Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by radlad | Hacker News Reader

Parent Full thread

radlad·

Unfortunately, as a ZFS on Linux user, LTS is the best way to get continual updates without breaking my system.

View on HN

Probably best to not leave any ZFS system connected to the internet then.

Or perhaps this illustrates the value of running all web services under KVM rather than bare metal.

Or the value of not running linux everywhere.

Regardless of the OS, kernel, or program you select there will inevitably be holes in your stack. A VM will always provide better isolation and more flexibility. In this instance it would mean being able to patch the box running the service without messing with the driver for the backing storage.

Depends on the VM system. Full blown virtualization add complexity and attack surface. Running vmless[0] could be even better if you trust the design of the isolation enough.

[0]https://www.youtube.com/watch?v=xXWaECk9XqM

Anything important should be virtualised and regularly snapshotted. Nothing is invulnerable but if it can be reconstituted in an hour, that’s close enough. If it isn’t and you care enough then a standby server with failover should take care of it.

I have found that Debian BPO kernel + BPO ZFS works well, and since ZFS gives you complete snapshotting capability a broken upgrade isn't as much of an issue, rolling back with zfsbootmenu is easy.

zfsbootmenu looks very cool, thanks for sharing!

What usually happens to me is that I run a full package update, forget about it for a while, and then reboot. And then the server doesn't come back online - and I'm not in front of it to fix it.

LTS kernel pretty much solved this issue for me when I switched.

ZFS is completely broken on Ubuntu Noble 6.8.0 LTS.

Reply on news.ycombinator.com