Rollback after Switch removes the staged deployment

[Johan-Liebert1]

If bootc rollback is run while a deployment is staged, the staged deployment is deleted silently. Reproducible like so. Sorry for the names of the current and rollback deployment being the same :|

# Switch to any image
$ bootc switch 192.168.122.1:5000/bootc-43-upgrade
layers already present: 0; layers needed: 52 (817.9 MB)
Fetched layers: 780.03 MiB in 12 seconds (67.21 MiB/s)                                                                                                                                              
  Deploying: done (3 seconds)                                                                                                                                                                       
Queued for next boot: 192.168.122.1:5000/bootc-43-upgrade
  Version: 42.20250623.3.1
  Digest: sha256:b3b0d49d8a6b084aba298c172c7f4c94458ab167c73f0f874dbf47e54002674b


# Switched image staged for deployment
$ bootc status
  Staged image: 192.168.122.1:5000/bootc-43-upgrade
        Digest: sha256:b3b0d49d8a6b084aba298c172c7f4c94458ab167c73f0f874dbf47e54002674b (amd64)
       Version: 42.20250623.3.1 (2025-07-16T11:24:47Z)

● Booted image: quay.io/fedora/fedora-coreos:stable
        Digest: sha256:da8486bd1571a7e101dd178eb7826e174de6810389d1f6eb3204278f1942ed53 (amd64)
       Version: 42.20250623.3.1 (2025-07-10T18:50:20Z)

  Rollback image: quay.io/fedora/fedora-coreos:stable
          Digest: sha256:906ee44ef3c21ee25c856d7c6964cba89595ff03d6454eb89b83bc7c36c2aa2b (amd64)
         Version: 42.20250609.3.0 (2025-06-23T19:16:31Z)


# Rollback
$ bootc rollback
Next boot: rollback deployment


$ bootc status

# Staged image removed. File `/run/ostree/staged-deployment` is deleted

● Booted image: quay.io/fedora/fedora-coreos:stable
        Digest: sha256:da8486bd1571a7e101dd178eb7826e174de6810389d1f6eb3204278f1942ed53 (amd64)
       Version: 42.20250623.3.1 (2025-07-10T18:50:20Z)

  Rollback image: quay.io/fedora/fedora-coreos:stable
          Digest: sha256:906ee44ef3c21ee25c856d7c6964cba89595ff03d6454eb89b83bc7c36c2aa2b (amd64)
         Version: 42.20250609.3.0 (2025-06-23T19:16:31Z)


# After reboot

$ bootc status
● Booted image: quay.io/fedora/fedora-coreos:stable
        Digest: sha256:906ee44ef3c21ee25c856d7c6964cba89595ff03d6454eb89b83bc7c36c2aa2b (amd64)
       Version: 42.20250609.3.0 (2025-06-23T19:16:31Z)

  Rollback image: quay.io/fedora/fedora-coreos:stable
          Digest: sha256:da8486bd1571a7e101dd178eb7826e174de6810389d1f6eb3204278f1942ed53 (amd64)
         Version: 42.20250623.3.1 (2025-07-10T18:50:20Z)

bootc version

bootc 1.3.0

Tested on Fedora CoreOS 42.20250609.3.0

[cgwalters]

If bootc rollback is run while a deployment is staged, the staged deployment is deleted silently.

This is currently intended behavior, partially because on the ostree side staged deployments are defined to be in /run and not persist across reboots. I think it'd break things to change it.

In general the way I think things should work is that higher level control loops (auto-update agents) need to drive things, and they should just recreate the staged deployment.

[Johan-Liebert1]

Even if the behaviour is intended, thinking from a UX perspective, I think it'd be nice to let the user know what's going to happen to their staged deployment, and maybe have them confirm the rollback?