pub fn check_filesystem(path: &Path) -> Result<()>Expand description
Refuse to start on a filesystem the read path cannot survive.
Every block is read through mmap. On a network filesystem a server that
goes away, or a file that changes length underneath a mapping, is delivered
as SIGBUS — a signal, not an io::Error. There is nothing to catch and no
way to unwind; the process dies mid-query. The atomicity this design rests on
is also weaker there: NFS rename is atomic on the server but a client may
still serve a cached negative lookup, and fsync semantics vary by mount
option. Both are reasons to say no at startup rather than at 3am.
Called once, on the data directory, before anything is published or mapped.