Skip to main content
RunBook Academy

CephXXXVII · RBD SnapshotsRBD Snapshots

Rolling back to a snapshot

Intermediate⏱ ~16 minrbd

What you'll learn

  • Perform a snapshot rollback safely
  • Predict the duration and impact of a rollback
  • Choose between rollback, clone, and export
  • Protect against an accidental rollback

Prerequisites

  • T
  • h
  • e
  • i
  • m
  • a
  • g
  • e
  • u
  • n
  • m
  • a
  • p
  • p
  • e
  • d
  • f
  • r
  • o
  • m
  • e
  • v
  • e
  • r
  • y
  • c
  • l
  • i
  • e
  • n
  • t
  • ,
  • a
  • n
  • d
  • c
  • o
  • n
  • f
  • i
  • r
  • m
  • a
  • t
  • i
  • o
  • n
  • t
  • h
  • a
  • t
  • d
  • a
  • t
  • a
  • w
  • r
  • i
  • t
  • t
  • e
  • n
  • s
  • i
  • n
  • c
  • e
  • t
  • h
  • e
  • s
  • n
  • a
  • p
  • s
  • h
  • o
  • t
  • i
  • s
  • g
  • e
  • n
  • u
  • i
  • n
  • e
  • l
  • y
  • e
  • x
  • p
  • e
  • n
  • d
  • a
  • b
  • l
  • e
  • .

Verified against Ceph Tentacle 20.2.x · Ceph Squid 19.2.x (supported previous) · cephadm matches the verified Ceph release · podman 4.x · csi-rbd and csi-cephfs current · RBD / CephFS / RGW current (matches Ceph release) · Linux kernel 5.15+ (5.10 minimum) · Ubuntu 24.04 LTS (Ceph host baseline) · Debian 12 (Bookworm) (Ceph host baseline) · Rocky Linux / RHEL / AlmaLinux 9.x (Ceph host baseline) · Proxmox VE 9.x (cross-course integration) · Kubernetes 1.31+ (cross-course integration) · 2026-08-18

Not yet marked complete on this device.

Why this matters in production

Rollback is destructive by design: it discards every write since the snapshot, permanently. It is also frequently not the right tool — a clone achieves the same recovery goal without destroying the current state, and takes the same amount of time to set up.

The operation

# the image must not be in use
rbd status rbd-vms/vm-disk-01
# Watchers: none

rbd snap rollback rbd-vms/vm-disk-01@before-upgrade
# Rolling back to snapshot: 100% complete...done.

rbd map rbd-vms/vm-disk-01
mount /dev/rbd0 /mnt/data

rbd status showing watchers means a client still has the image open. Rolling back underneath a live client corrupts what that client is doing.

What it costs

Rollback copies the snapshot’s preserved object versions back over the current ones. Duration is proportional to how much changed since the snapshot — the same figure that determines the snapshot’s capacity cost.

rbd du rbd-vms/vm-disk-01
# the snapshot's USED column is roughly what will be rewritten

On a heavily-modified image this is not instant, and the image is unusable throughout.

The alternative: clone instead

rbd snap protect rbd-vms/vm-disk-01@before-upgrade
rbd clone rbd-vms/vm-disk-01@before-upgrade rbd-vms/vm-disk-01-recovered
rbd map rbd-vms/vm-disk-01-recovered

Instant, non-destructive, and the original image is untouched. You can inspect the recovered state, copy out what you need, and decide afterwards — which is almost always better than committing immediately.

RollbackClone
Speedproportional to changeinstant
Destroys current stateyesno
Requires image offlineyesno
Keeps the image nameyesno
Reversiblenoyes

Use rollback when you are certain, when the image name must not change, and when the current state is definitively unwanted. Use a clone in every other case.

Protecting against accidents

rbd snap protect rbd-vms/golden@v1
rbd snap rollback rbd-vms/golden@v1
# Error: snapshot is protected

Protection prevents both deletion and rollback, which makes it a useful guard on snapshots that exist as clone parents or as reference points.

Quiz

Knowledge check · 4 questions

  1. Q1. You need to recover data from a snapshot but are not certain the current image state is expendable. What should you do?

  2. Q2. `rbd status` showing watchers means the image is safe to roll back.

  3. Q3. Recover a VM after a failed application upgrade.

    An application upgrade on a production VM has failed. A snapshot was taken before the upgrade. The VM has been running for six hours since, and users have created data during that time that ideally should not be lost.

  4. Q4. Why is cloning a snapshot instant while rolling back to it is not?

Passing score: 75%. Answers are checked in this browser.

Production discipline

Default to cloning rather than rolling back; it achieves the same recovery with none of the destruction and costs nothing extra. Where a rollback is genuinely required, make the watcher check a mandatory step — rolling back underneath a live client is the worst outcome the operation has and the check that prevents it takes seconds.

Cross-course references

  • Kubernetes: restoring a PVC from a VolumeSnapshot creates a new volume for the same reason
  • Linux: git checkout -b from a commit versus git reset --hard is the identical choice