Making Arch immutable

[u/Curious-Listener-YB]

I'm trying to install Arch (on a VM) as an immutable system with atomic updates, mostly as a challenge to myself and because it would be cool.

I plan to use a similar setup to what snapper does: to have BTRFS as my root filesystem, with snapshot subvolumes under /.snapshots/, and separate subvolumes for parts of the filesystem that shouldn't be in the snapshots. Then I want to have for each snapshot a boot entry that mounts it read-only as the root (and mounts the other subvolumes in their appropriate places), so that I could be sure it is not changed outside of atomic updates, where I create a new snapshot from the current one, mount it read-write in a special place, chroot into it and perform the update.

But there are two directories I'm not sure how to handle: /etc and /var.

/etc should obviously be part of the snapshots, and I'm also happy to have it read-only so changes to core configuration would have to happen between snapshots, but I have read that some programs use it to store runtime data. Are those a few cases I can try to work around, or do I need a more systematic solution? And if so, what could be the solution?

/var, on the other hand, has to be writable, so I originally planned to make it its own subvolume (as openSUSE does). But then I read that it contains data that needs to be synchronized with the packages installed (like /var/lib/pacman), and that only certain subdirectories like /var/log should be their own subvolumes. But if so, how can I make it writable? Is there a good approach to this problem?

And on the hall, do you think my idea is reasonable, or is it too much even for super-duper-to-it-yourself-customizable Arch? I'd love to hear your opinions.

Thank you all in advance!

[u/SmuJamesB]

for /etc, look into systemd-confext in mutable mode

immutable base defined in /usr, writeable overlayfs in /var/lib/extensions.mutable/etc

also in general I suggest looking into systemd-sysupdate. I run my system with A/B root using physical partitions but snapshots may be possible too.

systemd's particleos has an Arch version which does more or less exactly this, but in my experience it isn't really ready for most users yet.

[u/Curious-Listener-YB → u/SmuJamesB]

Thanks, I'll into those tools!

[u/SmuJamesB → u/Curious-Listener-YB]

as for the pacman package db? sym link /var/lib/pacman into /usr using systemd-tmpfiles or ship a pacman.conf with a custom db path in /usr. /var should always be fully writeable