectstringGoogle Cloud project (default: gcloud config get project).
--environmentstringModal environment (default: the profile's).
--token-stdinbooleanfalseHetzner: read the project's Read & Write API token from stdin (otherwise HCLOUD_TOKEN, the saved token or the hcloud CLI's context). It is saved in the Cua credential store once the checks pass.

Examples

cua cloud test aws
cua cloud test gcp --project my-project

cua cloud disconnect#

Forget a connected cloud. Refused while Spaces Cua created there still run (they would keep billing unseen); add --delete to delete everything Cua created there first, then disconnect.

cua cloud disconnect [OPTIONS] <PROVIDER>
ArgumentTypeDefaultDescription
<PROVIDER>stringrequiredaws, gcp, hetzner or modal.
FlagTypeDefaultDescription
--deletebooleanfalseDelete everything Cua created there first; disconnect only once the cloud confirms nothing is left.

Examples

cua cloud disconnect aws
 
# delete everything Cua created in the account, then disconnect
cua cloud disconnect aws --delete

cua cloud audit#

What Cua did in your clouds: connects, disconnects, and every resource recorded, created, confirmed and deleted (by you, a sweep, the automatic sweep or disconnect --delete). Newest last. Never shows a secret.

cua cloud audit [OPTIONS]
FlagTypeDefaultDescription
--limitinteger50How many of the newest entries (default 50).

Examples

cua cloud audit
cua cloud audit --limit 200
cua cloud audit --json

cua cloud sweep#

Find what Cua left in your clouds: expired Spaces and resources whose Space is gone (with --all, every Cua resource). Lists them unless --delete. Only resources Cua tagged and recorded are ever touched.

cua cloud sweep [OPTIONS] [PROVIDER]
ArgumentTypeDefaultDescription
<PROVIDER>stringoptionalOnly this cloud.
FlagTypeDefaultDescription
--deletebooleanfalseDelete what it finds (default: list only).
--allbooleanfalseInclude Cua resources that have not expired (every Space there).

Examples

cua cloud sweep
cua cloud sweep aws --delete
cua cloud sweep --all --delete

cua cloud add#

Add hosts in your cloud to your pool: computers made for Cua work that join by themselves (cua cloud add aws).

cua cloud add [OPTIONS] <COMMAND>

Examples

cua cloud add aws --count 2 --type g6.xlarge --ttl-hours 6
cua cloud add aws --list
cua cloud add aws --down

cua cloud add aws#

EC2 hosts in your connected AWS account (cua cloud connect aws) that join your pool by themselves: Ubuntu 24.04 for CPU types, the AWS Deep Learning Base GPU image for g*/p* types. Each one is dedicated (made only for this work: jobs run in its own Space, with its GPU) and powers off (and is terminated) at its TTL.

cua cloud add aws [OPTIONS]
FlagTypeDefaultDescription
--countinteger1How many hosts.
--typestringc7i.largeThe EC2 instance type. GPU types (g*, p*) only when named here.
--regionstringRegion (default: the connected one).
--ttl-hoursintegerHours until each host powers off and is terminated (default: the connection's, 8).
--tagstringAn extra key=value tag on every resource. Repeatable.
--disk-gbintegerRoot disk in GiB (default 60 for CPU types, 100 for GPU types).
--namestringWith --down: only this host (aws-3).
--no-waitbooleanfalseReturn once the instances exist, without waiting for them to join.
--listbooleanfalseThe hosts cua cloud add aws made, their state and whether they joined.
--downbooleanfalseTerminate the hosts cua cloud add aws made (all, or --name) and remove them from your pool.

Examples

cua cloud add aws --count 2 --type c7i.large
cua cloud add aws --count 2 --type g6.xlarge --ttl-hours 6 --tag team=ml
cua cloud add aws --list
cua cloud add aws --down

cua cloud plan#

What the elastic pool would do for some Spaces: where each goes (your devices first, then hosts with room, then new cloud machines at the least cost) and what it costs. Pins are constraints of the same solve. With --apply, adds the machines (then create the Spaces with --on auto).

cua cloud plan [OPTIONS]
FlagTypeDefaultDescription
--countinteger1How many Spaces.
--imagestringImage (default linux).
--kindstringcontainer, vm or microvm.
--cpusintegervCPUs each.
--memory-mbintegerMemory each, MiB.
--callerstringinteractive, batch, compat or persistent_agent.
--duration-secsintegerExpected lifetime, seconds.
--providerstringOnly this cloud.
--regionstringOnly this region.
--instance-typestringOnly this machine type.
--hostsintegerExactly this many new machines.
--max-per-hournumberA $/hour cap for this plan.
--togetherbooleanfalseKeep them on one machine (forks of one checkpoint).
--no-scalebooleanfalseAdd no machines.
--devices-onlybooleanfalseOnly your own devices.
--applybooleanfalseAdd the machines the plan needs.

