Atomic updates

An update either fully applies or does not apply at all. The system never ends up half-updated.

What atomic means here

On a conventional distribution, an update is hundreds of individual package operations. Interrupt it — a crash, a power cut, a full disk — and the machine is left in a state that is neither the old version nor the new one, and that nobody designed or tested.

Immos updates as a whole image. There is exactly one moment at which the machine stops being on the old version and starts being on the new one: the reboot. Before that instant, nothing has changed. After it, everything has.

The sequence

1. Check. The updater fetches the release manifest and compares it against the version you are running.
2. Verify. The manifest is signed with the Immos release key, whose public half is inside your system image. An unsigned or altered manifest is refused before anything is downloaded.
3. Download and write. The new image is streamed into the free slot, checksummed against the manifest as it goes.
4. Commit. Only after the write has completed and verified is the slot labelled with the new version. This is the last step, so an interruption anywhere earlier leaves nothing but a partially written slot nobody will boot.
5. Stage the boot entry. The new version’s boot entry is installed with three attempts allowed.
6. Reboot. The bootloader picks the new version. A successful start marks it permanently good; three failed starts fall back to the previous version.

What it means in practice

• You can update while you work and reboot when it suits you.
• A laptop that runs out of battery mid-update is not damaged.
• There is no “finish the interrupted upgrade” recovery procedure, because there is no intermediate state to finish.

Size and frequency

Updates are full images rather than deltas — around 4 GB compressed. This is the honest cost of the design in its current form; the download happens in the background, and delta updates are on the roadmap.

Applications update separately and incrementally, as Flatpaks, and do not require a reboot.

Trying it

See updating your system for the commands, and snapshots and rollback for what happens when an update turns out to be a mistake.