Require manual confirmation to purge database with purge-db

[macladson]

Issue Addressed

#5028

Proposed Changes

The purge-db flag now requires manual confirmation in order to purge the database.
A new flag called purge-db-force has been added for those who still wish to purge with no intervention.

Additional Info

This is a pretty spicy breaking change as I suspect --purge-db is widely used.

See the alternative (although outdated) PR here which adds a purge-db-safe flag, which means the safety would effectively become opt-in. In my opinion this is unnatural, although more convenient as it doesn't require a breaking change.

[michaelsproul]

@mergify queue

[mergify]

queue

✅ The pull request has been merged automatically

The pull request has been merged automatically at 32f2e05

[wjmelements]

I don't use interactive mode. For me this was a stupid and annoying breaking change. I am curious if anyone was grateful about it. #5088 would have been better because it would not have been a breaking change. Those wanting confirmation in interactive mode would still have it.

[wjmelements]

The most annoying aspect is that it fails to purge the db quietly. My node was broken for an excessive amount of time because the db was not purged as expected.

[wjmelements]

It would have been less annoying even if it had caused an early exit, because then I would have noticed weeks earlier.

[michaelsproul]

@wjmelements We have a lot of users who used to purge-db excessively due to either forgetting to remove the flag from their config, or not understanding that they should remove it. This change was designed to help them, and I think so far it has been effective.

It would have been less annoying even if it had caused an early exit, because then I would have noticed weeks earlier.

We try to avoid breaking changes like this that temporarily brick the node, because they represent a headache for node admins. Having a node suddenly fail to start is more annoying for many people than having it start with a warning and a different behaviour to what was expected. Especially in this case, where the different behaviour is somewhat benign (keeping the DB).

The most annoying aspect is that it fails to purge the db quietly. My node was broken for an excessive amount of time because the db was not purged as expected.

I don't understand how purge-db was both an essential part of your node operation, and also how your node was out of sync for weeks without you noticing. I suspect you're using Lighthouse in a somewhat different way to the majority of users, where you don't run it all the time, and just checkpoint sync it whenever you do want it. But then I still don't understand how you didn't notice that it wasn't synced? You mustn't have actually been relying on it for anything?

Anyway, the ship has sailed on this. The breaking change was clearly described in the release notes. We're not going to implement another breaking change to put it back to how it was.

[wjmelements]

We have a lot of users who used to purge-db excessively due to either forgetting to remove the flag from their config, or not understanding that they should remove it

Unless these users are disproportionately using interactive mode, it's going to be the same problem but with purge-db-force.

We're not going to implement another breaking change

Until you decide to implement purge-db-force-force

I don't understand how purge-db was both an essential part of your node operation, and also how your node was out of sync for weeks without you noticing. I suspect you're using Lighthouse in a somewhat different way to the majority of users, where you don't run it all the time, and just checkpoint sync it whenever you do want it. But then I still don't understand how you didn't notice that it wasn't synced? You mustn't have actually been relying on it for anything?

I run between 5 and 20 nodes. I don't check the broken ones constantly. There are scripts to unbreak them. You broke those scripts. The logs indicating why the purge didn't work got cycled. Pardon my frustration.