Pinning functionality

[tulilirockz]

It would be interesting to have something like the ostree admin pin (number) functionality on bootc directly. Like, sometimes we get some users that have a functioning system on one deployment but for whatever reason the other one doesnt work on their system, that would make it so the user can have that safety that they're never going to have their system "bricked"

[p5]

I think a good first step would be to implement readonly functionality to pinning - just being able to see pinned images.

Right now, if either the staged, booted or rollback deployments are pinned, Bootc makes this information available in the machine-readable formats (JSON, YAML etc). This would be easy enough to display.

However, if the pinned image is not one of these (i.e. was the deployment before the rollback), Bootc doesn't seem to be aware this deployment exists from an end-user perspective.

rpm-ostree:

~ 
❯ rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● ostree-image-signed:docker://ghcr.io/rsturla/eternal-linux/lumina:42-nvidia-open
                   Digest: sha256:e53063e967e52c07d7fffd1714fb3d5ff3f97675608ca007419ba1a68d2ba35f
                  Version: 250403 (2025-04-03T01:44:51Z)

  ostree-image-signed:docker://ghcr.io/rsturla/eternal-linux/lumina:42-nvidia-open
                   Digest: sha256:438654e56f50129441905df1fa72f026478aff6e3850d77ec8c8dda3e5f91ebe
                  Version: 250401 (2025-04-01T21:48:54Z)

  ostree-image-signed:docker://ghcr.io/rsturla/eternal-linux/lumina:stable-nvidia-open
                   Digest: sha256:79403bb8be5515a7937710310a68020724c25488ba687269832189e6375da227
                  Version: 250329 (2025-03-29T01:44:28Z)
                   Pinned: yes

bootc:

~ 
❯ bootc status
● Booted image: ghcr.io/rsturla/eternal-linux/lumina:42-nvidia-open
        Digest: sha256:e53063e967e52c07d7fffd1714fb3d5ff3f97675608ca007419ba1a68d2ba35f
       Version: 250403 (2025-04-03 01:44:51 UTC)

  Rollback image: ghcr.io/rsturla/eternal-linux/lumina:42-nvidia-open
          Digest: sha256:438654e56f50129441905df1fa72f026478aff6e3850d77ec8c8dda3e5f91ebe
         Version: 250401 (2025-04-01 21:48:54 UTC)

[p5]

Took a quick look at the readonly implementation for pinning, and it looks quite straight forward. Bootc does receive information about these pinned deployments, though discards them shortly after.

There will need to be some design decisions taken as to how this will be exposed to the user (i.e. the human and machine readable formats).

Below is an example of a YAML output, treating the pinned deployments as a Vec<>, and letting serde handle the serialization. Happy to continue this once we know some more details.

