# Cloud Security and Troubleshooting

This page explains how cmux Cloud keeps your machines private and lists common errors with their fixes.

## Security model

-   Machines have no public inbound ports. Only your signed-in Macs reach them, over WireGuard keys that stay on each Mac.
-   Signing out or revoking a Mac removes all of its network access and sessions.
-   No cmux account token or control credential is stored on a machine. Model credentials are added outside the machine.
-   Environment variables and secret files travel over the encrypted cmux link and are not echoed.
-   File uploads use single-use keys that expire after 15 minutes and a pinned host key. File data does not go through the cmux API.
-   All agents on a machine run as the same Linux user. Use separate machines to separate work that must not share files.
-   While you are signed in, cmux Cloud sends connection timing and error codes. Terminal content and credentials are never sent.
-   Administrators can turn off Cloud Machines or file transfer with managed policies.

## Common problems

| Problem | Fix |
| --- | --- |
| No Cloud tab or New Cloud Machine command | Turn on Settings › Beta Features › Cloud Machines. If Cloud still does not show, check whether your administrator disabled Cloud Machines. |
| Cloud Machines are disabled or unavailable | Cloud Machines are off because the local Settings toggle is off or your administrator disabled Cloud. Turn on the toggle, or ask your administrator to allow Cloud. |
| Cloud VM access requires sign-in | Run cmux auth login, then try again. If your session was rejected, run cmux auth logout first. |
| Cloud VMs require a paid plan | Free accounts cannot create machines. Upgrade on the pricing page. |
| A size needs a larger plan | Machines larger than 16 GB need cmux Max. Choose a smaller size or upgrade. |
| Active machine limit reached | Pause or delete a machine, then try again. |
| Not enough Cloud VM resources | Your active machines already use the shared vCPUs or memory. Pause or delete a machine, choose a smaller size, or upgrade to Max. |
| Machine is locked | Your paid plan ended and the machine is older than 7 days. Upgrade to reconnect. Your files are kept. |
| claude or codex: command not found | The machine is still setting up. Wait a moment, or read /tmp/cmux/provision.log. |
| cmux vm exec times out | exec is for short commands. Use cmux vm run, cmux vm agent, or a workspace terminal. |
| The first command is slow | The machine was paused. Run cmux vm wait with --wake before your script. |
| Checkpoint or fork is refused | The machine's provider does not support that operation. |
| cmux vm ssh fails | This is expected for most machines. Use cmux vm shell, cmux vm exec, or cmux vm open. |
| Upload is too large | Uploads are limited to 256 MB. Clone the repository inside the machine. |
| .git is missing after an upload | Uploads skip .git by default. Add --no-default-excludes. |
| Cloud session disconnected | Click Reconnect. Your terminal is still running on the machine. |
| Domain verification is pending | DNS changes can take time. Run cmux cloud domains verify again. |
| A visitor cannot open a published URL | Check the access mode with cmux cloud domains access, or grant the visitor's email. |
| File transfer is disabled by your organization | A managed policy turns off file transfer. Ask your administrator. |

## Get help

If a create fails, use Copy Error in the notification and include it, with the trace ID if there is one, when you contact support.

Canonical: https://cmux.com/docs/cloud/troubleshooting

Documentation index: https://cmux.com/llms.txt