Kfftfuftur
commented
2 years ago After having lost data to Zsys destroying datasets i would like to add some points to this:
-
Do NOT automatically run Zsys when booting the install disk. When you boot any kind of live image you usually don't expect any changes to be made to your system unless you are explicitly confirming them. In my case I accidentally overwrote grub when reinstalling windows. To recover I booted the live image, mounted rpool and bpool, chrooted and reinstalled grub. Only problem: I had previously restored my system via grub so there where multiple systems listed. I might or might not have mounted the wrong datasets and by the time I was done Zsys had already silently destroyed the my datasets.
-
As a repetition of what is written above Explicitly ask the user before destroying any datasets. However asking before deleting automatically created snapshots which should not impact the current state of the datasets might become more of an annoyance to the user.
I notice there is also a bug where Zsys deletes data if the password is misspelled multiple times and consequently rpool isn't mounted. . . again this would be solved by explicitly asking the user.
On a side note I wonder what the reasoning was for Zsys purely relying on ZFS metadata and seeing which datasets are mounted instead of keeping proper / persistent records of states in a separate data set that would be used by all machines independent of the current boot configuration.
I think the text "Experimental" in the 20.04 LTS installer might not be explicit enough. It should probably tell the user that they should unrecoverable loss of data if Zsys misbehaves and not just some minor bugs that might require manual intervention as I expected when checking the checkbox. I just checked and was shocked that the experimental warning isn't even present in the 21.10 Installer.
As far as I understand using Ubuntu on ZFS and ZSys service is to PROTECT user data from being deleted (instead of ZSys being of main driver for user data lose). I've looked through some bugs here and I would like to suggest few features for ZSys to in fact protect user data not destroying it.
>zsys has to collect (garbage collect) to free up space any datasets unassociated to any system state Is it better for user to loose some free space, or loose all of data ? We should protect data for all means, if any 'unexpected' situation happens, user (by default) should be notified, not have its data deleted.Second thing here is that Ubuntu is advised as 'User Friendly', good for 'first Ubuntu experience' and even delivered by default with some PC. How many of those users You think uses more then one Linux user account? Most of those use cases (home users) will user just one account and never delete any account, so deleting dataset in such scenarios should be considered very, very suspicious.Pro users can have option to enable management of user datasets (then will also know how to enable it), but home users (I bet most users what use Ubuntu on ZFS might not event know what ZSys is running there)?
Manage just rpool and bpool, by default.
Ubuntu on ZFS quide speaks of two pools bpool and rpool - and those should only be managed by default. If anyone want to extend monitoring for other pools (like epool etc). then this should be an option, not default, mandatory settingAdd on-screen notifications.
If something bad happens, then user should be notified by on-screen notification. Like "Tomorrow we gonna destroy all Your data". I think destroying user data is pretty important and user should be notified by all means (You should make sure that user knows dataset will be deleted).Add confirmations to notifications
If possible user should be asked if he/she want to delete datasets, like "We found that dataset rpool/USERDATA/user_234 if not related to any user in system. Do You ant to delete it?" or "Dataset rpool/USERDATA/user_3r234 is not related to any rpool/ROOT state. You you want to delete it?'Do NOT delete any manually created datasets.
If user created dataset manually (no matter where) then most likely he/she knows how to delete it. Default automanagement is NOT needed.