This architectural review validates a methodology for structural state-decoupling on a Linux hypervisor host. Traditional unified storage typologies expose nested. By designing a hybrid layout that maps the host operating system to a Timeshift-tracked Btrfs subvolume tree while binding guest runtime files to an independent, non-Copy-on-Write (No-CoW) enterprise XFS partition, we establish complete rollback immunity.
This review confirms that reverting the host root Timeshift snapshots leaves nested guest XML definitions and high-allocation QCOW2 volumes completely undisturbed and operationally continuous.
******************************************
Final Disk layout of Sparky 2026 06 instance
******************************************
root@devs-SW8664:~# uname -a
Linux devs-SW8664 7.1.13+deb14-amd64 #1 SMP PREEMPT_DYNAMIC Debian 7.1.13-1 (2026-09-03) x86_64 GNU/Linux
*************************************************************
Folder /opt was created during Calamares setup and formated as XFS.
**************************************************************
root@devs-SW8664:~# df -Th
Filesystem Type Size Used Avail Use% Mounted on
/dev/vda3 btrfs 51G 7.6G 42G 16% /
devtmpfs devtmpfs 7.6G 0 7.6G 0% /dev
tmpfs tmpfs 7.6G 4.5M 7.6G 1% /dev/shm
efivarfs efivarfs 256K 97K 154K 39% /sys/firmware/efi/efivars
tmpfs tmpfs 3.1G 1.1M 3.1G 1% /run
none tmpfs 1.0M 0 1.0M 0% /run/credentials/systemd-journald.service
tmpfs tmpfs 7.6G 8.0K 7.6G 1% /tmp
/dev/vda3 btrfs 51G 7.6G 42G 16% /home
/dev/vda3 btrfs 51G 7.6G 42G 16% /var/log
/dev/vda3 btrfs 51G 7.6G 42G 16% /var/cache
/dev/vda3 btrfs 51G 7.6G 42G 16% /etc/libvirt/qemu
/dev/vda2 ext4 2.0G 182M 1.7G 10% /boot
/dev/vda4 xfs 44G 5.4G 39G 13% /opt
/dev/vda1 vfat 300M 15M 286M 5% /boot/efi
tmpfs tmpfs 1.6G 120K 1.6G 1% /run/user/1000
**************************************************************
Resulting btrfs flat layout after decoupling subvolume @qemu
**************************************************************
root@devs-SW8664:~# findmnt -t btrfs
TARGET SOURCE FSTYPE OPTIONS
/ /dev/vda3[/@] btrfs rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=297,subvol=/@
├─/home /dev/vda3[/@home] btrfs rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=296,subvol=/@home
├─/etc/libvirt/qemu
│ /dev/vda3[/@qemu] btrfs rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=283,subvol=/@qemu
├─/var/log /dev/vda3[/@log] btrfs rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=259,subvol=/@log
└─/var/cache /dev/vda3[/@cache] btrfs rw,relatime,compress=zstd:1,discard=async,space_cache=v2,subvolid=258,subvol=/@cache
**********************************************************
Final status of default libvirt-pool after switching from /var/lib/libvirt/images to /opt/libvirt/images
**********************************************************
root@devs-SW8664:~# virsh pool-info default
Name: default
UUID: 0a07f1dd-e6c6-4f0a-8fae-808662b9c7ab
State: running
Persistent: yes
Autostart: yes
Capacity: 43.88 GiB
Allocation: 5.33 GiB
Available: 38.55 GiB
root@devs-SW8664:~# virsh pool-dumpxml default | grep path
<path>/opt/libvirt/images</path>
*************************
Phase 1
*************************
Follows exactly Sparky Linux 2026 06 OverlayFS BTRFS with Timeshift setup
************************
Post installation Phase 2
************************
#1. Install KVM Hypervisor and Cockpit Web Console
#2. Decouple @qemu sub-volume mounted on /etc/libvirt/qemu
root@devs-SW8664:~# cat Setup001
# -- Step 1-2. Preparation: Create the subvolume first (assuming /mnt/btrfs-top is your top-level mount)
sudo mkdir -p /mnt/btrfs-top
sudo mount -o subvolid=5 /dev/vda3 /mnt/btrfs-top
sudo btrfs subvolume create /mnt/btrfs-top/@qemu
# -- Step 3: Sync data to a safe temporary location
sudo mkdir -p /mnt/temp-qemu
sudo mount -o subvol=@qemu /dev/vda3 /mnt/temp-qemu
sudo rsync -aHAX /etc/libvirt/qemu/ /mnt/temp-qemu/
sudo umount /mnt/temp-qemu
# -- CRITICAL SUB-STEP: Clear out the old directory contents before mounting over it
# (If you don't do this, old files remain hidden underneath, wasting space)
sudo rm -rf /etc/libvirt/qemu/*
# -- Step 4: Inject mapping (Using your actual Btrfs UUID from vda3)
echo "UUID=2f880c1f-d17c-4213-a515-0b1a78b1e6be /etc/libvirt/qemu btrfs subvol=@qemu,defaults,compress=zstd:1 0 0" | \ sudo tee -a /etc/fstab
# -- Step 5: Reload and Mount
sudo systemctl daemon-reload
sudo mount -a
# -- Clean up the top-level mount
sudo umount /mnt/btrfs-top
#--Step 6. Apply Security and Ownership Integrity Restorations
# Ensure the new mount point maintains strict ownership for root and the libvirt group
sudo chown -R root:libvirt /etc/libvirt/qemu
sudo chmod 750 /etc/libvirt/qemu
# Reload AppArmor profiles to ensure libvirt recognizes the path changes flawlessly
sudo systemctl reload apparmor
# 6-1. Create the standard configuration subdirectories if they don't exist
sudo mkdir -p /etc/libvirt/qemu/autostart /etc/libvirt/qemu/networks
# 6-2. Reset strict ownership to root and the libvirt group
sudo chown -R root:libvirt /etc/libvirt/qemu
# 6-3. Apply secure permission bits (750 for qemu, 700 for subfolders)
sudo chmod 750 /etc/libvirt/qemu
sudo chmod 700 /etc/libvirt/qemu/autostart /etc/libvirt/qemu/networks
# 6-4. Restart libvirt to safely hook into the new subvolume
sudo systemctl restart libvirtd
*****************************************
#3. Switching to new libvirt-pool as root
*****************************************
mkdir -p /opt/libvirt/images
chown root:root /opt/libvirt/images
chmod 0711 /opt/libvirt/images
# 1. Stop the active default pool
virsh pool-destroy default
# 2. Delete the old definition
virsh pool-undefine default
# 3. Define the new default pool path
virsh pool-define-as --name default --type dir --target /opt/libvirt/images
# 4. Start the pool and set it to autostart on boot
virsh pool-start default
virsh pool-autostart default
********************
Tuning apparmor
********************
root@devs-SVC8664:~#sudo nano /etc/apparmor.d/local/abstractions/libvirt-qemu
root@devs-SVC8664:~# cat /etc/apparmor.d/local/abstractions/libvirt-qemu
/opt/libvirt/images/** rwk,
root@devs-SVC8664:~# sudo systemctl reload apparmor
No comments:
Post a Comment