Atomic rollback with occasional local packages: DNF transactions or image-based updates

Direct Answer

For a fleet with short maintenance windows and intermittent local RPMs, image-based updates (bootc/ostree-style deployments) are the better fit because rollback is a bootloader selection into a previously staged deployment, restoring the kernel, initramfs, and userspace together. DNF's history rollback reverses RPM database entries but does not guarantee a coherent prior kernel or bootloader state.

Confirmed Facts vs. Items Needing Verification

Confirmed by general EL ecosystem behavior: DNF transactions accept arbitrary third-party RPMs at runtime, while image-based updates stage complete deployments atomically. Locally layered packages in image mode persist across base-image updates and can drift from base-image libraries.

Requires verification against Rocky Linux release notes: Rocky tracks RHEL minors but is not byte-identical. Specific bootc/ostree defaults, module signing requirements, and any Rocky-specific policy on layering versus rebuilding must be confirmed for your target Rocky minor release rather than assumed from RHEL or Fedora documentation.

Layering vs. Rebuilding

Rocky Linux does not publish a single, blanket policy that resolves every layering-versus-rebuild case. A practical split:

• Layer small, leaf-node utilities that do not introduce deep library dependencies and do not need to exist in the initramfs.
• Rebuild the base image when the package requires specific library versions, must be present early in boot, or includes kernel modules. This keeps the deployment self-contained.

Out-of-Tree Modules Under Image Mode

1. Build into the base image so the module is locked to the exact kernel and trust chain of that deployment.
2. Layer only with exact kernel version matching if the RPM carries a hard Requires: kernel = <version>; verify with rpm -q --requires <pkg>.
3. Avoid akmods/DKMS in image mode. They compile at boot or update time, which undermines the pre-staged, immutable deployment model and can break the rollback guarantee.

Verification Steps

# Confirm DNF rollback gap on a disposable test host
sudo dnf history rollback <txid>
# After reboot, compare running kernel and default boot entry
uname -r
grubby --default-kernel

# After a base-image update, inventory layered packages
rpm -qa | grep '^layered-'
# Check for library drift on a layered binary
ldd /usr/bin/<layered-binary>

# Boot the previous deployment and confirm module state
lsmod | grep <module_name>

One Missing Diagnostic

Do your hosts require Secure Boot with custom MOK enrollment? If yes, module signing and shim behavior must be scripted into the image build; otherwise, image mode may be blocked on real hardware even if it works in a VM.