# Convention: ZFS boot environments

Solnix treats **ZFS boot environments** (BEs) as system generations — the illumos
analog of NixOS generations plus a bootloader rollback.

- A system change (upgrade, risky config) creates a **new BE** — a clone of the
  current root filesystem. The running system is untouched until you boot into
  the new BE.
- If the new BE is bad, **boot the previous one** — instant rollback, no restore
  from backup.
- Managed with `beadm`:
  ```
  beadm list                 # show boot environments
  beadm create pre-upgrade   # snapshot the current root as a named BE
  beadm activate <be>        # boot into <be> next time
  beadm destroy <be>         # remove an old BE
  ```

## Why it matters for Solnix

Nix already makes package sets atomic and rollback-able; ZFS BEs extend that to
the *whole system state* (including things outside the Nix store) and to the boot
path. Together they make "try it, roll back if it breaks" the default safety
model.

For packagers/admins: design upgrades to be BE-friendly — don't mutate shared
mutable state in a way that can't be rolled back by booting the prior BE.
Reference: <https://solnix.io/handbook/boot-environments>.