How safe are those sysexts?

[travier]

In #53 (comment), the question was raised around the safety of those updates:

When the README says "I recommend updating them at the same time as you update your system with bootc/rpm-ostree so that the content of the sysexts matches what is on your base system as right now there are no guarantees there."

does that mean the base system might break? Or that the extension might break? Or both? I can see Neovim not working for some reason, but if I failed to update Neovim at the same time, would that break the base system somehow?

Theoretically, any system extension could break the entire system as it may overlay a broken bash executable for example. Sysexts are overlayed on top of /usr using overlayfs so it behaves similarly to how containers do: it can remove files, change existing ones and add new ones.

In practice, in this repo, we try to only create sysexts that will add new files and thus would likely not create any issues. We already have one notable exception with https://github.com/travier/fedora-sysexts/tree/main/mesa-git.

I think it's unlikely that incompatibilities would happen during a major Fedora release lifetime but it could happen. As most sysexts only extend the system and do not replace files, this would for example mean that neovim may fail to run due to incompatible libraries but the rest of the system works.

[kekkoudesu]

Sorry, I've got more questions 😁

Sysexts are overlayed on top of /usr using overlayfs so it behaves similarly to how containers do: it can remove files, change existing ones and add new ones.

A scenario I can think of off the top of my head is package conflicts like a podman-docker and a docker-ce system extension. Though I wonder what would happen if you tried to layer two conflicting extensions together 🤔 I guess that's a different scenario entirely.

Back to removing/changing files, I guess you might need a newer library for some system extensions? Or even an older one for something like DaVinci Resolve which has failed to work on newer kernels before? So you wouldn't be relying on repository packages for dependencies. Though at least with Resolve you can just use it in Flatpak. If most extensions are just using the same base image and installing dependencies from Fedora's repository, there shouldn't be any conflicts... though I guess if you update the main image out of sync with the extensions you could end up with breakage.

That leads me to my next question, actually.

How do system extensions and rollbacks interact? Let's say I've somehow managed to install a bad extension and hosed the system. Can I select the previous image and rollback to it in GRUB? Or will the broken system extension completely override that and attempt to layer itself onto every image you try to boot from?

Is there some kind of "Safe Mode" to disable all system extensions and sort the problem out by excising the bad extension?

We already have one notable exception with https://github.com/travier/fedora-sysexts/tree/main/mesa-git.

Lastly, I'm interested in creating a sysext. Just a small one. Does this sysext actually work? I noticed it doesn't have a Containerfile. I understand containers but not just, yet.

[travier]

package conflicts like a podman-docker and a docker-ce system extension

There is indeed no notion of conflict for sysexts. Adding those would be re-inventing a package manager and this is probably better done using an existing one via a container build or package layering with rpm-ostre/dnf. You are responsible for making sure that the sysexts work well together.

Though at least with Resolve you can just use it in Flatpak

Yes, the goal is still to place everything as much as possible in a Flatpak or a container. The sysexts are for things that don't work well in Flatpaks or containers.

The systemd documentation warns about using sysext for doing anything else than adding files:

System extensions are supposed to be purely additive, i.e. they are supposed to include only files that do not exist in the underlying basic OS image. However, the underlying mechanism (overlayfs) also allows overlaying or removing files, but it is recommended not to make use of this.

How do system extensions and rollbacks interact?

Right now they don't interact at all. Ideally this would be managed by bootc. See:

• https://github.com/travier/fedora-sysexts#how-does-this-fit-with-bootc-and-bootable-containers
• https://github.com/travier/fedora-sysexts/blob/main/README.containers.md
• Figure out how to build, ship and use sysexts using containers #48

Lastly, I'm interested in creating a sysext. Just a small one. Does this sysext actually work? I noticed it doesn't have a Containerfile. I understand containers but not just, yet.

See:

• https://github.com/travier/fedora-sysexts/blob/main/CONTRIBUTING.md
• https://github.com/travier/fedora-sysexts#building

This repo currently builds the sysexts in two different ways, one via the justfile and the other as a regular container build.