Persistence and updates
The root filesystem is RAM, rebuilt from the boot media every boot. That is the appliance's whole trick: a clean boot is always one reboot away, and nothing can rot in place. Three things survive:
| the saved state | /etc and the listed /root paths (pipe identity, SSH keys, agent credentials). Saved by pipeos save — automatically every 15 minutes and at shutdown, or save state now in the dashboard |
/work | an ordinary ext4 partition: repos, agent memory, logs, uploads, user homes. Persistent disk; it is finite and it fills — the Overview disk tile is watching it |
| packages | pipeos pkg add fetches a package and its dependencies into the local mirror on the media, so the next boot has it without a network. Plain apk add is gone at reboot — by design |
Anything else — a file in /tmp, a hand-edited system file outside saved state — evaporates at reboot. If a change must stick, it either belongs in /work or it goes through the dashboard, which saves what it changes.
Operating it
These cross the persistence boundary. They are yours, at the keyboard or over SSH; an agent does not run them on its own.
| pipeos status | health and persistence state at a glance |
| pipeos verify | will a reboot reproduce this state? non-zero means no — run it before and after any change to the media |
| pipeos save | commit state now, guarded and atomic |
| pipeos pkg add · del | install or remove software persistently |
| pipeos snapshot ls · rollback | the saved generations on the media; stage an older one, or the last known-good boot, as next-boot state |
| pipeos selfupdate | a verified in-place upgrade with rollback; off until you point it at a source in /etc/pipeos/selfupdate.conf |
Every boot self-checks and DMs you a report. A bad save is recoverable: the media mounts on any laptop and the last known-good state restores over it. Everything else is pipeos --help.