apiVersion: org.containers.bootc/v1
kind: BootcHost
metadata:
  name: host
spec:
  image:
    image: ghcr.io/rsturla/eternal-linux/lumina:42-nvidia-open
    transport: registry
    signature: containerPolicy
  bootOrder: default
status:
  staged: null
  booted:
    image:
      image:
        image: ghcr.io/rsturla/eternal-linux/lumina:42-nvidia-open
        transport: registry
        signature: containerPolicy
      version: '250403'
      timestamp: 2025-04-03T01:44:51Z
      imageDigest: sha256:e53063e967e52c07d7fffd1714fb3d5ff3f97675608ca007419ba1a68d2ba35f
      architecture: amd64
    cachedUpdate: null
    incompatible: false
    pinned: false
    store: ostreeContainer
    ostree:
      checksum: fe3eb280f463608dbf3f40f57e9898f47252e42dde378dd48e28bc63c713e334
      deploySerial: 0
  rollback:
    image:
      image:
        image: ghcr.io/rsturla/eternal-linux/lumina:42-nvidia-open
        transport: registry
        signature: containerPolicy
      version: '250401'
      timestamp: 2025-04-01T21:48:54Z
      imageDigest: sha256:438654e56f50129441905df1fa72f026478aff6e3850d77ec8c8dda3e5f91ebe
      architecture: amd64
    cachedUpdate:
      image:
        image: ghcr.io/rsturla/eternal-linux/lumina:42-nvidia-open
        transport: registry
        signature: containerPolicy
      version: '250403'
      timestamp: 2025-04-03T01:44:51Z
      imageDigest: sha256:e53063e967e52c07d7fffd1714fb3d5ff3f97675608ca007419ba1a68d2ba35f
      architecture: amd64
    incompatible: false
    pinned: false
    store: ostreeContainer
    ostree:
      checksum: 6b28207754d2e6cd5b5bdf6756c5c46e06879af2c1e791d0ac58fa8a8f480e23
      deploySerial: 0
  rollbackQueued: false
  pinned:
  - image:
      image:
        image: ghcr.io/rsturla/eternal-linux/lumina:stable-nvidia-open
        transport: registry
        signature: containerPolicy
      version: '250329'
      timestamp: 2025-03-29T01:44:28Z
      imageDigest: sha256:79403bb8be5515a7937710310a68020724c25488ba687269832189e6375da227
      architecture: amd64
    cachedUpdate:
      image:
        image: ghcr.io/rsturla/eternal-linux/lumina:stable-nvidia-open
        transport: registry
        signature: containerPolicy
      version: '250401'
      timestamp: 2025-04-01T02:11:10Z
      imageDigest: sha256:1d7d40408ca6eda7a355162c7a89646d0f99b17b426eb95323fa6bd1ab4ebb85
      architecture: amd64
    incompatible: false
    pinned: true
    store: ostreeContainer
    ostree:
      checksum: 99b2cc3b6edce9ebaef6a6076effa5ee3e1dcff3523016ffc94a1b27c6c67e12
      deploySerial: 0
  type: bootcHost

And the git diff of the simplest possible implementation (excl human readable):

diff --git a/lib/src/spec.rs b/lib/src/spec.rs
index ce174c4..94fa750 100644
--- a/lib/src/spec.rs
+++ b/lib/src/spec.rs
@@ -154,6 +154,8 @@ pub struct HostStatus {
     pub booted: Option<BootEntry>,
     /// The previously booted image
     pub rollback: Option<BootEntry>,
+    /// All pinned images
+    pub pinned: Option<Vec<BootEntry>>,
     /// Set to true if the rollback entry is queued for the next boot.
     #[serde(default)]
     pub rollback_queued: bool,
diff --git a/lib/src/status.rs b/lib/src/status.rs
index 260a207..802d0f2 100644
--- a/lib/src/status.rs
+++ b/lib/src/status.rs
@@ -273,6 +273,16 @@ pub(crate) fn get_status(
         })
         .unwrap_or_default();
 
+    let pinned = deployments
+        .other
+        .iter()
+        .filter_map(|d| {
+            d.is_pinned()
+                .then(|| boot_entry_from_deployment(sysroot, d).ok())
+        })
+        .collect::<Option<Vec<_>>>()
+        .filter(|v| !v.is_empty());
+
     let ty = if booted
         .as_ref()
         .map(|b| b.image.is_some())
@@ -290,6 +300,7 @@ pub(crate) fn get_status(
         booted,
         rollback,
         rollback_queued,
+        pinned,
         ty,
     };
     Ok((deployments, host))

[cgwalters]

My initial thought in the bootc design was to try to go all-in on a spec/status style model, so you could just bootc edit and change the pinning state, image source, etc. Then we'd have CLI sugar like bootc deployment pin (?) or so on top of that.

However it's a bit tricky as right now the spec is just the desired image and says nothing about other images; the only special case is the bootOrder entry. We could add rollbackPinned: bool perhaps and only support changing the pinning state of the rollback? But that doesn't scale very well...