System images and slots

Your disk holds room for two system images at once. That single fact is what makes updates safe.

Two slots

The disk is laid out with two system slots. At any moment one holds the version you are running and the other holds either the previous version or nothing at all:

disk
├── boot partition      bootloader + one boot image per system version
├── system slot         the version you are running now
├── system slot         the previous version (or empty on a fresh install)
└── data partition      /home, /var, your /etc changes — grows to fill the disk

An update never writes to the slot you booted from. It writes the new image into the other slot, and only when that write has completed and verified does it mark the slot as holding the new version. Pull the power halfway through and the slot is simply unfinished; the system you are running was never touched, and it still boots.

How the right image gets booted

Each version’s boot image knows which slot holds its own system, because the slot is labelled with the version number and the boot image asks for it by name. There is no “slot A / slot B” bookkeeping to get out of sync, no bootloader configuration to edit, and no state that can be corrupted into pointing at the wrong place.

The bootloader simply picks the highest version available and starts it.

Why only two

Two slots is enough for the guarantee that matters: whatever you are running now, the thing you were running before is still on disk. A third slot would double the disk cost of the system to protect against a scenario — both the current and previous images being bad — that a rollback already covers.

When a third version arrives, it overwrites the oldest slot. You always have the current version and the one before it.

What the data partition does

Everything writable lives on the fourth partition, and it is deliberately outside this whole mechanism. Updates do not read it, write it or migrate it. That is why a rollback cannot lose your files: the images move, your data does not.

On first boot it expands to fill the physical disk, so the same 17 GiB image is equally at home on a 32 GB USB stick and a 2 TB SSD.