Mount a governed folder

tp volume create acme/support-transcripts -d "Tier-2 tickets, redacted"
tp volume push ./transcripts --name acme/support-transcripts
tp submit my-sft --profile h200:8 --volume acme/support-transcripts

The job reads the files at $VOLUMES_DIR/support-transcripts, read-only. Nobody can download them unless the owner turns that on.

A Volume is not a dataset

	Volume	Dataset
Versions	None. Its current contents are its contents	Immutable versions
Reference	`<owner>/<name>`	`<owner>/<name>[@version]`
Changes	Files added and removed in place	A new version each time
Use it for	Internal documents, reference PDFs, material that keeps growing	Training data a finished run has to be able to name
Download	Off until the owner turns it on	Available to anyone who can reference it

A version suffix on a volume reference is refused when the spec is parsed. So is a malformed id, and two volumes whose leaf names would collide at the same mount path.

Create and fill one

tp volume create acme/support-transcripts -d "Tier-2 tickets, redacted"
tp volume create acme/refs --public                    # any signed-in user may reference it
tp volume push ./transcripts --name acme/support-transcripts
tp volume ls

tp volume push uploads everything under the directory, minus OS and Office noise. Raise --concurrency on a fast link. Removing files, or the whole volume:

tp volume rm acme/support-transcripts -p old/2024 -p drafts
tp volume rm acme/support-transcripts --yes

Reference it from a job

Declare it in the experiment config, which is the durable form:

data:
  volumes:
    - acme/support-transcripts
    - bob/reference-pdfs

Or override for one submission:

tp submit my-sft --profile h200:8 \
  --volume acme/support-transcripts --volume bob/reference-pdfs

Each one appears at $VOLUMES_DIR/<leaf name>. Read the path from the environment; never hard-code it.

import os, pathlib

root = pathlib.Path(os.environ["VOLUMES_DIR"]) / "support-transcripts"
for path in root.rglob("*.txt"):
    ...

A job that cannot see a referenced volume is refused at submission. That is deliberate: an empty directory would make a permission problem look like a modelling problem.

Which backends can mount one

Fleet kind	Mounts a volume	How
`local`	Yes	A bind mount
`node`	Yes	One filesystem at the same path on every node
`kuberay`	Only with `TUNEPLANE_K8S_VOLUME_PVC`	A read-only claim at `/volumes`
`slurm`	No	The platform does not control the image’s bind list

On a backend that cannot, submission is refused naming the setting, rather than starting a job whose mount would be empty.

Turn one file into something people can read

Two permissions, both the owner’s, both off by default:

Permission	What it allows
`allow_download`	Fetching the bytes back out. The only way material leaves by design
`allow_preview`	The console rendering one file at a time, inline. Every read is audited

They are independent. Listing the structure — file names, sizes — is always available to anyone who can reference the volume; content is not.

Produce a dataset from a volume

Reading a volume and publishing the result is a Processing Run: your code, on the platform, with provenance.

tp submit my-prep --profile h200:1 \
  --volume acme/support-transcripts \
  --output-dataset acme/support-sft@v1

The job writes into $TUNEPLANE_DATASET_OUT_DIR and the platform publishes when the run succeeds. The job never holds a registry credential, and the published dataset inherits the classification of the material it read. This is also how you clean a volume: read, treat, publish. The platform never rewrites what you uploaded.

Check it worked

tp volume ls shows the volume with its file count. In a running job:

ls -la "$VOLUMES_DIR"

The mount is read-only, so a write there fails — that is the mount working, not a bug.

What a Volume does not protect against

If your code can read the plaintext, no storage control stops exfiltration. A script that can open a PDF can base64 it into its own stdout.What a Volume does enforce: no download route while allow_download is off, no preview route while allow_preview is off, one audited read per file when it is on, a read-only mount, an audited reference, and no bulk log download. Every way out is a decision somebody made and a record somebody can find.Keeping material off the cluster entirely is the deployment’s egress policy, not this feature.

Datasets · Submitting a job · The Data page

Get started

Core concepts

Train a model

Evaluate and serve

Agent environments

Extend the platform

Collaborate

Integrations

Reference

Help

Mount a governed folder

A Volume is not a dataset

Create and fill one

Reference it from a job

Which backends can mount one

Turn one file into something people can read

Produce a dataset from a volume

Check it worked

Next

​A Volume is not a dataset

​Create and fill one

​Reference it from a job

​Which backends can mount one

​Turn one file into something people can read

​Produce a dataset from a volume

​Check it worked

​Next

A Volume is not a dataset

Create and fill one

Reference it from a job

Which backends can mount one

Turn one file into something people can read

Produce a dataset from a volume

Check it worked

Next