From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 61CB71FF0E0 for ; Thu, 09 Jul 2026 10:21:21 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 2FFB3214F8; Thu, 09 Jul 2026 10:20:49 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783366861; x=1783971661; darn=lists.proxmox.com; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=D8wXCcYH0WCyb1fmTmZrFBW5n0t7RJLUvfvRvQ2BKAo=; b=bOLiDgrhEH1ZKtkYCKW7Kk0u6AcrZiX162Hiuyo5EYxH5yvxXsyyy0qzrnZ2w1st4r w8DCauJWp16Vs2hEJsBc3W47S29bWP62QbeYjv6TTNcf3CTG9gI0Imhv1bXfxnUmXS6j U5AFlwbV5d6XwXXCeUIiSLfzvpdiWx+Anni3SAUEEvveiCZMNF98iLlMJdn5bt3WZTQP fmPQ6gbpLv0kZDh2gD63wYo+5HW/zvkbaGqecVFgkf5kDuZpquikD7fdsprpP1GPm1nS 9kUUU23webRc9KweZI4d9v1Qr+6or2lyR1rRYAokaLUjbmL5oDIbRxTypSiqQc9tcvEr BWnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783366861; x=1783971661; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=D8wXCcYH0WCyb1fmTmZrFBW5n0t7RJLUvfvRvQ2BKAo=; b=pIAcviKvr3Gjb/maWyRrFGZRIK4WWaGIiTDvQJKzKW/XaUQ0DCUSKQaVLG2pWXjQR1 enD64CVGXsg+1muSL9ucrlRZqRtgMSOr5AE9pJRZ81nTBbl2TLlFGGzK/1mMkf+ly41o /i6EgUr4it9rhto5z+3LKUFdCC5l32fXzxmyIBU79PLhJuhHb/OsRX9fgMJZ6bVRHPpO 2SSELWAeNBBQBHOuyUZ/T07onC1ssF461VNXH97l5nZ3mh8Xs/CKhrmckIbfeeqkMsuv J63TViWIWy5xIGMI/pU1JSuZZfQI/TYKepk01U1AnJ9gmCfvscPDsYggvEPi3xIelVSa 4D/A== X-Gm-Message-State: AOJu0Yxlue2EsTOY0blwhYA3tS1kUCPsJkEQA88VVtiAbGfaJQQA5Cs0 ad7WgWIuvpC5V5K8Amj1afyy1fUOvx3NMPVFhelVpZ1UIY8mpNOx1AFrKgFmA0Lt X-Gm-Gg: AfdE7ckGzjpq8cP54iH7d7vTexRWrvg7s0xZNg7e3NsFEdk7z70GJEjCiZ517o86/0b NGnL8ePgYXXg6mHMHjhQ3kQOI6qyt1nJGaSpjNwZa5ZA0+s2Ysp3ogCk7b0F+8MM7DoqhWAIuhm F6jdiT4EJ5rryql1BeTuHRjJd0ixH48XRabaDCaQ36kpoH8eh+cgdzdkrMnmF+UhA9/KKeLZbXI NbDgbRiIrNAk2TgQ7GawnFHcBxrxDBIhn1OfyArhXO7Z3vaJ8MV1dEYLUGT9P5mZ26HnCaMHzct 9ZixZat21tmsJ2RUhIhmZRsvNywiKu7XxuhrJkRF5qeql0tCzZNk0n4MFQnX2eb2a2xBuSowsH0 MVuuO+y8VN93w6fU2tKnkCid6MnMQdYkY5rVLpdGmnf7Cv1OkRDD3Zmq03Ucf3YRn04nUaCsFum YGys5MxeQZf/NFZ0AuF9JmYWAT X-Received: by 2002:a5d:638f:0:b0:475:f0d1:eb6a with SMTP id ffacd0b85a97d-47de6663a50mr1489768f8f.55.1783366861117; Mon, 06 Jul 2026 12:41:01 -0700 (PDT) From: copystring To: pve-devel@lists.proxmox.com subject: SPAM: [RFC PATCH 0/4] lxc: add safe OCI rootfs replacement Date: Mon, 6 Jul 2026 21:40:53 +0200 Message-ID: <20260706194059.280257-1-copystring@gmail.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 4 AWL -0.381 Adjusted score from AWL reputation of From: address DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy FORGED_GMAIL_RCVD 1 'From' gmail.com does not match 'Received' headers FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust RCVD_IN_SBL_CSS 3.558 Received via a relay in Spamhaus SBL-CSS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record X-MailFrom: copystring@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation Message-ID-Hash: XCQUMGTYJS4NCPYWT75HW5YCKM22GCVR X-Message-ID-Hash: XCQUMGTYJS4NCPYWT75HW5YCKM22GCVR X-Mailman-Approved-At: Thu, 09 Jul 2026 10:20:40 +0200 CC: copystring X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This RFC adds an explicit rootfs replacement path for stopped LXC containers created from OCI images. The intent is to support the common "refresh the OCI image" workflow without pretending that data stored inside the old rootfs can be merged safely. The safety model is intentionally conservative: * require an explicit confirmation parameter; * only operate on stopped, non-template, non-HA, unprotected CTs without snapshots or pending config changes; * only replace the active rootfs volume, while preserving mpX mount points; * keep the previous rootfs as an unusedX volume instead of deleting it; * fail if no unusedX slot is available; * never remove the newly allocated rootfs once config writing has started; * do not use overlayfs or path heuristics such as /config or /data detection; * reject shrink-like requests by requiring the target size to be at least the current rootfs size. This means data that only exists on / becomes data on the old unused volume, not on the new active rootfs. Users are expected to keep persistent application data on separate mount points or to have a backup before replacing the rootfs. By default, the endpoint also updates OCI-derived runtime config such as entrypoint, environment, ostype, arch and OCI-generated lxc keys. A caller can set update-oci-config=0 to preserve the existing runtime config and only switch the rootfs. The pve-manager GUI and pve-docs changes are kept as separate repository series, but they are part of the same proposed workflow: the UI exposes the destructive operation behind a confirmation dialog, and the docs describe exactly which data is preserved and which is not. Tested on a disposable PVE 9.2.2 VM: * make -C src check * make -C /root/proxmox-dev/pve-container clean deb * API tests cover 24 rootfs replacement subtests, including confirmation, non-OCI archives, stopped-only and protected/template/HA/snapshot/pending guards, no free unused slot, missing/unmanaged/foreign-owned rootfs, target storage without rootdir content, shrink requests, zero/one/multiple mpX mount point preservation, update-oci-config=0, prepare failures, fork failures and write_config failure handling without deleting the new rootfs. copystring (4): lxc: create: add isolated OCI rootfs preparation api: lxc: add OCI rootfs replacement endpoint pct: add OCI rootfs replacement command test: cover OCI rootfs replacement API transaction src/PVE/API2/LXC.pm | 300 ++++++++++++++ src/PVE/CLI/pct.pm | 8 + src/PVE/LXC/Create.pm | 95 +++++ src/test/Makefile | 4 +- src/test/api-oci-rootfs-replace-test.pm | 486 +++++++++++++++++++++++ src/test/oci-rootfs-replace-test.pm | 250 ++++++++++++ src/test/run_oci_rootfs_replace_tests.pl | 10 + 7 files changed, 1152 insertions(+), 1 deletion(-) create mode 100644 src/test/api-oci-rootfs-replace-test.pm create mode 100644 src/test/oci-rootfs-replace-test.pm create mode 100644 src/test/run_oci_rootfs_replace_tests.pl -- 2.55.0.windows.2