Re: How is OSTree designed to be safe from power loss damage?

[Colin Walters <walters verbum org>]

On Mon, Jan 9, 2017, at 07:37 AM, Leon Woestenberg wrote:

I would like to make OSTree a first class citizen in upstream Yocto/OpenEmbedded, a lot has been done already by Leon Anavi and Anton Gerasimov in meta-updater.
(https://github.com/advancedtelematic/meta-updater)

Awesome, happy to help with anything I can here.

The question was not so much about the atomic swap, but more about what happens if the system was power-cycled or reset in the middle of pulling objects from a remote, or in the middle of deploying an OS?

In other words, what happens if I reset the device halfway creating the hardlinks, on the next boot cycle?

Okay, so there are two phases here.  Downloading into the repo, and creating deployments.

For downloads, the latest on this is:

https://github.com/ostreedev/ostree/commit/27a45e2edbd1c4551b801a957cafcb27b3417fd3

Specifically:

https://github.com/ostreedev/ostree/commit/27a45e2edbd1c4551b801a957cafcb27b3417fd3#diff-23d4c8887c7dda91613c9451bf3fe7c0R1281

Basically, pending objects (files) are staged in a directory per kernel "boot id", which is

unique per boot.  Hence, if the power is lost any pending objects will be discarded (

we currently do a time-based pruning of the tmpdir).

This is a bit conservative obviously - we could *try* resuming from them and if the checksum doesn't match, redownload, but so far it hasn't gone up in priority.

For deployments, it's a lot simpler - we're just making a hardlink farm and copying

forward changes in /etc.  If the system crashes before, on the next upgrade attempt,

we'll just garbage collect the pending hardlink farm and redo it.