From 2c18f6d975b26286f234ae7c17353530f3a22c6b Mon Sep 17 00:00:00 2001
From: MacRimi <ricoextincion@gmail.com>
Date: Thu, 12 Mar 2026 23:37:21 +0100
Subject: [PATCH] update oci manager

---
 AppImage/components/secure-gateway-setup.tsx |   18 +-
 AppImage/scripts/build_appimage.sh           |    3 +-
 AppImage/scripts/oci_manager.py              | 1259 +++++++++---------
 3 files changed, 620 insertions(+), 660 deletions(-)

diff --git a/AppImage/components/secure-gateway-setup.tsx b/AppImage/components/secure-gateway-setup.tsx
index edd696af..f879ab3b 100644
--- a/AppImage/components/secure-gateway-setup.tsx
+++ b/AppImage/components/secure-gateway-setup.tsx
@@ -99,11 +99,14 @@ export function SecureGatewaySetup() {
   const loadInitialData = async () => {
     setLoading(true)
     try {
-      // Load runtime info (just for display, deploy will auto-install if needed)
+      // Load runtime info (checks for Proxmox 9.1+ OCI support)
       const runtimeRes = await fetchApi("/api/oci/runtime")
       if (runtimeRes.success && runtimeRes.available) {
         setRuntimeAvailable(true)
         setRuntimeInfo({ runtime: runtimeRes.runtime, version: runtimeRes.version })
+      } else {
+        // Show version requirement message
+        setRuntimeInfo({ runtime: "proxmox-lxc", version: runtimeRes.version || "unknown" })
       }
 
       // Load app definition
@@ -180,8 +183,8 @@ export function SecureGatewaySetup() {
       if (!result.success) {
         // Make runtime errors more user-friendly
         let errorMsg = result.message || "Deployment failed"
-        if (errorMsg.includes("runtime not available") || errorMsg.includes("Container runtime")) {
-          errorMsg = "Container runtime (Podman) is required but could not be installed automatically. Please run 'apt install podman' on your Proxmox host first, then try again."
+        if (errorMsg.includes("9.1") || errorMsg.includes("OCI") || errorMsg.includes("not supported")) {
+          errorMsg = "OCI containers require Proxmox VE 9.1 or later. Please upgrade your Proxmox installation to use this feature."
         }
         setDeployError(errorMsg)
         setDeploying(false)
@@ -805,18 +808,19 @@ export function SecureGatewaySetup() {
           {runtimeAvailable ? (
             <div className="flex items-center gap-2 text-xs text-muted-foreground">
               <CheckCircle className="h-3.5 w-3.5 text-green-500" />
-              <span>{runtimeInfo?.runtime} {runtimeInfo?.version} available</span>
+              <span>Proxmox VE {runtimeInfo?.version} - OCI support available</span>
             </div>
           ) : (
-            <div className="flex items-center gap-2 text-xs text-muted-foreground">
-              <Info className="h-3.5 w-3.5 text-cyan-500" />
-              <span>Podman will be installed automatically during deployment</span>
+            <div className="flex items-center gap-2 text-xs text-yellow-500">
+              <AlertTriangle className="h-3.5 w-3.5" />
+              <span>Requires Proxmox VE 9.1+ (current: {runtimeInfo?.version || "unknown"})</span>
             </div>
           )}
 
           <Button
             onClick={() => setShowWizard(true)}
             className="w-full bg-cyan-600 hover:bg-cyan-700"
+            disabled={!runtimeAvailable}
           >
             <ShieldCheck className="h-4 w-4 mr-2" />
             Deploy Secure Gateway
diff --git a/AppImage/scripts/build_appimage.sh b/AppImage/scripts/build_appimage.sh
index 6ace6c92..bbf806ca 100644
--- a/AppImage/scripts/build_appimage.sh
+++ b/AppImage/scripts/build_appimage.sh
@@ -310,7 +310,8 @@ pip3 install --target "$APP_DIR/usr/lib/python3/dist-packages" --upgrade --no-de
     PyJWT \
     pyotp \
     segno \
-    beautifulsoup4
+    beautifulsoup4 \
+    cryptography
 
 # Phase 3: Install WebSocket with newer h11
 pip3 install --target "$APP_DIR/usr/lib/python3/dist-packages" --upgrade \
diff --git a/AppImage/scripts/oci_manager.py b/AppImage/scripts/oci_manager.py
index c4a2a8d6..73af454b 100644
--- a/AppImage/scripts/oci_manager.py
+++ b/AppImage/scripts/oci_manager.py
@@ -3,17 +3,20 @@
 """
 ProxMenux OCI Manager
 
-Manages deployment and lifecycle of OCI container applications.
-Supports both podman and docker runtimes.
+Manages deployment and lifecycle of OCI container applications using Proxmox VE 9.1+
+native LXC from OCI images functionality.
 
 Usage:
     - As library: import oci_manager; oci_manager.deploy_app(...)
     - As CLI: python oci_manager.py deploy --app-id secure-gateway --config '{...}'
 """
 
+import base64
 import json
 import logging
 import os
+import re
+import secrets
 import shutil
 import subprocess
 import time
@@ -21,13 +24,19 @@ from datetime import datetime
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple
 
+# Optional: cryptography for encryption
+try:
+    from cryptography.fernet import Fernet
+    ENCRYPTION_AVAILABLE = True
+except ImportError:
+    ENCRYPTION_AVAILABLE = False
+
 # Logging
 logger = logging.getLogger("proxmenux.oci")
 
 # =================================================================
 # Paths
 # =================================================================
-# Production paths - persistent data in /usr/local/share/proxmenux/oci
 OCI_BASE_DIR = "/usr/local/share/proxmenux/oci"
 CATALOG_FILE = os.path.join(OCI_BASE_DIR, "catalog.json")
 INSTALLED_FILE = os.path.join(OCI_BASE_DIR, "installed.json")
@@ -35,269 +44,173 @@ INSTANCES_DIR = os.path.join(OCI_BASE_DIR, "instances")
 
 # Source catalog from Scripts (bundled with ProxMenux)
 SCRIPTS_CATALOG = "/usr/local/share/proxmenux/scripts/oci/catalog.json"
-
-# For development/testing in v0 environment
 DEV_SCRIPTS_CATALOG = os.path.join(os.path.dirname(__file__), "..", "..", "Scripts", "oci", "catalog.json")
 
+# Encryption key file
+ENCRYPTION_KEY_FILE = os.path.join(OCI_BASE_DIR, ".encryption_key")
 
