# Set the PostgreSQL link-mode upgrade rollback boundary before startup

> Decide the independent rollback path before starting a PostgreSQL cluster upgraded with linked files.

- Canonical URL: https://update.dsesecurity.com/updates/set-the-postgresql-link-mode-upgrade-rollback-boundary-before-startup/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:32:42+00:00
- Modified: 2026-10-15T13:36:15+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

Decide the independent rollback path before starting a PostgreSQL cluster upgraded with linked files.

## Potentially affected

This applies to PostgreSQL 17 pg_upgrade planning. It addresses the link-mode rollback boundary, not every extension compatibility check or permission to upgrade an unsupported application stack.

## DSE recommendation

DSE recommends writing the rollback decision before the upgrade begins: which untouched recovery copy exists, who can approve first startup, and what evidence must be reviewed at that gate.

## Article

Decide the independent rollback path before starting a PostgreSQL cluster upgraded with linked files.

## Source facts

PostgreSQL 17 pg_upgrade offers link mode to avoid copying data files, reducing upgrade time and extra space compared with copying. The old and new data directories must share a filesystem for that mode. Crucially, once the upgraded new cluster is started, the old cluster is no longer usable with those linked files. The check option performs compatibility checks without changing data. Clone mode has different availability and old-cluster consequences, so the chosen mode matters to rollback design.

Source: [PostgreSQL 17 — pg_upgrade](https://www.postgresql.org/docs/17/pgupgrade.html).

## Applicability

This applies to PostgreSQL 17 pg_upgrade planning. It addresses the link-mode rollback boundary, not every extension compatibility check or permission to upgrade an unsupported application stack.

## DSE recommendation

DSE recommends writing the rollback decision before the upgrade begins: which untouched recovery copy exists, who can approve first startup, and what evidence must be reviewed at that gate. Run compatibility checks and a timed rehearsal using the intended mode. Do not describe the old data directory as the fallback after linked-file startup. Record filesystem prerequisites and restoration steps explicitly, along with the application checks needed before normal write traffic resumes.

## Verification

Rehearse the upgrade on an isolated copy, retain check output, and verify the documented recovery path from an independent preserved copy. Confirm the team understands the point after which the old linked directory cannot serve as rollback. Record application and extension checks before approving the live plan.

## Official reference

[PostgreSQL 17 — pg_upgrade](https://www.postgresql.org/docs/17/pgupgrade.html). Reviewed October 15, 2026.

## Primary reference

- Name: PostgreSQL 17 — pg_upgrade
- Authority: www.postgresql.org
- URL: https://www.postgresql.org/docs/17/pgupgrade.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Set the PostgreSQL link-mode upgrade rollback boundary before startup,” DSE Security, https://update.dsesecurity.com/updates/set-the-postgresql-link-mode-upgrade-rollback-boundary-before-startup/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.