Lockfile is not preventing Host OS updates

Product support
1

Hello! Apologies if this has already been asked. I’m trying to understand how to use the update lock to prevent updates. My current understanding (from Update locks | balena and Self-service updates | balena ) is that in a multicontainer application, creating the lockfile in any container at /tmp/balena/updates.lock should prevent reboots, application updates, and host OS updates, while supervisor updates are still allowed (since they do not require a reboot).

However, when I create the lockfile (using lockfile from procmail, as suggested by the Update Locks page), it prevents reboots and application updates, but OS updates still go through and ultimately reboot the device. Is this the expected behavior? Host OS version is 6.9.4+rev2 and supervisor version is 17.2.1 (though the versions have been slowly going up during testing).

Thanks for your help!

2

Hello Eberlant,

Thanks for reaching out, this was discussed in support, but I’d like to explain it in public as well.

So you are correct lockfile from procmail doesn’t block our OS update from rebooting. The documentation is unfortunately out of date and we will fix it with clear instruction.

The confusing part is that lockfile does indeed work for app update (balena push), and prevent the application from being stopped and updated. However it doesn’t prevent reboot while updating the host OS.

lockfile being somewhat legacy, I advise you to use flock in both case to prevent an app from being updated AND for the device to be rebooted as well.

In my case I made it work with:
flock /tmp/balena/updates.lock -c 'sleep infinity'

But a real use case would replace 'sleep infinity' by a command actually verifying if your service can now be rebooted.

Bests,

Yann