+# Default storage for templates
+DEFAULT_STORAGE = "local"
+
+# VMID range for OCI containers (9000-9999 to avoid conflicts)
+OCI_VMID_START = 9000
+OCI_VMID_END = 9999
+
+
+# =================================================================
+# Encryption Functions for Sensitive Data
+# =================================================================
+def _get_or_create_encryption_key() -> bytes:
+    """Get or create the encryption key for sensitive data."""
+    if os.path.exists(ENCRYPTION_KEY_FILE):
+        with open(ENCRYPTION_KEY_FILE, 'rb') as f:
+            return f.read()
+    
+    if ENCRYPTION_AVAILABLE:
+        key = Fernet.generate_key()
+    else:
+        key = secrets.token_bytes(32)
+    
+    os.makedirs(os.path.dirname(ENCRYPTION_KEY_FILE), exist_ok=True)
+    with open(ENCRYPTION_KEY_FILE, 'wb') as f:
+        f.write(key)
+    os.chmod(ENCRYPTION_KEY_FILE, 0o600)
+    
+    return key
+
+
+def encrypt_sensitive_value(value: str) -> str:
+    """Encrypt a sensitive value. Returns base64-encoded string with 'ENC:' prefix."""
+    if not value:
+        return value
+    
+    key = _get_or_create_encryption_key()
+    
+    if ENCRYPTION_AVAILABLE:
+        f = Fernet(key)
+        encrypted = f.encrypt(value.encode())
+        return "ENC:" + encrypted.decode()
+    else:
+        value_bytes = value.encode()
+        encrypted = bytes(v ^ key[i % len(key)] for i, v in enumerate(value_bytes))
+        return "ENC:" + base64.b64encode(encrypted).decode()
+
+
+def decrypt_sensitive_value(encrypted: str) -> str:
+    """Decrypt a sensitive value."""
+    if not encrypted or not encrypted.startswith("ENC:"):
+        return encrypted
+    
+    encrypted_data = encrypted[4:]
+    key = _get_or_create_encryption_key()
+    
+    try:
+        if ENCRYPTION_AVAILABLE:
+            f = Fernet(key)
+            decrypted = f.decrypt(encrypted_data.encode())
+            return decrypted.decode()
+        else:
+            encrypted_bytes = base64.b64decode(encrypted_data)
+            decrypted = bytes(v ^ key[i % len(key)] for i, v in enumerate(encrypted_bytes))
+            return decrypted.decode()
+    except Exception as e:
+        logger.error(f"Failed to decrypt value: {e}")
+        return encrypted
+
+
+def encrypt_config_sensitive_fields(config: Dict[str, Any], schema: Dict[str, Any]) -> Dict[str, Any]:
+    """Encrypt sensitive fields in config based on schema."""
+    encrypted_config = config.copy()
+    for field_name, field_schema in schema.items():
+        if field_schema.get("sensitive") and field_name in encrypted_config:
+            value = encrypted_config[field_name]
+            if value and not str(value).startswith("ENC:"):
+                encrypted_config[field_name] = encrypt_sensitive_value(str(value))
+    return encrypted_config
+
+
+def decrypt_config_sensitive_fields(config: Dict[str, Any], schema: Dict[str, Any]) -> Dict[str, Any]:
+    """Decrypt sensitive fields in config based on schema."""
+    decrypted_config = config.copy()
+    for field_name, field_schema in schema.items():
+        if field_schema.get("sensitive") and field_name in decrypted_config:
+            value = decrypted_config[field_name]
+            if value and str(value).startswith("ENC:"):
+                decrypted_config[field_name] = decrypt_sensitive_value(str(value))
+    return decrypted_config
+
+
+# =================================================================
+# Directory Management
+# =================================================================
 def ensure_oci_directories():
-    """
-    Ensure OCI directories exist and catalog is available.
-    Called on first use to initialize the OCI environment.
-    """
-    # Create base directories
+    """Ensure OCI directories exist and catalog is available."""
     os.makedirs(OCI_BASE_DIR, exist_ok=True)
     os.makedirs(INSTANCES_DIR, exist_ok=True)
     
-    # Copy catalog from Scripts if not present in OCI dir
     if not os.path.exists(CATALOG_FILE):
-        # Try production path first
         if os.path.exists(SCRIPTS_CATALOG):
             shutil.copy2(SCRIPTS_CATALOG, CATALOG_FILE)
-            logger.info(f"Copied catalog from {SCRIPTS_CATALOG}")
-        # Try development path
         elif os.path.exists(DEV_SCRIPTS_CATALOG):
             shutil.copy2(DEV_SCRIPTS_CATALOG, CATALOG_FILE)
-            logger.info(f"Copied catalog from {DEV_SCRIPTS_CATALOG}")
     
-    # Create empty installed.json if not present
     if not os.path.exists(INSTALLED_FILE):
         with open(INSTALLED_FILE, 'w') as f:
             json.dump({"version": "1.0.0", "instances": {}}, f, indent=2)
-        logger.info(f"Created empty installed.json")
-
-# Container name prefix
-CONTAINER_PREFIX = "proxmenux"
 
 
 # =================================================================
-# Runtime Installation
+# Proxmox VE Detection and Compatibility
 # =================================================================
-def install_runtime(runtime: str = "podman") -> Dict[str, Any]:
-    """
-    Install container runtime (podman or docker).
-    
-    Args:
-        runtime: Runtime to install ('podman' or 'docker')
-    
-    Returns:
-        Dict with success status and message
-    """
+def check_proxmox_version() -> Dict[str, Any]:
+    """Check Proxmox VE version and OCI support."""
     result = {
-        "success": False,
-        "message": "",
-        "runtime": runtime
-    }
-    
-    logger.info(f"Installing container runtime: {runtime}")
-    print(f"\n{'='*60}")
-    print(f"  Installing {runtime.capitalize()}")
-    print(f"{'='*60}\n")
-    
-    try:
-        # Detect distribution
-        distro = "debian"  # Default
-        if os.path.exists("/etc/os-release"):
-            with open("/etc/os-release") as f:
-                content = f.read().lower()
-                if "alpine" in content:
-                    distro = "alpine"
-                elif "arch" in content:
-                    distro = "arch"
-                elif "fedora" in content or "rhel" in content or "centos" in content:
-                    distro = "rhel"
-        
-        # Install commands by distro
-        install_commands = {
-            "debian": {
-                "podman": ["apt-get", "update", "&&", "apt-get", "install", "-y", "podman"],
-                "docker": ["apt-get", "update", "&&", "apt-get", "install", "-y", "docker.io"]
-            },
-            "alpine": {
-                "podman": ["apk", "add", "--no-cache", "podman"],
-                "docker": ["apk", "add", "--no-cache", "docker"]
-            },
-            "arch": {
-                "podman": ["pacman", "-Sy", "--noconfirm", "podman"],
-                "docker": ["pacman", "-Sy", "--noconfirm", "docker"]
-            },
-            "rhel": {
-                "podman": ["dnf", "install", "-y", "podman"],
-                "docker": ["dnf", "install", "-y", "docker-ce"]
-            }
-        }
-        
-        # Get install command
-        if distro == "debian":
-            # Use shell for && syntax
-            if runtime == "podman":
-                cmd = "apt-get update && apt-get install -y podman"
-            else:
-                cmd = "apt-get update && apt-get install -y docker.io"
-            
-            print(f"[*] Running: {cmd}")
-            proc = subprocess.run(
-                cmd,
-                shell=True,
-                capture_output=False,
-                timeout=300
-            )
-        else:
-            cmd = install_commands.get(distro, {}).get(runtime, [])
-            if not cmd:
-                result["message"] = f"Unsupported distro: {distro}"
-                return result
-            
-            print(f"[*] Running: {' '.join(cmd)}")
-            proc = subprocess.run(
-                cmd,
-                capture_output=False,
-                timeout=300
-            )
-        
-        if proc.returncode != 0:
-            result["message"] = f"Failed to install {runtime}"
-            return result
-        
-        # Configure podman registries if needed
-        if runtime == "podman":
-            registries_conf = "/etc/containers/registries.conf"
-            if os.path.exists("/etc/containers") and not os.path.exists(registries_conf):
-                try:
-                    with open(registries_conf, 'w') as f:
-                        f.write('unqualified-search-registries = ["docker.io", "quay.io", "ghcr.io"]\n')
-                    print("[*] Configured container registries")
-                except Exception as e:
-                    logger.warning(f"Could not configure registries: {e}")
-        
-        # Verify installation
-        verify_cmd = shutil.which(runtime)
-        if verify_cmd:
-            print(f"\n[OK] {runtime.capitalize()} installed successfully!")
-            result["success"] = True
-            result["message"] = f"{runtime.capitalize()} installed successfully"
-            result["path"] = verify_cmd
-        else:
-            result["message"] = f"{runtime.capitalize()} installed but not found in PATH"
-        
-    except subprocess.TimeoutExpired:
-        result["message"] = "Installation timed out"
-    except Exception as e:
-        logger.error(f"Failed to install runtime: {e}")
-        result["message"] = str(e)
-    
-    return result
-
-
-def ensure_runtime() -> Dict[str, Any]:
-    """
-    Ensure a container runtime is available, installing if necessary.
-    
-    Returns:
-        Dict with runtime info (same as detect_runtime)
-    """
-    runtime_info = detect_runtime()
-    
-    if runtime_info["available"]:
-        return runtime_info
-    
-    # No runtime available, install podman
-    print("\n[!] No container runtime found. Installing Podman...")
-    install_result = install_runtime("podman")
-    
-    if not install_result["success"]:
-        return {
-            "available": False,
-            "runtime": None,
-            "version": None,
-            "path": None,
-            "error": install_result["message"]
-        }
-    
-    # Re-detect after installation
-    return detect_runtime()
-
-
-# =================================================================
-# Runtime Detection
-# =================================================================
-def detect_runtime() -> Dict[str, Any]:
-    """
-    Detect available container runtime (podman or docker).
-    Returns dict with runtime info.
-    """
-    result = {
-        "available": False,
-        "runtime": None,
+        "is_proxmox": False,
         "version": None,
-        "path": None,
+        "oci_support": False,
         "error": None
     }
     
