State of transactional-update Research Engineer / SUSE openSUSE Conference 2022 Ignaz Forster [email protected]

State of transactional-update ➢What are Transactional Updates? ➢What’s new? ➢Revamped software stack (C++, library) ➢D-Bus service ➢Cockpit interface for updates ➢dnf integration ➢Q&A

What are Transactional Updates? ● Update your system in the background – Won’t interfere with your currently running system ● Typically used on read-only* systems openSUSE MicroOS ALP

Definition A transactional update is an update that ● is atomic – Either fully applied, or not applied at all – Update does not influence the running system ● can be rolled back – A failed or incompatible update can be quickly discarded to restore the previous system condition

SUSE Tools ● Zypper for package management ● Snapper for snapshot management ● Btrfs as default file system

… Update with transactional-update current / next / 1. 2. Active system 1. snapper creates new target snapshot 2. zypper updates system in snapshot, makes it read-only and sets it as default for next boot ● Current root file system is not modified ● Discard snapshot in case of errors ➔ Reboot activates new system

Interested in more details? ● /etc handling ● /var handling ● bind mounts ● health-checker ● rebootmgr ⇒ Presentation at SUSE Labs Conference 2020

What’s new?

Everything! (But only under the hood.)

New architecture ● transactional-update (1537 line Bash script) ● libtukit.so (generic C++ API for handling transactions) ● tukit (Command line client for API) ● tukitd (D-Bus interface) ● transactional-update (now 1557 lines of *SUSE specific Bash script)

libtukit.so ● Generic library for Transaction management – init(std::string base) ⇒ Initialize – execute(char* argv[]) ⇒ Execute some command – finalize() ⇒ Make snapshot ro and set as new default ● Basic Snapshot management – getList(std::string columns) ⇒ List snapshots – deleteSnap(std::string id) ⇒ Delete given snapshot ● Currently only header file documentation ● C bindings ● Could also support snapshot managers other than Snapper / Btrfs

tukit ● Command line wrapper for libtukit.so – tukit execute ⇒ Wrapper for API functions init, execute, finalize – But also fine grained API control possible tukit open tukit call tukit close

Using the library API (libtukit.so) Application (tukitd, dnf-Plugin) Application tukit (calling zypper from transactional-update)

transactional-update ● Wrapper for all *SUSE specific commands ● Interface stays the same – transactional-update dup will just call tukit call zypper dup in the background ● Not everything migrated yet, e.g. snapshot management (transactional-update cleanup / rollback)

transactional-update Cheat Sheet ● Update installed packages transactional-update up transactional-update up ● Perform a distribution update transactional-update dup transactional-update dup ● Install package(s) transactional-update pkg in transactional-update pkg in ● Update package(s) transactional-update pkg up transactional-update pkg up ● Remove package(s) transactional-update pkg rm transactional-update pkg rm ● Open shell transactional-update shell transactional-update shell ● Request reboot transactional-update reboot transactional-update reboot ● System rollback transactional-update rollback [number] transactional-update rollback [number]

D-Bus interface ● Written in C ● Exposing the API via D-Bus ● Same with /org/opensuse/tukit/Snapshot ● Responses for longer commands are asynchronous D- busctl --system introspect org.opensuse.tukit /org/opensuse/tukit/Transaction org.opensuse.tukit.Transaction

overlay /etc overlay defaults,upperdir=/sysroot/var/lib/overlay/18/etc,lowerdir=/sysroot/var/lib/ overlay/16/etc:/sysroot/var/lib/overlay/12/etc:/sysroot/var/lib/overlay/10/ etc:/sysroot/var/lib/overlay/8/etc:/sysroot/var/lib/overlay/7/etc:/sysroot/ var/lib/overlay/6/etc:/sysroot/etc,workdir=/sysroot/var/lib/overlay/work- etc,x-systemd.requires-mounts-for=/var,x-systemd.requires-mounts-for=/var/ lib/overlay,x-systemd.requires-mounts-for=/sysroot/var,x-systemd.requires- mounts-for=/sysroot/var/lib/overlay,x-initrd.mount 0 0 Simplified /etc overlays (May still contain several lowerdirs when using the --continue option) overlay /etc overlay defaults,upperdir=/sysroot/var/lib/overlay/7/etc,lowerdir=/sysroot/var/lib/ overlay/3/etc:/sysroot/etc,workdir=/sysroot/var/lib/overlay/7/work-etc,x- systemd.requires-mounts-for=/var,x-systemd.requires-mounts-for=/sysroot/var,x- initrd.mount 0 0

Other (older) news ● Added SELinux support, including setup-selinux command ● status command (experimental) to see whether a system is up to date or modified ● Kernel Live-Patching support ● transactional-update --quiet is really quiet now ● stderr output not mangled into stdout

Contact us ● Find us on [email protected] ● openSUSE Bugzilla: Component MicroOS ● SUSE Bugzilla: Component Transactional Update ● GitHub: https://github.com/openSUSE/transactional-up date

https://kubic.opensuse.org IRC: irc://irc.opensuse.org/#kubic