State of transactional-update (oSC 2022)

transactional-update is the openSUSE way of a Transactional Operating System update and a core component of openSUSE MicroOS / Kubic and SLE Micro, making sure updates can be applied safely without affecting the currently running system. It's also supposed to play an important component in the future ALP.

At lot of things have changed internally since the last talk at oSC19: The core functionality has been rewritten in C++ (formerly Bash), including a C++ and C API and a D-Bus interface. From a user's perspective the transactional-update command line interface still looks the same, but we now have Cockpit and dnf integration.

This talk will

- give a short overview of transactional-update for those new to the concept.
- introduce tukit, the command line interface for the API functionality.
- present the new Cockpit interface for transactional-update.
- present the dnf integration.
- give an overview over other changes (SELinux support, Kernel Live Patching).
- and we should also have some minutes left for questions and discussions.

Transcript

1. State of transactional-update Research Engineer / SUSE openSUSE Conference 2022 Ignaz Forster iforster@suse.com
2. State of transactional-update ➢What are Transactional Updates? ➢What’s new? ➢Revamped software stack (C++, library) ➢D-Bus service ➢Cockpit interface for updates ➢dnf integration ➢Q&A
3. What are Transactional Updates? • Update your system in the background – Won’t interfere with your currently running system • Typically used on read-only* systems openSUSE MicroOS ALP
4. Definition A transactional update is an update that • is atomic – Either fully applied, or not applied at all – Update does not influence the running system • can be rolled back – A failed or incompatible update can be quickly discarded to restore the previous system condition
5. SUSE Tools • Zypper for package management • Snapper for snapshot management • Btrfs as default file system
6. … Update with transactional-update current / next / 1. 2. Active system 1. snapper creates new target snapshot 2. zypper updates system in snapshot, makes it read-only and sets it as default for next boot • Current root file system is not modified • Discard snapshot in case of errors ➔ Reboot activates new system
7. Interested in more details? • /etc handling • /var handling • bind mounts • health-checker • rebootmgr ⇒ Presentation at SUSE Labs Conference 2020
8. What’s new?
9. Everything! (But only under the hood.)
10. New architecture • transactional-update (1537 line Bash script) • libtukit.so (generic C++ API for handling transactions) • tukit (Command line client for API) • tukitd (D-Bus interface) • transactional-update (now 1557 lines of *SUSE specific Bash script)
11. libtukit.so • Generic library for Transaction management – init(std::string base) ⇒ Initialize – execute(char* argv[]) ⇒ Execute some command – finalize() ⇒ Make snapshot ro and set as new default • Basic Snapshot management – getList(std::string columns) ⇒ List snapshots – deleteSnap(std::string id) ⇒ Delete given snapshot • Currently only header file documentation • C bindings • Could also support snapshot managers other than Snapper / Btrfs
12. tukit • Command line wrapper for libtukit.so – tukit execute <command> ⇒ Wrapper for API functions init, execute, finalize – But also fine grained API control possible tukit open tukit call <id> <command> tukit close <id>
13. Using the library API (libtukit.so) Application (tukitd, dnf-Plugin) Application tukit (calling zypper from transactional-update)
14. transactional-update • Wrapper for all *SUSE specific commands • Interface stays the same – transactional-update dup will just call tukit call zypper dup in the background • Not everything migrated yet, e.g. snapshot management (transactional-update cleanup / rollback)
15. transactional-update Cheat Sheet • Update installed packages transactional-update up transactional-update up • Perform a distribution update transactional-update dup transactional-update dup • Install package(s) transactional-update pkg in <name> transactional-update pkg in <name> • Update package(s) transactional-update pkg up <name> transactional-update pkg up <name> • Remove package(s) transactional-update pkg rm <name> transactional-update pkg rm <name> • Open shell transactional-update shell transactional-update shell • Request reboot transactional-update reboot transactional-update reboot • System rollback transactional-update rollback [number] transactional-update rollback [number]
16. D-Bus interface • Written in C • Exposing the API via D-Bus • Same with /org/opensuse/tukit/Snapshot • Responses for longer commands are asynchronous D- busctl --system introspect org.opensuse.tukit /org/opensuse/tukit/Transaction org.opensuse.tukit.Transaction
17. overlay /etc overlay defaults,upperdir=/sysroot/var/lib/overlay/18/etc,lowerdir=/sysroot/var/lib/ overlay/16/etc:/sysroot/var/lib/overlay/12/etc:/sysroot/var/lib/overlay/10/ etc:/sysroot/var/lib/overlay/8/etc:/sysroot/var/lib/overlay/7/etc:/sysroot/ var/lib/overlay/6/etc:/sysroot/etc,workdir=/sysroot/var/lib/overlay/work- etc,x-systemd.requires-mounts-for=/var,x-systemd.requires-mounts-for=/var/ lib/overlay,x-systemd.requires-mounts-for=/sysroot/var,x-systemd.requires- mounts-for=/sysroot/var/lib/overlay,x-initrd.mount 0 0 Simplified /etc overlays (May still contain several lowerdirs when using the --continue option) overlay /etc overlay defaults,upperdir=/sysroot/var/lib/overlay/7/etc,lowerdir=/sysroot/var/lib/ overlay/3/etc:/sysroot/etc,workdir=/sysroot/var/lib/overlay/7/work-etc,x- systemd.requires-mounts-for=/var,x-systemd.requires-mounts-for=/sysroot/var,x- initrd.mount 0 0
18. Other (older) news • Added SELinux support, including setup-selinux command • status command (experimental) to see whether a system is up to date or modified • Kernel Live-Patching support • transactional-update --quiet is really quiet now • stderr output not mangled into stdout
19. Contact us • Find us on kubic@lists.opensuse.org • openSUSE Bugzilla: Component MicroOS • SUSE Bugzilla: Component Transactional Update • GitHub: https://github.com/openSUSE/transactional-up date
20. https://kubic.opensuse.org IRC: irc://irc.opensuse.org/#kubic