Implementing guix system rollback / switch-generation

[Chris Marusich]

Hi,

Reliable system-level rollback is a great feature of GuixSD.  Currently,
I've heard [1] that rollback can be performed using a variety of
methods.  I've experimented with these methods and come to the
conclusion that they should be improved.  However, before making any
changes, I wanted to get a second opinion.

Basically, I think there should be a command like "guix system
roll-back" which does the opposite of "guix system reconfigure
config.scm".  The rollback command should not require an operating
system configuration file.  I think this would be better than the
current rollback methods.  What do you think?

As I understand it, when I invoke "guix system reconfigure config.scm",
the following things happen (in guix/scripts/system.scm):

* A new system is built in the store (e.g.,
  /gnu/store/1qkdd4glvqjqf7azqniis7abkf7v1lng-system).

* A new symlink is created in /var/guix/profiles (e.g.,
  /var/guix/profiles/system-7-link), which points to the system in the
  store.

* The /var/guix/profiles/system symlink is updated to point to the new
  symlink.

* The new system's activation script is run, and the Shepherd services
  are upgraded.

* A new grub.cfg is copied to /boot/grub/grub.cfg.  This new grub.cfg
  updates the default menu entry to point to the new system, and it adds
  the previous system to the list of previous generations.

At this point, you are running a new system.  I am not sure if you need
to reboot to truly upgrade, but judging by the implementation of the
upgrade-shepherd-services procedure, it seems like you might sometimes
need to reboot to "really" complete the upgrade process.

This is great!  To upgrade your system, you just invoke one command,
and you're running the new system.  In addition, the next time you boot,
the new system will automatically be selected and booted by GRUB.  Nice.

Rollback should be just as easy.  You should be able to invoke a single
command: "guix system roll-back".  When that command succeeds, you
should be running the previous system, and the next time you boot, the
previous system should be automatically selected and booted by GRUB.  It
should be the opposite of "reconfigure".

However, there is currently no way to roll back in this manner.  Here
are the ways we can supposedly roll back, with commentary about each
one:

* Manually update the /var/guix/profiles/system symlink to point to a
  previous generation, e.g., /var/guix/profiles/system-5-link.

If you do this, it seems the running system will not actually be rolled
back.  The system pointed to by /run/current-system will not change,
since it points to a store path rather than to the
/var/guix/profiles/system symlink.  In addition, because
/boot/grub/grub.cfg has not been modified, when you reboot, GRUB will
still automatically select and boot the system from which you wanted to
roll back.  Also, the previous system's activation script will not be
run, and the shepherd services will not be downgraded.  With that in
mind, I'm not really sure what manually flipping this symlink actually
accomplishes.

* Use the emacs interface to update that symlink.

This is the same as above, except that emacs does the symlink flip for
you.  It does not seem to actually roll back the system.  The elisp code
seems to assume that flipping the symlink is sufficient.  Maybe that
works for changing user profile generations, but it seems to be
insufficient for system generation changes.

* While booting, at the GRUB menu, manually select a previous
  generation.

This is the only method that seems to actually put the system back into
a previous state, and it appears to do so correctly.  I've used this
method to save my systems a few times from bad upgrades, which is great.
The only downside to this method is that it doesn't modify the grub.cfg
file: until you reconfigure your system again, every time you restart,
GRUB will continue to automatically select and boot the newer,
problematic system from which you wanted to roll back.

I'd like to implement a rollback mechanism that lets you run a single
command which actually does the opposite of "guix system reconfigure".
I've looked at the code in guix/scripts/system.scm, and at first blush
this seems like a straightforward task.  However, I've noticed that the
switch-to-system procedure requires an operating system configuration
file to do things like get the system's activation script and generate
the new grub.cfg file.  Surely a user should not have to specify the
previous system's operating system configuration file on the command
line in order to roll back the system.  Is it possible to obtain these
things (e.g., the service activation script, the previous system's
grub.cfg) without requiring the user to supply the previous system's
operating system configuration file on the command line?  If I can
figure out how to do that, implementing the rest of the command should
be pretty easy, since it will do basically the same kind of things that
reconfigure does.

More generally, are people satisfied with the way system rollback is
currently implemented in GuixSD?  Do you think that the mechanism I'm
proposing is a bad idea?  I'd hate to try to implement something that
nobody else thinks is needed.

Footnotes: 
[1]  https://lists.gnu.org/archive/html/help-guix/2016-04/msg00001.html

-- 
Chris

signature.asc
Description: PGP signature