# mvirt 0.14.6 migrations: no wire: unchanged rev: 5c968f7119f9c16ec4dcf4084189edcb49f8805f v0.14.6 β€” a template import can actually reach the network and has somewhere to put the image Two defects behind "the import fails", both traced on the fleet with tcpdump and the eBPF maps. - node: the reverse-path filter is now LOOSE. NixOS defaults it to strict and implements it as `-m rpfilter` in mangle PREROUTING β€” a hook the rp_filter sysctl counters never mention, which is why everything looked clean. mvirt routes asymmetrically by design (an externally-routed prefix leaves through its anchor's tunnel while a non-anchor border relays the same source over the underlay), so strict dropped every relayed packet on the anchor. Loose still drops a source with no route anywhere. - import image m2: the download + qcow2β†’raw scratch moved off /tmp, which every container gets as an unsized tmpfs (RAM, half the pod-VM's memory = 256 MiB here), onto /var/tmp β€” rootfs-backed by the pod's 8 GiB scratch disk. A stock cloud image did not fit in RAM before the conversion started. Upgrade: control-plane host first, then nodes one at a time; a node rolls back by booting the previous generation. ## Upgrading Point your flake's `mvirt` input at this release and redeploy the control-plane host first, then each node in turn: ``` nix run .#colmena -- apply boot --reboot --on nix run .#colmena -- apply boot --reboot --on # one at a time ``` This release adds no migrations, so the control-plane host rolls back the same way a node does: boot the previous NixOS generation.