So an image released in March? I’m not sure I’d proclaim it completely solved when it’s been ga for all of three months.

Indeed, I was referring to Attended Sysupgrade in luci or CLI.

What switches are you running it on?

All of that is a nope. The solution is that a router should have a standard unattended upgrade system built into it that is on by default and pulls from the stable release stream, preserves your configuration automatically with a 100% guarantee of it working, automatically falls back to the last known working image if the update fails, and has a way to notify you of what’s going on with it. This must work out of the box with the first install without you having to do anything at all or even be aware of it except perhaps setting the time of day and day of week/month when the router is allowed to reboot itself for the upgrades (but the default should be set automatically by the system). Anything less than that is simply broken for anything that is considered production quality. Words like “image builder” and “config baked into the image” are for those developing the system, not end users.

Maybe so. The documentation seems to be all over the map, and the GUI suggests using "attended sysupgrade" for upgrades.

...which I tried doing, a week or so ago, for a minor point release update within the 25.12.x series. And then the router went out to lunch and didn't come back.

Getting it going again wasn't so bad as such things go. My router has a huge advantage here in that it's a Raspberry Pi 4, so it's easy to remove/replace/re-do the flash device and start over.

(Except: I get all out of sorts when I need to do Internet stuff to fix my Internet connection while that Internet connection is absent.)

But what if you don't want to tinker? I switched to OPNsense as a direct replacement for our Asus "WiFi routers", and it has been phenomenal, reliable, and does everything needed - when you just want it to work, it really just does. But when you want more advanced functions, there are tons of plugins and stuff that you can run natively, while still having a true CLI.

I suppose it comes down to what you said - "if you intend to run other stuff on the same hardware." Is it a good idea to run all sorts of extra stuff on your literal firewall/router? And if you did, I'd assume using a hypervisor is safer anyway? That way you can have the GUI and reliability of OPNsense but have a Linux distro beside it.

You also said that Linux has much better performance vs BSD, which seems rather far fetched. Got any data for that?

One other thing: OPNsense comes with a ton of helpful rules to eliminate bot traffic, allow IPv6, different NATs, VLANS, etc which you'd have to add manually. Not the end of the world, but worth considering.

Please support your claim about (networking) performance of BSD-based systems and Linux with some source(s). It surprised me. Thank you.

Thats more or less what I did, and nix just made sense for the job. For 99% of people I'd say no its not worth it to tinker, just go with opnsense virtualized so you get at least some the benefits of the better linux drivers. By that I mean NBASE-T on various intel chips and while intel's igb is fairly solid on unixes many other vendors' drivers are less so. However if you're willing to figure out configuring per your needs you definitely can get a lower latency router with all the same capabilities and more, with it's components more sanely isolated via containers.

Some people want a webinterface tho.