Ceph

To get around the issue of a child image needing to update the parent image's header, Sage suggested only allowing access to class methods that add/remove the child from the parent image's child list, and using uuids to make the entries in the list of children hard to guess.

Being a little bit more explicit: the point of the UUIDs is to allow child images to add themselves to the parent's list of children (but do no other write operations), and remove themselves from the list, but not remove other entries belonging to other children (because attackers can't easily guess the UUID of other children, and cannot list them).

The other point that came up was, if rbd can't delete the parent volume until all children have been deleted, the glance backend for rbd needs to handle this somehow.