From ce04318b7891fb7ffd528c5cafcb218a21ccbe08 Mon Sep 17 00:00:00 2001 From: Codex Date: Tue, 13 Oct 2026 23:15:59 +0300 Subject: [PATCH] Document managed root directory policy and kernel mount compatibility --- docs/system-recovery.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/docs/system-recovery.md b/docs/system-recovery.md index b8003c3..f402455 100644 --- a/docs/system-recovery.md +++ b/docs/system-recovery.md @@ -12,6 +12,16 @@ subvolumes beneath `@root` are refused. Boot and fstab must select the filesyste UUID plus `subvol=@root`, never a numeric root subvolume ID. `@home` and VM disks stored there survive restoration; files stored elsewhere in `@root` roll back. +The image keeps `/srv`, `/var/lib/machines` and `/var/lib/portables` as ordinary +directories so that systemd does not create nested subvolumes on first boot. +Assembly copies the installed vendor `home.conf`, `systemd-nspawn.conf` and +`portables.conf` into `/etc/tmpfiles.d`, changing only those three creation rules. +Other vendor rules and the separate `/home` policy are preserved. Image rebuilds +regenerate these overrides and reject unexpected vendor rules. After a Portage +systemd update, review the overrides against the new `/usr/lib/tmpfiles.d` files; +existing `/etc` overrides continue to take precedence. Recovery still refuses +unknown nested subvolumes rather than silently omitting their contents. + This includes `/var/lib/hydra-update`: a full root restoration also restores the checkpoint's runtime update receipts and replay floor. The signed updater's monotonic sequence guarantee applies to runtime apply/recovery/rollback, not to @@ -37,7 +47,8 @@ hydra-system restore --root-uuid ROOT_UUID --checkpoint CHECKPOINT_ID \ --execute --confirm-root-uuid ROOT_UUID ``` -Plans and list mount targets read-only; Btrfs inspection disables log replay. +Plans and list mount targets read-only; Btrfs inspection disables log replay with +`rescue=nologreplay`, as supported by the packaged kernel. Execution requires matching confirmation and verifies UUID/PARTUUID uniqueness, ordinary partitions, inactive swap, no holders, and a single-device Btrfs layout. A private mount namespace and a root-owned lock isolate the command's mounts.