Examples

cua cloud plan --count 256 --image linux:24.04-slim --caller batch --duration-secs 1800
cua cloud plan --count 20 --provider aws --instance-type c7g.xlarge --json
cua cloud plan --count 64 --no-scale
cua cloud plan --count 32 --apply

cua cloud hosts#

The hosts the elastic pool runs in your clouds: add them by hand (pinned: the scaler never removes them), list or remove them.

cua cloud hosts [OPTIONS] <COMMAND>

cua cloud hosts list#

The hosts with their state and cost.

cua cloud hosts list [OPTIONS]

Alias: cua cloud hosts ls.

Examples

cua cloud hosts ls

cua cloud hosts add#

Add hosts by hand (pinned: never removed by the scaler).

cua cloud hosts add [OPTIONS] --provider <PROVIDER> --type <INSTANCE_TYPE>
FlagTypeDefaultDescription
--providerstringrequiredaws, gcp or hetzner.
--typestringrequiredMachine type (cua cloud plan --json lists the offers).
--regionstringRegion (default: the connection's).
--countinteger1How many.
--ttl-hoursintegerHours until each ends on its own (1 to 168, default 24).

Examples

cua cloud hosts add --provider hetzner --type cax41 --region fsn1
cua cloud hosts add --provider aws --type c7g.xlarge --count 2 --ttl-hours 4

cua cloud hosts remove#

Remove hosts this home added (their Spaces end).

cua cloud hosts remove [OPTIONS] <NAMES>...

Alias: cua cloud hosts rm.

ArgumentTypeDefaultDescription
<NAMES>...stringrequiredTheir names (hetzner-1). Repeatable.

Examples

cua cloud hosts rm hetzner-1
cua cloud hosts rm aws-1 aws-2

cua cloud budget#

The elastic pool's budget: a $/hour cap, a monthly cap, the autoscale switch. Without flags, shows them and what the clouds cost now.

cua cloud budget [OPTIONS]
FlagTypeDefaultDescription
--max-per-hournumberMost USD per hour your clouds may cost at once.
--monthlynumberMost USD per calendar month on elastic hosts.
--autoscalestringon or off: add and remove cloud hosts by itself. Off, you manage machines: --on auto uses only what runs, and --on <cloud> gives each Space a cloud machine of its own.
--max-new-hostsintegerMost hosts one placement adds.
--warmstringon or off: keep an idle host warm when demand predicts a Space soon.
--allow-metalstringon or off: let one small VM Space buy a KVM metal host (dollars an hour). Off, such a request is refused and says so.

Examples

cua cloud budget
cua cloud budget --max-per-hour 2 --monthly 40
cua cloud budget --autoscale off

cua cloud reconcile#

Run the elastic pool's scale-in pass now (the daemon runs one every 30 s): idle hosts go at the end of their paid time.

cua cloud reconcile [OPTIONS]
FlagTypeDefaultDescription
--watchbooleanfalseKeep running a pass every 30 s.

Examples

cua cloud reconcile
cua cloud reconcile --watch

Exit codes#

CodeMeaning
0Success.
1Failure, or cua do reported an error.
2Invalid argument, or an ambiguous sandbox name (qualify it: local:NAME).
3Not found: sandbox, window, skill or image (or an image not published yet).
4Not supported, or not configured (for example no provider credentials).
5No cua-spacesd answered, or a transport failure.
6Unauthenticated or permission denied (by Cua or your cloud account).
7Not enough free disk space (see cua cache).
8No room on the machine: its VMs are at their memory or CPU limit, or it is low on memory.
130Cancelled (Ctrl-C during a create): what it made was removed.