Zum Inhalt

openSUSE Leap & Tumbleweed Provisioning: Btrfs Snapper Rollbacks, Transactional Updates & YaST/Agama

Executive Summary: openSUSE engineered the reference standard for resilient Copy-on-Write Linux filesystems: out of the box, both openSUSE Tumbleweed (curated rolling release tested via openQA) and openSUSE Leap / MicroOS integrate Btrfs subvolumes, Snapper, Zypper plugins, and GRUB2-Btrfs so that any broken update, kernel regression, or misconfiguration can be rolled back directly from the UEFI boot menu in seconds. This guide details production provisioning, fine-grained Btrfs subvolume architecture, transactional-update atomic operations, and firewalld + AppArmor/SELinux hardening.

  • Bootable GRUB2 Btrfs Snapshots

    Boot directly into any historical read-only Btrfs snapshot from the GRUB2 menu and promote it to the live system via snapper rollback.

  • openQA-Verified Tumbleweed

    Run bleeding-edge Linux kernels and toolchains validated by automated full-system openQA regression pipelines before every snapshot release.

  • YaST2 & AutoYaST / Agama

    Manage storage, systemd services, AppArmor profiles, network bonds, and unattended XML/JSON installations from a unified TUI/GUI control plane.

  • Zypper SAT Solver (libsolv)

    Resolve complex multi-repository dependencies with Boolean Satisfiability (libsolv) precision and automatic pre/post-transaction snapshots.

1. Architecture: The openSUSE Default Btrfs Subvolume Topology

Unlike simplistic Btrfs setups that snapshot the entire filesystem blindly, openSUSE's storage layout isolates directories that must persist across a system rollback—such as /var (logs, databases, container volumes), /home, /srv, /tmp, and /boot/grub2/*—into dedicated subvolumes excluded from / snapshots:

%%{init: {'flowchart': {'wrappingWidth': 600, 'subGraphTitleMargin': {'top': 15, 'bottom': 15}}}}%%
flowchart TB
    subgraph TopBtrfs["Btrfs Pool (@ Subvolume Tree)"]
        SnapRoot["/.snapshots<br/>Active Root: @/.snapshots/1/snapshot"]
        SubVar["@/var (Excluded)<br/>Logs, Containers & DBs Persist"]
        SubHome["@/home (Excluded)<br/>User Data Persists"]
        SubOpt["@/opt & @/srv<br/>Service Data"]
    end

    subgraph ZyppPipeline["Zypper + Snapper Workflow"]
        Pre["Pre-Snapshot (#42)<br/>Before zypper dup"]
        Zypp["libsolv Package Upgrade<br/>Kernel + glibc + systemd"]
        Post["Post-Snapshot (#43)<br/>After zypper dup"]
    end

    subgraph Recovery["Instant Boot Recovery"]
        GRUBBtrfs["GRUB2 Boot Menu<br/>Boot Read-Only #42 -> snapper rollback"]
    end

    Pre --> Zypp
    Zypp --> Post
    Post --> SnapRoot
    SnapRoot --> GRUBBtrfs
    SnapRoot -.->|"Mounted Alongside"| SubVar
    SnapRoot -.->|"Mounted Alongside"| SubHome

Why Isolating @/var and @/boot/grub2 Matters

Suppose you upgrade PostgreSQL or Docker via zypper dup at 10:00 AM, write new production transactions into /var/lib/pgsql until 2:00 PM, and then discover a kernel driver bug that requires rolling back the OS to the 9:59 AM snapshot. Because /var is a separate subvolume (@/var with Copy-on-Write disabled chattr +C on database directories), executing snapper rollback reverts the kernel and /usr binaries to 9:59 AM without erasing the database transactions written between 10:00 AM and 2:00 PM.

