admin/felhom-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

golden: use classic overlay2 (containerd-snapshotter off) so images land on the data volume

Browse Source 
Validation caught that Docker 29's default containerd-snapshotter keeps the
image store at /var/lib/containerd (on the rootfs), so mounting the data volume
at /var/lib/docker only moved named volumes — images (1.2G) stayed on the
rootfs, defeating the split. overlay2 stores images+overlay+volumes under
data-root = the data volume, which the split and the controller's statfs(/)
guard both require. Golden daemon.json now sets features.containerd-snapshotter
false + a driver guard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
authentik Default Admin
2026-06-13 15:50:39 +02:00
parent d7d68fdd83
commit 239f5f6440
2 changed files with 23 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RUNBOOK-provisioning-storage.md
+9 -2
View File
@@ -31,8 +31,15 @@ OS_SIZE_GB=32 GOLDEN_DOCKER_GB=16 \
- `--rootfs ${ROOTFS_STORAGE}:${OS_SIZE_GB}` + `--mp0 ${ROOTFS_STORAGE}:${GOLDEN_DOCKER_GB},mp=/var/lib/docker,backup=1`.
- Keep `GOLDEN_DOCKER_GB` small (just the baked images + headroom) — provision grows it.
- The script bakes `/etc/docker/daemon.json` log rotation (`max-size 10m`, `max-file 3`), verifies
`/var/lib/docker` is a separate mount, and **aborts if vzdump excludes mp0** (the B3 trap).
- The script bakes `/etc/docker/daemon.json` with **`features.containerd-snapshotter: false`** (the
classic **overlay2** driver) + log rotation (`max-size 10m`, `max-file 3`), verifies `/var/lib/docker`
is a separate mount + the driver is overlay2, and **aborts if vzdump excludes mp0** (the B3 trap).
- **Why overlay2 (not the Docker-29 default containerd-snapshotter):** containerd-snapshotter keeps the
image content store under `/var/lib/containerd`, which is NOT `/var/lib/docker` — so it would stay on
the OS rootfs and the split would only move named volumes, leaving images (the bulk) on the rootfs
(validated live: 1.2 GB of images landed on the rootfs). overlay2 stores **everything** (images +
overlay + volumes) under data-root = the data volume, which is what the split + the controller's
`statfs("/")` prevention guard both require.
## Provision (per customer guest)