From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id A912D1FF0E0 for ; Thu, 09 Jul 2026 10:21:54 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 913322158F; Thu, 09 Jul 2026 10:20:50 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783366854; x=1783971654; darn=lists.proxmox.com; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=D8wXCcYH0WCyb1fmTmZrFBW5n0t7RJLUvfvRvQ2BKAo=; b=j0p1gA6s9+g0LFqh2QSWWb7iNpSudgJm6384r2tJgg+Id3YY8xc2szcILECXDPMlHl fD+38DwGfLsg8QH65I1XMqtQJ589HreX3AWQC/Az3IC4IqtAvjcasfuSyYQnNCVM4jqv mmWztrSjCQUm0fmYwd/IxxTyWUDqA95gND9R9hrN8xb+j4SqEX0TUZq4BUCKWVTxIK/m JjcWjJ0GZ83cmuCbclWkEoBJIo0FR3tY79Ksgh8L3wZBYlSxLZ8Jj3CSh1DPBgkEiGhG CLXSbF8S8rvDVrLnPFHU3uZc/vCiWKHJRVI8cs5z59RHBfA8iWHFnzPLD8ArAlF7utgT 9QEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783366854; x=1783971654; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=D8wXCcYH0WCyb1fmTmZrFBW5n0t7RJLUvfvRvQ2BKAo=; b=JLJLQnFIs7JEySYpHyRbKcs04bqFaBoNCvcxx+3y63fu5ukfSqLBkQ7nd1/NT8MfOm bjyKm1Wa7NxqJMOFGc1jVMrYcYSTjZr4Pn2doEukzBVJK0+O2CbS9LBDsl3ULSCmjp/7 kYDnKUlx/PE0hCpFMO/6W5489leUWu/T/hJ/8RQLEmQiZ19q/xpQCyyVZ+dy9PKPLMtK satnN1jOcWD0kzWuaH20cS4RGERYGZD60v8eTTdP75xvqnEfaCLPj8TZKneIyVcsdwX+ JuDNY+FWEPdhzcGO8vPXXeh69KsHGvVqnGMjlhLqVyjj0xtCbwOuvohKE5lDrc+t73lj FmVA== X-Gm-Message-State: AOJu0Yzo6SLZUMF4G/AM3Fx5CV6WEMBzD6Xl90zYFmhYw1jzxIJuYYM/ y+tpgEl44+zHNRarv9mB805M0mgOxcMer713Oqfjb3cMEbizOuU4JsRpbkSmNLHE X-Gm-Gg: AfdE7cmM0p7Sv0MqBmIakXJ2Z2/5JpPe/gvR0Lxt/kwnaPR2h8ffrT9ih8AD3pt6C11 t1faK5xQwVNpQvi7O8SaVgbfvX/pdGMofQ3nleKpAieBvnkqaTpFymFcjao5px7cK/SpSLBGux3 sK1Km7aJEgc267m4GrFEP1XDuAtJt0fopoZhsndp2zm0snsLTLj2QVqkymT+9/xM5oC8e7DuNe2 5NoEiMr4xOhn4EcFFCvGYX3m00MI/YjL3boWZQFsS7PXq0ENeiMMbKIy3H26Di5t97Y+oEHsE0+ 8ytlZMOq8qW/CLDR02Oftf6ZVCJAryeMNqH7nqy/sw20KiqOvD4QbAubU/hEf5q+9XQBNzXG3jr IhrnsFv6D8VZFhsyl3E2hz0Hj5ufD+J6RvzRJmdvERZEppNhLxSz+rZBjyzGQKXzmfzGK5s1l6u MYQjbayMOjBuzNkw== X-Received: by 2002:a05:6000:1189:b0:478:9d9a:d4e1 with SMTP id ffacd0b85a97d-47de6686e6emr1441778f8f.30.1783366853568; Mon, 06 Jul 2026 12:40:53 -0700 (PDT) From: copystring To: pve-devel@lists.proxmox.com subject: SPAM: [RFC PATCH 0/4] lxc: add safe OCI rootfs replacement Date: Mon, 6 Jul 2026 21:39:28 +0200 Message-ID: <20260706193934.279992-1-copystring@gmail.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 3 DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider POISEN_SPAM_PILL 0.1 Meta: its spam POISEN_SPAM_PILL_1 0.1 random spam to be learned in bayes POISEN_SPAM_PILL_3 0.1 random spam to be learned in bayes RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust RCVD_IN_SBL_CSS 3.558 Received via a relay in Spamhaus SBL-CSS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record X-MailFrom: copystring@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation Message-ID-Hash: CVT27ODYDBAQNJ2MY5HBHQIA7VKH5FIR X-Message-ID-Hash: CVT27ODYDBAQNJ2MY5HBHQIA7VKH5FIR X-Mailman-Approved-At: Thu, 09 Jul 2026 10:20:40 +0200 CC: copystring X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This RFC adds an explicit rootfs replacement path for stopped LXC containers created from OCI images. The intent is to support the common "refresh the OCI image" workflow without pretending that data stored inside the old rootfs can be merged safely. The safety model is intentionally conservative: * require an explicit confirmation parameter; * only operate on stopped, non-template, non-HA, unprotected CTs without snapshots or pending config changes; * only replace the active rootfs volume, while preserving mpX mount points; * keep the previous rootfs as an unusedX volume instead of deleting it; * fail if no unusedX slot is available; * never remove the newly allocated rootfs once config writing has started; * do not use overlayfs or path heuristics such as /config or /data detection; * reject shrink-like requests by requiring the target size to be at least the current rootfs size. This means data that only exists on / becomes data on the old unused volume, not on the new active rootfs. Users are expected to keep persistent application data on separate mount points or to have a backup before replacing the rootfs. By default, the endpoint also updates OCI-derived runtime config such as entrypoint, environment, ostype, arch and OCI-generated lxc keys. A caller can set update-oci-config=0 to preserve the existing runtime config and only switch the rootfs. The pve-manager GUI and pve-docs changes are kept as separate repository series, but they are part of the same proposed workflow: the UI exposes the destructive operation behind a confirmation dialog, and the docs describe exactly which data is preserved and which is not. Tested on a disposable PVE 9.2.2 VM: * make -C src check * make -C /root/proxmox-dev/pve-container clean deb * API tests cover 24 rootfs replacement subtests, including confirmation, non-OCI archives, stopped-only and protected/template/HA/snapshot/pending guards, no free unused slot, missing/unmanaged/foreign-owned rootfs, target storage without rootdir content, shrink requests, zero/one/multiple mpX mount point preservation, update-oci-config=0, prepare failures, fork failures and write_config failure handling without deleting the new rootfs. copystring (4): lxc: create: add isolated OCI rootfs preparation api: lxc: add OCI rootfs replacement endpoint pct: add OCI rootfs replacement command test: cover OCI rootfs replacement API transaction src/PVE/API2/LXC.pm | 300 ++++++++++++++ src/PVE/CLI/pct.pm | 8 + src/PVE/LXC/Create.pm | 95 +++++ src/test/Makefile | 4 +- src/test/api-oci-rootfs-replace-test.pm | 486 +++++++++++++++++++++++ src/test/oci-rootfs-replace-test.pm | 250 ++++++++++++ src/test/run_oci_rootfs_replace_tests.pl | 10 + 7 files changed, 1152 insertions(+), 1 deletion(-) create mode 100644 src/test/api-oci-rootfs-replace-test.pm create mode 100644 src/test/oci-rootfs-replace-test.pm create mode 100644 src/test/run_oci_rootfs_replace_tests.pl -- 2.55.0.windows.2