-    # Try podman first (preferred for Proxmox)
-    podman_path = shutil.which("podman")
-    if podman_path:
-        try:
-            proc = subprocess.run(
-                ["podman", "--version"],
-                capture_output=True, text=True, timeout=5
-            )
-            if proc.returncode == 0:
-                version = proc.stdout.strip().replace("podman version ", "")
-                result.update({
-                    "available": True,
-                    "runtime": "podman",
-                    "version": version,
-                    "path": podman_path
-                })
-                return result
-        except Exception as e:
-            logger.warning(f"Podman found but failed to get version: {e}")
+    try:
+        # Check if pveversion exists
+        if not shutil.which("pveversion"):
+            result["error"] = "Not running on Proxmox VE"
+            return result
+        
+        proc = subprocess.run(
+            ["pveversion"],
+            capture_output=True, text=True, timeout=5
+        )
+        
+        if proc.returncode != 0:
+            result["error"] = "Failed to get Proxmox version"
+            return result
+        
+        # Parse version: "pve-manager/9.1-2/abc123..."
+        version_str = proc.stdout.strip()
+        result["is_proxmox"] = True
+        
+        match = re.search(r'pve-manager/(\d+)\.(\d+)', version_str)
+        if match:
+            major = int(match.group(1))
+            minor = int(match.group(2))
+            result["version"] = f"{major}.{minor}"
+            # OCI support requires Proxmox VE 9.1+
+            result["oci_support"] = (major > 9) or (major == 9 and minor >= 1)
+        
+        if not result["oci_support"]:
+            result["error"] = f"OCI support requires Proxmox VE 9.1+, found {result['version']}"
+            
+    except Exception as e:
+        result["error"] = str(e)
     
-    # Try docker as fallback
-    docker_path = shutil.which("docker")
-    if docker_path:
-        try:
-            proc = subprocess.run(
-                ["docker", "--version"],
-                capture_output=True, text=True, timeout=5
-            )
-            if proc.returncode == 0:
-                # Parse "Docker version 24.0.5, build abc123"
-                version = proc.stdout.strip()
-                if "version" in version.lower():
-                    version = version.split("version")[1].split(",")[0].strip()
-                result.update({
-                    "available": True,
-                    "runtime": "docker",
-                    "version": version,
-                    "path": docker_path
-                })
-                return result
-        except Exception as e:
-            logger.warning(f"Docker found but failed to get version: {e}")
-    
-    result["error"] = "No container runtime found. Install podman or docker."
     return result
 
 
-def _get_runtime() -> Optional[str]:
-    """Get the runtime command (podman or docker) or None if unavailable."""
-    info = detect_runtime()
-    return info["runtime"] if info["available"] else None
-
-
-def _run_container_cmd(args: List[str], timeout: int = 30) -> Tuple[int, str, str]:
-    """Run a container command with the detected runtime."""
-    runtime = _get_runtime()
-    if not runtime:
-        return -1, "", "No container runtime available"
-    
-    cmd = [runtime] + args
+def _run_pve_cmd(cmd: List[str], timeout: int = 60) -> Tuple[int, str, str]:
+    """Run a Proxmox VE command."""
     try:
-        proc = subprocess.run(
-            cmd, capture_output=True, text=True, timeout=timeout
-        )
+        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
         return proc.returncode, proc.stdout.strip(), proc.stderr.strip()
     except subprocess.TimeoutExpired:
         return -1, "", "Command timed out"
@@ -305,48 +218,143 @@ def _run_container_cmd(args: List[str], timeout: int = 30) -> Tuple[int, str, st
         return -1, "", str(e)
 
