feat: a new install_code mode #135
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This change describes a new install_code mode that allows canister
controllers to skip the pre_upgrade hook during the upgrade.
This upgrade method can serve two purposes.
1. Act as an escape hatch if the canister entered otherwise
irrecoverable state due to a critical bug in the `post_upgrade`
method of the new canister version. The stable memory must already
contain the entire state for the "fix" to work.
2. Canister developers can use it during canister deployment to
excercise the `pre_upgrade` method of the new canister.
Imagine that the `post_upgrade` method implementation has a bug that
bricks the canister. Upgrading the canister in such a state is either
impossible (`pre_upgrade` method traps unconditionally) or can result
in a data loss (the `post_upgrade` method erronously discarded
important data, and executing `pre_upgrade` would corrupt the
original). The stable memory, however, might still contain the
correct state that the old version recorded.
If developers ever find themselves in such situation (I did), the
`evict` install method is the only salvation.
Testing `pre_upgrade` hooks is a constant source of struggle.
If this method contains a bug, the canister can become unupgradable.
The evict method provides a method to excercise the `pre_upgrade`
method of the new canister version without the fear of data loss using
the following procedure:
1. Stop the canister.
2. Upgrade the canister to the new version.
3. If upgrade succeeded, upgrade the canister again to same version.
This upgrade will excercise the `pre_upgrade` hook.
4. If the second upgrade succeeds, proceed with the next step.
Otherwise, install the old version of the canister in `evict` mode.
5. Start the canister.
✅ Deploy Preview for ic-interface-spec ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
mraszyk
reviewed
Feb 5, 2023
mraszyk
reviewed
Feb 5, 2023
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
ielashi
reviewed
Jun 1, 2023
mraszyk
reviewed
Jul 16, 2023
ielashi
reviewed
Jul 17, 2023
mraszyk
reviewed
Jul 17, 2023
mraszyk
reviewed
Jul 17, 2023
crusso
reviewed
Jul 26, 2023
crusso
reviewed
Jul 26, 2023
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as off-topic.
This comment was marked as off-topic.
Co-authored-by: Claudio Russo <[email protected]>
Co-authored-by: Claudio Russo <[email protected]>
mraszyk
reviewed
Jul 27, 2023
Co-authored-by: Claudio Russo <[email protected]>
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
✅ Deploy Preview for ic-interface-spec ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
This comment was marked as resolved.
This comment was marked as resolved.
gitlab-dfinity
pushed a commit
to dfinity/ic
that referenced
this pull request
Aug 28, 2023
…upgrade-flag' into 'master' feat: EXC-1422: Canister install mode v2 with skip pre-upgrade flag This MR is the first step that follows dfinity/interface-spec#135. Closes EXC-1422. Closes EXC-1422 See merge request dfinity-lab/public/ic!13842
Dfinity-Bjoern
approved these changes
Sep 5, 2023
gitlab-dfinity
pushed a commit
to dfinity/ic
that referenced
this pull request
Sep 13, 2023
…-v-2-in-order-to-use-skip-upgrade-functionality' into 'master' feat: Allow replica to receive CanisterInstallModeV2 to use skip_upgrade functionality This MR enables canisters to receive CanisterInstallModeV2, hence it enables `skip_pre_upgrade` functionality. This should be included in the release after the next one. It is the last step for [feature](https://dfinity.atlassian.net/browse/EXC-1334) initiated by interface [specs](dfinity/interface-spec#135). Closes EXC-1474 Closes EXC-1474 See merge request dfinity-lab/public/ic!14479
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR describes a new variant of the upgrade mode for
install_codethat allows canister controllers to skip thepre_upgradehook during the upgrade.This upgrade method can serve two purposes.
Act as an escape hatch if the canister entered otherwise irrecoverable state due to a critical bug in the
post_upgrademethod of the new canister module. The stable memory must already contain the entire state for the "fix" to work.Canister developers can use it during canister deployment to excercise the
pre_upgrademethod of the new canister.Recovering from buggy
post_upgradehooksImagine that the
post_upgrademethod implementation has a bug that bricks the canister. Upgrading the canister in such a state is either impossible (pre_upgrademethod traps unconditionally) or can result in a data loss (thepost_upgrademethod erroneously discarded important data, and executingpre_upgradewould corrupt the original). The stable memory, however, might still contain the correct state that the old module recorded.If developers ever find themselves in such situation (I did), the
upgradeinstall method withskip_pre_upgradeis the only salvation.Testing the
pre_upgradehookTesting
pre_upgradehooks is a constant source of struggle. If this method contains a bug, the canister can become unupgradable.The upgrade method with
skip_pre_upgradeprovides a method to excercise thepre_upgrademethod of the new canister module without the fear of data loss using the following procedure:pre_upgradehook.skip_pre_upgrade.