> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xpander.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# File storage

> Where agent workspaces, uploads and generated files live on each deployment, what S3 is used for, and what to size.

| Files                                                                      | Where they live                                                                                                                                   | Notes                                                                                                                                                |
| -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| Agent workspaces (the working tree of a session: code, downloads, outputs) | Fleet volumes on your cluster's XFS StorageClass with `prjquota`; about 5 GiB per agent that uses a workspace                                     | Persist across runs with quotas and cleanup; `fleet.storage.className`, `fleet.storage.createClass`                                                  |
| Uploads, attachments, generated files and live-surface assets              | Object storage: xpander's asset store on the cloud; Supabase Storage on Hybrid and Air-Gapped, on an in-cluster volume or on an S3 bucket you own | On-prem installs sign Storage URLs instead of using xpander's CDN. Size the in-cluster volume at 50 GiB and up on Air-Gapped, or point Storage at S3 |
| Files in your own S3 buckets that agents read or write as work             | Your AWS account, through the Amazon S3 skill                                                                                                     | Served by the AWS Operator with per-skill IAM roles; see [AWS Operator](/self-hosted/aws-operator)                                                   |

## Workspace volumes

The executor fleet is a warm pool of executor pods; an agent is a directory on a fleet volume, and every turn runs in its own sandbox against that directory. The fleet needs a StorageClass that mounts XFS with project quotas; `fleet.storage.createClass: true` creates one, or name an existing one in `fleet.storage.className`. Without it the fleet refuses to start rather than run unbounded. Sizing and the idle guard are on [Sizing and requirements](/self-hosted/sizing).

The **Computer view** in Xpander Chat is the workspace as a file browser; credential stores such as `.aws`, `.ssh` and `.kube` never appear in it. See [Agent workspace](/use/agents/conversations#results-and-the-files-an-agent-produces).

## Object storage

Baseline volumes on a self-hosted install are 48 GiB for the chart's stores plus 5 GiB per workspace-using agent. Object storage is Supabase Storage. By default it keeps its objects on an in-cluster volume. On AWS it can instead keep them in an S3 bucket you own. Authentication uses the pod's own identity, IRSA or EKS Pod Identity, so no key is stored in the chart:

```yaml theme={"dark"}
supabase:
  storage:
    backend: s3
    s3:
      bucket: <bucket name>
      region: <bucket region>
    serviceAccountName: storage-api     # annotated with the role that may read and write the bucket
    publicUrl: https://<supabase host>   # leave credentialsSecret empty: the role is the credential
```

The bucket needs versioning off and public access blocked; the role needs get, put, delete and list on that bucket alone. On an air-gapped sealed VPC the S3 gateway endpoint is required in either case, for ECR image pulls.

## S3 as a skill

Agents reach your buckets through the **Amazon S3** skill, one of the AWS skills served by the AWS Operator in your cluster. Calls are signed with a per-skill IAM role assumed by the operator, so no bucket credential is ever handed to an agent. The role design is on [IAM best practices](/self-hosted/iam-best-practices); the skill's actions are on [Amazon S3](/connectors/amazon-s3).