1SYSTEMD.OFFLINE-UPDATES(7) systemd.offline-updates SYSTEMD.OFFLINE-UPDATES(7)
2
6 systemd.offline-updates - Implementation of offline updates in systemd
7
9 This man page describes how to implement "offline" system updates with
10 systemd. By "offline" OS updates we mean package installations and
11 updates that are run with the system booted into a special system
12 update mode, in order to avoid problems related to conflicts of
13 libraries and services that are currently running with those on disk.
14 This document is inspired by this GNOME design whiteboard[1].
15 The logic:
17 1. The package manager prepares system updates by downloading all (RPM
19 or DEB or whatever) packages to update off-line in a special
20 directory /var/lib/system-update (or another directory of the
21 package/upgrade manager's choice).
22 2. When the user OK'ed the update, the symlink /system-update is
24 created that points to /var/lib/system-update (or wherever the
25 directory with the upgrade files is located) and the system is
26 rebooted. This symlink is in the root directory, since we need to
27 check for it very early at boot, at a time where /var is not
28 available yet.
29 3. Very early in the new boot systemd-system-update-generator(8)
31 checks whether /system-update exists. If so, it (temporarily and
32 for this boot only) redirects (i.e. symlinks) default.target to
33 system-update.target, a special target that pulls in the base
34 system (i.e. sysinit.target, so that all file systems are mounted
35 but little else) and the system update units.
36 4. The system now continues to boot into default.target, and thus into
38 system-update.target. This target pulls in all system update units.
39 Only one service should perform an update (see the next point), and
40 all the other ones should exit cleanly with a "success" return code
41 and without doing anything. Update services should be ordered after
42 sysinit.target so that the update starts after all file systems
43 have been mounted.
44 5. As the first step, an update service should check if the
46 /system-update symlink points to the location used by that update
47 service. In case it does not exist or points to a different
48 location, the service must exit without error. It is possible for
49 multiple update services to be installed, and for multiple update
50 services to be launched in parallel, and only the one that
51 corresponds to the tool that created the symlink before reboot
52 should perform any actions. It is unsafe to run multiple updates in
53 parallel.
54 6. The update service should now do its job. If applicable and
56 possible, it should create a file system snapshot, then install all
57 packages. After completion (regardless whether the update succeeded
58 or failed) the machine must be rebooted, for example by calling
59 systemctl reboot. In addition, on failure the script should revert
60 to the old file system snapshot (without the symlink).
61 7. The upgrade scripts should exit only after the update is finished.
63 It is expected that the service which performs the upgrade will
64 cause the machine to reboot after it is done. If the
65 system-update.target is successfully reached, i.e. all update
66 services have run, and the /system-update symlink still exists, it
67 will be removed and the machine rebooted as a safety measure.
68 8. After a reboot, now that the /system-update symlink is gone, the
70 generator won't redirect default.target anymore and the system now
71 boots into the default target again.
72
74 1. To make things a bit more robust we recommend hooking the update
75 script into system-update.target via a .wants/ symlink in the
76 distribution package, rather than depending on systemctl enable in
77 the postinst scriptlets of your package. More specifically, for
78 your update script create a .service file, without [Install]
79 section, and then add a symlink like
80 /usr/lib/systemd/system-update.target.wants/foobar.service →
81 ../foobar.service to your package.
82 2. Make sure to remove the /system-update symlink as early as possible
84 in the update script to avoid reboot loops in case the update
85 fails.
86 3. Use FailureAction=reboot in the service file for your update script
88 to ensure that a reboot is automatically triggered if the update
89 fails. FailureAction= makes sure that the specified unit is
90 activated if your script exits uncleanly (by non-zero error code,
91 or signal/coredump). If your script succeeds you should trigger the
92 reboot in your own code, for example by invoking logind's Reboot()
93 call or calling systemctl reboot. See logind dbus API[2] for
94 details.
95 4. The update service should declare DefaultDependencies=false,
97 Requires=sysinit.target, After=sysinit.target,
98 After=system-update-pre.target and explicitly pull in any other
99 services it requires.
100 5. It may be desirable to always run an auxiliary unit when booting
102 into offline-updates mode, which itself does not install updates.
103 To do this create a .service file with
104 Wants=system-update-pre.target and Before=system-update-pre.target
105 and add a symlink to that file under
106 /usr/lib/systemd/system-update.target.wants .
107
109 systemd(1), systemd.generator(7), systemd-system-update-generator(8),
110 dnf.plugin.system-upgrade(8)
111
113 1. GNOME design whiteboard
114 https://wiki.gnome.org/Design/OS/SoftwareUpdates
115 2. logind dbus API
117 https://www.freedesktop.org/wiki/Software/systemd/logind
118systemd 239 SYSTEMD.OFFLINE-UPDATES(7)