 
+# =================================================================
+# VMID Management
+# =================================================================
+def _get_next_vmid() -> int:
+    """Get next available VMID in OCI range (9000-9999)."""
+    try:
+        # Get list of all VMIDs in use
+        rc, out, _ = _run_pve_cmd(["pvesh", "get", "/cluster/resources", "--type", "vm", "--output-format", "json"])
+        
+        if rc != 0:
+            # Fallback: try pct list
+            rc, out, _ = _run_pve_cmd(["pct", "list"])
+            used_vmids = set()
+            if rc == 0:
+                for line in out.splitlines()[1:]:  # Skip header
+                    parts = line.split()
+                    if parts:
+                        try:
+                            used_vmids.add(int(parts[0]))
+                        except ValueError:
+                            pass
+        else:
+            resources = json.loads(out)
+            used_vmids = {r.get("vmid") for r in resources if r.get("vmid")}
+        
+        # Find first available in OCI range
+        for vmid in range(OCI_VMID_START, OCI_VMID_END + 1):
+            if vmid not in used_vmids:
+                return vmid
+        
+        raise RuntimeError("No available VMID in OCI range (9000-9999)")
+        
+    except Exception as e:
+        logger.error(f"Failed to get next VMID: {e}")
+        # Return a high number and hope for the best
+        return OCI_VMID_START + int(time.time()) % 1000
+
+
+def _get_vmid_for_app(app_id: str) -> Optional[int]:
+    """Get the VMID for an installed app."""
+    installed = _load_installed()
+    instance = installed.get("instances", {}).get(app_id)
+    return instance.get("vmid") if instance else None
+
+
+# =================================================================
+# OCI Image Management
+# =================================================================
+def pull_oci_image(image: str, tag: str = "latest", storage: str = DEFAULT_STORAGE) -> Dict[str, Any]:
+    """
+    Pull an OCI image from a registry and store as LXC template.
+    
+    Args:
+        image: Image name (e.g., "docker.io/tailscale/tailscale")
+        tag: Image tag (e.g., "stable")
+        storage: Proxmox storage to save template
+    
+    Returns:
+        Dict with success status and template path
+    """
+    result = {
+        "success": False,
+        "message": "",
+        "template": None
+    }
+    
+    # Check Proxmox OCI support
+    pve_info = check_proxmox_version()
+    if not pve_info["oci_support"]:
+        result["message"] = pve_info.get("error", "OCI not supported")
+        return result
+    
+    # Normalize image name
+    if not image.startswith(("docker.io/", "ghcr.io/", "quay.io/")):
+        image = f"docker.io/{image}"
+    
+    full_image = f"{image}:{tag}"
+    
+    logger.info(f"Pulling OCI image: {full_image}")
+    print(f"[*] Pulling OCI image: {full_image}")
+    
+    # Use pveam to download OCI image
+    # pveam download <storage> <image> --url <registry_url>
+    rc, out, err = _run_pve_cmd([
+        "pveam", "download", storage, full_image
+    ], timeout=300)
+    
+    if rc != 0:
+        # Try alternative syntax
+        rc, out, err = _run_pve_cmd([
+            "pvesh", "create", f"/nodes/localhost/storage/{storage}/download-url",
+            "--content", "vztmpl",
+            "--url", f"oci://{full_image}"
+        ], timeout=300)
+    
+    if rc != 0:
+        result["message"] = f"Failed to pull image: {err}"
+        logger.error(f"Pull failed: {err}")
+        return result
+    
+    # Find the downloaded template
+    rc, out, _ = _run_pve_cmd(["pveam", "list", storage])
+    if rc == 0:
+        for line in out.splitlines():
+            # Look for matching template (may have been renamed)
+            image_name = image.split("/")[-1]
+            if image_name in line and tag in line:
+                result["template"] = line.split()[0]
+                break
+    
+    if not result["template"]:
+        # Construct expected template name
+        image_name = image.replace("/", "-").replace(".", "-")
+        result["template"] = f"{storage}:vztmpl/{image_name}-{tag}.tar.zst"
+    
+    result["success"] = True
+    result["message"] = "Image pulled successfully"
+    print(f"[OK] Image pulled: {result['template']}")
+    
+    return result
+
+
 # =================================================================
 # Catalog Management
 # =================================================================
 def load_catalog() -> Dict[str, Any]:
     """Load the OCI app catalog."""
-    # Ensure directories and files exist on first call
     ensure_oci_directories()
     
-    # Try to load from standard location
-    if os.path.exists(CATALOG_FILE):
-        try:
-            with open(CATALOG_FILE, 'r') as f:
-                return json.load(f)
-        except Exception as e:
-            logger.error(f"Failed to load catalog from {CATALOG_FILE}: {e}")
-    
-    # Try alternative locations
-    alternative_paths = [
-        SCRIPTS_CATALOG,
-        DEV_SCRIPTS_CATALOG,
-        "/usr/local/share/proxmenux/scripts/oci/catalog.json",
-        os.path.join(os.path.dirname(__file__), "oci", "catalog.json"),
-    ]
-    
-    for alt_path in alternative_paths:
-        if os.path.exists(alt_path):
+    for path in [CATALOG_FILE, SCRIPTS_CATALOG, DEV_SCRIPTS_CATALOG]:
+        if os.path.exists(path):
             try:
-                with open(alt_path, 'r') as f:
-                    catalog = json.load(f)
-                    logger.info(f"Loaded catalog from alternative path: {alt_path}")
-                    # Copy to standard location for next time
-                    try:
-                        os.makedirs(os.path.dirname(CATALOG_FILE), exist_ok=True)
-                        with open(CATALOG_FILE, 'w') as out:
-                            json.dump(catalog, out, indent=2)
-                    except Exception:
-                        pass
-                    return catalog
+                with open(path, 'r') as f:
+                    return json.load(f)
             except Exception as e:
-                logger.error(f"Failed to load catalog from {alt_path}: {e}")
+                logger.error(f"Failed to load catalog from {path}: {e}")
     
-    logger.error(f"No catalog found. Checked: {CATALOG_FILE}, {alternative_paths}")
     return {"version": "1.0.0", "apps": {}}
 
 
@@ -380,29 +388,24 @@ def list_available_apps() -> List[Dict[str, Any]]:
 # =================================================================
 def _load_installed() -> Dict[str, Any]:
     """Load the installed apps registry."""
-    # Ensure directories exist
     ensure_oci_directories()
-    
     if not os.path.exists(INSTALLED_FILE):
         return {"version": "1.0.0", "instances": {}}
-    
     try:
         with open(INSTALLED_FILE, 'r') as f:
             return json.load(f)
-    except Exception as e:
-        logger.error(f"Failed to load installed registry: {e}")
+    except Exception:
         return {"version": "1.0.0", "instances": {}}
 
 
 def _save_installed(data: Dict[str, Any]) -> bool:
     """Save the installed apps registry."""
     try:
-        os.makedirs(os.path.dirname(INSTALLED_FILE), exist_ok=True)
         with open(INSTALLED_FILE, 'w') as f:
             json.dump(data, f, indent=2)
         return True
     except Exception as e:
-        logger.error(f"Failed to save installed registry: {e}")
+        logger.error(f"Failed to save installed: {e}")
         return False
 
 
@@ -416,20 +419,16 @@ def list_installed_apps() -> List[Dict[str, Any]]:
     """List all installed apps with their status."""
     installed = _load_installed()
     apps = []
-    
     for app_id, instance in installed.get("instances", {}).items():
-        # Get current container status
         status = get_app_status(app_id)
-        
         apps.append({
             "id": app_id,
             "instance_name": instance.get("instance_name", app_id),
+            "vmid": instance.get("vmid"),
             "installed_at": instance.get("installed_at"),
             "installed_by": instance.get("installed_by", "unknown"),
-            "container": instance.get("container", {}),
             "status": status
         })
-    
     return apps
 
 
@@ -437,13 +436,9 @@ def get_installed_app(app_id: str) -> Optional[Dict[str, Any]]:
     """Get details of an installed app."""
     installed = _load_installed()
     instance = installed.get("instances", {}).get(app_id)
-    
     if not instance:
         return None
-    
-    # Enrich with current status
     instance["status"] = get_app_status(app_id)
-    
     return instance
 
 
@@ -451,9 +446,7 @@ def get_installed_app(app_id: str) -> Optional[Dict[str, Any]]:
 # Container Status
 # =================================================================
 def get_app_status(app_id: str) -> Dict[str, Any]:
-    """Get the current status of an app's container."""
-    container_name = f"{CONTAINER_PREFIX}-{app_id}"
-    
+    """Get the current status of an app's LXC container."""
     result = {
         "state": "not_installed",
         "health": "unknown",
@@ -464,117 +457,48 @@ def get_app_status(app_id: str) -> Dict[str, Any]:
     if not is_installed(app_id):
         return result
     
-    # Check container status
-    rc, out, _ = _run_container_cmd([
-        "inspect", container_name,
-        "--format", "{{.State.Status}}|{{.State.Running}}|{{.State.StartedAt}}"
-    ])
+    vmid = _get_vmid_for_app(app_id)
+    if not vmid:
+        result["state"] = "error"
+        result["health"] = "unknown"
+        return result
+    
+    # Get LXC status using pct
+    rc, out, _ = _run_pve_cmd(["pct", "status", str(vmid)])
     
     if rc != 0:
         result["state"] = "error"
         result["health"] = "unhealthy"
         return result
     
