Readonly root partitions

[kennyhyun]

improper shutdown causes disk failure and someone could have a hardship to recover from it.
it's better to use read-only system partition and use dedicated docker system disk.

this script can provide a tool for building root partition initially and mount as a readonly disk from the next booting

• readonly root
  • some memfs and/or overlay user disk would be used
• default user directory disk
• docker system disk (maybe options to share with the user dir disk)
• ability to remount rootfs as rw and remount as ro again
  • would not be required when overlay was used?

Would overlay help the broken root fs?

If rootfs couldn't be mount, the system cannot be run in a normal mode.
Only limited commands can be run and no user scripts are available.
But read-only fs should not be broken by improper host shutdown and can still provide some user scripts
And the user scripts could fix the additional disks

For example for docker,

• break the vdi and recreate vdi
• reboot and the script will initialize the fs
• disk size can be adjusted too

For home dir,

• fsck -y and reboot?

That was the plan but what if the overlay disk was broken, would that

• boot with r/w rootfs?
• boot only with ro rootfs?

so maybe it can be tried to use ro only and then to add overlay

Test/Dev Steps

• Build from scratch as it is
  • with adding additional disks
    • /home and /var
    • /var/lib/docker
• try to make rootfs readonly with memfs
• reboot and see if it's working
• try remount as r/w? and reboot to see it's applied

Chanllenges

• How can it be detected to fix overlay and reboot?
• Managing many disk image is not good for
  • fixed disk size requires more host disk than required
  • increasing variable disk size affects performance
• But custom fs has benefits like to customize number of inodes

Steps

• Build root fs from scratch
  • Using vagrant and external dotfiles scripts
    • Same as before
  • Shutdown (vagrant halt)
• Make read only
  • Export disk image
    • variable size
  • Manage vagrant scripts for user disk
    • update fstab as well
  • Add overlay and/or memfs
  • Try reboot if it's working as readonly

Resources

• official docs
  • https://wiki.debian.org/ReadonlyRoot
• stack exchanges
  • https://unix.stackexchange.com/questions/316018/how-to-use-overlayfs-to-protect-the-root-filesystem
• blogs
  • https://gsthnz.com/posts/readonly_root_with_overlayfs/
  • http://chschneider.eu/linux/thin_client/
  • https://spin.atomicobject.com/2015/03/10/protecting-ubuntu-root-filesystem/
• gists
  • https://gist.github.com/mutability/6cc944bde1cf4f61908e316befd42bc4

[kennyhyun]

I was using Metered connection for the Windows network interface. so this would make Windows Upgrade less often.

but I still see this is happening in many instances.