image: write the resolution record durably - #14
Merged
Merged
Conversation
storeResolution wrote the record with os.WriteFile to a fixed temp name and renamed it into place: no fsync, so a power loss after the rename could publish a zero-length or torn record under the real name; and a temp name shared by every writer of the same ref, so two concurrent runs of one image could rename each other's half-written bytes. Both landed as a corrupt record, which loadResolution reads as a miss and re-resolves — benign in effect, wrong in kind: a cache that is trusted on the warm path is written like one. primordium's filesystem.WriteFile is the drop-in: a unique temp in the same directory, write, fsync, close, rename. pkg/volume's cache image already did this by hand; the record now does the same. Still best-effort — a cache-write failure must never fail a run. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: closer-claudio <claudio@farcloser.world>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
storeResolutionwrote the resolve record withos.WriteFileto a fixed temp name and renamed it — nofsync, and a temp name shared by every writer of the same ref. A power loss after the rename could publish a zero-length or torn record; two concurrent runs of the same image could rename each other's half-written bytes. Both read back as a corrupt record → miss → re-resolve, so benign in effect — but a cache trusted on the warm path was not written like one.Now
filesystem.WriteFilefrom primordium: unique temp in the same directory, write,fsync, close, rename.pkg/volumealready did this by hand for the cache image; the record does the same. Still best-effort: a cache-write failure never fails a run.One function body;
just lintandjust testgreen. Both #10 and #13 touch this function and rebase trivially onto it.