Hi Christoph, Hi Tony,

> On Jan 29, 2020, at 12:10 PM, Tony Garnock-Jones <tonyg at leastfixedpoint.com> wrote:
> 
> That sounds like a great idea.

+1

> On configurations where overwrite-by-rename is a problem, perhaps an
> alternate of "copy the existing image to a *.bak file" would work?

+1. This is IMO a safer and easier implementation path.  I would use @rename to a backup” though.  So the snapshot file operation is

- if saving to an existing file, then
   - rename existing file to some backup, eg foo.imagebak
   - write new image file foo.image
   - delete foo.imagebak

- if not saving to an existing file, then
   - write new image file foo.image

> Perhaps the image save primitive could respond to a VM command-line
> switch (or in-image VM parameter?) selecting among three behaviours:
> 
> 1. The current overwrite-in-place, risk-of-corruption behaviour
> 2. Overwrite-by-rename if possible
> 3. Make backup copy before overwrite-in-place

Why would the rename be possible and the save not?  Ah, if the file is writable but the directory is not the rename would fail but the write would not, right?  But then both copy and rename would fail.  So I think we only need to support rename and the snapshot primitive should fail if the directory is not writable.

P.S. volunteers welcomed to do the work...

> Regards,
>  Tony
> 
> 
>> On 1/29/20 6:00 PM, Thiede, Christoph wrote:
>> Hi all,
>> 
>> 
>> some months ago, I corrupted my image by accidentally shutting down the
>> host system while saving the image file (many of my images are > 500 MB,
>> so this can take a few seconds even on an SSD). The same can happen due
>> to various other IO/connection issues, so here's an idea:
>> Couldn't we always use overwrite-by-rename when saving the image file?
>> I. e., first the image into a new temporary file and, after saving
>> has completed, replace the original file with that temp file (via mv)?
>> This would ensure the image file's integrity.
>> 
>> 
>> A possible disadvantage, though, would be that some filesystems, such as
>> NTFS, associate meta-information with the file identity, which changes
>> when using the overwrite-by-rename approach. Also, technologies such as
>> FileSystemWatcher would be confused for the same reason. However, afaik
>> overwrite-by-rename is a quite common approach, in primary for big and
>> sensitive files.
>> 
>> 
>> However, what are your opinions about this topic? :-)
>> 
>> 
>> Best,
>> 
>> Christoph
>> 
>> 
>> 
>