[doublerabbit]

> Once the DKMS packages are in place very little should change for end users

Doesn't that mean I now have to enroll the MOK key on all my work workstations that use secure boot? If so that's a huge PITA on over 200 machines. As like with the NVIDIA driver you can't automate the facility.

[yomismoaqui]

Not to troll, I'm asking in good faith

Is this filesystem stable enough for deploying on 200 production machines?

From a cursory look I get things like this:

https://hackaday.com/2025/06/10/the-ongoing-bcachefs-filesys...

[bravetraveler]

I have to constantly adjust my comfort level regarding what 'production' means. Consider the prep conditions, or 'prod', for your typical Chef or Butcher!

Anyway, fair question IMO. Another point I'd like to make... migrating away from this filesystem, disabling secure boot, or leaning into key enrollment would be fine. Dealer's choice.

The 'forced interaction' for enrollment absolutely presents a hurdle. That said: this wouldn't be the first time I've used 'expect' to use the management interface at scale. 200 is a good warm up.

The easy way is to... opt out of secure boot. Get an exception if your compliance program demands it [and tell them about this module, too]. Don't forget your 'Business Continuity/Disaster Recovery' of... everything. Documents, scheduled procedures, tooling, whatever.

Again, though, stability is a fair question/point. Filesystems and storage are cursed. That would be my concern before 'how do I scale', which comparatively, is a dream.

[doublerabbit]

> The easy way is to... opt out of secure boot. Get an exception if your compliance program demands it.

Not going to happen. Secure Boot is a mandatory requirement in this scenario.

I can't talk further because NDA, but sure am confused by the downvotes for asking a question.

[bravetraveler]

Fair 'nuff; say no more -- I get it. Neat they don't mind a 'plugged' kernel, otherwise :) I find the situation interesting to say the least!

I'll hit this post positively in an attempt to counter the down-trend. edit: well, that was for squat.

[LeFantome]

I am not going to advocate to put bcachefs on 200 production machines.

However, I would like to push back on that article.

It says that bcachefs is "unstable" but provides no evidence to support that.

It says that Linus pushed back on it. Yes, but not for technical reasons but rather process ones. Think about that for a second though. Linus is brutal on technology. And I have never heard him criticize bcachefs technically except to say that case insensitivity is bad. Kind of an endorsement.

Yes, there have been a lot of patches. It is certainly under heavy development. But people are not losing their data. Kent submitted a giant list of changes for the kernel 6.17 merge window (ironically totally on time). Linus never took them. We are all using the 6.16 version of bcachefs without those patches. I imagine stories of bcachefs data loss would get lots of press right now. Have you heard any?

There are very few stories of bcachefs data loss. When I have heard of them, they seems to result in recovery. A couple I have seen were mount failures (not data loss) and were resolved. It has been rock-solid for me.

[koverstreet]

Eh? Linus has called it "experimental garbage that no one could be using" a whole bunch of times, based on absolutely nothing as far as I can tell.

Meanwhile just scan the thread for btrfs reports...

[optionalsquid]

> Eh? Linus has called it "experimental garbage that no one could be using" a whole bunch of times, based on absolutely nothing as far as I can tell.

Where did Linus call bcachefs "experimental garbage"? I've tried finding those comments before, but all I've been able to find are your comments stating that Linus said that

[jandrese]

Don't you only have to do that once per machine? After that the kernel should use the key you installed for every module that needs it. It is a pain in the ass for sure, but if you make it part of the deployment process it's manageable.

For sure it's a headache when you install some module on a whole bunch of headless boxes at once and then discover you need to roll a crash cart over to each and every one to get them booting again, but the secure boot guys would have it no other way.