2. Cryptographic ISO Verification & Installer Selection

Download either openSUSE Tumbleweed (for engineering workstations and modern hardware) or openSUSE Leap 15.6 / 16.0 (binary-compatible with SUSE Linux Enterprise Server SLES) and verify the GPG-signed sha256 checksum:

Verifying openSUSE ISO Checksum & GPG Signature
# 1. Import openSUSE Project Signing Key (2048R/3DBDC284 / 4096R/39DB7C82)
gpg --keyserver keyserver.ubuntu.com --recv-keys 22C07BA534178CD02EFE22AAB88B2FD43DBDC284

# 2. Verify cryptographic signature and SHA-256 hash
gpg --verify openSUSE-Tumbleweed-NET-x86_64-Current.iso.sha256.asc \
             openSUSE-Tumbleweed-NET-x86_64-Current.iso.sha256
sha256sum -c openSUSE-Tumbleweed-NET-x86_64-Current.iso.sha256
  1. System Role: Choose Server (headless minimal with firewalld and SSH enabled) or Transactional Server (MicroOS) for an immutable read-only root filesystem with automatic atomic updates (transactional-update).
  2. Guided Partitioning: Enable Propose Separate Home Volume, Enable Snapshots (Btrfs on /), and Encrypt Device (LUKS2) with PBKDF2/Argon2id depending on GRUB2 TPM2 unlock requirements.
  3. Security Summary: Open SSH port (22/tcp), keep firewalld Enabled, and select SELinux or AppArmor as the active Linux Security Module (LSM).

3. Mastering Zypper & zypper dup vs. zypper up

On openSUSE, the update command depends strictly on the distribution branch:

Distribution Correct Upgrade Command Architectural Explanation
openSUSE Tumbleweed sudo zypper dup (dist-upgrade) Each Tumbleweed snapshot is an atomic distribution release. dup handles package splits, renames, and architecture transitions cleanly.
openSUSE Leap sudo zypper patch / sudo zypper up Applies maintenance security patches and minor updates within the fixed SLES-backed point release.
openSUSE MicroOS sudo transactional-update dup Clones the current read-only Btrfs root snapshot into a new writable target snapshot, applies updates inside a chroot, and switches the boot target for the next reboot.
Essential Zypper Repository & Package Operations
# 1. Refresh all metadata and verify GPG repository keys
sudo zypper ref

# 2. Upgrade Tumbleweed with no-recommends to keep server footprint minimal
sudo zypper dup --no-recommends

# 3. List processes running deleted binaries/libraries after an upgrade
sudo zypper ps -s

4. Snapper Administration & Disaster Rollback Drill

Inspect automatic pre/post snapshot pairs created by zypp-plugin-snapper, compare modified configuration files between snapshots, and practice a system rollback:

Auditing Btrfs Snapshots, Diffs & Executing Rollbacks with Snapper
# 1. List all Btrfs root snapshots with pre/post pair numbers and descriptions
sudo snapper list

# 2. Inspect which files changed between Pre-Snapshot #42 and Post-Snapshot #43
sudo snapper status 42..43

# 3. View exact unified diff of /etc changes between snapshots 42 and 43
sudo snapper diff 42..43 /etc/ssh/sshd_config

# 4. Undo changes to a single configuration file without rolling back the entire OS
sudo snapper undochange 42..43 /etc/ssh/sshd_config

# 5. Full System Rollback: If you booted into read-only Snapshot #42 from the GRUB2 menu:
sudo snapper rollback
sudo systemctl reboot

Tuning /etc/snapper/configs/root Retention Limits

On smaller NVMe drives (< 128 GiB), restrict the number of retained number (package-manager) and timeline snapshots so old kernel images do not consume excessive Btrfs blocks:

/etc/snapper/configs/root (Retention Quota Tuning)
TIMELINE_CREATE="no"
NUMBER_CLEANUP="yes"
NUMBER_MIN_AGE="1800"
NUMBER_LIMIT="10"
NUMBER_LIMIT_IMPORTANT="5"

Apply cleanups immediately via sudo snapper cleanup number.