Files & Locations

Where Levee installs its programs, keeps policy, configuration, audit, logs, images, tools, and plugins, and who can access each location

Levee keeps its programs in one place and its data in another. Programs live under Program Files, where only administrators can change them. Policy, the audit log, logs, and container data live under ProgramData. Each user's files stay in their own profile.

This page lists every file and folder you are likely to need: for deployment packaging, antivirus exclusions, backup, SIEM forwarding, audits, and support cases.

%ProgramFiles% is normally C:\Program Files. %ProgramData% is normally C:\ProgramData. %LOCALAPPDATA% is the signed-in user's C:\Users\<user>\AppData\Local.

Where is the audit trail?

The audit trail is two files in %ProgramData%\Vediram\Levee\. Only the Levee service can write them. Standard users can read them.

Standard users can read these files but are denied write, modify, and delete; Administrators can read and delete. See Activity and audit and the Audit event reference.

Where are users' files?

Each user's projects are ordinary folders in their own profile, by default %USERPROFILE%\LeveeProjects\. Levee never moves them, and uninstalling Levee leaves them in place. See Per-user files.

Reference

Programs

Programs installed under Program Files can be changed only by administrators. Levee versions before 0.59.0 installed them under %ProgramData%\Vediram\Levee\; an upgrade moves them.

Levee uses its own container engine and does not use or modify Docker Desktop or any other container runtime on the machine.

Windows services and driver

The Levee MSI installs LeveeFSHost and the LeveeFs driver, and removes them when Levee is uninstalled.

Machine configuration and state

All under %ProgramData%\Vediram\Levee\. The folder itself is writable only by SYSTEM and Administrators; standard users can read it.

Logs

Log files are compressed JSON lines (.jsonl, .jsonl.gz). Read them with levee log tail rather than opening them directly. Each user can read their own logs and those of the projects they own; Administrators can read everything. See Logging.

Per-user files

Inside each project folder

Remembered approvals and file grants are kept by the service in approvals\ and grants\ (see above), not in the project folder, so editing the project folder cannot grant access.

Inside the sandbox

Standard environment variables set in the sandbox: HTTP_PROXY, HTTPS_PROXY, NO_PROXY, SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, ANTHROPIC_BASE_URL, OPENAI_BASE_URL, and LEVEE_PROJECT_ID. The model API key variables hold placeholder values that only work through Levee. Administrators can add variables with the container.environmentVariables policy setting, but can't override the certificate variables.

Antivirus and EDR exclusions

Exclude the container engine's data folder from real-time scanning. Scanning it makes image loading and sandbox start very slow and can cause timeouts.

%ProgramData%\Vediram\Levee\engine\data

Keep scanning the project folders: they hold the files the agent creates, and scanning them does not affect Levee.

With Microsoft Defender:

Add-MpPreference -ExclusionPath "$env:ProgramData\Vediram\Levee\engine\data"

What uninstalling removes

Uninstalling Levee removes the programs, the Start menu shortcut, the LeveeService, LeveeContainerEngine and LeveeFSHost services, and the LeveeFs driver. It leaves your data in place: policy.json, config.json, tenant-config.json, the audit trail, logs, images, tools, plugins, and all project folders. This keeps the audit evidence and lets a reinstall pick up where it left off. See Updates and uninstall to remove everything.

Related

• Logging
• Collecting logs for support