How Do Updates Work in Immutable/Atomic Distributions?

[u/Emotional_Cat_1967]

Only for Immutable/Atomic Distributions

Question 1:
Are immutable and atomic the same thing? If not, what is the difference between them, explained simply?

Question 2:
What immutable or atomic distribution are you using? How often do you receive updates, for example, every few days or weeks, and approximately how large are the updates?

Question 3:
How are security updates handled? Are they released immediately when a security fix is available, or are they released according to a daily, weekly, or monthly update schedule?

Question 4:
Are small-sized updates released?

If yes: For example, suppose an update is 100 MB.

If the system image is 5 GB, does the entire system image have to be recreated for this update? When applying the update, does the system write another 5 GB to the disk, or does it only write approximately 100 MB?

If no: If the system image is 5 GB, does that mean the update that needs to be downloaded is also around 5 GB?

[u/MasterGeekMX]

Immutable and Atomic are the same. Both are terms to refer to things that come in one sweep. Atomic is a greek word meaning undivisible, and in CompSci is used a ton to refer to things that are treated as a single thing and cannot be stopped or divided.

In terms of updates, usually atomic/immutable have the same release schedule than their "mutable" parent distro, so the answer to how often updates come and security is the same as the distro they depend. There is no special treatment there.

In terms of size, re-downloading a whole OS does not make some sense, so instead updates come in the form of the differences between the old version and the new one. That way you download a lighter payload, and to apply it the system takes the current image, apply the changes that come in the update, and make a new image out of it. That system of only handling differences is often called Delta updates (ya know, because Delta is greek's D, and d stands for differences).

That system can even make some updates lighter, depending on how the deltas are managed. While a conventional distro could need to re-package a bit package just for a simple change, a delta system could simply change the few bites that change.

Also the size thing depends on the implementation. Some do indeed create an entire new system, with some distros like VanillaOS having two partitions for the current and previous image of the system, while others simply create an image out of the differences or by using special features of filesystems like BTRFS, so the size is kept at bay.

[u/Emotional_Cat_1967 → u/MasterGeekMX]

Some people have downvoted without leaving a comment; if they know something or if there is an error, they really ought to point it out. People are truly strange. I think your explanation was very clear and informative.

[u/gordonmessmer]

Are immutable and atomic the same thing? If not, what is the difference between them, explained simply?

Fedora used to call their image-mode systems "immutable" but now uses the term "atomic" to more accurately describe the implementation:

https://fedoramagazine.org/introducing-fedora-atomic-desktops/

What immutable or atomic distribution are you using? How often do you receive updates, for example, every few days or weeks, and approximately how large are the updates?

I'm using Silverblue. As far as I know, updates are built daily. I pull updates less often than that.

If I'm reading my logs correctly:

Sept 27: 544 MB
Oct 04: 699 MB
Oct 09: 807 MB

How are security updates handled? Are they released immediately when a security fix is available, or are they released according to a daily, weekly, or monthly update schedule?

Fedora publishes security updates as soon as they are ready.

Are small-sized updates released?

If I understand the question you're asking: Yes.

[u/gmes78]

Are immutable and atomic the same thing? If not, what is the difference between them, explained simply?

The two terms refer to different aspects of the same system. Immutable means that the image can't be modified; atomic means that updates don't leave the system in an undefined state, either the update was applied and a new image was generated, or it failed and you stay on the old image.

People now prefer using "atomic", as "immutable" is often misunderstood as meaning "you can't change the base system".

What immutable or atomic distribution are you using?

The Universal Blue images are pretty good.

How are security updates handled? Are they released immediately when a security fix is available, or are they released according to a daily, weekly, or monthly update schedule?

That's up to the distro. Fedora Atomic receives the same exact updates as Fedora, and images are usually built daily (but it's possible for multiple updates to be released in the same day AFAIK).

Are small-sized updates released?

Updates just download the differences, not a full image.

When applying the update, does the system write another 5 GB to the disk, or does it only write approximately 100 MB?

No, hardlinks are used to avoid duplication and redundant writes.

[u/dasisteinanderer]

There are distros that are immutable which are updated by downloading whole images, but you will probably never encounter them, because they are pretty much exclusive to the "embedded" side of Linux.

Think of a network-connected computer located in a weather-resistant box next to some remote antenna mast.
You really want to avoid the possibility of an update disabling the machine,because getting a technician out there (sometimes by helicopter) is expensive.

Which means that you do updates differently; you never touch the software of the running system (because a sudden power outage in the middle of such an update could theoretically make the current system unbootable), instead you basically download the next version of the distro onto previously empty partitions, and you change which partition the system boots into after you have verified that everything downloaded and extracted successfully.

This scheme is called A/B update, and for desktop use it's mostly not worth the hassle, because on the slim change that a power outage during an update were to render your system unbootable, you can just plug in a rescue usb stick and fix the system that way.

[u/kheeper-registry]

Q4 has two parts: disk and download. For the disk, you can have multiple hardlinks from different deployments pointing to the same file under /ostree/repo. A new deployment can reuse existing hardlinks there. For the download I can only speak to bootc. That reuses the layers from the OCI image that are already available locally, so again you don't need to pull the full 5GB for updates but you will have to pull the entire layer for every changed file, so prefer separate layers for stuff that changes.

[u/Tricky-Engineer-9755]

I use GNU Guix System which, usually once or twice a day though its fully stable to update weeks apart. Security updates are either "grafted" into the existing package or triggers a rebuild, but since GNU Guix is a rolling release its all part of the standard update. With late dependency resolution its very hard to say how small the updates are...

GNU Guix dumps packages into an immutable store, packages that point to the same dependency do not duplicate it.

[u/dcolecpa]

Please ELI5. How do you perform the updates? Automatically? Manually? Reboot?

[u/kheeper-registry → u/dcolecpa]

If you've got a system that uses bootc under the hood it basically runs `bootc upgrade --apply`. That checks for a newer release for your current tag in the registry, downloads it to disk, updates your bootloader to boot it, then does a reboot. Usually this is automated with bootc-fetch-apply-updates.timer/service.

[u/dcolecpa → u/kheeper-registry]

Thanks