A snapshot in 1VMTool is an APFS clone of the machine's disk rather than a copy of it. The filesystem shares the blocks until one side writes, so taking a snapshot copies zero bytes and completes in about a millisecond — on a 24 GiB disk and on a 1 TiB disk alike, because there is no size to scale with.

That changes what snapshots are for. When one costs seconds and gigabytes you ration them, and you skip the one before the risky step. When it costs nothing you stop deciding.

Taking and restoring

1vm snapshot take dev "before upgrade"
1vm snapshot list dev
1vm snapshot restore dev before-upgrade
1vm snapshot rm dev <ref>

A <ref> is a name or an id prefix. snapshot rm takes -r to remove a whole branch rather than one node.

Snapshots branch

Restoring an older state and then taking a new snapshot creates a second line rather than discarding the first. You can explore more than one direction from the same starting point, and the tree view draws the real shape with each node's own unique data — so the branch that is actually consuming disk is visible rather than guessed at.

What gets captured

Situation	Captured
Running on Virtualization.framework	Memory alongside the disk, so restoring resumes mid-execution
Running on the 1VM engine	Disk only — restoring cold-boots
Stopped, either engine	Disk only

Three ways back

These are easy to confuse, so they are worth stating plainly.

snapshot restore goes to a specific snapshot you chose.

discard-session returns to the snapshot this boot started from, throwing away everything written since power-on:

1vm discard-session dev --force

reset returns the machine to its clean state:

1vm reset dev --force

Rollback mode

For a machine that should never accumulate state — a browsing VM, a sandbox, a demo, anything you hand to someone else — turn on rollback mode and it discards every write at power-off automatically:

1vm rollback dev on

Every boot then starts from the safe point with nothing to remember. This is the structural version of the discipline you would otherwise have to keep by hand.

Clones

The same clone primitive gives you cheap copies of a whole machine:

1vm clone dev test            # linked clone, shares blocks until they diverge
1vm clone dev test --full     # an independent copy
1vm clone dev test --rekey-ssh  # regenerate the guest's host keys

Use --rekey-ssh when the clone will run at the same time as its parent — otherwise both machines present the same SSH host key.

Disk usage

1vm du

Reports allocated, on-disk and per-snapshot bytes across the library, which is the honest answer to "how much space is this using" when clones share blocks.