-    try:
-        parts = out.split("|")
-        status = parts[0] if len(parts) > 0 else "unknown"
-        running = parts[1].lower() == "true" if len(parts) > 1 else False
-        started_at = parts[2] if len(parts) > 2 else ""
+    # Parse status: "status: running" or "status: stopped"
+    if "running" in out.lower():
+        result["state"] = "running"
+        result["health"] = "healthy"
         
-        result["state"] = "running" if running else status
-        result["health"] = "healthy" if running else "stopped"
-        
-        # Calculate uptime
-        if running and started_at:
+        # Get uptime
+        rc, out, _ = _run_pve_cmd(["pct", "exec", str(vmid), "--", "cat", "/proc/uptime"])
+        if rc == 0:
             try:
-                # Parse ISO timestamp
-                started = datetime.fromisoformat(started_at.replace("Z", "+00:00"))
-                result["uptime_seconds"] = int((datetime.now(started.tzinfo) - started).total_seconds())
+                uptime = float(out.split()[0])
+                result["uptime_seconds"] = int(uptime)
             except:
                 pass
-    except Exception as e:
-        logger.error(f"Failed to parse container status: {e}")
-        result["state"] = "error"
+    elif "stopped" in out.lower():
+        result["state"] = "stopped"
+        result["health"] = "stopped"
+    else:
+        result["state"] = "unknown"
     
     return result
 
 
-# =================================================================
-# Network Detection
-# =================================================================
-def detect_networks() -> List[Dict[str, Any]]:
-    """Detect available networks for VPN routing."""
-    networks = []
-    
-    # Excluded interface prefixes
-    excluded_prefixes = ('lo', 'docker', 'br-', 'veth', 'tailscale', 'wg', 'tun', 'tap')
-    
-    try:
-        # Use ip command to get interfaces and addresses
-        proc = subprocess.run(
-            ["ip", "-j", "addr", "show"],
-            capture_output=True, text=True, timeout=5
-        )
-        
-        if proc.returncode != 0:
-            return networks
-        
-        interfaces = json.loads(proc.stdout)
-        
-        for iface in interfaces:
-            name = iface.get("ifname", "")
-            
-            # Skip excluded interfaces
-            if any(name.startswith(p) for p in excluded_prefixes):
-                continue
-            
-            # Get IPv4 addresses
-            for addr_info in iface.get("addr_info", []):
-                if addr_info.get("family") != "inet":
-                    continue
-                
-                local = addr_info.get("local", "")
-                prefixlen = addr_info.get("prefixlen", 24)
-                
-                if not local:
-                    continue
-                
-                # Calculate network address
-                import ipaddress
-                try:
-                    network = ipaddress.IPv4Network(f"{local}/{prefixlen}", strict=False)
-                    
-                    # Determine interface type
-                    iface_type = "physical"
-                    if name.startswith("vmbr"):
-                        iface_type = "bridge"
-                    elif name.startswith("bond"):
-                        iface_type = "bond"
-                    elif "." in name:
-                        iface_type = "vlan"
-                    
-                    networks.append({
-                        "interface": name,
-                        "type": iface_type,
-                        "address": local,
-                        "subnet": str(network),
-                        "prefixlen": prefixlen,
-                        "recommended": iface_type in ("bridge", "physical")
-                    })
-                except Exception:
-                    pass
-    except Exception as e:
-        logger.error(f"Failed to detect networks: {e}")
-    
-    return networks
-
-
 # =================================================================
 # Deployment
 # =================================================================
 def deploy_app(app_id: str, config: Dict[str, Any], installed_by: str = "web") -> Dict[str, Any]:
     """
-    Deploy an OCI app with the given configuration.
+    Deploy an OCI app as a Proxmox LXC container.
     
     Args:
         app_id: ID of the app from the catalog
@@ -587,27 +511,20 @@ def deploy_app(app_id: str, config: Dict[str, Any], installed_by: str = "web") -
     result = {
         "success": False,
         "message": "",
-        "app_id": app_id
+        "app_id": app_id,
+        "vmid": None
     }
     
-    # Ensure runtime is available (install if necessary)
-    runtime_info = ensure_runtime()
-    if not runtime_info["available"]:
-        error_msg = runtime_info.get("error", "Unknown error")
-        result["message"] = f"Container runtime not available. {error_msg}. Please install Podman or Docker manually: apt install podman"
+    # Check Proxmox OCI support
+    pve_info = check_proxmox_version()
+    if not pve_info["oci_support"]:
+        result["message"] = pve_info.get("error", "OCI containers require Proxmox VE 9.1+")
         return result
     
-    runtime = runtime_info["runtime"]
-    logger.info(f"Using runtime: {runtime}")
-    
     # Get app definition
     app_def = get_app_definition(app_id)
     if not app_def:
-        # Log detailed info for debugging
-        logger.error(f"App '{app_id}' not found. Catalog file: {CATALOG_FILE}, exists: {os.path.exists(CATALOG_FILE)}")
-        catalog = load_catalog()
-        logger.error(f"Available apps: {list(catalog.get('apps', {}).keys())}")
-        result["message"] = f"App '{app_id}' not found in catalog. Make sure the catalog file exists at {CATALOG_FILE}"
+        result["message"] = f"App '{app_id}' not found in catalog"
         return result
     
     # Check if already installed
@@ -615,369 +532,407 @@ def deploy_app(app_id: str, config: Dict[str, Any], installed_by: str = "web") -
         result["message"] = f"App '{app_id}' is already installed"
         return result
     
-    container_name = f"{CONTAINER_PREFIX}-{app_id}"
     container_def = app_def.get("container", {})
-    image = container_def.get("image")
+    image = container_def.get("image", "")
     
     if not image:
-        result["message"] = "App definition missing container image"
+        result["message"] = "No container image specified in app definition"
         return result
     
-    # Create instance directory
-    instance_dir = os.path.join(INSTANCES_DIR, app_id)
-    state_dir = os.path.join(instance_dir, "state")
+    # Parse image and tag
+    if ":" in image:
+        image_name, tag = image.rsplit(":", 1)
+    else:
+        image_name, tag = image, "latest"
     
-    try:
-        os.makedirs(instance_dir, exist_ok=True)
-        os.makedirs(state_dir, exist_ok=True)
-    except Exception as e:
-        result["message"] = f"Failed to create instance directory: {e}"
+    # Get next available VMID
+    vmid = _get_next_vmid()
+    result["vmid"] = vmid
+    
+    hostname = config.get("hostname", f"proxmenux-{app_id}")
+    
+    logger.info(f"Deploying {app_id} as LXC {vmid}")
+    print(f"[*] Deploying {app_id} as LXC container (VMID: {vmid})")
+    
+    # Step 1: Pull OCI image
+    print(f"[*] Pulling OCI image: {image}")
+    pull_result = pull_oci_image(image_name, tag)
+    
+    if not pull_result["success"]:
+        result["message"] = pull_result["message"]
         return result
     
-    # Save user config
-    config_file = os.path.join(instance_dir, "config.json")
-    try:
-        with open(config_file, 'w') as f:
-            json.dump({
-                "app_id": app_id,
-                "created_at": datetime.now().isoformat(),
-                "values": config
-            }, f, indent=2)
-    except Exception as e:
-        result["message"] = f"Failed to save config: {e}"
-        return result
+    template = pull_result["template"]
     
-    # Build container run command
-    cmd = ["run", "-d", "--name", container_name]
+    # Step 2: Create LXC container
+    print(f"[*] Creating LXC container...")
     
