Field updates that can’t brick a device
- 18 releases
- A/B rollback
- Watchdog recovery
- Challenge
- A fleet of Raspberry Pi kiosks needed remote updates and provisioning, with nobody on site to recover a device when an update goes wrong.
- What we did
- Built the loader that supervises the kiosk software: A/B app slots with automatic rollback after repeated failures, a 21-step provisioning script that is safe to re-run, a systemd watchdog, and a Jenkins + Docker pipeline that checks every release before it ships.
- Result
- 18 releases over 18 months, each rolled out remotely and rolled back automatically if it fails.