-    # Network mode
-    network_mode = container_def.get("network_mode")
-    if network_mode:
-        cmd.extend(["--network", network_mode])
+    # Build pct create command
+    pct_cmd = [
+        "pct", "create", str(vmid), template,
+        "--hostname", hostname,
+        "--memory", str(container_def.get("memory", 512)),
+        "--cores", str(container_def.get("cores", 1)),
+        "--rootfs", f"local-lvm:{container_def.get('disk_size', 4)}",
+        "--ostype", "unmanaged",
+        "--unprivileged", "0" if container_def.get("privileged") else "1",
+        "--features", "nesting=1",
+        "--onboot", "1"
+    ]
     
-    # Restart policy
-    restart_policy = container_def.get("restart_policy", "unless-stopped")
-    cmd.extend(["--restart", restart_policy])
+    # Network configuration
+    net_config = "name=eth0"
+    if container_def.get("network_mode") == "host":
+        # For host network, use bridge with DHCP
+        net_config += ",bridge=vmbr0,ip=dhcp"
+    else:
+        net_config += ",bridge=vmbr0,ip=dhcp"
     
-    # Capabilities
-    for cap in container_def.get("capabilities", []):
-        cmd.extend(["--cap-add", cap])
+    pct_cmd.extend(["--net0", net_config])
     
-    # Devices
-    for device in container_def.get("devices", []):
-        cmd.extend(["--device", device])
-    
-    # Volumes
-    for vol_name, vol_def in app_def.get("volumes", {}).items():
-        container_path = vol_def.get("container_path", "")
-        if container_path:
-            host_path = os.path.join(state_dir, vol_name)
-            os.makedirs(host_path, exist_ok=True)
-            cmd.extend(["-v", f"{host_path}:{container_path}"])
-    
-    # Static environment variables
-    for key, value in app_def.get("environment", {}).items():
-        cmd.extend(["-e", f"{key}={value}"])
-    
-    # Dynamic environment variables from config
-    config_schema = app_def.get("config_schema", {})
-    for field_name, field_def in config_schema.items():
-        env_var = field_def.get("env_var")
-        if not env_var:
-            continue
-        
-        value = config.get(field_name)
-        if value is None:
-            value = field_def.get("default", "")
-        
-        # Handle special formats
-        env_format = field_def.get("env_format")
-        if env_format == "csv" and isinstance(value, list):
-            value = ",".join(str(v) for v in value)
-        
-        if value:
-            cmd.extend(["-e", f"{env_var}={value}"])
-    
-    # Build extra args from flags
-    extra_args = []
-    for field_name, field_def in config_schema.items():
-        flag = field_def.get("flag")
-        if not flag:
-            continue
-        
-        value = config.get(field_name)
-        if value is True:
-            extra_args.append(flag)
-    
-    # For Tailscale, set TS_EXTRA_ARGS
-    if extra_args and "tailscale" in image.lower():
-        # Also add routes if specified
-        routes = config.get("advertise_routes", [])
-        if routes:
-            extra_args.append(f"--advertise-routes={','.join(routes)}")
-        
-        cmd.extend(["-e", f"TS_EXTRA_ARGS={' '.join(extra_args)}"])
-    
-    # Add image
-    cmd.append(image)
-    
-    # Pull image first if needed
-    pull_policy = container_def.get("pull_policy", "if_not_present")
-    if pull_policy != "never":
-        logger.info(f"Pulling image: {image}")
-        print(f"[*] Pulling image: {image}")
-        pull_rc, pull_out, pull_err = _run_container_cmd(["pull", image], timeout=300)
-        logger.info(f"Pull result: rc={pull_rc}, out={pull_out[:100] if pull_out else ''}, err={pull_err[:200] if pull_err else ''}")
-        if pull_rc != 0 and pull_policy == "always":
-            result["message"] = f"Failed to pull image: {pull_err}"
-            return result
-    
-    # Run container
-    logger.info(f"Starting container with cmd: {cmd}")
-    print(f"[*] Starting container: {container_name}")
-    rc, out, err = _run_container_cmd(cmd, timeout=60)
-    logger.info(f"Run result: rc={rc}, out={out[:100] if out else ''}, err={err[:200] if err else ''}")
+    # Run pct create
+    rc, out, err = _run_pve_cmd(pct_cmd, timeout=120)
     
     if rc != 0:
-        result["message"] = f"Failed to start container: {err}"
-        # Cleanup on failure
-        _run_container_cmd(["rm", "-f", container_name])
+        result["message"] = f"Failed to create container: {err}"
+        logger.error(f"pct create failed: {err}")
         return result
     
-    container_id = out[:12] if out else ""
+    # Step 3: Configure environment variables
+    env_vars = []
     
-    # Get image ID
-    img_rc, img_out, _ = _run_container_cmd(["inspect", image, "--format", "{{.Id}}"])
-    image_id = img_out[:12] if img_rc == 0 and img_out else ""
+    # Add static env vars from container definition
+    for env in container_def.get("environment", []):
+        env_name = env.get("name", "")
+        env_value = env.get("value", "")
+        
+        # Substitute config values
+        if env_value.startswith("$"):
+            config_key = env_value[1:]
+            env_value = config.get(config_key, env.get("default", ""))
+        
+        if env_name and env_value:
+            env_vars.append(f"{env_name}={env_value}")
     
-    # Save to installed registry
+    # Set environment via pct set
+    if env_vars:
+        # Proxmox 9.1 supports environment variables for OCI containers
+        for i, env in enumerate(env_vars):
+            _run_pve_cmd(["pct", "set", str(vmid), f"--lxc.environment", env])
+    
+    # Step 4: Enable IP forwarding if needed (for VPN containers)
+    if "tailscale" in image.lower() or container_def.get("requires_ip_forward"):
+        _enable_host_ip_forwarding()
+    
+    # Step 5: Start the container
+    print(f"[*] Starting container...")
+    rc, _, err = _run_pve_cmd(["pct", "start", str(vmid)])
+    
+    if rc != 0:
+        result["message"] = f"Container created but failed to start: {err}"
+        logger.error(f"pct start failed: {err}")
+        # Don't return - container exists, just not started
+    
+    # Step 6: Save instance data
+    instance_dir = os.path.join(INSTANCES_DIR, app_id)
+    os.makedirs(instance_dir, exist_ok=True)
+    
+    # Save config (encrypted)
+    config_file = os.path.join(instance_dir, "config.json")
+    config_schema = app_def.get("config_schema", {})
+    encrypted_config = encrypt_config_sensitive_fields(config, config_schema)
+    
+    with open(config_file, 'w') as f:
+        json.dump({
+            "app_id": app_id,
+            "vmid": vmid,
+            "created_at": datetime.now().isoformat(),
+            "values": encrypted_config
+        }, f, indent=2)
+    os.chmod(config_file, 0o600)
+    
+    # Update installed registry
     installed = _load_installed()
     installed["instances"][app_id] = {
         "app_id": app_id,
-        "instance_name": app_id,
+        "vmid": vmid,
+        "instance_name": hostname,
         "installed_at": datetime.now().isoformat(),
-        "updated_at": datetime.now().isoformat(),
         "installed_by": installed_by,
-        "installed_version": app_def.get("version", "1.0.0"),
-        "container": {
-            "runtime": runtime,
-            "container_id": container_id,
-            "container_name": container_name,
-            "image_id": image_id,
-            "image_tag": image
-        },
-        "paths": {
-            "config": config_file,
-            "runtime": os.path.join(instance_dir, "runtime.json"),
-            "state": state_dir
-        }
+        "image": image,
+        "template": template
     }
-    
-    if not _save_installed(installed):
-        result["message"] = "Container started but failed to save registry"
-        return result
+    _save_installed(installed)
     
     result["success"] = True
-    result["message"] = f"App '{app_id}' deployed successfully"
-    result["container_id"] = container_id
+    result["message"] = f"App deployed successfully as LXC {vmid}"
+    print(f"[OK] Container {vmid} ({hostname}) deployed successfully!")
     
     return result
 
 
+def _enable_host_ip_forwarding() -> bool:
+    """Enable IP forwarding on the Proxmox host."""
+    logger.info("Enabling IP forwarding on host")
+    print("[*] Enabling IP forwarding...")
+    
+    try:
+        # Enable IPv4 forwarding
+        with open("/proc/sys/net/ipv4/ip_forward", 'w') as f:
+            f.write('1')
+        
+        # Enable IPv6 forwarding
+        ipv6_path = "/proc/sys/net/ipv6/conf/all/forwarding"
+        if os.path.exists(ipv6_path):
+            with open(ipv6_path, 'w') as f:
+                f.write('1')
+        
+        # Make persistent
+        sysctl_d = "/etc/sysctl.d/99-proxmenux-ip-forward.conf"
+        with open(sysctl_d, 'w') as f:
+            f.write("net.ipv4.ip_forward = 1\n")
+            f.write("net.ipv6.conf.all.forwarding = 1\n")
+        
+        subprocess.run(["sysctl", "-p", sysctl_d], capture_output=True)
+        return True
+        
+    except Exception as e:
+        logger.warning(f"Could not enable IP forwarding: {e}")
+        return False
+
+
 # =================================================================
-# Lifecycle Actions
+# Container Control
 # =================================================================
 def start_app(app_id: str) -> Dict[str, Any]:
-    """Start an installed app's container."""
-    if not is_installed(app_id):
-        return {"success": False, "message": f"App '{app_id}' is not installed"}
+    """Start an app's LXC container."""
+    result = {"success": False, "message": ""}
     
-    container_name = f"{CONTAINER_PREFIX}-{app_id}"
-    rc, _, err = _run_container_cmd(["start", container_name])
+    vmid = _get_vmid_for_app(app_id)
+    if not vmid:
+        result["message"] = f"App '{app_id}' not found"
+        return result
     
-    if rc != 0:
-        return {"success": False, "message": f"Failed to start: {err}"}
+    rc, _, err = _run_pve_cmd(["pct", "start", str(vmid)])
     
-    return {"success": True, "message": f"App '{app_id}' started"}
+    if rc == 0:
+        result["success"] = True
+        result["message"] = f"Container {vmid} started"
+    else:
+        result["message"] = f"Failed to start: {err}"
+    
+    return result
 
 
 def stop_app(app_id: str) -> Dict[str, Any]:
-    """Stop an installed app's container."""
-    if not is_installed(app_id):
-        return {"success": False, "message": f"App '{app_id}' is not installed"}
+    """Stop an app's LXC container."""
+    result = {"success": False, "message": ""}
     
-    container_name = f"{CONTAINER_PREFIX}-{app_id}"
-    rc, _, err = _run_container_cmd(["stop", container_name], timeout=30)
+    vmid = _get_vmid_for_app(app_id)
+    if not vmid:
+        result["message"] = f"App '{app_id}' not found"
+        return result
     
-    if rc != 0:
-        return {"success": False, "message": f"Failed to stop: {err}"}
+    rc, _, err = _run_pve_cmd(["pct", "stop", str(vmid)])
     
-    return {"success": True, "message": f"App '{app_id}' stopped"}
+    if rc == 0:
+        result["success"] = True
+        result["message"] = f"Container {vmid} stopped"
+    else:
+        result["message"] = f"Failed to stop: {err}"
+    
+    return result
 
 
 def restart_app(app_id: str) -> Dict[str, Any]:
-    """Restart an installed app's container."""
-    if not is_installed(app_id):
-        return {"success": False, "message": f"App '{app_id}' is not installed"}
+    """Restart an app's LXC container."""
+    result = {"success": False, "message": ""}
     
-    container_name = f"{CONTAINER_PREFIX}-{app_id}"
-    rc, _, err = _run_container_cmd(["restart", container_name], timeout=60)
+    vmid = _get_vmid_for_app(app_id)
+    if not vmid:
+        result["message"] = f"App '{app_id}' not found"
+        return result
     
-    if rc != 0:
-        return {"success": False, "message": f"Failed to restart: {err}"}
+    rc, _, err = _run_pve_cmd(["pct", "reboot", str(vmid)])
     
-    return {"success": True, "message": f"App '{app_id}' restarted"}
+    if rc == 0:
+        result["success"] = True
+        result["message"] = f"Container {vmid} restarted"
+    else:
+        result["message"] = f"Failed to restart: {err}"
+    
+    return result
 
 
-def remove_app(app_id: str, remove_data: bool = False) -> Dict[str, Any]:
-    """Remove an installed app."""
-    if not is_installed(app_id):
-        return {"success": False, "message": f"App '{app_id}' is not installed"}
+def remove_app(app_id: str, remove_data: bool = True) -> Dict[str, Any]:
+    """Remove an app's LXC container."""
+    result = {"success": False, "message": ""}
     
-    container_name = f"{CONTAINER_PREFIX}-{app_id}"
+    vmid = _get_vmid_for_app(app_id)
+    if not vmid:
+        result["message"] = f"App '{app_id}' not found"
+        return result
     
-    # Stop and remove container
-    _run_container_cmd(["stop", container_name], timeout=30)
-    rc, _, err = _run_container_cmd(["rm", "-f", container_name])
+    logger.info(f"Removing app {app_id} (VMID: {vmid})")
+    
+    # Stop if running
+    _run_pve_cmd(["pct", "stop", str(vmid)])
+    time.sleep(2)
+    
+    # Destroy container
+    rc, _, err = _run_pve_cmd(["pct", "destroy", str(vmid), "--purge"])
     
     if rc != 0:
-        return {"success": False, "message": f"Failed to remove container: {err}"}
+        result["message"] = f"Failed to destroy container: {err}"
+        return result
     
-    # Remove from registry
+    # Remove from installed registry
     installed = _load_installed()
     if app_id in installed.get("instances", {}):
         del installed["instances"][app_id]
         _save_installed(installed)
     
-    # Optionally remove data
+    # Remove instance data
     if remove_data:
         instance_dir = os.path.join(INSTANCES_DIR, app_id)
         if os.path.exists(instance_dir):
-            shutil.rmtree(instance_dir, ignore_errors=True)
+            shutil.rmtree(instance_dir)
     
-    return {"success": True, "message": f"App '{app_id}' removed"}
+    result["success"] = True
+    result["message"] = f"App {app_id} removed successfully"
+    
+    return result
 
 
-# =================================================================
-# Logs
-# =================================================================
 def get_app_logs(app_id: str, lines: int = 100) -> Dict[str, Any]:
-    """Get recent logs from an app's container."""
-    if not is_installed(app_id):
-        return {"success": False, "logs": "", "message": "App not installed"}
+    """Get logs from an app's LXC container."""
+    result = {"success": False, "message": "", "logs": ""}
     
-    container_name = f"{CONTAINER_PREFIX}-{app_id}"
-    rc, out, err = _run_container_cmd(["logs", "--tail", str(lines), container_name], timeout=10)
+    vmid = _get_vmid_for_app(app_id)
+    if not vmid:
+        result["message"] = f"App '{app_id}' not found"
+        return result
+    
+    # Try to get logs from inside container
+    rc, out, err = _run_pve_cmd([
+        "pct", "exec", str(vmid), "--",
+        "tail", "-n", str(lines), "/var/log/messages"
+    ])
     
     if rc != 0:
-        return {"success": False, "logs": "", "message": f"Failed to get logs: {err}"}
+        # Try journalctl
+        rc, out, err = _run_pve_cmd([
+            "pct", "exec", str(vmid), "--",
+            "journalctl", "-n", str(lines), "--no-pager"
+        ])
     
-    # Combine stdout and stderr (logs go to both)
-    logs = out if out else err
+    if rc == 0:
+        result["success"] = True
+        result["logs"] = out
+    else:
+        result["message"] = f"Failed to get logs: {err}"
+        result["logs"] = err
     
-    return {"success": True, "logs": logs}
+    return result
 
 
 # =================================================================
-# Configuration Update
+# Network Detection
 # =================================================================
-def update_app_config(app_id: str, config: Dict[str, Any]) -> Dict[str, Any]:
-    """Update an app's configuration and recreate the container."""
-    if not is_installed(app_id):
-        return {"success": False, "message": f"App '{app_id}' is not installed"}
+def detect_host_networks() -> List[Dict[str, Any]]:
+    """Detect available networks on the Proxmox host."""
+    networks = []
     
-    # Get current installation info
-    installed = _load_installed()
-    instance = installed.get("instances", {}).get(app_id, {})
-    installed_by = instance.get("installed_by", "web")
+    try:
+        # Get bridges from Proxmox
+        rc, out, _ = _run_pve_cmd(["pvesh", "get", "/nodes/localhost/network", "--output-format", "json"])
+        
+        if rc == 0:
+            ifaces = json.loads(out)
+            for iface in ifaces:
+                if iface.get("type") == "bridge":
+                    networks.append({
+                        "interface": iface.get("iface", ""),
+                        "type": "bridge",
+                        "address": iface.get("address", ""),
+                        "cidr": iface.get("cidr", ""),
+                        "recommended": True
+                    })
+        
+    except Exception as e:
+        logger.error(f"Failed to detect networks: {e}")
     
-    # Remove the app (but keep data)
-    remove_result = remove_app(app_id, remove_data=False)
-    if not remove_result["success"]:
-        return remove_result
+    return networks
+
+
+# =================================================================
+# Runtime Detection (for backward compatibility)
+# =================================================================
+def detect_runtime() -> Dict[str, Any]:
+    """Check if Proxmox OCI support is available."""
+    pve_info = check_proxmox_version()
     
-    # Redeploy with new config
-    return deploy_app(app_id, config, installed_by=installed_by)
+    return {
+        "available": pve_info["oci_support"],
+        "runtime": "proxmox-lxc" if pve_info["oci_support"] else None,
+        "version": pve_info.get("version"),
+        "path": shutil.which("pct"),
+        "error": pve_info.get("error")
+    }
 
 
 # =================================================================
 # CLI Interface
 # =================================================================
-def main():
-    """CLI entry point for use from bash scripts."""
+if __name__ == "__main__":
     import argparse
     
     parser = argparse.ArgumentParser(description="ProxMenux OCI Manager")
-    subparsers = parser.add_subparsers(dest="command", help="Command to run")
+    subparsers = parser.add_subparsers(dest="command", help="Commands")
     
-    # deploy
+    # Deploy command
     deploy_parser = subparsers.add_parser("deploy", help="Deploy an app")
-    deploy_parser.add_argument("--app-id", required=True, help="App ID from catalog")
-    deploy_parser.add_argument("--config", required=True, help="JSON config string")
-    deploy_parser.add_argument("--source", default="cli", help="Installation source")
+    deploy_parser.add_argument("--app-id", required=True, help="App ID")
+    deploy_parser.add_argument("--config", default="{}", help="JSON config")
     
-    # start
-    start_parser = subparsers.add_parser("start", help="Start an app")
+    # Status command
+    status_parser = subparsers.add_parser("status", help="Get app status")
+    status_parser.add_argument("--app-id", required=True, help="App ID")
+    
+    # Control commands
+    start_parser = subparsers.add_parser("start", help="Start app")
     start_parser.add_argument("--app-id", required=True)
     
-    # stop
-    stop_parser = subparsers.add_parser("stop", help="Stop an app")
+    stop_parser = subparsers.add_parser("stop", help="Stop app")
     stop_parser.add_argument("--app-id", required=True)
     
-    # restart
-    restart_parser = subparsers.add_parser("restart", help="Restart an app")
-    restart_parser.add_argument("--app-id", required=True)
-    
-    # remove
-    remove_parser = subparsers.add_parser("remove", help="Remove an app")
+    remove_parser = subparsers.add_parser("remove", help="Remove app")
     remove_parser.add_argument("--app-id", required=True)
-    remove_parser.add_argument("--remove-data", action="store_true")
     
-    # status
-    status_parser = subparsers.add_parser("status", help="Get app status")
-    status_parser.add_argument("--app-id", required=True)
-    
-    # list
-    subparsers.add_parser("list", help="List installed apps")
-    
-    # catalog
-    subparsers.add_parser("catalog", help="List available apps")
-    
-    # networks
-    subparsers.add_parser("networks", help="Detect available networks")
-    
-    # runtime
-    subparsers.add_parser("runtime", help="Detect container runtime")
+    # List commands
+    subparsers.add_parser("list", help="List available apps")
+    subparsers.add_parser("installed", help="List installed apps")
+    subparsers.add_parser("runtime", help="Check runtime")
     
     args = parser.parse_args()
     
     if args.command == "deploy":
         config = json.loads(args.config)
-        result = deploy_app(args.app_id, config, installed_by=args.source)
-    elif args.command == "start":
-        result = start_app(args.app_id)
-    elif args.command == "stop":
-        result = stop_app(args.app_id)
-    elif args.command == "restart":
-        result = restart_app(args.app_id)
-    elif args.command == "remove":
-        result = remove_app(args.app_id, remove_data=args.remove_data)
+        result = deploy_app(args.app_id, config, "cli")
+        print(json.dumps(result, indent=2))
     elif args.command == "status":
-        result = get_app_status(args.app_id)
+        print(json.dumps(get_app_status(args.app_id), indent=2))
+    elif args.command == "start":
+        print(json.dumps(start_app(args.app_id), indent=2))
+    elif args.command == "stop":
+        print(json.dumps(stop_app(args.app_id), indent=2))
+    elif args.command == "remove":
+        print(json.dumps(remove_app(args.app_id), indent=2))
     elif args.command == "list":
-        result = list_installed_apps()
-    elif args.command == "catalog":
-        result = list_available_apps()
-    elif args.command == "networks":
-        result = detect_networks()
+        print(json.dumps(list_available_apps(), indent=2))
+    elif args.command == "installed":
+        print(json.dumps(list_installed_apps(), indent=2))
     elif args.command == "runtime":
-        result = detect_runtime()
+        print(json.dumps(detect_runtime(), indent=2))
     else:
         parser.print_help()
-        return
-    
-    print(json.dumps(result, indent=2))
-
-
-if __name__ == "__main__":
-    main()